Configure NLB Nodes for WAP (non domain joined)

You might run into some node-level trust issues if you are trying to configure an NLB cluster for the Web Application Proxy role. 

The best practice from Microsoft states that any servers running the Web Application Proxy role should reside in a DMZ network and not be domain joined. This brings it's own set of issues as the nodes don't automatically trust each other. 

Gone are the days of creating two local administrator accounts on two non-domain joined hosts with the same password and praying it "passes through" authentication requests. Although we are still going to do this, a few other steps must be completed for it to work. 

If you are configuring an NLB cluster on none domain joined nodes, you will probably be faced with "Access Denied" when you attempt to add the second host to the already existent cluster. This is even if you have matching local administrator credentials on both machines. I'm led to believe this is due to later versions of Windows inspecting the local SID's of user accounts instead of the username string. 

To resolve this do the following - 

• Create a new DWORD entry for LocalAccountTokenFilterPolicy in the registry of both nodes, this disables certain parts of UAC.  The registry path is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System and for clarity the new entry should be a DWORD set to decimal and the value of 1.

• Configure the Trusted Hosts store on each of the nodes and create an entry for each server on each node. All the info on this can be found here http://winintro.ru/windowspowershell2corehelp.en/html/f23b65e2-c608-485d-95f5-a8c20e00f1fc.htm

• Configure (from NLB Manager) Options > Credentials on both servers with the local admin account that has been created on each of the servers.

• Configure the NLB cluster using node IP's and not DNS names (even if you have DNS names configured with the hosts file, I've found IP's seem to work better in a none domain joined NLB cluster).

Microsoft Surface Pro 3 Boot from USB Not Working

Easy blog post which may not help many IT Professional but if your a consumer this post hopefully helped you. 

I recently got a Microsoft Surface Pro 3 hybrid device for using at work, it's a nice device that is lightweight and powerful so perfect if you travel a lot like me.

As I passionately hate the OEM builds of Windows you get on next devices the first thing I wanted to do was to rebuild it myself with a clean Windows 8.1 Enterprise image.

Obviously the Surface 3 does not have an optical drive so the only options are to boot from USB, PXE or attach an external DVD drive. I do not have an MDT/PXE server setup and handy so USB was my only option.

The official manual says to boot a Surface Pro 3 you do;

• Turn Off Device Completely
• Press/Hold Volume Down Button
• Turn Device On
• Release Volume Button when Surface Splash Screen Appears

This for whatever reason did not work for me so I started looking around on forums, and someone had mentioned if you rename your USB drive with Windows on to "BOOTME" it forces the Surface to boot from it. Never worked for me.

The only way in which I could get a new operating system installed was to run the Windows 8.1 setup from the old installation.

If you do it this way (which from what I can remember never worked in older versions of Windows) the setup automatically reformats the SSD disk and reinstalls everything for you.

I found that after the first reboot the Surface hangs at the Surface splash screen, the fix is to hard reset it while leaving the USB drive inserted.