{"id":1859,"date":"2011-12-27T13:00:29","date_gmt":"2011-12-27T19:00:29","guid":{"rendered":"http:\/\/www.jasemccarty.com\/blog\/?p=1859"},"modified":"2011-12-30T09:23:28","modified_gmt":"2011-12-30T15:23:28","slug":"vmware-update-manager-download-service-on-windows-2008-r2-core","status":"publish","type":"post","link":"https:\/\/www.jasemccarty.com\/blog\/vmware-update-manager-download-service-on-windows-2008-r2-core\/","title":{"rendered":"VMware Update Manager Download Service on Windows 2008 R2 Core"},"content":{"rendered":"

Have to(?) access the Internet to download patches<\/strong>
\nUsing the default configuration of vSphere Update Manager, it must be able to connect to the Internet to download vSphere patches.\u00a0 This configuration is not always possible, depending on network architecture, policies, security configuration, or other reasons.\u00a0 Often times, simply using a proxy will accommodate the requirement of getting to the Internet to download patches.<\/p>\n

But what if there is a situation, for what ever reason, that you do not want to allow the server where VMware Update Manager is running to access the Internet?\u00a0 I talked to a customer not too long ago about the process of patching vSphere hosts in a situation such as this.\u00a0 In vSphere 4, it was somewhat bothersome using the VMware vSphere CLI, as opposed to using Update Manager.\u00a0 Also, when only using the VMware vSphere CLI, it is hard to get a good graphical representation of how a host is patched.\u00a0 VMware Update Manager does this well.\u00a0 But what if the server running VMware Update Manager is not going to be allowed online to download patches?<\/p>\n

VMware Update Manager Download Service<\/strong> provides the ability to create a local repository of vSphere patches and Virtual Appliance patches. Jason Horn posted an article on the process for vSphere 4.x back in 2010. You can find his article here: VMware Update Manager Download Service<\/strong><\/a><\/p>\n

Not much has changed with vSphere 5.0, other than to say that Windows and Linux guest patches are no longer available, given that VMware removed guest patching in vSphere 5.\u00a0 In all honesty, I have seen the umds<\/strong> folder for a while, but never paid much attention to it before the conversation I had with the customer.\u00a0 I knew it was there, but had never really looked into it.<\/p>\n

The UMDS Server<\/strong>
\nI went about installing a UMDS server, following Jason Horn’s instructions.\u00a0 Again UMDS for vSphere 4.x isn’t much different than UMDS for vSphere 5. There are some basic requirements for .Net and a SQL database for UMDS to run. The other thing to consider, is how are the updates going to be made available to Update Manager instances on the network?<\/p>\n

By default, UMDS only downloads the patches.\u00a0 That’s it.<\/p>\n

Given that UMDS runs on Windows, why not use Internet Information Services to serve the patches\/content for vSphere updates? And while I’m at it… Why not use Windows Server 2008 R2 Core.\u00a0 In the past, I have seen success using Windows Server Core editions as web servers.\u00a0 They have a smaller attack footprint, and given that there is almost never a need to log onto them locally.\u00a0 Why not choose a Windows Server Core installation for the UMDS server?<\/p>\n

\"\"<\/a>Installing Windows Web Server 2008 R2 Core<\/strong>
\nI installed Windows Web Server 2008 R2 (Server Core) in an VM, but before I added it to the lab domain, I installed the VMware Tools.\u00a0 This can be done pretty easily with the VMware Tools setup for vSphere 5.\u00a0 By selecting Install\/Upgrade VMware Tools from the vSphere Client, and choosing Interactive ToolsUpgrade, simply run setup64.exe from the command line from the CD-ROM drive.\u00a0 I chose to install the tools before doing anything else, given that I chose VMXNET3 as the nic type, and Windows Server 2008 R2 doesn’t recognize it without the VMware Tools installed.<\/p>\n

\"\"<\/a>If you haven’t used Server Core, basic configurations can be done using sconfig.cmd.\u00a0 I started with updating the IP address, updating DNS settings, changing the computer name, adding the server to Active Directory, and downloading\/installing updates.\u00a0 A side note, I added this server to Active Directory, but for the purpose of using this Server Core system as a VMware UMDS server, it isn’t needed.\u00a0 With Active Directory, GPOs, and a local WSUS server, it isn’t necessary for me to constantly download updates from Microsoft.\u00a0 I’m not going to go into to the benefits of WSUS in a lab, other than to say, it can significantly reduce bandwidth use if you setup and tear down servers often.<\/p>\n

The basic Core configuration will not allow for the installation of UMDS, because .NET is not enabled by default.\u00a0 In addition to that, I want to use IIS to provide the interface for individual Update Manager installations to use for updates.\u00a0 To enable both .NET and IIS, I used a script that I pieced together after some Googling. (If I find the specific sites I used, I’ll update this post with references.)\u00a0 I’m not going to go deep into the script, but the “Deployment Image Servicing & Management” tool (DISM) is one of the primary resources I used to enable features in Server 2008 R2 Core, along with PowerShell, and some good old fashioned command line utilities.<\/p>\n

The script to enable .NET & IIS:<\/p>\n

dism \/online \/enable-feature \/featurename:NetFx2-ServerCore
\ndism \/online \/enable-feature \/featurename:NetFx3-ServerCore
\ndism \/online \/enable-feature \/featurename:NetFx2-ServerCore-WOW64
\ndism \/online \/enable-feature \/featurename:NetFx3-ServerCore-WOW64
\ndism \/online \/enable-feature \/featurename:IIS-WebServerRole
\ndism \/online \/enable-feature \/featurename:IIS-ISAPIFilter
\ndism \/online \/enable-feature \/featurename:IIS-ISAPIExtensions
\ndism \/online \/enable-feature \/featurename:IIS-NetFxExtensibility
\ndism \/online \/enable-feature \/featurename:IIS-ASPNET
\ndism \/online \/enable-feature \/featurename:MicrosoftWindowsPowerShell
\ndism \/online \/enable-feature \/featurename:IIS-ManagementService<\/p>\n

\\windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe set-executionpolicy unrestricted
\n\\windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe import-module WebAdministration
\n\\windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe get-command -pssnapin WebAdministration<\/p>\n

reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WebManagement\\Server \/v EnableRemoteManagement \/t REG_DWORD \/d 1<\/p>\n

sc config wmsvc start= auto<\/p>\n

net start wmsvc<\/p><\/blockquote>\n

Installing UMDS<\/strong>
\n\"\"<\/a>Now that I have a Server 2008 R2 Core installation with .NET and an IIS installation, I can proceed with installing UMDS. I started by attaching the VMware vCenter 5.0 iso to my VM.<\/p>\n

With my CD-ROM drive being E:, I changed my active drive to the E: drive.\u00a0 The UMDS installable is located in the the UMDS folder.\u00a0 After changing active directories to E:\\umds, I ran vmware-umds.exe to get the ball rolling.<\/p>\n

The installation should not complain about .NET pieces missing.\u00a0 If you haven’t run the contents of the above script, you will likely get an error stating “You must use the Role Management Tool to install or configure Microsoft .NET Framework 3.5 SP1.”<\/p>\n

Be sure to enable .NET and IIS either through the script, or manually to enable the UMDS installation.<\/p>\n

\"\"<\/a><\/p>\n

Keep in mind that UMDS uses a database, just like Update Manager.\u00a0 This can reside locally or remotely, again just like Update Manager. For the purposes of the lab, I chose the default SQL Server 2008 R2 Express installation that UMDS defaults to.<\/p>\n

I would like for the installation to be self sufficient, as I will likely take the server off of the domain, and isolate it in a DMZ.\u00a0 Connecting to a remote database kind of gets in the way of doing things like that, without some exceptions.<\/p>\n

\"\"<\/a><\/p>\n

From a configuration perspective, I also wanted to make sure I could grow my patch download location, without having to modify the C: drive (or vmdk).\u00a0 When installing the server, I also created a D: drive for the storage of patches.\u00a0 I created a separate drive so I would have the flexibility of keeping downloaded patches in the event I were to reinstall the OS on the C: drive.<\/p>\n

Using a separate .vmdk to store updates on gives me additional flexibility.\u00a0 I can easily reuse it in the future for other UMDS installations or even for installations where I choose to leverage the normal Update Manager.<\/p>\n

\"\"<\/a>During the installation you may come across this error:<\/p>\n

Rest assured, this is “normal.” Microsoft KB Article 927978<\/a><\/strong> states that it may be ignored, but make sure you patch the system afterward.<\/p>\n

Configuring UMDS to download patches<\/strong>
\nUMDS 5.0 has the ability to provide patches for vSphere 5.0\/4.x, & VI3, as well as virtual appliance updates.<\/p>\n

\"\"<\/a>To start configuring UMDS, change to the C: drive, and change the directory to C:\\Program Files (x86)\\VMware\\Infrastructure\\Update Manager.\u00a0 VMware-umds.exe is used to configure what is downloaded.\u00a0\u00a0 Type vmware-umds.exe by itself to see a list of options.<\/p>\n

I chose to disable updates for VI3 & vSphere 4, as I don’t have any of them in my lab now, and did not see a need to download the patches for them.\u00a0 Here is the command to disable downloads: vmware-umds -S -d <package-name> <\/strong><package-name> <\/strong><\/strong><\/p>\n

The packages available are:<\/p>\n\n\n\n\n\n\n\n\n\n\n
package-name<\/strong><\/td>\nVMware version<\/strong><\/td>\n<\/tr>\n
esx-3.5.0<\/td>\nESX 3.5.0<\/td>\n<\/tr>\n
embeddedEsx-3.5.0<\/td>\nESXi 3.5.0<\/td>\n<\/tr>\n
esx-4.0.0<\/td>\nESX 4.0.0<\/td>\n<\/tr>\n
embeddedEsx-4.0.0<\/td>\nESXi 4.0.0<\/td>\n<\/tr>\n
esx-4.1.0<\/td>\nESX 4.1.0<\/td>\n<\/tr>\n
embeddedEsx-4.1.0<\/td>\nESXi 4.1.0<\/td>\n<\/tr>\n
embeddedEsx-5.0.0<\/td>\nESXi 5.0.0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Additionally vmware-umds -S -e <package-name> <\/strong><package-name>\u00a0<\/strong><\/strong>may be used to enable packages for download.\u00a0 Using vmware-umds -G <\/strong>will show a list of the packages that are currently configured for download.<\/p>\n

Downloading of Virtual Appliances is turned on by default, and can be disabled using: vmware-umds -S –disable-va<\/strong> or re-enabled using: vmware-umds -S –enable-va<\/strong><\/p>\n

Use vmware-umds -D<\/strong> to start the downloading patches.<\/p>\n

Downloading patches is a manual process, so a scheduled task will have to be setup to download patches on a regular basis. Schtasks.exe is the command line to for creating scheduled tasks.<\/p>\n

Schtasks \/Create \/SC Daily \/ST 23:00 \/TN “Download Updates” \/TR “‘c:\\program files (x86)\\VMware\\Infrastructure\\Update Manager\\vmware-umds.exe’ -D”<\/strong> will schedule the download for every night at 11:00pm.<\/p>\n

Here is an explanation of the parameters I used:<\/p>\n