Creation of the VMM Resource Group Failed

While trying to install VMM as a Highly Available following the steps in this article, I kept running into the same issue over and over and over again.  The installation would start, run for a few minutes, and then fail and rollback with this error at the end:  “Creation of the VMM resource group VMM failed.Ensure that the group name is valid, and cluster resource or group with the same name does not exist, and the group name is not used in the network.”

I first thought it was because I had pre-configured the DNS entry, but even after removing the DNS entry and verifying that neither cluster node could resolve it anymore the installation still failed.  Next I rebooted both nodes of the cluster.  The installation still failed.  My next thought is maybe I can’t use VMM as the HA VMM name so I used XXXVMM and sure enough it worked.  Now, whether or not that is because I had the VMM DNS entry created previously and it screwed something up, or because you really can’t use the VMM name, I don’t know.

At this point it said setup completed successfully, but with warnings.

 

Starting the clustered VMM service XXXVMM failed.Ensure that the user has permission, the VMM service is installed properly, and cluster resources can be brought online.A service connection point (SCP) could not be registered in Active Directory Domain Services (AD DS) for the VMM management server.Run “D:\Program Files\Microsoft System Center 2012 R2\Virtual Machine Manager\setup\ConfigureSCPTool.exe -install XXXVMM.nfm.com XXX\XXXVMM$” in a command window and then check AD DS. If an SCP is not registered, VMM consoles on other computers will not be able to connect to this VMM management server and deploying a Hyper-V host to a bare-metal computer will not work.

I ran the setup as a domain administrator, and am logged into the cluster node as this same domain administrator.

Looking at the Cluster event logs, this is the error I get when I try to manually bring the service online:

Failed to bring the resource VMM Service XXXVMM online.  Error code 0x80071736 The Resource failed to come online due to the failure of one or more resource providers.

Looking at Services, the System Center Virtual Machine Manager Agent service is running, but the System Center Virtual Machine Manager service is not running, and if I try to start it, it fails with the error.

In the Event Log, I find this error entry which seems pretty useful.

Cluster network name resource ‘XXXVMM’ failed to create its associated computer object in domain ‘nfm.com’ during: Resource online.

The text for the associated error code is: A constraint violation occurred.

Please work with your domain administrator to ensure that:

– The cluster identity ‘VMM-HV-CLUS01$’ has Create Computer Objects permissions. By default all computer objects are created in the same container as the cluster identity ‘VMM-HV-CLUS01$’.

– The quota for computer objects has not been reached.

– If there is an existing computer object, verify the Cluster Identity ‘VMM-HV-CLUS01$’ has ‘Full Control’ permission to that computer object using the Active Directory Users and Computers tool.

While looking in AD for this object, I also stumbled across a VMM computer object (who the hell knows where that come from) so I deleted that object as well.  I am nearly 100% certain that is what caused my installation using VMM as my VMM Cluster Name to fail.

At the very bottom of this article it outlines how to troubleshoot issues with Cluster AD Accounts.  The instructions are only slightly different for Server 2012, and it tells you how to grant only the permissions that you need.

With that done, I removed the VMM installation and tried it again, with the original VMM Cluster name (just VMM) and it worked fine, with no errors!

 

 

 

 

PowerShell DSC Journey – Day 23

No intro. Going right back into trying to add a Network Adapter and a VMNetwork to that adapter. I look first at the hardware profile, and lo and behold I have 9 legacy network adapters, which is interesting because yesterday I had none. So, I remove them all first.

Ok, first things first, let’s make sure I can get the network I want, which I can do using this command:

The next thing I can do is try to create a new network adapter on the Hardware Profile, which I can do using this command.

However, this creates a Legacy network adapter. After reading the help file I determine that I need the -Synthetic parameter in order to make it a non-legacy network adapter.

So, that’s all working now. Next step is to see if I can actually set the Virtual Network on the adapter itself, which is where I failed so hard yesterday. This works.

So, let’s try this next. And it works. I swear I did this a billion times but I am not even to go back and look because it might make me angry or depressed. Or both.

So, let’s run my Configuration and see what happens again. And it works. Of course it does.

I then add most of the same code to the section of Set-TargetResource for when a Hardware Profile doesn’t exist. Now let me delete my profile and try it. And of course I get some errors because I am using the $ResourceHWProfile variable in this section of code instead of just $Name. So, I change it to this.

And that works as well. One interesting thing to note. There is a lot of Write-Verbose commands I have that aren’t being written after this section of code. And I have no idea why either.

Well, that’s working now so I am happy. Now that I have a functioning Resource that does what I wanted it to do, this will be the last post in the series 🙂

PowerShell DSC Journey – Day 22

Alright, after my little fiasco yesterday I need to do a little re-configuring of my Configuration because of course DSC will not allow a Plain text password.

Here is the new version of the Configuration.

Now, let’s try to run this and see what breaks. And. Nothing breaks. I am literally speechless. Seriously.

Well. Here goes nothing. And I forgot to change something back in .psm1 file when I was messing around with it yesterday that caused this entire thing to blow up. I will spare you all the red text but here is the error.

With that fixed I try to run it, and I don’t get any errors, but clearly I have something to fix with my Test-TargetResource function because it just skipped running Set-TargetResource.

So, let’s see if we can figure out what’s going on. I am pretty sure this section is the problem.

I set the $result to $false, then tested for the $VMMServer, and returned $True, so DSC was like “oh hey, everything is gravy.” Fail on my part. Let’s fix this. I already know if the Credential or VMMServer is invalid that it will fail, so I just need to check to make sure $ResourceVMMServer exists and then do the rest of my checks. I am pretty sure this is going to fail for a couple of reasons, but I am going to test this anyways in the interest of full disclosure :).

I run several of my tests that I expect to return both $True and $False. I made a few changes and added one line, so here is the new and improved section of my code.

So, let’s try this again! HOLY BUCKETS IT WORKED! Minus, one small issue.

dsc62

Now, the one issue there is that no VMNetwork was set. Probably because there is no network adapter, which I am guessing I forgot to include in my Set-TargetResource. Let’s take a look.

Yeah, that’s not going to work. I need to create the adapter first. Turns out it’s easier than I thought it would be. Just kidding, I can’t use the parameter for $VMNetwork, it needs to be a different type.

Which opens a whole new can of worms because I need to check to make sure that is a valid VM Network somewhere. For the purposes of this, I am going to assume that if it should be present, it is a valid name. Actually I lied. We aren’t going to do that, because that opens up a giant mess when it comes to creating a new Virtual Network.

After banging away on this for about the last 30 minutes I am going to stop here for the day and pick it up again tomorrow. I am currently stuck on getting the right object type from Get-SCVMNetwork to pass to……..oh hell…wait a minute. Just kidding! Kidding again. I have a moment of genius! And this is also where I hate Virtual Machine Manager anymore. Only thing good to say is that I learned a hell of a lot more than I ever wanted to know about VMM cmdlets this afternoon.

So, let me delete the Hardware Profile and run my Configuration again. The network adapter didn’t get created. My brain is exhausted. I’m done for today. For real this time.

PowerShell DSC Journey – Day 21

Alright, when I left off I had added in some testing for the $Credential Property of the Resource in the Get-TargetResource and Test-TargetResource functions. Today I am going to do the same with Set-TargetResource, and then test my Configuration to see what I did wrong. If I survive that I will try to create a Hardware Profile with my Resource.

First things first, I add this same section to Set-TargetResource.

I think that is all I need to do here because Get-SCHardwareProfile and Set-SCHardwareProfile don’t require a credential.

I run my first test, and everything works great except the test removed the DVD Drive. Which it wasn’t supposed to do. And there is all some verbage for the CPU Count that is incorrect, and it looks like I need to add a case for when CPUCount is not specified.

Ok, let’s tackle the DVD Drive issue first. I didn’t specify an option for it, it was already present, and the profile was set to Ensure = Present, so it should not have been removed. Here is the code block.

What is happening is I am not specifying a value for the DVDDrive Property. So as far as it is concerned, the last Else statement gets executed. I am going to need to add a case for not specifying the DVDDrive Property. I reconfigured this code to look like this instead.

And that works exactly like it should. Now I need to do the same thing for CPUCount. This also works just fine. And it’s also at this point that I realize that I already have the VMNetwork parameter setup that way. Apparently it never occurred to me I would need to do the same thing for the others. Oh well. Moving along! I run a few more test and make a few more minor changes and tweaks but I am not going to bore you with those details. I just needed to update the part of the function that creates a new Hardware Profile with the same If checks as above.

And now. Let’s see how badly I have failed here. Let’s test this bad boy.

Pretty good. So far. I don’t expect this to continue.

Well. That was unexpected. I guess on to the next thing. Let’s try my Configuration again. Here is my current Configuration.

}

}

Alright. So….I declared my credential variable to be of the type [pscredential]. Maybe it needs to be [MSFT_Credential]? Let’s try it. But wait, I have the bright idea that I should check to see how the ADDomain resource handles it, and I find my answer in the .psm1 file for the resource.

Looks like I need to update my Resource.

Hmmm. How else would you get the schema.mof to show that Type? Then I look at the schema.mof for my resource and get my answer.

So the type Credential, automatically changes to that in the schema. Good to know. Now I try my Resource using [MSFT_Credential]$Credential and that fails.

This has me stumped. Nothing of use in the DSC Event Logs. Comparing my .psm1 file to the ADDomain.psm1 file, I notice that all of their credentials are of the type [PSCredential] while mine is of the type [System.Management.Automation.PSCredential]. Which is weird (I think?). I try to change the parameter in my Configuration to the type [System.Management.Automation.PSCredential] but I get the same error. So I am going to change the .psm1 type to just [pscredential] and see what happens. I reloaded everything and change the type for Credential back to [PSCredential] and the same thing still happens.

I am stumped. Going to call it a day on that front.

Edit: Thanks to Jason Hofferle for helping figure out what I was doing wrong (and it was something dumb). I was so wrapped up in the thought that I did something wrong in my Resource that I didn’t bother to specify the Credential property in my actual Configuration.

PowerShell DSC Journey – Day 20

When I left off yesterday I was trying to actually run a Configuration to create a Hardware Profile, and quickly realized that I was going to need a Credential parameter in order to do this, because not just anyone can connect to a Virtual Machine Manager server. So today’s post is going to be about adding a Credential property to my Configuration.

I am going to be referencing the Active Directory resource for this because I know that uses a credential parameter to authenticate to Active Directory. First thing first, let’s create a new DSC Resource Property.

Then I will need to update my resource with this new Property.

And here is what my schema.mof file looks like:

And this is a snippet of the Get-TargetResource function show the additional property as well.

Now, that’s all well and good, but how do I go about testing this in Get-TargetResource? Let’s take a look at what the Active Directory resource does. It looks like it is using the Credential property when testing other properties, so I will do the same. I believe I only need to add this where other commands need to authenticate to the VMMServer, and I should probably test to make sure the credential is valid. Get-SCHardwareProfile doesn’t require a credential, only the VMMServer name, so I don’t think I need to do anything there. I did add this to the Get-TargetResource function.

And I suppose I should test this now to see what breaks. This test prompted me for the credential and completed successfully.

Just to be safe I tried the same test but added a -Credential (Get-Credential) command and everything worked fine.

Here is a test where I submitted a completely bogus credential that has no permissions to anything.

Here is what I added to my Test-TargetResource Function.

So let’s test this out. I am astounded this is actually working properly. With valid credential:

With non valid Credential:

I am running out of time today and feel like this is a great place to stop. I will move on to the Set-TargetResource function tomorrow!

PowerShell DSC Journey – Day 19

Alright, so in my last post I was able to resolve the issue with my Custom Resource not showing up under Get-DSCResource (because as usual I was doing something dumb).

Proof!

Now, let’s try and write a Configuration! Look ma, no errors!

Let’s build this out for a test.

I run this Configuration and the .MOF gets created.

When I run this configuration I immediately encounter two errors.

The first issue crossed my mind literally as I was hitting enter to start the Configuration. That is, am I going to need a credential variable to pull this off because not just anyone can connect to a VMM Server. This error came from running PowerShell as Administrator. When I run PowerShell as my elevated account (which has access) this is what happens.

I am going to try this (although if it works this not a valid solution as far as I am concerned), and this shouldn’t work but I am going to try it anyways.

And it did exactly what I thought it should do (which is nice for a change).

So, I am going to need a $Credential parameter. That sounds like a good place to start tomorrow 🙂

PowerShell DSC Journey – Day 18

Yesterday I finished up modifying the Set-TargetResource function and doing all the tests and it seems to be working exactly the way that I want. The next step today is to turn this into a module, import it, write a DSC Configuration and see if it actually works.

I already have my SCVMM_Hardware.psm1 file, so I just need to add a module manifest file.

Looking at the other DSC Resources, none of them specify a root module, so I guess we will see if this breaks it or not. They also have multiple resources associated with each module, so that could be part of the reason as well.

This article on TechNet says to “Finally, use the New-ModuleManifest cmdlet to define a .psd1 file for your custom resource module. When you invoke this cmdlet, reference the script module (.psm1) file”, but the module manifest they show has the root module as ”, which doesn’t match up with what they are saying. I am just going to try it this way and see what happens. Because that’s what I do. Actually, I am going to change something up here to prepare for my other SCVMM Resource.

  • Rename the root folder to cSCVMM
  • Create a DSCResources folder underneath
  • Create a cSCVMM_Hardware folder, move my .psm1 and schema.mof files into this folder
  • Create the module manifest and place it in the root cSCVMM folder

Round 2.

So far so good! (No errors anyways). I am going to restart ISE and see if it loads the module or what happens. This is where I had so much trouble in my previous post. And I ran into the same issue. If I say Get-Module -Name cSCVMM nothing happens. If I do Get-Module -ListAvailable it shows up in the list. So first thing, I am going to get rid of the root module path and see what happens.

Same thing. Move it out of the DSCResources folder, same thing.

Looking at the other resources, they have a CLR version and a description, so let’s just try that (although I am sure that has nothing to do with it).

Long story short, turns out (once again) that I just don’t know what I am doing. Once you import it by name, you can then get the information on it. Duh.

So, now that I wasted a bunch of time on that, let’s see if I can remember how to build a Configuration :).

First issue I run into is, when I do Import-DSCResource -Module cSCVMM it acts like it has no idea what the hell that is. So, uh, what do I do about that?

So, yeah. My .psm1 file is exporting the commands, so that shouldn’t be a problem. I guess first thing first, let’s run Get-DSCResource and see what happens.

I get that error, but then all of the DSCResources are listed (except for mine).

Further investigation reveals this.

Alright, so that’s fun. I am going to backup here and try something referencing the steps in this article.

I create a “new” DSCResource using my properties. And guess what? Even then it doesn’t show up as a DSC Resource. So, that’s good right? I don’t think so. That article makes it seem like it should be pretty simple, so I don’t know what’s going on.

Next step, I am going to test this on WMF 4.0 (I am using WMF 5.0 Preview). And the same thing happens there. So that’s good I guess. I really have no idea what is going on here. Completely. Puzzled.

Time to stop for the day. Hopefully I think of something before tomorrow as of what to try next.

Edit: I was able to resolve this issue with the help of Don Jones on the PowerShell.org forums.

When I first created the Resource what I did was this:

What I should have done was this:
New-xDscResource -Name cSCVMM_Hardware -Property $DVDDrive, $VMNetwork, $CPUCount, $Ensure, $Name, $VMMServer -FriendlyName “SCVMM_Hardware” -ClassVersion 1.0 -Path ‘C:\Program Files\WindowsPowerShell\Modules\cSCVMM’

Since I didn’t specify the Module name it just created the DSC Resources folder and that messed up everything. Lesson learned!

PowerShell DSC Journey – Day 17

Alright. So yesterday I worked through some issues in the Set-TargetResource Function and left off with a big one still remaining. Namely, that even though I have Ensure = Present in my test of the Function, it is running through the Ensure = Absent portion of the script if the Hardware Profile already exists, which doesn’t make any sense.

Here is the section of the Function in question.

And if I run this Test with a Hardware Profile that already exists, this is the output that I get.

And I know it’s removing it because the Hardware Profile disappears from VMM. The question is, why? I can see from the Verbose output that $Ensure is set to Present, so why is the Function ignoring that? As another test, if I run the same test but set $Ensure to Absent, it removes it. But that was really just a diversion to avoid thinking about the real problem because I am completely stumped.

I change my Else block to ElseIf($Ensure = “Present”) and that has no effect. It just jumps right into the If Absent block and deleted the Hardware Profile. Lacking ideas I start going through the xVMHyperV Set-TargetResource function searching for Ensure to see how they do it. And they are using -eq in the If statement instead of =. Does this really make a difference? Yes, that’s the answer. After I change it to that, it evaluates the parameter properly. I feel like this is a very simple mistake that I made solely because of my lack of experience and knowledge of PowerShell.

Doing a little research in PowerShell using Get-Help I discover the following:

  • = is an Assignment Operator.  It sets the value of a variable to a specified value
  • -eq is a Comparison Operator.  It compares to objects looking for an identical value
  • Thus, = does not equal -eq.  I feel dumb.  I should have known that.

That being said, when I run my test using an existing Hardware Profile now (with Ensure = Present), I get this for output.

Clearly there are a couple of issues here. The DVDDrive section looks OK, but then in the CPU section I get this beauty for Verbose output.

Yeah, that’s not real useful. Looking at this it appears that $HWProfile.CPCount is not what I think it is. Actually I think it’s because I used $HWProfile instead of the $ResourceHWProfile variable. This is going to require a fix in a lot of places. I make those changes and try my test again. I get the expected output, except that I get the same error about the VirtualNetworkAdapter that I got above. This goes back to my work in the previous blog post about how to handle this, because I don’t want to make this parameter mandatory. So, I need to add in some additional logic to my Function here.

And now when I run my test, I get exactly the output that I would expect.

Boom!
I do various tests with different CPU, DVDDrive and VMNetwork settings and everything looks good. I do make a change to one line of Verbose output, but other than that everything checks out fine. This is really cool. I have an actual functioning DSC Custom Resource. Tomorrow I am going to turn this thing into a Module, and try out an actual DSC Configuration and see if that actually works before adding in my additional parameters.

PowerShell DSC Journey – Day 16

When I left off yesterday I had a somewhat functioning Set-TargetResource function. I use functioning in the way that when something kind of works and doesn’t throw errors but doesn’t actually do anything functions. So, today I am going to be figuring out where I screwed up my logic and getting this Resource to work. And hopefully this doesn’t turn into a smaller version of War and Peace.

Here is my Set-TargetResource in it’s entirety.

The first problem I noticed is that when I run this test of my Set-TargetResource (in which I am testing for a Hardware Profile that doesn’t exist), here is the output I get.

Couple of things to note here. It didn’t find the Hardware Profile, so it created it. However, I didn’t specify anything for the DVD Drive, but the verbose output indicates that it was set to False, so it did not create a DVD Drive, so that needs to be fixed. The second issue is that the verbose output indicates that the CPU count set to 0 or not specified, CPU count should be at least 1. If I don’t specify a CPU count the Hardware Profile creation defaults to 1 CPU, so the message should indicate that. And lastly it just errored out on setting the VMNetwork because I didn’t specify one.

First things first, here is the section of code I have to handle the DVD Drive.

While thinking about this, it occurs to me that maybe I should set this to default to True, because I imagine that in almost every case you are going to want a DVD Drive on your server. I feel like that is a better solution than adding in another ElseIf section that has the Null case. Do people agree? I changed the parameter in the Set-TargetResource Function so that $DVDDrive = $True, and that means the existing code block should work fine.

Second minor issue is changing the Verbose text when the CPU Count is set to 0 or not specified. This particular section of code I changed from:

To:

Of course after doing this I think, should I just set the CPUCount parameter to default to 1? I mean, you need a CPU for it to run, and it defaults to 1 anyways without even setting anything. I realize the code in the Else block is a little redundant, but for consistency sake I left it that way so somebody reading it wouldn’t be like “why did he set the hardware profile in the first section and not the second?”. I could also make CPUCount a mandatory parameter, but that seems a little excessive when it just defaults to 1 anyways. Hmm. I don’t think there is a good answer to this. I am going to set CPUCount to default to 1 and just change the Else statement to use -CPUCount $CPUCount for now. I don’t like the idea of hard coding parameter values into a DSC Configuration, but in this particular case I think it is justifiable.

Alright, now for the last problem with the VMNetwork. If I don’t specify it, it shouldn’t just freak out and throw and error, it needs to say something useful. Here is my current code.

The problem here is that I thought that checking to see if the parameter was not equal to Null mean it would also check to make sure it wasn’t empty. Clearly this is not the case. So how do I check for both cases? It appears based on some Google searches the best way to do this is to change it from If($VMNetwork -ne $null) to just If($VMNetwork) which checks for Null or Empty.

With those changes done, lets test again and see what happens (I deleted the Hardware Configuration created from the previous test).

Much better!