Welcome to Kraft Kennedy

Kraft & Kennedy, Inc. provides technology and strategic consulting services to law firms, corporate legal departments and financial services firms. We can help you analyze, plan, implement and manage business and technology solutions to optimize your organization's functionality and processes.

Kraft Kennedy | Technology Blog

About Matt Liebowitz

Matt Liebowitz is a Solution Architect at Kraft Kennedy. He provides systems and infrastructure design and implementation services for clients of all sizes. Matt has been published on the topic of virtualization in both Law Technology News and the ALA’s New York chapter newsletter. In addition, he has presented on virtualization and VDI at LegalTech 2010 and the annual ILTA conference in both 2008 and 2009. He also holds three VMware Certified Professional certifications.

Matt has also been named a VMware vExpert for 2010.

He can be reached at:

Email: liebowitz@kraftkennedy.com
Twitter: @mattliebowitz

Quite a while back I saw that Eric Sloof had figured out how to add his Twitter feed directly into the VI Client.  I thought it was clever but didn’t really give it much more thought than that.

Today I decided to take that concept and extend it to systems that you might manage alongside your VI3/vSphere environment.  Storage management seemed like the obvious first choice.
Continue reading…

For quite a while there has been confusion over how VMware’s Transparent Page Sharing (TPS) feature works with vSphere 4 running on Nehalem (or other modern) processors. Many people were noticing that it appeared that TPS was not actually working anymore and looked for ways to fix the problem.

In my recent post on the effects of ASLR in vSphere the comments turned into a discussion about TPS on modern processors. And there are countless posts about this issue on the VMTN forums where folks are looking for a fix. In reality nothing is broken and there is no need to fix the issue.
Continue reading…

When VMware released vSphere 4 last year, one of the changes they made was a completely re-written software iSCSI initiator. This was done to optimize performance which is great considering how popular iSCSI SANs have become. They also gave the ability to use Round Robin MPIO (mutlipathing) in the software initiator in addition to Fixed Path and MRU which were previously available.

I’m working on a vSphere implementation using Dell EqualLogic SANs and wanted to configure Round Robin on all of my datastores. Dell has a great whitepaper on how to set this up, but unfortunately the document fails to mention one key thing: this doesn’t change the default path selection plugin (PSP) from Fixed to Round Robin.   That means that you’ll have to set the multipathing policy to Round Robin on all of your existing datastores and will have to remember to do that on all future datastores. When you’ve got multiple ESX hosts with lots of  datastores this can quickly become a pain.


Continue reading…

I’ve seen a lot of talk lately about VMware’s Transparent Page Sharing (TPS) and how it is affected by ASLR in Windows 2008/Windows 7. I wanted to see if there was any real measurable reduction in shared memory when using ASLR vs. when it was disabled. First, let’s talk about what TPS and ASLR actually are and what the acronyms mean.

Continue reading…

Virtualizing SCSI tape drives with an iSCSI bridge

For years organizations have relied on tape drives and changers for backup and recovery of their critical data. Despite many predictions to the contrary, tape is still alive as we begin 2010.

When virtualization became popular it presented a challenge to those looking to continue to use their tape drives in fully virtualized environments. If you were using VMware you could use SCSI pass-through to present a tape drive or changer directly to a virtual machine but that prevented you from using any advanced features like VMotion. It also tied your tape drive and VM to a single host containing a SCSI card, making things complicated if that host were to experience a hardware failure.


Continue reading…

For years the best practice has been to disable screensavers on virtual machines.  Screensavers take memory and CPU cycles to run and that can hurt consolidation ratios, especially when there is no reason to run a screensaver on a server VM.  After all, why run a screensaver on a server that doesn’t actually connect to a monitor?  Seems obvious and almost unnecessary to bring up in 2009.

While working on a recent VDI project, I noticed unexpectedly high CPU utilization on a seemingly idle virtual desktop.  Turns out that the desktop image we were given had the 3D Flying Objects screensaver enabled.  When it kicked in after the desktop went idle it started taking a fair amount of the CPU.  How much CPU it was using might surprise you.  Take a look:


Continue reading…

With the release of VMware vSphere 4, VMware has released a very powerful management tool called Fault Tolerance (FT).  At a basic level, FT allows you to keep two virtual machines (a Primary VM and a Secondary VM) running in lockstep on two different physical ESX hosts.  If one of the ESX hosts were to experience a hardware failure, the VM protected with FT would remain running on the second host without any downtime.  This can greatly reduce downtime due to hardware failures and provide increased service levels for important applications.

FT is often compared to Microsoft Windows Failover Clusters, formerly Microsoft Cluster Server (MSCS), and in fact many have talked about how FT can replace Microsoft clustering altogether.  Rather than jump to conclusions like this, it is important to understand the use cases for both technologies.  In addition, there are several limitations to FT that need to be considered. Here are some important points to remember about FT:


Continue reading…

Expand Windows 2008 boot volumes with no downtime

In a previous post, I discussed how to expand virtual machine boot volumes with no downtime using Dell’s ExtPart utility.  Using this method is useful if you are using Windows Server 2000/2003, but is no longer required when using Windows 2008.  With Windows 2008 becoming the preferred server operating system going forward, using the method described below will become more and more common.

Microsoft has made it possible to expand boot volumes easily and on the fly without downtime without the need for any additional tools.  In this example, we’ll expand the C: drive of a Windows 2008 virtual machine from 25GB to 30GB.

1. Expand the size of the virtual disk.
Expand virtual hard drive

2. Launch Disk Management by right clicking on My Computer, selecting Manage, and then selecting Storage\Disk Management.  If you do not see the unallocated space, right click on Disk Management and select “Rescan Disks.”

Disk Management


Continue reading…

ILTA 2009 – Recap from Tuesday, 8/25

Tuesday was a exciting day at ILTA 2009 with lots of great sessions and discussions throughout the day.  About the only part of the day that wasn’t so great was the turkey bacon served at breakfast, which had the texture of construction paper and the flavor of it as well.

The morning saw a number of really good sessions, such as the session entitled “G100 Recap: Weathering the Storm and Cloud Computing.”  A number of key points were raised, such as the acknowledgment that technology spending was sacrificed during the economic downturn during the past couple of years.  The panelists believe that IT will actually help lead firms out of the recession and allow them to complete projects to help overall productivity.  On the subject of cloud computing, it was said that most law firms will likely begin to get exposure through telephony systems where there is less of the privacy concerns of other cloud based applications.

If you’re interested in exploring cloud computing in greater detail, Kraft Kennedy’s John Tsiofas and Dave Carlson will be speaking on data center relocation and cloud computing at 11:00AM on Wednesday in the Maryland C ballroom.

Also in the morning was a great session called “From the Trenches: Office 2007 Deployment Lessons.”  Here three different firms talked about their experiences, both good and bad, in upgrading to Office 2007.  The general consensus from the panelists was that the ribbon bar, the biggest visual change in the Office 2007 suite, actually turned out to be an insignificant issue overall.  The larger concerns were around application integration with document management systems and add-ins to Office applications that cause instability and performance issues.  In fact, one panelist described the project as “The document management system project featuring Office 2007,” highlighting the importance of the integration between Office 2007 and the DMS.

Office 2010 may have some of the same challenges.  Feel free to stop by Kraft Kennedy’s booth (721/723) to get a first hand look at Office 2010 running in our VDI environment.  The VDI desktops also feature Windows 7 and Microsoft Office Communications Server 2007 R2, so stop by and check them out!

VDI, or virtual desktop infrastructure, seems to be a hot topic at the conference this year.  Firms are starting to recognize that there are many benefits that can come with implementing a VDI solution, both in terms of financial savings as well as ease of administration and management.  We’ve spoken with many firms at the conference already this year that are starting to look at VDI as an alternative to traditional desktop deployment strategies.  We think the release of Windows 7 is also helping to drive VDI interest and adoption, as is the acceptance of virtualization technology in general.

With cost savings in mind, firms are also talking about how to contain costs or continue to reduce them.  Technologies like virtualization are helping to reduce costs as firms work to extend their hardware investments.  Developing a sound technology strategy has also been a reoccurring topic throughout the day as firms are preparing for what is coming next and want to ensure their strategy makes good business sense.

Finally, the day ended with the “Tut After Dark” party and casino night and everyone had a great time.  Even the party is a great place to learn new things, such as this blogger learning just how quickly you can lose $25,000 at the high rollers craps table.  But hey, it sure was a fun four minutes of my life!

Installing the VMware Tools package inside a VMware virtual machine improves overall performance and allows the use of advanced features and faster virtual hardware drivers.  The installation package also installs a tray icon that controls guest access to virtual hardware, time synchronization, etc.  Since most virtual machines are servers and end users don’t typically access the console of a server, worries about the security implications of leaving that tray application running have been fairly minimal.  However, as firms move towards solutions like virtualized XenApp servers or virtual desktops, this becomes more of a concern.

Removing administrator access to end users is unfortunately not enough.  For example, a user can open the VMware Tools tray icon and select the Devices tab, and from there can uncheck “NIC1″ and click Apply.  What happens?  You guessed it – the virtual NIC is disconnected and the user loses connection.  That’s bad in a virtual desktop environment since it will orphan the desktop and likely require a connection broker like XenDesktop to create another desktop but it is even worse on a XenApp server where the user potentially just disconnected dozens of other users as well.

This, and several other things found in the VMware Tools, can be dangerous to leave available to an end user even if they have no rights to the server itself.  To get around this, there are two approaches that make sense:

1) Remove access to the VMware Tools for end users.

2) Modify the VMX configuration file to prevent these actions.

I prefer the second method since it allows for more granular control over security, though if you’re interested in option one then you can read VMware’s KB article on the subject.  In order to prevent this at the VMX (virtual machine configuration file) level, simply add the following lines to the virtual machine(s) that you wish to protect (after powering it down):

isolation.device.connectable.disable = “true”
isolation.device.edit.disable = “true”

To see how to add one of these values to the VMX file via PowerShell and PowerCLI, it would look something like this:

$vm = Get-View (Get-VM NameofVM).ID
$vmConfigSpec = New-Object VMware.Vim.VirtualMachineConfigSpec
$vmConfigSpec.extraconfig += New-Object VMware.Vim.optionvalue
$vmConfigSpec.extraconfig[0].Key=”isolation.device.connectable.disable
$vmConfigSpec.extraconfig[0].Value=”true”
$vm.ReconfigVM($vmConfigSpec)

There are many other security parameters that can be set in the VMX file that are covered in VMware’s Security Hardening document (PDF).  The document covers this and many other common security best practices for virtual machines.  As always, test any change you make (especially the script above) before putting anything into production.