Using the Microsoft Offline Virtual Machine Servicing Tool Version 2.1 with WSUS (Part 2)

If you would like to read the first part in this article series please go to Using the Microsoft Offline Virtual Machine Servicing Tool Version 2.1 with WSUS (Part 1).

Introduction

In Part I of this article, you were introduced to the Microsoft Offline Virtual Machine Servicing Tool, Version 2.1, and how it can help you to resolve the problem of updating offline virtual machines stored in a VMM library. In Part II of the article series, I will share the OVMST 2.1 installation requirements, presented with a step-by-step procedure guide to install and configure OVMST 2.1, and configure and store target VMs as offline virtual machines in a VMM library. You also learn how to create and monitor an OVMST 2.1 servicing job.

Overview

There are several steps required to install, configure, and use OVMST 2.1 in conjunction with Windows Software Update Services (WSUS) to update offline virtual machines. The procedures in this article will walk you through the following steps:

• Installing and configuring OVMST 2.1 on a VMM server
• Configuring Group Policy to identify the WSUS server
• Configuring virtual machine client firewall settings
• Storing virtual machine clients as offline virtual machines in a VMM library
• Configuring OVMST 2.1 to perform offline virtual machine updates
• Monitoring an OVMST 2.1 servicing job

Before proceeding with OVMST 2.1 installation, you must ensure that the environment into which it is deployed includes the following infrastructure services:

• Active Directory Domain Services (ADDS)
• DNS and DHCP Services
• Windows Software Update Services 3.0 SP1 or later version
• System Center Virtual Machine Manager 2008 or later version
• Virtual Server 2005 R2 SP1, Hyper-V, or Hyper-V R2

Even though this article focuses on integrating OVMST 2.1 with WSUS, you can also integrate it with System Center Configuration Manager 2007 SP1 or later version, if that is your standard software update distribution system.

OVMST 2.1 Installation Assumptions

The procedures presented in this article assume that the following components are already deployed, configured, and operating in your environment:

• Windows Software Update Services 3.0 SP2 (WSUS 3.0 SP2)
• System Center Virtual Machine Manager 2008 R2 (VMM 2008 R2)
• Windows Server 2008 R2 Hyper-V

With the exception of Windows Server 2008 R2 Hyper-V which must be installed on physical machine, all other components can be installed on either physical or virtual machines.

The System Center VMM 2008 R2 server must have the following components installed:

• VMM Server
• VMM Administrator Console
• VMM Library

Although the VMM roles are not required to be installed on a single server, OVMST 2.1 must be installed on the same server as the VMM Administrator Console because it provides Windows PowerShell support.

In a production environment, it is also a best practice to create a new host group on your VMM server that includes one or more Hyper-V hosts that will be used to deploy and service offline virtual machines, and perform other maintenance tasks. Hyper-V maintenance hosts should be excluded in the placement and execution of production virtual machines. In an environment with limited physical hardware, you can forgo this step and use the default Hyper-V host group and Hyper-V hosts. However, you should anticipate that OVMST servicing jobs may impact the performance of your Hyper-V hosts.

Installing and configuring OVMST 2.1 on a VMM server

The following procedure provides the steps to install OSVMT 2.1 and modify VMM server configuration settings to support it. You must perform these steps on the server where the VMM Administrator Console is installed.

Setting the Windows PowerShell Execution Policy

Before installing OVMST 2.1, you must change the execution policy on the server to require downloaded scripts to be signed by a trusted publisher before they can be executed.

1. Log into the server where the VMM Administrator Console is installed and open a VMM PowerShell command window. You can launch it by selecting Start | All Programs | Microsoft System Center | Virtual Machine Manager 2008 R2, and then select Windows PowerShell – Virtual Machine Manager.

Figure 1

2. In the VMM PowerShell command window, type get-executionpolicy and it should come back with Restricted.

Figure 2

3. In the VMM PowerShell command windows, type set-executionpolicy remotesigned.
4. When prompted, enter Y (for Yes) to accept the execution policy change, and then press Enter.
5. Close the Windows PowerShell command window.

Installing OVMST 2.1 on the VMM Server

1. In a temporary directory on your VMM server, download and extracted the OVMST 2.1 files.
2. From the directory where you extracted the OVMST 2.1 files, launch the OVMST 2.1 installation by double-clicking on OfflineVMServicing_x64.msi (use OfflineVMServicing_x86.msi for 32-bit installation), and select Run when prompted.

Figure 3

3. On the Microsoft Office Virtual Machine Servicing Tool Setup Wizard page, click Next.

Figure 4

4. On the End-User License Agreement page, select I accept the terms in the License Agreement, and click Next.

Figure 5

5. On the Features To Install page, click Next.

Figure 6

6. On the Ready to Install page, click Install.

Figure 7

7. On the Completing the Microsoft Offline Virtual Machine Servicing Tool Setup Wizard page, click Finish to complete the installation.

Figure 8

8. OVMST 2.1 will install in the C:\Program Files\Microsoft Offline Virtual Machine Servicing Tool directory.

Copying and Configuring the PsExec Utility on the VMM Server

After the installation of OVMST 2.1, you must also download the PsExec utility (which is part of the PsTools set) to the VMM server and unblock it on the server. The PsExec utility allows remote execution of OVMST processes on client virtual machines during servicing jobs.

1. In a temporary directory on your VMM server, download the PsTools files.

Figure 9

2. Select the psexec.exe and pdh.dll files, and copy them to the C:\Program Files\Microsoft Offline Virtual Machine Servicing Tool\Bin folder.

Figure 10

3. In the list of files in the Bin folder, right-click psexec.exe, and then click Properties.

Figure 11

4. Near the bottom of the dialog box, click Unblock, and then click OK.
5. Repeat steps 3 and 4 for the pdh.dll file.

Configuring Active Directory and Group Policy to Identify the WSUS Server

When you are using WSUS to manage software updates, you must create a group policy object (GPO) that configures the WSUS server settings to be used for offline virtual machine servicing. You may want to consider creating a new Active Directory (AD) container and placing the virtual machine clients in it to link and more strictly enforce the GPO.

1. On an Active Directory Domain Controller (DC) in your domain, open the Group Policy Management Console (gpmc.msc).

Figure 12

2. Select the container to which you want to link the GPO (WSUS in the figure below), right-click, and select Create A GPO In This Domain, And Link It Here from the menu.

Figure 13

3. Enter a name for the new GPO, and click OK.

Figure 14

4. In the Domain tree, right-click the GPO and select Edit.

Figure 15

5. In the Group Policy Management Editor, navigate to Computer Configuration | Policies | Administrative Templates: Policy Definitions | Windows Components | Windows Update.
6. Enable the following settings:

   1. Configure Automatic Updates
   2. Specify Intranet Microsoft Update Service Location
   3. Allow Automatic Updates Immediate Installation

7. In the settings for Specify Intranet Microsoft Update Service Location, make sure to enter the URL for the WSUS server.

Figure 16

8. Close the Group Policy Management Editor.
9. Close the Group Policy Management Console.

Configuring Virtual Machine Client Firewall Settings

The following procedure prepares a virtual machine for offline update servicing by modifying configuration settings to allow communication through the Windows client firewall.

1. Connect to the virtual machine client and open Control Panel.

Figure 17

2. Under Security, select Allow a program through Windows Firewall.
3. In the Windows Firewall Settings dialog, under the Program or Port section, check the following selections:

   1. File and Printer Sharing
   2. Remote Administration
   3. Windows Management Instrumentation (WMI)

Figure 18

4. After making the proper selections, click OK.
5. Close the Control Panel.

Storing Virtual Machine Clients as Offline Virtual Machines in a VMM library

After you have configured a virtual machine client and it is ready to store, you use the VMM Store In Library feature to transform it into an offline virtual machine and store it in the VMM library.

1. Log into the VMM server and launch the VMM Administrator Console.

2. Select the Virtual Machines workspace, right-click the desired virtual machine, and select Store In Library from the menu.

Figure 19

3. In the Store Virtual Machine Wizard, on the Select Library Server page, select the VMM server, and then click Next.

Figure 20

4. On the Select Path page, enter the path to the VMM library share to store the virtual, and then click Next.

Figure 21

5. On the Summary page, review the settings, and then click Store.

Figure 22

6. A Jobs dialog box will display to allow you to monitor the progress of the job.

7. When the job completes successfully, close the Jobs dialog box.

Configuring OVMST 2.1 to Perform Offline Virtual Machine Updates

After you have converted all of your virtual machine clients into offline virtual machines that are stored in the VMM library, you can configure the OVMST 2.1 tool, create a virtual machine group, and then create a servicing job.

Configuring OVMST 2.1 Settings

1. Ensure that you are logged in the VMM server with Domain Administrator credentials.
2. On the desktop, click Start and then click on the Microsoft Offline Virtual Machine Servicing tool menu option to launch the OVMST 2.1 Administrator Console.

Figure 23

3. In the Administration workspace, under the Actions heading, click Configure Tool.

Figure 24

Note:
The first time that you start the OVMST 2.1 tool, you must complete the Configure Tool wizard. The wizard establishes the connections between the tool and the other applications and services that are used to update offline virtual machines.

4. In the Configure Tool wizard, on the Configure Server page, enter the following information:
   a.    VMM Server
   b.    WSUS Server

Figure 25

Note:
You should configure either the Configuration Manager Primary Site Server or WSUS Server, not both.

5. After you enter the information, click Next.
6. On the Configure Maintenance Hosts page, select your Hyper-V host, and then click Next.

Figure 26

7. On the Configure Global Settings page, enter a value of 30 for each of the time-out settings.

Figure 27

8. Click Finish to close the Configure Tool wizard.

Creating a virtual machine group

1.  In the left pane of the OVMST 2.1 Administrator Console, select the Virtual Machine Groups workspace.

Figure 28

2. In the Actions pane, under Virtual Machine Groups, select the New Group option.

Figure 29

3. In the New Group wizard, on the Create A Virtual Machine Group page, enter the following information:
   a.    Virtual Machine Group Name
   b.    Virtual Machine Group Description

Figure 30

4. Move the offline virtual machines from Available to Selected.
5. Click Finish.
6. In the Virtual Machine Groups workspace, verify that the Vista Machine Group was successfully created and that the offline virtual machines were added to the new group.

Creating and running an OVMST 2.1 Servicing Job

1. In the left pane of the OVMST 2.1 Administrator Console, select the Servicing Jobs workspace.

Figure 31

2. In the Actions pane, under Servicing Jobs, select the New Servicing Job option.
3. In the New Servicing Job wizard, on the Configure Job Type page, enter the following information:
   a.    Servicing Job Name

Figure 32

Note:
Make sure that you do not enter any spaces in the service job name. Although the UI does not flag this as an issue, the job will fail if you enter a job name that includes spaces.

4. In the Software Update Management System section, verify that the WSUS option is selected, and then click Next.
5. On the Select Virtual Machines page, verify that the Select Virtual Machines From A Group option is selected, and that the correct Machine Group is selected. Then move the offline virtual machine from Available to Selected, and click Next.

Figure 33

6. On the Select A Network page, select the Use The Configured Virtual Machine Network option if you want the offline virtual machine to be connected to the previously configured virtual network, or select Use An Isolated Virtual LAN if you will use a VLAN to isolate the offline virtual machines during the servicing job.

Figure 34

7. When you have completed your selection, click Next.
8. On the Select Maintenance Hosts page, move your Hyper-V host from Available Maintenance Hosts to Maintenance Hosts To Use For This Servicing Job, and click Next.

Figure 35

9. On the Configure Account Information page, enter account credentials with local administrator privileges on the offline virtual machines, and then click Next.

Figure 36

10. On the Schedule the Servicing Job page, select the Run The Servicing Job Now option to run the servicing job immediately, or select Schedule The Servicing Job and enter the date and time to schedule the job. You may also specify job recurrence, if needed.

Figure 37

11. When you have completed your selection, click Finish.

Monitoring an OVMST 2.1 Servicing Job

Once an OVMST 2.1 servicing job has started, you can monitor the servicing job and verify that the virtual machines are being updated.

In the OVMST 2.1 Administrator Console, select the Servicing Jobs workspace in order to monitor its progress. By selecting the job that you just created (or that is running), you can monitor the job details. At the beginning of the job, the status should reflect that a virtual machine is being moved out of the VMM library to be deployed on the Hyper-V host. Once a virtual machine is deployed, the status will then change to reflect that the update cycle was initiated.  As new updates are installed, a virtual machine may require a restart. The servicing job monitors and ensures that a virtual machine properly restarts. When the update cycle is complete, the status will reflect that the virtual machine is being moved back into the VMM library. 

You can monitor the deployment of virtual machines from the VMM library onto maintenance hosts using the VMM Administrator Console. In the VMM Administrator Console, simply select the VMM library workspace, and then select the virtual machine to monitor. You can then review task details as the virtual machine is moved from the VMM library share to the maintenance host storage location. It is also possible to monitor the virtual machine deployment using the Hyper-V Manager.

If you encounter any errors, or after a servicing job successfully completes, you can review the OVMST 2.1 job logs stored in the %SystemDrive%\Program Files\Microsoft Offline Virtual Machine Servicing Tool\Log folder. As shown in the figure below, two log files are created for each OVMST servicing job.

Figure 38

The log that begins with the JOB_DBG prefix contains a list of all the scripts and processes that executed during the servicing job, as well as the completion status. The information contained in the log can assist you to pinpoint the cause of problems that may occur during a servicing job.

Conclusion

In Part I of this article, you were introduced to the Microsoft Offline Virtual Machine Servicing Tool, Version 2.1 and how it can help you to resolve the problem of updating offline virtual machines stored in a VMM library. In Part II of the article, you learned about OVMST 2.1 installation requirements, how to install and configure OVMST 2.1, how to configure and store target VMs as offline virtual machines in a VMM library, and how to create and monitor an OVMST 2.1 servicing job.

If you would like to read the first part in this article series please go to Using the Microsoft Offline Virtual Machine Servicing Tool Version 2.1 with WSUS (Part 1).