BIOS Settings for Hyper-V Role in Windows 8 on Lenovo W-Series

Image

Recently I upgraded to Windows 8 on my Lenovo W510 in order to setup a virtual lab in Hyper-V. Hoping to save others the frustration I experienced during BIOS configuration, I thought I’d share the Intel hardware virtualization settings necessary for the role. The order that settings are made and complete power downs after certain settings changes are significant. Don’t save time with warm boots!

Step 1. Boot the machine, press F1 to enter setup, and you’ll be presented with this menu.  Make sure that the BIOS is the most recent version (1.45 as of this post).  Press enter on Config.

BIOS top level menu

BIOS top level menu

Step 2. In Config menu, arrow down to CPU and press enter.

Config Menu on Lenovo W510 BIOS

Config Menu on Lenovo W510 BIOS

Step 3. In the CPU menu, make sure the settings are:
• Intel Hyper-Threading = Enabled
• Intel Virtualization Technology = Enabled
• Intel VT-d Feature = Enabled

Core Multi-Processing Enabled, Intel Hyper-Threading Technology Enabled, Intel Virtualization Technology Enabled, Intel VT-d Feature Enabled

Hardware Virtualization BIOS Settings on Lenovo W510

If any settings in Step 3 had to be changed, hit F10 to save the settings and then power the machine off. Re-enter the BIOS by pressing F1 on the next startup.

Step 4. Return to the Main Menu in Step 1, and select Security. This menu will appear.
Arrow down to Memory Protection and press enter.

Security Menu on Lenovo W510

Security Menu on Lenovo W510

Step 5. In Memory Protection, make sure Execution Prevention is set to Enabled
Press ESC to return to the Security menu from Step 4

Execution Prevention Enabled

Memory Protection BIOS Settings on Lenovo W510

Step 6. Confirm the following settings:
• Security Chip = Active
• Intel TXT Feature = Disabled

Security Chip Active, Intel TXT Feature ***Disabled***

Security Chip BIOS Settings on Lenovo W510

Press F10 to save settings, and power down the machine. After restart, the Hyper-V role can be installed.

Encrypting Online Storage with EncFS

Dropbox, SkyDrive, Google Drive, SugarSync, Box, iCloud and dozens of other online storage providers all make sharing content online for access from multiple devices fast and convenient. How sweet it is to take a picture or create a document on your phone or tablet and have it automatically uploaded to “the cloud”.  You no longer have to worry about the data being lost if something happens to your mobile device, right?

It’s great until your mobile device falls into the wrong hands, somebody hacks into your online account, or the online storage provider suffers a privacy breach.  Depending on the data you stored online, that sweet solution could leave a sour aftertaste.  One solution is to encrypt the data before it is stored online using EncFS, a tool that encrypts an entire folder structure, but file by file, as opposed to a single container like TrueCrypt.  Because it stores data encrypted and decrypts only when mounted using a password, the data residing on mobile devices and in the cloud is securely encrypted if lost or compromised.

EncFS is a mature, decade old solution with broad platform support, including Linux, Windows, Macintosh, iPhone/iPad, Android, and a variety of online storage platforms.  Apps that make use simple include:

Cisco AnyConnect vs. Internet Connection Sharing in Windows 8

Having recently installed Windows 8 on my laptop to take advantage of the Client Hyper-V, I’m working through the kinks that come with a new OS on my daily driver. Hyper-V leverages the built-in Internet Connection Sharing (ICS) to provide NAT and DHCP for internet access for VM’s running on the hypervisor. This isn’t quite as intuitive as the network implementations in VMware Workstation or Oracle’s VirtualBox, but that’s a different discussion.

I recently had some trouble establishing the VPN connection, and set about re-installing Cisco AnyConnect as a result. During the install, a notification box popped up numerous times to warn me: “The VPN client agent was unable to create the interprocess communication depot.”

Cisco AnyConnect Install Error

The VPN client agent was unable to create the interprocess communication depot.

The install completed after clicking OK on the notifications, but would not establish a VPN connection, with a not so informative message “Unable to establish VPN”.  A bit of searching later, I found that AnyConnect is not compatible with Internet Connection Sharing, which Cisco states in the AnyConnect VPN Client FAQ.

The solution is to disable the ICS service before installing AnyConnect.  Subsequently, when trying to connect, I encountered connection failures:

AnyConnect Unable to Establish Connection

AnyConnect was not able to establish a connection to the specified secure gateway. Please try connecting again.

The solution is again to disable the ICS service, establish the AnyConnect VPN connection, and then enable ICS.  Oddly, it seems that after the first failed connection attempt followed by stop / connect / restart cycle of the ICS service, AnyConnect can be reconnected without any trouble.  Tedious, but it works.  Ping me back if you know a better way!