Problems with view agent 5.1 - some VMs stays in "customizing..." for ever

[Najtsob]

Hi,

after upgrading view agent in our golden images to version 5.1, we noticed that VMs composed from certain golden images stays in "customizing" state for ever when you try to recompose to newer snapshot with agent 5.1 installed.

View composer logs from C:\windows\temp looks fine and they are without errors and only difference I could found is some certificate.

I found that when you install view agent 5.1, new computer certificate store is created called "VMwareView" and that self signed certificate is generated and stored under this store.

Then I checked problematic golden images and found out that there is no certificate in this "VMwareView" certificate store.

After this I deleted certificate from one of the working GIs and try to recompose few VMs and they stuck in "customizing" so this seems to prove that missing certificate is causing my troubles.

My questions now are:
- how to check why this certificate is not generated on some golden images

- why this isn't documented in view 5.1 documentation, or am I missed something

- how to fix this

Also I googled alot about this problem and I found nothing, seems I'm the only one with this issue.

Best regards, Primoz.

[Najtsob]

Anyone anything ?

[leaffan]

Just wondering if you've looked at the following kb's

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=200731...

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=100630...

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=102816...

[mittim12]

Have you tried exporting that certificate from a working GI and importing into a problematic GI to see if it resolves your issue? 

[Najtsob]

Yes I read all the articles you mentioned and they are not helping me with this issue.

I am 99,999% sure that missing certificate is cause of my problems.

[Najtsob]

Yes, I have tried to export certificate from one VM into another but it doesn't help.

[mittim12]

Have you tried an uninstall of the agent, reboot, and then install the agent again?  

[Najtsob]

Yes, I have tried to reinstall agent, reinstall vmware tools and agent, applay various windows updates and the reinstall agent and/or vmware tools,...
I'm pretty much sure that I have tried everything possible when installing view agent 5.1.

[Suiname]

Are you running windows 7 and using all the same windows keys?  I know this happened to me when I was using some golden masters that did not have a key server, which is now required in view 5.

[Najtsob]

Hi,

i'm not exatly sure what you mean by a "key server". Do you have any link explaining it, because i really can't remeber that I have to deal with key server when we were upgrading to view 5.

All our golden masters are clonned from same template and only differences are made later when we install additional drivers or software.

[mittim12]

I think the reference was in regard to a KMS server. 

[Suiname]

Yes, I am talking about running a KMS server which is required for linked clones.  here's the KB explaining:

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=102655...

[Najtsob]

Yes we have KMS server and we didn't have any problems with activations.

If license key was missing or we have issues with KMS server than we would have problems already using view agent 5.0.

I'll still check this, but I think this is not an issue.

[Suiname]

Yeah, that's probably not your issue then.  I just posted that because I saw the same behavior as you and that was my solution.  Sorry, good luck.

[Najtsob]

We found this in view agent debug log under C:\ProgramData\VMware\VDM\logs:

2012-08-08T15:07:06.845+02:00 ERROR (0488-04B4) <MessageFrameWorkDispatch> [MessageFrameWork] Key store VMwareViewKeyContainer cannot be created: 0x8009000F (Object already exists.)
2012-08-08T15:07:06.845+02:00 DEBUG (0488-04A0) <Service Main Thread> [wsnm_desktop] AcceptTicketSSLAuth = 1. Settings:
   ErrorText = "Unable to load certificate"

After some googling we discoverd that this error could refer to C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder and permisions on this folder.

By default local administrators group have set "full control" and applay to is set to "This folder only", if you change this to "This folder, subfolders and file" and reboot the golden image, certificate is created and provisioning works fine.