Thursday, June 20, 2013

Backing up Windows Home Server 2011 to 4K sector size disks

Last week my Windows Home Server 2011 box informed me that my external USB backup hard disk was beginning to fail.  Big props to the folks at Dojo North who supply a free SMART monitoring plug-in for Windows Home Server, otherwise I would not have known the disk was on the way out.

So yesterday I purchased a Western Digital "MyBook" 3TB external hard disk to replace this external drive, and configured the Windows Home Server backup to store data on this drive from now on.   Imagine my surprise when I see this the next morning:



OK, that was unexpected.  Wonder what the problem was?  Let's have a look at the detailed error:


The request "could not be performed because of an I/O error"?  Huh?

Well let's cut to the chase.  The problem is caused by Windows Server 2008 R2 (and Windows 7) not supporting disks with native 4K sector sizes  for storing of VHD files.  Don't confuse this with NTFS cluster sizes - that's totally separate and does not solve the problem.  

As we know, Windows Image Backups are VHD files, and so the backup fails.   Great.

So how do we fix this?  The only way to fix this problem in Windows 2008 R2 and Windows 7 is to force the drive to use 512KB Emulation mode on the low level format.  This is not something you can do with Windows format tool and must be done with a manufacturer tool.  Thankfully, Western Digital provide the "WD Quick Formatter" utility which allows you to reformat the drive to 512E mode.  This removes Windows XP support, but who the hell cares.

Here's what FSUTIL says about the drive before it was reformatted using the WD tool:


 And here's what it says after the reformat:


But my drive can't be reformatted to 512E mode!

Well my friend, you are hosed and either need to buy a drive that does, or upgrade to Windows 2012 (or Windows 8).

Sunday, June 2, 2013

Annoying password storage in Windows for Outlook accounts

I'm somewhat of an Information Security maverick, so I've been living the BYOD lifestyle (whilst keeping stuff secure) for the better part of 4 years.  This basically means that none of my devices are members of the corporate Active Directory Domain.

When your machine is a domain member and you login, the domain credentials are tokenised (either as NTLM tokens or Kerberos Tickets).  Any application which can make use of these - such as Outlook - just calls on the token and passes it on to the Exchange CAS servers to authenticate your session.   No need to enter your password again - Single Sign On.  Everybody's happy.

However if you're not a domain member there is no automatic creation of authentication tokens to services hosted in any AD domains, so when you launch applications which access those services you're prompted for your credentials.  No big deal - you just enter the relevant username and password and tick the "Remember my Credentials" option.  The next time you launch the application the authentication is seamless.

When you change your domain password, your applications will pop a dialog box asking you to re-enter your password because, hey, the authentication failed since the stored password is the old one.   Again you would suggest this is no big deal because you can just re-enter your password and ensure the "remember my password" option is ticked, right?

Wrong (at least for some Outlook).

For some bizarre reason, the Windows Credential store does not update the password when you enter a new one.   The login will work but the store keeps the old password and the next time you launch Outlook you get prompted for the password again.  This continues indefinitely unless you take action.

As per Microsoft's own article on this problem (http://support.microsoft.com/kb/2762344), the only solution is to open the Windows Credential Manager and manually remove the stored credentials for any items with the word "Outlook" listed in them.  The next time you open Outlook and tell the popup to store the credential, the password is saved back to the credential store.

It sure would be nice if Microsoft fixed this one, because it's happening on my Windows 8 Pro machines running Office 2013, so it's not like it's something from the past.