Gnawgnu's Realm

Galaxy Tab WiFi stops working every few days

2012-01-17T18:51:00.002-05:00

Having finally gotten fed up with rebooting my galaxy tab every few days to get it to work with my home netgear router, I started trolling through forums for a solution. Suffice it to say, Android has a long way to go as far as dhcp and wifi if even half of what's posted on these forums is accurate. Fortunately I managed to stumble on a fix that worked for me. My wifi network was set up to accept Both WPA and WPA2. I removed WPA support and just left only WPA2 support on and I haven't had to reboot in the past few weeks. (There's some kind of rekey'ing issue with WPA version 1 every few days) I'd also had intermittent issues with my Cisco WAPs and I applied the same changes to them and am waiting to see if it helps.

Android Exchange 2010 ActiveSync issue with Smart Forwarding

2012-01-05T08:39:00.001-05:00

Ran into a real doozy of a bug this week with one of my user's DROID phones. Apparently there's a bug in the Smart Forwarding feature that causes an infinite loop for an outgoing message. After doing some digging I found a LOT of references to this rare bug on the forums. I'll post the links below but the short version is that the smart forwarding is supposed to just insert a marker when you forward an email with an attachment. That marker tells the server to insert the attachment so the client doesn't have to download the whole email to their phone first. In some cases this marker gets hosed royally and causes a loop between the client and server and it just repeatedly sends out the same email. The only way to break that loop is to kill the mail profile on the device or hard reset it.

So for now I've told my users that if they've got this feature to turn it off.

settings -> battery and data manager ->datadelivery -> Email and corporate sync -> smart forwarding

Email Settings-> SmartForwarding

http://social.technet.microsoft.com/Forums/en-AU/exchangesvrmobility/thread/0e332aff-dc44-47d2-a294-36c68b56b04e

http://www.sharepointpanda.com/2011/08/motorola-atrix-with-gingerbread-update-triggers-infinite-loop-on-forwarded-emails/

http://www.atrixforums.com/forum/rescue-squad/5153-forwarded-emails-exchange-2010-get-sent-infinite-loop-after-gb-update.html

I like the Cisco AP541N WAPs

2011-10-14T21:48:00.001-04:00

So I've been resisting giving wireless access to my internal network for a long while. But over time the security options on wireless equipment have gotten better and frankly the cable clutter in the conference rooms has started resembling a brier patch. So I went to go look for a wireless router that could not only handle multiple VLANs but would also provide strong security and integrate my user's Active Directory accounts. Enter in the Cisco AP541N which can emulate up to 15 virtual APs, each can be configured with unique authentication options, VLAN tagging, and supports redirection to a URL. And it had good clustering support to boot which was a nice plus along with POE support to simplify deployment and it comes in just under $400.
http://www.cisco.com/cisco/web/solutions/small_business/products/wireless/ap_500/index.html

For my secure network I set the VAP to use RADIUS auth to my win2k8 r2 domain controllers that were set up using NPS. Good setup article here: http://aaronwalrath.wordpress.com/2010/06/22/install-windows-2008-r2-nps-for-radius-authentication-for-cisco-router-logins/

Accessing the VAP is a breeze as the user just has to click connect on their domain joined laptops and their credentials are automatically passed through without any end user configuration. Nice video at: http://www.youtube.com/watch?v=g-0MM_tK-Tk

Now the only thing that I didn't like when I configured it was that the admin password was limited to only 8 alphanumeric characters. Fortunately if that's an issue you can just configure the whole WAP to use 802.1x to authenticate the admin account. I also ran into an issue where the auto-configured settings that the cluster feature set up had an authentication problem but all I had to do to fix that was just re-enter the RADIUS password again and it went away.

TMG 2010 and enabling TLS 1.2

2011-09-26T07:30:00.004-04:00

With the impending demise of TLS 1.0 on the web I figured it was a good time to make sure all my servers had TLS 2.0 enabled on them. The normal IIS 7.x servers wouldn't be a problem since I'd found a powershell script for turning those on a while ago but I wasn't sure about the TMG 2010 servers. Since they also function as ssl termination endpoints they also needed to support TLS 1.2. After a bit of searching I found only a few mentions of TLS 1.2 and TMG 2010 and they seemed to imply that it would track with whatever the OS had enabled on it. So I went ahead and ran the script to enable it, rebooted, and then tested my servers out with the SSL labs tester (https://www.ssllabs.com/ssldb/index.html) which reported back to me that my servers were now supporting TLS 1.2.

But they also reported back that my server still supported Insecure Negotiation. So I dug around a bit more and found some registry keys that need to be set in order to turn off Insecure Negotiation at http://support.microsoft.com/kb/980436 . So I set these 3 DWORD values to zero:

AllowInsecureRenegoClients

AllowInsecureRenegoServers

UseScsvForTls

Updated: I started getting an supplied sspi channel bindings were incorrect on servers that were published behind the TMG server so I deleted those keys and that went away.

The powershell script that I used for TLS 1.2 enabling can be found here:

http://derek858.blogspot.com/2010/06/enable-tls-12-aes-256-and-sha-256-in.html

Custom Calendar permissions missing in Outlook on recovered calendar

2011-07-25T15:47:00.003-04:00

After painfully recovering a Calendar last week for a user, they were no longer able to set 'Custom' permissions for their Calendar. All the Free/Busy options had disappeared from the panel completely. The solution turned out to be running outlook.exe /ResetFolders Only that fixed all the odd permission issues on the Calendar.

Silent installs and MDT 2010

2011-07-20T10:57:00.005-04:00

The initial rollout of MDT was well received by the rest of my IT department but as with all things the new toy eventually led to new requests for changes. At the top of the list was to make the application installs silent or hands-free. It didn't take long to discover that there was no silver bullet to fix that problem. There are multiple installer programs, differences between .msi implementations, secret flags, and in some cases a matter of hunting down hidden alternate downloads of application installers. In this post I'm going to describe how I streamlined my testing and at the bottom I'll list all the install flags that I'm using currently.

The first you'll need a good testing platform. I recommend either a Hyper-V or VMWare VM so you can just do snapshots and then restore the state back after each test.

Next you'll want to create a Custom Task in MDT 2010 that will just run 1 application. You'll be able to manually run this task from your virtual machine while inside windows. Otherwise you'd have wait for the whole OS install, etc each time you want to test a new command line syntax. To get to the Task you just go to your deployment share, Scripts folder and run litetouch.vbs.

"\\yourservername\deployment$\Scripts\LiteTouch.vbs"

Third, go to www.appdeploy.com and search their knowledgebage for your application. Their package knowledgebase has a good user contribution database made from the blood, sweat, and tears of your colleagues in the field. Take for instance Adobe Reader X. The package KB article is linked here: http://www.appdeploy.com/packages/detail.asp?id=1976

Once there, click the Command Line section and you'll see what options you have for non-interactive or silent installs. There are multiple entries for most of them as the method sometimes changes with newer versions of the software or some users just like different options to be selected instead. If you make good use of virtual machine snapshots you'll save yourself tons of time testing these out.

WHENEVER possible, use the noreboot or suppress reboot. MDT hates it when apps reboot by themselves. Just set the reboot flag under the application properties in MDT instead.

For some applications you'll have to download special versions of the installer and for others you may have to do an msi extraction first. Below you'll find my list of applications that I use and what flags work for me.

7-zip 64 bit

msiexec /i 7z465-x64.msi /quiet

windirstat

windirstat1_1_2_setup.exe /S

CutePDF (made a batch file)

ECHO Installing converter

converter.exe /auto

ECHO Installing cutepdf

cutewriter.exe /silent

Malware Bytes

mbam-setup.exe /SP- /SILENT /NOCANCEL

Symantec Endpoint protection 11.0.6

Just create a self-installing image using the Centralized admin console

Microsoft Windows Live Messenger

WLSetup-web.exe /q /NOToolbarCEIP /NOhomepage /Nolaunch /nosearch /AppSelect:Photo,Mail,Messenger

Microsoft .net 4.0 framework

dotNetFx40_Full_x86_x64.exe /passive /norestart

Microsoft Office 2007/2010

Just use the customization tool - http://technet.microsoft.com/en-us/library/cc179097.aspx

Adobe Acrobat X Reader

AdbeRdr1000_en_US.exe /sAll /msi /norestart ALLUSERS=1 EULA_ACCEPT=YES

VMWare Player 3.0

msiexec /i "vmware player.msi" REBOOT=ReallySuppress DESKTOP_SHORTCUT=0 QUICKLAUNCH_SHORTCUT=0 /qn

Microsoft Visual Studio 2010 (recommend doing an application bundle with SP1)

setup\setup.exe /q /norestart

Microsoft Visual Studio 2010 SP1 (recommend doing an application bundle with SP1)

setup /q /norestart

Roxio Creator 10.3

setup.exe /qn Reboot=ReallySuppress

SQL Server 2008 R2

Let the GUI build out an unattended file for you.

http://mycodelog.com/2010/09/28/sqlsilent/

Then use this syntax:

setup /CONFIGURATIONFILE=CompanyInstallSettingsR2.ini /INDICATEPROGRESS /SAPWD="password"

Microsoft TMG 2010 Firewall Client

msiexec /i ms_fwc.msi SERVER_NAME_OR_IP=yourTMGServer ENABLE_AUTO_DETECT=1 REFRESH_WEB_PROXY=1 /qn /L*v c:\fwc_inst.log

SnagIT 9.x

Build out a batch file

snagit.exe USERNAME="INSERT USER NAME HERE" TSC_SOFTWARE_KEY="INSERT KEY HERE" TSC_LICENSEMODE="Full" /quiet

That's all folks! Good luck.

Lync 2010 SIPPROXY_E_CONNECTION_EXTERNAL_INTERNET_ACCESS_DISABLED

2011-06-21T07:40:00.002-04:00

So after following 3 guides and one book I can now connect to my Lync 2010 server remotely through TMG 2010. The nifty error in the title there was rather fun to get rid of. You'd think that just toggling a setting that says enable remote user access would be the end of it. The final hitch that got me was that all the guides I found for setting up an Edge server have you export/import the configuration BEFORE you assign a global access policy and the Access Edge Configuration. I just assumed that once they'd partnered up, all updates would just magically sync by themselves. I found out through trial and error that if you make changes after you've deployed your Edge server then you need to go back in and re-import the configuration. Here's how to sync them up again:

1. Export out the current configuration from your internal Lync 2010 server.

Export-CsConfiguration -filename c:\temp\yourfilename.zip

2. Import the current configuration onto your Edge server using that file.

Import-CsConfiguration -filename c:\temp\yourfilename.zip -LocalStore

TMG 2010, android 3.0, and the google market

2011-06-09T11:34:00.004-04:00

Now this one was driving me up the wall. One of our users has a new Iconia Tablet and wasn't able to use the Android market at all while behind my firewall but worked fine everywhere else. I did a trace with TMG and there were no errors, all outgoing connections looked fine. So I went ahead and threw on Network Monitor onto the firewall so I could see where it was going. I noticed that 74.125.227.4 kept popping up which resolves to android.clients.google.com. I added that to the Web Browser tab for the proxy and then let the settings kick in and it fixed the problem. So I'm guessing that there's some issue with the TMG proxy and the google market.

Addendum - 6/15/11

Well, that didn't fully knock it out of the park. Apparently it also tries an outbound TCP 5228 which I also had to add to the protocol list for my users.

http://www.google.com/support/forum/p/Android%20Market/thread?tid=011f8c3c93e8953b&hl=en

Powershell script to change UPN suffix of an existing user

2011-05-25T11:05:00.004-04:00

One of the things that I really hate about using UPN suffixes in Active Directory is that it doesn't sort the list Alphabetically. So if you've got a server with say 50 UPN suffixes you have to scroll through all of them. So here's a script my colleague wrote to do a quick changeover. (Watch out for wrapped text if you copy and paste this out. Some of the write host commands are too long for blogspot.)

#####################################################################

# Script to change UPN of an AD User

# Co-authored by Gnawgnu

# Last edited 5/25/11

####################################################################

Import-Module ActiveDirectory

Function ChangeUPN ($samName2, $upnName2) {

#test for existence

$samDead = get-aduser $samName2

if(!$samDead) {

write-Host "Account not found"

} else {

$fullupn = $samName2 + "@" + $upnName2

write-host ""

write-host "Changing to $fullupn now" -foregroundcolor green

write-host ""

set-ADUser $samName2 -userprincipalname $fullupn

}

if ($Args.Count -lt 2) {

write-host ""

write-host "=================== You Failed ===================" -foregroundcolor red

write-host ""

write-host "Enter in user logon name AND and email suffix" -foregroundcolor red

write-host ""

write-host " Example: ChangeUPN.ps1 myusername test.local" -foregroundcolor yellow

write-host " Do NOT include the @ symbol" -foregroundcolor yellow

write-host ""

write-host "Try again" -foregroundcolor red

write-host ""

} else {

$samName = $Args[0]

$upnName = $Args[1]

write-host "Congrats on following directions"

write-host ""

write-host "Changing UPN for user $samName to be $upnName" -foregroundcolor green

write-host ""

write-host "Please allow up to 5 minutes for AD to refresh"

ChangeUPN $samName $upnName

}

monad.exe backup exec 2010 and failed exchange GRT backups

2011-03-15T18:39:00.002-04:00

I got this one from a colleague this week who'd been struggling with a backup exec issue. GRT enabled exchange backups suddenly stopped working and the event logs on the exchange server kept showing a monad.exe 13.0.4164.0 failure followed by beremote crashing. Symantec released a hotfix this week that appears to fix it:

http://www.symantec.com/business/support/index?page=content&id=TECH148347

Dell WebCam and WebEx problem

2011-02-17T08:04:00.002-05:00

I recently had fun trying to get the integrated Dell WebCam on an E6410 to work with WebEx. Turns out that by default the software runs in Capture mode. At the bottom right if you change the drop down to IM mode, then WebEx can use the camera.

How to Set Up AD FS 2.0 to SSO to Salesforce using SAML 2.0

2011-02-14T07:59:00.024-05:00

Project:

Set up Microsoft AD FS 2.0 on my Windows 2008 R2 Active Directory to allow my users to authenticate to Salesforce.com using their domain accounts using SAML 2.0. We'll be using Federated Authentication and not delegated authentication which requires you to code your own web service.

Introduction:

On paper, Single Sign-On (SSO) looks fairly simple and very logical and can lull you into a false sense of confidence. In practice, it requires a lot of planning, preparation, and some knowledge of sessions, authentication infrastructure, packet capture, encryption, and sometimes alcohol. If you're more of an administrator and less of a programmer, you'll also notice how closely the lines between the two are blurred when you work with these products. There's a lot of articles out there on using several 3rd party IDPs to SSO to the force.com suite but I had trouble finding stuff for AD FS 2.0

Prerequisites:

A working Active Directory, preferably 2008 or higher.

A server or virtual machine that can run AD FS 2.0, preferably 2008 or higher and joined to your domain.

An active Salesforce.com account. They do recommend using a developer account for the initial setup and testing of SSO.

A valid SSL certificate that's trusted on the Internet. I use a wildcard certificate personally.

A DNS host record for your new AD FS. For this tutorial, I'm using samlportal.example.com

If you're using a firewall (which you should) between your AD FS and the internet, then you'll need to publish inbound SSL to it. Preferably with no authentication required.

If you want to set up a AD FS Proxy in a DMZ, then a second server or virtual machine will be required. For that, you'll need port 443 open from the proxy AD FS to the internal AD FS and 443 open from the internet to your proxy AD FS. The proxy server does NOT have to be domain joined.

Federation Service Name notes:

Try to avoid using your internal DNS AD name, and do not name it the same as the server's host name. You really want this name to be unique. This name will also have to be resolvable on the Internet since you'll need an A record for it and an SSL certificate.

Setup:

First download AD FS 2.0 to your server.

Install the IIS role on your server.

Add your SSL certificate to IIS (IIS manager under Server Certificates) and bind it to 443.

Test the server to make sure SSL is working.

Only AFTER you have the SSL settings right, then proceed to install AD FS 2.0

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=118c3588-9070-426a-b655-6cec0a92c10b&displaylang=en

Install AD FS 2.0 and choose the "Federation Server" option.

Then run the AD FS 2.0 Federation Server Configuration Wizard to Create a new Federation Service.

Now you have a decision point, if you've only got a handful of users you can just do a stand-alone install. If you plan on having hundreds to thousands of users on this, then you can set up a Farm which will allow you to have multiple servers. Note: This option uses Windows Internal database (aka SQL express effectively). If you want to utilize an existing SQL DB server, you have to install using the command line.

Next the installer will detect your SSL certificate. If it doesn't, something's wrong with your IIS configurations.

Click Next

It'll install now and give you a list of success/failures. Warnings are generally not a problem and often occur if you're reinstalling AD FS.

If you get an SPN registration error, you'll have to update it manually from the command line. Substitute the following using your federation id and the account you're running AD FS as a service under.

setspn -S host//samlportal.example.com ADFSserviceAcctName

After that's done, go into the AD FS 2.0 console, click Service, right click on Service and choose Edit Federation Service Properties.

Confirm that the Federation Service name, etc all match what you have on your DNS A record and your SSL certificate. Copy down your Federation Service Identifier.

Then go under Certificates and Export a copy of your Token-signing certificate. Now we'll jump over to Salesforce as we can't proceed without data from them.

Next go into your salesforce account, then Setup, then on the left Security Controls, then Single Sign-On settings. This next bit of configuration came from a forum post from "Da G Man" on the thread: http://social.msdn.microsoft.com/Forums/en/Geneva/thread/2fc66b27-966c-49e5-891e-6e7e404e001d (Yeah, forums are great).

Choose Edit, then change the SAML drop down to 2.0.

For the Issuer, enter in your Federation Service Identifier. In this example, it was http://samlportal.example.com/adfs/services/trust

And yes, that is http and not https. And it is CASE-Senstive.

Choose User ID Type: Assertion contains User's salesforce.com username

Choose User ID Location: User ID is an Attribute element.

Enter Attribute Name: mail

Then click Save.

Now you can click on the Download Metadata button. Copy this file to your AD FS server.

Next on your AD FS server, go to Trust Relationships>Relying Party Trusts and add a new Relying Party Trust.

Under Data Source, choose Import data about the relying party from a file and choose your file that you downloaded from Salesforce.

Name it something. (This name will display on your user's login portal)

Choose the Permit all users option.

Click Next.

Click Finish.

Right-click on the relying party trust and choose Edit Claim Rules.

Name the claim something.

Choose Active Directory for the Attribute Store.

Choose E-mail Addresses for the LDAP Attribute and type in mail for the Outgoing claim Type.

Click OK, then OK.

Now make sure you have a user in salesforce whose username field matches the primary email address of a user in your active directory. Also make sure that this user is not an Administrator in Salesforce as by policy SSO supposedly doesn't work for those.

Now it's time to test. After much searching I figured out what URL I was supposed to use and I've provided it below:

https://samlportal.example.com/adfs/ls/IDPInitiatedSignOn.aspx

(yes, it is https and it has no bearing on your Federation service identifier being http)

The picture above is from a Microsoft doc on AD FS. http://download.microsoft.com/documents/France/Interop/2010/Using_ADFS2_0_For_Interoperable_SAML_2_0-Based_Federated_SSO.docx

At this point the IDPInitiatedSignOn page should have loaded. If it didn't, then you've got a configuration issue. Otherwise you should be at a page that gives you the option to either log on or log on and go to salesforce in one step.

So now you've (hopefully) got the IDP initiated sign on part working! At some point you'll notice that you're still able to log in with your old login and password if you go to the salesforce site directly. Apparently the only way to fix that is to first switch to using their My Domain feature.

Once you're provisioned your domain, then log off, then back on using your new domain URL which will be in the form of yourdomain.my.salesforce.com

After that's set up, if you go back into Single Sign-On Settings and enter in an Identity Provider Login URL and Save your site will now force all visitors to use Single Sign-On. Now the URL is tricky and I found one that works but I can't promise it's the 'correct' one but it works and that'll do for now.

https://samlportal.example.com/adfs/ls/IdpInitiatedSignOn.aspx?loginToRp=https://yourdomain.my.salesforce.com

The above URL is comprised of my my SSO provider's IDP signon page plus a '?" then loginToRp= and then your salesforce domain name.

For further troubleshooting you may want to install a header capture program like Fiddler to help you debug your setup.

Feel free to comment if you have any corrections or suggestions and I'll integrate them into this howto.

Additional Notes:

There's a fun bug in Firefox where it'll prompt you endlessly for credentials. Workaround is here:

http://social.technet.microsoft.com/wiki/contents/articles/ad-fs-2-0-continuously-prompted-for-credentials-when-using-firefox-3-6-3.aspx

If you want to provide the Identity Provider Logout URL you can use:

https://samlportal.example.com/adfs/ls/?wa=wsignout1.0 (yeah, it's a legacy method but seems to work)

Useful Links:

Good forum post that answers the my domain SSO question.

http://forums.sforce.com/t5/Security/SSO-Federated-Authentication-Help-needed/m-p/183606#M154

http://wiki.developerforce.com/index.php/Single_Sign-On_with_SAML_on_Force.com

https://login.salesforce.com/help/doc/en/sso_saml_login_history.htm

http://wiki.developerforce.com/index.php/How_to_Implement_Single_Sign-On_with_Force.com

Changing Federation Service Name.

http://social.technet.microsoft.com/wiki/contents/articles/ad-fs-2-0-how-to-change-the-federation-service-name.aspx

Powershell - search folder hierarchy for names matching a pattern from a file and copy them.

2011-02-13T17:47:00.004-05:00

So I had a request this week for a quick script that could search a folder structure for filenames for patterns that matched strings inside of a text file and then copy them to another folder. All the files had long complicated filenames so they needed an easy way to search through them. If it was *nix I'd just use Perl but since it was for Windows Powershell's the right way to go.

the text file contained strings like

00xy569e

TRs3002010

00xy589f

00xy589s

# Gnawgnu - 2/2011

# Searches filenames in a folder structure for

# patterns provided via text file

# Files to be Searched.

$srcFolder = "D:\filestobesearched"

# Destination of file copy.

$dest = "d:\CopyMatchesHere"

# List of patterns to look for.

$srcFile = "d:\matchlist.txt"

# Read in matchlist from text file.

$matchlist = Get-Content $srcFile

foreach ($match in $matchlist) {

$a = gci -r -i *$match* $srcFolder

foreach ($c in $a) {

# Change to move-item if needed

copy-item $c $dest

}

How to survive installing Exchange 2010 SP1

2011-01-29T21:04:00.002-05:00

In recent years Microsoft, in my opinion, has generally gotten better at putting out service packs that don't cause massive failures. So I was a bit surprised when I saw how many people were having problems with the latest Exchange 2010 service pack. I actually put it off for an extra month after reading some of the forum posts. But this week I revisited it and was able to deploy SP1 on my exchange servers without any hitches.

My usual process for getting ready for an upgrade is to read every forum and blog post about it I can find and to start looking for patterns of what people are running and where they're running into issues. The most useful site I used this time was:
http://msexchangeteam.com/archive/2010/09/01/456094.aspx
After all, no better place to start than a blog run by Microsoft Dev's.

I wasn't very pleased to find that only 1 of the pre-requisite patches I needed was a general release. The others were all what most of us would call beta or pre-release patches but MS swears up and down these have been fully testing and vetted. (Overall still not much comfort when you're installing them on your production servers.)
For my Windows 2008 R2 x64 servers I installed:
979099
982867
983440
981002
979744 - (watch out for an error that pops up for some people who have multiple iis bindings.)

And then I installed the Microsoft Filter Pack 2.0 which was recommended on another forum. Then I rebooted and took a backup of the server.

Then just prior to installing the patch, I stopped these services as recommended in this post:
http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/7c19d906-35ef-4053-bb64-f5a2cab4c008

Exchange Transport Service
System Attendant
Information Store

I also turned off my antivirus program and symantec spam filter.

I then extracted the SP1 patch and then ran setup on my CAS server as a user that had rights to update the domain schema and crossed my fingers. I was pleasantly surprised when it completed without any errors and tested it out to make sure it was working alright.

Then a couple of days later I went ahead and updated the Hub Transport/Mailbox server using the same procedure. So far everything's working fine. Next I'll work on converting my Managed Folder policies to the newer Retention Tag system.

Finally, an electronic switch hook for my plantronics/nortel ip phone.

2011-01-27T15:17:00.002-05:00

Since we started rolling out the Nortel IP 200x phones and now the Avaya 11xxe series phones the biggest complaint we've had from our users is that the HL10 lifter from Plantronics keeps falling off. Thankfully, Plantronics has recently released a series of USB EHS devices to integrate existing CS55 and CS70 headsets into our Avaya 1120e IP Phones.

My test configuration:
1. Avaya 1120e
2. APU-7 EHS Cable from Plantronics
3. CS70 headset

Tests:
1. Called into the IP Phone - confirmed that I received a ring warning through the headset
2. Pick up incoming phone call using button on headset - success
3. Turn on headset and get dial tone - success

Sadly, though, they missed one important feature with the new EHS cables - they didn't give us any way to hook up an online indicator light. On the old HL10 it was easy to hook one up but that feature got lost on this new device. Other than that this is a great new solution for us and I won't miss having to deal with all the wiring and points of failure that came with the HL10.

Cisco SLM2008 web managed and STP capable switch review

2011-01-20T15:23:00.004-05:00

So I've finally got a solution for my conference room switches. Every once in a while a bonehead user will plug both ends of a cable into the switch and take out a section of the network (STP convergence times heading toward infinity tend to have a detrimental effect on uptime). The larger switches all have Spanning Tree Protocol set up on them so they weren't really affected but I didn't have a cost effective solution for the smaller rooms that needed switches; and preferably the type that don't howl or cost a fortune. Enter in the Cisco Small business smart switch series:
SLM2008 - http://www.cisco.com/en/US/products/ps9996/index.html
They're compact, web-managed, support STP, VLANs, and the 8 port gigabit model only costs $100.

So after having set it up I had to test the bonehead maneuver! As much as the effort went against my better instincts, I took a cable and plugged it into ports 1 and 4. As you can see below, the switch detected the loop and blocked the ports out, thus preventing a cascade of pain to the nearest network closet.

And that's just one less vulnerable flank on my network...

Seagate GoFlex - testing USB 2.0 vs eSATA performance

2010-11-24T07:47:00.003-05:00

Recently I picked up some of the new Seagate FreeAgent GoFlex drives with the swappable interface dongles since we've had good luck with the previous generation of drives and we were interested in seeing if we could eek out a little bit more performance by changing interfaces for it. Running virtual machines off external hard drives is slow enough as it is so every 1MB/s you can get is a plus to me. My test platform was a Dell Latitude e6410 and a 500GB GoFlex drive with both the USB 2.0 and eSATA dongles.
First I tried out a few large file copies (500MB to 2GB) and noticed that windows was reporting a higher sustained rate for the USB2.0 but I also noticed a very long delay on the last 1-2% which I'm pretty sure was a cache delay. This delay at the end offset the perceived higher transfer rate that the USB transfer had shown. The eSATA transfers all went smoothly with no lag at the end at all. What can I say, I liked the honesty of the eSATA estimates better.
I then tried out some disk benchmarking tools like CrystalDiskMark (below) for further data and fortunately they all seemed to show the same significant advantage toward the eSATA:

Now I'm by no means an expert but I think eSATA will be the way to go for my Virtual Machines. At the very least the high sequential read/write should make the startup/shutdown for the VMs faster than they currently are under USB. So I shall sent out my little guinea pigs and wait for Murphy's law to kick in...

TMG 2010 and hyper-v guest issue with windows update 80072EE2

2010-10-20T07:47:00.003-04:00

I was trying to set up a temporary hyper-v server for demo/training purposes this week and ran into a windows update issue with a 2008 r2 guest on it. I turned on logging at my TMG server just to make sure the packets were getting out okay and then I noticed an odd error that popped up - 0xc0040018 FWX_E_BAD_LENGTH_PACKET_DROPPED - the packet was dropped because its IP length field does not fall within the allowed range or is inconsistent with the actual length.

So I tried looking that one up on the web and came up pretty dry other than the list of error codes from Technet. I decided to change gears and approach it from the other direction and went off in search of the windows update error code 80072EE2 which led me to this blog post:

http://msmvps.com/blogs/thenakedmvp/archive/2009/11/08/windows-update-error-80072ee2-hyper-v-guest-issues.aspx

And then it all clicked together. The offload settings weren't working right on the sub-standard hyper-v server I was using and the effect I was seeing on the firewall was incorrect packet lengths. As soon as I turned off the offload settings on the host server for that network card the windows update problems on the guest OS all went away.

My new favorite spare parts vendor for old Dell Poweredge Servers

2010-10-01T10:57:00.002-04:00

(Yes, this post is going to be a vendor plug as you should deduce from the title.)

We all have them lurking in our data centers, those old servers that you just can't seem to kick the users off of and retire gracefully. Inevitably, that server will suffer a hardware failure and if it's a Dell and more than 3 years old the chances are that after a half hour on the phone bouncing around they'll finally just admit that they don't have the part and have no idea when it'll ever be in stock again. Oh, but if it ever did magically appear it'll cost $800.

While digging through the forums I noticed another user had recommended Velocity TechSolutions http://www.velocitytechsolutions.com/ I'm always a little skeptical of new sites but being in a pinch I wasn't going to be picky. After a quick search through the site I found the parts kit that I needed for $99. I went ahead and ordered it with overnight shipping and had a fedex tracking confirmation within a few hours and the parts were here the next morning. Overall I've got a good first impression of them.

The Microsoft IT Site Delete Capture Feature 1.0 that wouldn't die

2010-09-13T22:39:00.005-04:00

So merely a day after the marathon weekend of getting my MSSX 2008 (wss 3.0 sp2) instance up to Sharepoint 2010 Server, an old add-on came back to haunt me. The Microsoft IT Site Delete Capture Feature 1.0 (MS.IT.SiteDeleteCapture) whose installation was long ago lost in a fiery server crash and whose features had long been disabled. Additionally, the install files for it have long disappeared from the face of the earth as all the links to it are dead. http://technet.microsoft.com/en-us/library/cc706867%28office.12%29.aspx (Thanks codeplex for ditching the old junk! LOL). What really makes it great is that it never came up as an issue in the preupgradecheck report.

Anyway I had a user report that they couldn't delete a subsite. Lo and behold the user was right. I used the trusty ULS viewer to decode the wonderfully cryptic Microsoft Correlation ID and discovered the culprit.

It is experiences like these that have converted me over to the philosophy of NEVER installing any third party addons to a sharepoint/wss/mssx install that didn't come out of the DVD or from the Microsoft update site. Or at the very least, plan on leaving there long before the next major upgrade.

So I ran my old favorite utility: http://featureadmin.codeplex.com/ (awesome utility btw). But it didn't show up there. I tried a few more tools and came to the conclusion that as far as sharepoint was concerned, it wasn't installed which meant that I had some phantom Event Hook of some type lingering around. At this point my two remaining choices were A) Open up a Microsoft PSS ticket or B) Roll the dice and try something crafty and stupid.

My plan B was to just plop on the newer version of the IT site capture following the age old wisdom of the best way to cure a hangover (more alcohol btw if you missed the reference). I found it at the redirected link for the old product under the new auspicious title of Sharepoint Governance. My theory was that it was the successor to the old product, and it would probably Event hook in a similar way, that it was worth a shot. Worst case scenario it would just be one more thing for them to fix for me if I wound up with PSS.

Cue the drum roll....

And we're back in business. And yes, as a sanity check I did check and see to make sure the site was gone and I also created a new site and deleted it as well. So far so good!

2008 multi-homed dns server failing simple query but otherwise works fine

2010-09-05T23:51:00.003-04:00

So my dns server was working fine, resolved queries, updated records, etc. But for some reason it kept failing the built in "Simple Query" and "Recursive Query" tests. After much messing around I discovered that it was trying to query the first interface it found. In this case it was the interface that I had manually excluded from the list because I didn't want DNS listening on it. I wound up changing the binding order for the network interfaces to fix the problem. After swapping them around I restarted DNS and voila the built in Monitoring started showing 'Pass" instead of "Fail".

List of interfaces, notice the non-listening one shows up first.

Under Network and Sharing, Advanced Properties, change the bind order.
Restart DNS and try again.

SEP 11.0.6 disabled windows 7 firewall even though NTP was never installed

2010-08-27T11:24:00.005-04:00

So I had to help another admin out with a fun issue this week. He had just upgraded his management server to Symantec Endpoint 11.0.6 MR1 and pushed out new clients. He created separate groups for laptops, desktops, etc and separated off the machines he didn't want to install Network Threat Protection on into their own group. The problem was that even though NTP wasn't being installed, it was still disabling the windows firewall (windows 7 in this case) and of course the new security center locked out the ability to reactivate it.

The solution in this case was to turn Inheritence OFF for that group and then withdraw the Firewall policy from that group. After the policy updates it should release the old on Windows Firewall. I didn't have time to stick around for that so we forced the policy update from the client and rebooted the machines for good measure.

1. Uncheck "Inherit policies and settings from parent Group xyz"

2. Click Tasks to the right of "Firewall policy" and Withdraw the policy.

Everything seems to work right afterward. Aside from the inconvenience of having a non-inherited policy to deal with later on when you want to make changes.

In most cases I've found that NTP works a lot better than the older versions like 10.x had so you most likely won't ever need the contents of this post but just in case, have fun.

Installing Microsoft System Center Essentials 2010 without it failing

2010-07-20T18:53:00.003-04:00

Okay, this was irritating. I started with a brand new fresh Windows 2008 x64 R2 install with all windows updates and the IIS and Application Roles installed. I popped in the DVD for SCE 2010 and rolled along and then it failed. Tried a few more times to no avail. After digging through the forums I found the answer. I had to uncheck the Microsoft Update checkbox! WTF MS? That of all things slipped through QC testing? Afterward it installed fine...

Thanks go out to:
Melissa Poole - http://social.technet.microsoft.com/Forums/en/systemcenteressentials/thread/8c21bd9d-22d5-474a-92a2-f4e51fa2dd44

and Kieranbarnes
http://bloke.org/windows/problems-installing-system-center-essentials-2010/

How to empty a hidden outbox in owa full of junk when outlook doesn't show anything

2010-07-20T18:13:00.002-04:00

I have no idea why this happened and I have even less of a clue why they decided to Hide the Outbox folder in OWA 2010. Anyway I had a user whose outbox showed zero items and when we checked the server properties it said that they had 90MB of junk on there. Well, in the old days I'd go into OWA 2k7 and kill them that way. No such luck in OWA 2010.
So my workaround was to turn off the "Cached Mode" and then closed and reopened Outlook.

Now this will force it to look directly at the server and it'll show you the problem Outbox. Delete all the junk from there and wait about 1/2 hour for your server to catch up. Then empty out Deleted Items, kill the OST file, wait a few minutes and then close outlook. Turn Cached Mode back on and you should be back to normal now.

Converting VMWare server 2.0 images to hyper-V R2

2010-06-26T16:50:00.009-04:00

After several attempts with different combination of offline/online conversions, I've finally found a fairly consistent method of converting VMWare Server 2.0 images to Hyper-V R2 images. SCVMM R2 has native support for ESX servers but not the low end free Server 2.0 edition so it requires more effort to get that working.

Software used:

VMWare Server 2.0
Hyper-V R2
SCVMM 2008 R2

Conversion requirements:
Windows 2003 - must have SP2
Windows 2008 preferably at sp1
WinXP should be at SP2/SP3
Vista preferably at SP1
Win7 RTM is fine
Windows 2008 R2 RTM is fine

Step 1:
You must uninstall vmware tools! This has to be done while running the image
on a vmware product (i.e. server, workstation, player). Just go into Add/Remove programs and remove it from there. I can't stress enough how important it is to get this uninstalled before conversion.
Note: By doing this, the machine will lose it's static IP settings if one is set.

Step 2:
Copy image to SCVMM R2 library folder
Wait a few minutes for SCVMM to refresh the library.

Step 3:
From the library view in SCVMM, right click on the VM and choose Convert Virtual.
From there follow the wizard.

Step 4:
After conversion occurs, go into the settings for the image in the Hyper-V console and confirm that a network card has been assigned. If not, add one. The first time you boot you may find that some services fail because the network card hasn't been detected yet. This should go away on the next reboot after you add the network card.

Step 5:
Boot the new image. Log into it and install the Integration components if they are missing.

Step 6:
Test to make sure your newly converted image is working properly.

Optional Step 7:
Compact the newly created VHD disks. This can free up a lot of wasted space. If you started with Static sized disks, the conversion process will have converted them to Dynamic sized disks. In Hyper-V R2 they supposedly fixed a lot of performance differences for dynamic vs static so it should be fine.

Now you should be all done.

PHP - trimming off characters after the last slash in a URL

2010-06-03T09:29:00.005-04:00

I really don't like programming. But every once in a while you've got to break down and do it for special projects. Recently I had to write some PHP code for a specific situation where I needed to be able to take the current URL the script was running at, strip out the script name, strip out the last slash and the directory name that proceeded it. Effectively, I was simulating ../ on the path because security requirements were getting in the way of a script. I played around with rtrim(), dirname(), regular expressions, etc but just wasn't quite getting the result that I wanted. My script determines the current URL, explodes it into a string array spliced at each slash character, then builds the new URL in a loop. You can tweak the iterations of the loop for however many directory levels back you want to go.

<?php
# Using SCRIPT_NAME

$path = $_SERVER['SCRIPT_NAME'];
$path2 = "/";
$domain = $_SERVER['HTTP_HOST'];

#echo "current path: " .$path . "<br>";
$parts = explode("/",$path); // splice by slash

$i=1; // skip zero cuz it's empty
$endi = count($parts) - 2; // number of parts minus 2 hierarchy

while ($i < $endi) {
$path2 = $path2 . $parts[$i] . "/";
$i++;
}
$temp = 'http://' . $domain . $path2;
echo $temp;

?>

Example:
If you run the above code and your original URL was http://www.test.com/blue/test.php
the output would be http://www.test.com/

Exchange 2010 Powershell Script - Email owners of all email distribution groups

2010-05-03T18:57:00.002-04:00

Updated for exchange 2010. Enumerates all distribution groups, then emails the owner of each group a list of group members per distribution list.

# Enumerates a list of all members of all Distribution Lists
# in Exchange 2010.
# Script will then proceed to email each owner a list of all
# members of each group.
#
# Use PowerShell.exe -command
# ". 'D:\Program Files\Microsoft\Exchange Server\V14
#\bin\RemoteExchange.ps1';
# Connect-ExchangeServer -auto; path_to_your_script"
#
# Updated 5/02/10
# By: Gnawgnu

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010

#first get all distributionlists
$dl = get-distributiongroup

#then enumerate through them all and get all group members.
foreach ($group in $dl) {

#build group data
$groupName = "Group Name: " + $group.name
$groupAddr = "Email Address: " + $group.PrimarySMTPAddress
write-host $groupName -foregroundcolor Green
$dlgm = get-distributionGroupMember $group.name.ToString()

# grab the first owner from the multivalued property
$gOwner = get-user -Identity $group.ManagedBy[0]

#setup email - make sure to add to your whitelist for
#antispam if applicable.
$sender = "PickASMTPSenderEmailAddress"
write-host $sender
#get Email Address of group owner
$recipient = $gOwner.WindowsEmailAddress
write-host $recipient
$server = "YourSMTPServerGoesHere"
write-host $server
$subject = "Monthly Review required - Email Group: " + $group.Name.ToString()
write-host $subject
#Note: `r`n is a carriage return
$bText1 = "`r`nOwner:" + $gOwner.Name + "`r`n"
$bText2 = $groupAddr.ToString() + "`r`n"
$bText3 = "group members: `r`n"
$bText4 = $dlgm | fl Name | out-String
$bText5 = "Please use your Outlook Client to make changes if needed.`r`n"
$bText6 = "If you are no longer the manager of this group, blah.`r`n"

$body = $bText1 + $bText2 + $bText3 +$bText4 +$bText5 +$bText6
write-host $body.ToString()
$msg = new-object System.Net.Mail.MailMessage $sender, `
$recipient, $subject, $body

#send email
$client = new-object System.Net.Mail.SmtpClient $server
$client.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
$client.Send($msg)

}

Old post:
http://gnawgnu.blogspot.com/2008/03/exchange-2007-powershell-script-emails.html

Exchange 2010 - email list of all distribution groups, members, and owner

2010-05-03T15:29:00.007-04:00

I recently had to update a script that I used to use in exchange 2007 that no longer works in 2010. It's mainly due to powershell changes and a tricky issue with getting the owner field back out. Anyway, this script cycles through all your email distribution groups, then emails a list of all of them, the members of each, and the owner to the email distribution group. It's similar to an old script I had back in 3/08.

Updated Note: You can also use
# grab the first owner from the multivalued property
$gOwner = get-user -Identity $group.ManagedBy[0]
instead to get the group owner property and then just use that .Name property for string ouput.

# Enumerates all members of all Distribution Lists in Exchange 2010.
# Use PowerShell.exe -command ". 'D:\Program Files\Microsoft\Exchange
# Server\V14\bin\RemoteExchange.ps1'; Connect-ExchangeServer
#-auto; replacewithyourscriptfilenameandpath"
# Script will then proceed to email a list of all
# members of each group
# Updated 5/02/10
# By: Gnawgnu

# this part is new for 2010
Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010

#first get all distributionlists
$dl = get-distributiongroup

# initialize variables
$recipient = "PickARecipientEmailAddress"
$sender = "PickASMTPSenderEmailAddress"
$subject = "Monthly Summary of Email Groups"
$server = "YourSMTPServerGoesHere"
$gOwner = "blankstring"

#prepare and output file
$currDate = get-date
#path must exist
write-host "Email groups as of: " $currDate | out-file 'c:\temp\emailgroupmembers.txt'

#then enumerate through them all and get all group members.
foreach ($group in $dl) {

$groupName = "-------------" + "`r`n" + "Group Name: " + $group.name
write-host $groupName -foregroundcolor Green
# this part joins the results of that field into one string.
$gOwner = $group.ManagedBy | `
Select @{Name='Name';Expression={[string]::join(";", ($_.Name))}}
write-host "Owner: " $gOwner -foregroundcolor Green
$groupName | out-file -append 'c:\temp\emailgroupmembers.txt'
$group.ManagedBy.Name | out-file -append 'c:\temp\emailgroupmembers.txt'
$groupAddr = "Email Address: " + $group.PrimarySMTPAddress
$dlgm = get-distributionGroupMember $group.name.ToString()
$dlgm | fw | out-file -append 'c:\temp\emailgroupmembers.txt'

#Note: `r`n is a carriage return
$bText0 = "-------------" + "`r`n" + "Group Name: " + $group.Name
$bText1 = "`r`nOwner:" + $gOwner + "`r`n"
$bText2 = $groupAddr.ToString() + "`r`n"
$bText3 = "`r`n" + "group members: `r`n"
$bText4 = $dlgm | fl Name | out-String
$bTextFinal = $bText0 + $bText1 + $bText2 + $bText3 +$bText4

$body = $body + $bTextFinal
}

$msg = new-object System.Net.Mail.MailMessage $sender, $recipient, $subject, $body

#send email
$client = new-object System.Net.Mail.SmtpClient $server
$client.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
$client.Send($msg)

To call it from a batch file: (avoid long path names, spaces, etc)
PowerShell.exe -command ". 'D:\Program Files\Microsoft\Exchange Server\V14\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto; D:\Exch2010enum.ps1"

Activesync 0x85010014 after moving email mailbox from exchange 2007 to 2010

2010-04-22T07:57:00.004-04:00

It's always fun when you run into a problem that only affects one or two users out of a hundred. You can only imagine my joy when I discovered that only my account wasn't working with Exchange Activesync after I moved my mailbox from the old Exchange 2007 server to the new Exchange 2010 one. By the way, I highly recommend using Microsoft's "Exchange Remote Connectivity Analyzer" for externally testing your setup. It's a great diagnostic aid during upgrades and such.
I tested my mailbox against an old windows mobile 6.1 PDA and got the 0x85010014 error, then I used Microsoft's analyzer above and drilled down to "Attempting FolderSync command on ActiveSync session" where it was failing. Then after much searching on the web, I found the clue at http://social.technet.microsoft.com/Forums/en/exchange2010/thread/0cb489da-c490-42ea-91fe-19b8e4de8571 which basically said that Inheritance was turned off on my AD account.
That's when i remembered that during the upgrade I had seen a warning that said some objects in AD had inheritance turned off. I had searched different OUs, etc at that time and hadn't managed to find it. So I opened up ADUC (Active Directory Users and Computers), set the view to Advanced under View so I could see the Security Tab on objects. I checked the "Include inheritable permissions from this object's parent" checkbox and then right afterward I was able to use ActiveSync again.

Updated: I've also found that an attribute flag gets set called "AdminCount" that can also cause that checkbox to reappear. To get rid of it, go under Attributes in the advanced view and clear the AdminCount attribute. You can use a powershell script to find all these affected users and groups here: http://www.shariqsheikh.com/blog/index.php/200908/use-powershell-to-look-up-admincount-from-adminsdholder-and-sdprop/

PS: If the account is a member of a priveleged group, you may find this checkbox unchecks itself after a while. http://msmvps.com/blogs/ulfbsimonweidner/archive/2005/05/29/49659.aspx

Dell Latitude E6400 video artifact problem with the Intel GMA 4500MHD

2010-04-17T07:58:00.003-04:00

Ran into a weird video problem with a E6400 recently. I tried updating drivers, changing settings, and all the usual stuff but it would show up again within the first 15 minutes, give or take a few. So I decided to research into the video chipset itself and found that users on multiple laptop makes and models appeared to be suffering the same problem. See example below.

I found the solution on one of the lenovo forums http://forums.lenovo.com/t5/T400-T500-and-newer-T-series/T500-with-intel-gma-4500mhd-increase-system-video-memory/m-p/132267 (See post by dragon-fly). Apparently, there's an issue when there are a unmatched pair of different size memory modules. This particular laptop had a 4GB and 2GB in it so I swapped out the 2GB for a 4GB. And entertainingly enough, the problem went away right after that. It's been a few days now and the problem hasn't reappeared once yet.

Getting around the Windows 2003 P2V Hyper-V Migration via SCVMM blue screen problem

2010-04-15T14:20:00.002-04:00

Yeah I know that's one long winded title. Here's the scenario:
1. Used Microsoft System Center Virtual Machine Manager 2008 R2 to do a physical to virtual server conversion for one of my older Windows 2003 x64 servers.
2. Since it was an OEM OS, I had to buy another server license and do a Repair from a Win2k3 R2 CD1 since that's just about the only good way to get around that activation issue.
3. All attempts to boot the VM got me the dreaded Blue Screen with a 07B error code.

Solution:
1. Don't install the integration components during the migration. On the last step of the SCVMM physical to virtual wizard it has an option to View Script.
2. Add -SkipInstallVirtualizationGuestServices to the very last New-P2V command. Then run the "Windows powershell - virtual machine manager" shortcut from the start menu and paste in the script. If you started from an OEM installation, continue to step 3, otherwise jump to step 5.
3. Then after the conversion, boot the VM off a Win2k3 R2 CD1 ISO or real CD and hit Enter for the first screen, then R to repair once it finds the OS.
4. After that's done, install Service Pack 2 for windows 2003 as it's required for the integration components. Then reboot.
5. Install the Integration services but DO NOT REBOOT yet. Check the registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wdf01000
The Group Value should be WdfLoadGroup and NOT "Base" or else bad things will happen.
(Thanks to the guys at this thread: http://social.technet.microsoft.com/Forums/en/winserverhyperv/thread/8c65fc96-f961-41dd-bfa2-8caa852f20c7 )

Now your virtual machine should boot up normally.

iTap RDP and group policy

2010-04-07T15:25:00.003-04:00

A user recently complained that their iPad device wasn't able to RDP into their workstation. They were using iTap RDP (http://itap.mobi/itap-rdp) which seemed to work fine for old XP boxes and non-domain joined workstations. It would give a NLA error when it tried to connect even though this newest version does support NLA. I knew it had to be group policy related since it only affected domain joined PCs. I wound up having to unconfigure the policy "Always prompt for password upon connection" under Computer Configuration -> Policies -> Admin templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security. Then gpupdate on my domain controllers, then gpupdate on the host pc and rebooted it for good measure. Afterwards, then the iTap RDP client was able to work properly.

Dell Powerconnect 6224 slow vlan routing problem

2010-03-07T15:44:00.006-05:00

So I noticed that intra-vlan network performance had decreased significantly recently but the effects were sporadic. Wireshark traces showed a lot of traffic bleeding over from multiple vlans and file copy performance between vlans was a staggeringly low. I ran the a cable qualification device on all the links and tested the speed between each switch. Everything was fine as long as I didn't do an inter-vlan activity. So I knew then that the problem was in the 6224 which I use for my layer 3 switching between vlans. While trolling through forums, I noticed someone had recommended STP as a place to start in troubleshooting. I set my 'root' switches priority 8192 (lower is higher in priority) and all the issues disappeared within a few seconds.

As far as I can tell the Multiple STP operation mode was running into problems when a load was applied. Since all the other switches are by default set to 32768 by default, now I shouldn't have this problem again.

Shrew VPN replacement for Juniper/Watchguard on Windows 7 x64

2010-02-25T07:41:00.003-05:00

So I'd been waiting to see if anyone had managed to get the Juniper netscreen vpn client to work on windows 7 x64 and then I just gave up and decided to look for an alternate solution. I really didn't want to keep an XP box around just for the purpose of connecting to this one partner's site. So after digging around I found Shrew (http://www.shrew.net/home) which supports XP/Vista/7 in both 32 and 64 bit. And as an added bonus they have tutorial/howtos for setting it up to work with over a dozen vpn endpoint devices. So I sent the info for the Juniper SSG setup to our partner site and they generated a new client file for us.

Installation of the client went smoothly and it imported the client file with no problems.

How to disable SoftAP (aka Windows 7 Wireless Hosted Networks) via Group Policy

2010-02-22T09:02:00.004-05:00

Windows 7 comes with a nifty feature that allows it to function as a wireless hotspot. For home users and technical enthusiasts, it's a cool feature. For paranoid network admins like me that feature is a problem. You don't want users opening up wireless APs inside your building or if they're remote, functioning as conduits for outsiders to piggyback into your networks.

To disable this function via group policy, create a new group policy or modify and existing one and go to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Wireless Network (IEEE 802.11) Policies. right click on there and Create a new policy.

Now be careful what you select in here or else you'll wind up causing havoc for your wireless users.

Name your Wireless policy whatever you want, then go to the "Network Permissions" tab. Select the checkbox for "Don't allow hosted networks" and that will block the SoftAP feature.

Do not check the other boxes that I've marked in blue unless you want to lock down your users to only using your wireless APs (which will also block APs at airports, starbucks, etc). That "Only use group policy..." setting is bad news for your traveling employees.

Once these settings go into effect, the windows 7 clients may require a reboot or two before the changes kick in. These changes also will only work if they are using the default built in wlan client that comes with windows 7. (See checkbox setting on first tab of that policy window).

For more details on what these settings are:
http://msdn.microsoft.com/en-us/library/dd815243(VS.85).aspx

TFSWarehouse Event 3000 Failed to load adapter with SQL 2008 data tier

2010-02-03T13:48:00.003-05:00

So I had my nice, mostly stable TFS implementation consisting of a SQL 2005 SP3 data tier and a TFS 2008 SP1 (9.0.30729.1) Application tier. I decided to upgrade the Data Tier to SQL 2008 since I'll need it to be there when we upgrade this year to TFS 2010. I followed Bill Wang's blog post http://billwg.blogspot.com/2009/04/how-to-upgrade-tfs-data-tier-to-sql.html

Everything went fine except the warehouse stopped refreshing. In the Event Log on the Application Tier I had this error:

Event Type: Error
Event Source: TFS Warehouse
Event Category: None
Event ID: 3000
Date: 2/3/2010
Time: 1:13:47 PM
User: N/A
Computer: TFS1
Description:
TF53010: The following error has occurred in a Team Foundation component or extension:
Date (UTC): 2/3/2010 6:13:47 PM
Machine: TFS1
Application Domain: /LM/W3SVC/3/Root/Warehouse-3-129096944229185149
Assembly: Microsoft.TeamFoundation.Warehouse, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a; v2.0.50727
Process Details:
Process Name: w3wp
Process Id: 5444
Thread Id: 5576
Account name: PS_NT\TFSSERVICE

Detailed Message: Failed to load adapter Microsoft.TeamFoundation.Warehouse.CommonStructureAdapter. Exception Info: \n System.IO.FileNotFoundException: Could not load file or assembly 'Microsoft.AnalysisServices, Version=10.0.0.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91' or one of its dependencies. The system cannot find the file specified.

After much head-banging I realized that I hadn't upgraded the SQL Client Connectivity on the App Tier to 2008 to match. D'oh. After installing the SQL 2008 Connectivity and Management tools and rebooting, I went to the http://localhost:8080/Warehouse/v1.0/warehousecontroller.asmx and hit 'Run', then invoke to force the update. Then used the 'GetWarehouseStatus' to watch the Adapter running. Fixed.

Symantec Backup Exec 2010 first impressions

2010-02-03T08:02:00.003-05:00

Now it may be too early to say, but so far I'm actually impressed with BE 2010 (Trial edition of course). Normally I'm pretty skeptical about new releases but after a colleague of mine told me that it fixed his backup issues with a 2008 x64 R2 Hyper-V machine I decided to give it a look over. He had that dreaded "Snapshot provider error (0xE000FED1): A failure occurred querying the Writer status." error. I set up a couple of test x64 servers in the lab with copies of the real VMs and loaded up BE 2010 and set it for some Disk to Disk tests. While I did get some GRT related errors even though I wasn't using GRT at the time, it still backed up the server images themselves.
As far as installation goes, the UI continues to improve with each release and it's pretty straightforward. Upgrading an existing BE 12.5 install was a breeze. The remote installation process has undergone a major makeover and now makes it easier to roll out multiple agents with different options selected. And to boot, it lists all the previously rolled out agents in the console. The management console is a bit more refined looking and they've integrated a lot of new little icons into the selection windows.

They've also added a few new agents that will be interesting to try (as soon as I get the budget). The DeDuplication agent could be useful for reducing backup sizes and the new Exchange archiving agent has potential as well.

As always, I recommend fully testing out any new software product in a test environment prior to rolling it out into production...

backup exec 12.5 stall - e0008821

2009-12-09T07:33:00.004-05:00

So every once in a while one of my policy based disk to disk to tape backup jobs will just hang or stall forever. It's really nifty since it will go well beyond the auto-cancellation period - you know the ' stop job if it takes longer than x hours' checkbox. The first few times it happened I wound up having to restart the whole backup server to get the job to cancel since no amount of effort on the front end GUI would fix it. After reboot it would show the failed job with a generic error code of e0008821. I even tried restarting the server that the job status claimed it was working on at the time of the hang. After a few more tries it occurred to me that the job status was lying to me and that it may actually be trying to communicate with the next server on the backup list. So to the command prompt I went. The results of netstat -aon | more

show that the server is currently communicating with port 10000 on another server. The catch is that while the job status said it was working on server A, the netstat showed it was only talking to server B at the time. So I went to server B and restarted the backup Agent and my stalled job suddenly started proceeding again. Of course, this isn't a great long term fix but it's not unusual for backup agents to need a good kick start from time to time. It would be nice if it was better at auto-recovery...

Step by step creating a Shared Scope in Search Server 2008 and making it show up in the dropdown

2009-12-03T10:11:00.008-05:00

So you've got your Search Server 2008 installed and working but you now want to get creative and add scopes to limit results. Seems reasonable enough. If you just try creating a scope from one of your site collections you may find that it doesn't give you any results when you try to use it and you get a nifty error message as well like "scope in your query does not exist".

So instead, you need to create a Shared scope and then make a copy of that scope in your site collection for it to work.

1. First create the shared scope from the Central Admin. Note the mode=ssp at the end!
http://YourServerName:yourportnumber/_layouts/viewscopesssp.aspx?mode=ssp
Click on New Scope, fill in the options and OK out of it.

2. You'll now see a that says Empty - Add Rules. Click on that. Here's where you'll set the limit on what sources you want results returned for. In my case, I chose content and limited my scope to only the sites my sharepoint server.

The finished Shared Scope should look like this:

3. You may or may not see a message saying that it will update in X minutes. If you see that, wait X minutes before continuing.

4. Now that you have your Shared Scope, go into one of your sites that you want to add this drop down to. (Yes, this will need to be done for every site that you want to add this to). Click Site Actions, Site Settings and under Site Collection Administration you should see "Search Scopes". If you don't, then log in as someone with more rights. Once you get into it, you should see a screen that by default has "Search Dropdown", "Advanced", and "Unused". At this point you'd love to be able to just drag it over and be done but alas, we're not there yet.
5. Click on the drop down arrow next to your Shared Scope and choose "Make copy"

6. Then click on the drop down arrow next to your new copy and click on Edit Properties and Rules.

7. You'll notice that unlike the Shared Scope, you can actually check the boxes for "Search Dropdown" and "Advanced Search". Rename the scope to what you want to display, check the boxes, and then click OK.

8. Now you should see your new copied scope show up in the right categories. You may or may not see a message saying that it will update in X minutes. If you see that, wait X minutes before continuing.

9. Now if you go into your site and refresh the page, you should see your new drop down option in the search box. (If you've created a "SearchCenter" page, remember to edit the WebPart first to actually show the drop down box.) Test it out to make sure it's working.

10. Now rinse, lather, and repeat the same for all the sites that you want this scope added to.

Credit where credit's due:
Aboo Bolaky's page - http://www.bolaky.net/?tag=/msse Good clue for finding the mode=ssp starting point.

And a thanks to the countless blogs out there that I used to set up search server 2008 in the first place! (It only took me 5 tries, thank heaven for virtual machines and rollback!)

Search Server 2008, ISA 2006, AAM, and why All Sites wasn't showing up externally

2009-11-24T13:40:00.010-05:00

So I've had my WSS 3.0 SP2 site running for quite some time now and had all the publishing in place for ISA Server 2006 so my guys could get access to it remotely. I finally decided to try out Search Server 2008 Express which took a few tries to get installed correctly. (Thank heaven for virtual machines and snapshot rollback!). So now all my sites have an extra drop down under Search for "All Sites" and I now have a search center site collection for users to hit directly as well. Problem is, that it wasn't showing up externally and the search center site completely barfed for my external users.

At this point I was pretty sure AAM (Alternate Access Mapping) was involved but I just wasn't sure why Search was so special. It took a couple of hours but I figured it out. There's a ton of good websites out there that show you how to set up sharepoint and ISA server so I'm just going to focus on what I missed and skip the basics.

Mistakes:
1. I had never 'Extended' the Web Application. I only had a Default Zone Web Application.
2. My ISA publishing rule was using the Intranet Zone name for the server. Which means that all external users were being seen by the Sharepoint server as using the Intranet Zone even thought they were using the Internet address. (i.e. They typed in sharepoint.yourdomain.com and the ISA server sent on sharepoint.intranet.yourdomain.com). This was never a problem before search but it became one afterwards.

Warning: I am by no means an expert on Sharepoint, I just play one at work. The following comprises the most critical things I had to change to get mine to work. Always back up your systems before making changes to production environments.

So to fix it, I first went into Central Administration, Application Management and then "Create or Extend Web Application"

Then "Extend an Existing Web Application"

Then click the drop down for Web Application and make sure the right website is selected. Then fill in the port (in almost all cases its 80) and the Host Header (REQUIRED - since we'll be stacking onto the same Port as other Sites on the same server). I use Kerberos but if you haven't set up your SPNs then choose something else. Make sure to choose the Intranet zone (or whatever yours corresponds to)

Now either Restart IIS manually, or iisreset /noforce, or if you're bored reboot the whole server.
When it comes back you should be done. Test it from an external location.

For reference, here's my AAM settings (modified of course.) And I wouldn't worry if yours don't match exactly, sharepoint is just weird that way.

Note: If you had anything published on the original Default site, you'll need to duplicate it into the new Host Header site. i.e. /images or other static content, etc using the IIS Manager. It is, for all intents and purposes, a completely different site.

Useful References:
Microsoft reference - at the bottom talks about Extending Web Applications
http://technet.microsoft.com/en-us/library/cc268368.aspx

Tutorial on publishing sharepoint through ISA
http://www.isaserver.org/tutorials/How-to-Publish-Microsoft-Sharepoint-Service-ISA-Server-2006.html

AAM
http://technet.microsoft.com/en-us/library/cc288609.aspx

More on extending
http://sharepointnotes.wordpress.com/2008/03/02/sharepoint-extranet-solutions-with-isa-server-2006-part-2-creating-the-extranet-web-application/

And more AAM
http://blogs.catapultsystems.com/matthew/archive/2008/05/19/search-results-and-aam.aspx

Why you can't find Hash Publication for BranchCache or Lanman Server under administrative templates.

2009-11-11T08:05:00.004-05:00

If, like me, you forgot to update your Central Policy store when you upgraded your AD to 2008 R2, then these won't show up at all.

First confirm that you are using a Central Policy store by opening up any group policy in Group Policy Management and look for the highlighted text.

Once confirmed, now go to \\FQDN\SYSVOL\FQDN\policies\PolicyDefinitions (replace FQDN) and look at the dates. Now compare those with c:\windows\PolicyDefinitions on one of your 2008 R2 AD controllers. If the 2008 R2 has newer files, copy all the contents of that PolicyDefinitions folder to the \\FQDN\SYSVOL\FQDN\policies\PolicyDefinitions, replacing all that's there currently.

Now if you close Group Policy Management, reopen it, and then go back into a policy you'll see new entries including the elusive "Lanman Server" which contains the "Hash Publication for BranchCache" value that you're looking for.

The dreaded e00081d9 The Backup Exec job engine system service is not responding error

2009-11-08T08:29:00.003-05:00

It's odd that every time I get backup exec 12.5 SP2 to a nice stable point something inevitably goes wrong. I suddenly started getting this error when the other half of my two backup jobs would run. I tried deleting/re-creating the jobs from policy, liveupdate, beutility- rebuild/repair/etc the db. Each time the backup job engine would puke and fail. Finally I gave up, made a copy of all the mdf and ldf files in the backup exec/data folder and uninstalled the program. And wiped out the whole backup exec folder for good measure. Then I re-installed it, liveupdated it, and then stopped the backup exec and sql services so I could re-swap out the mdf/ldf files. This restored all my jobs/policies/preferences/etc so I wouldn't have to start from scratch. But I still ran into the problem so I ran a manual backup job and it worked so I went ahead and deleted the whole Policy and selection list and made a new one from scratch.

After sleeping on it, it occurred to me that I had made one other change to one of the servers that gets backed up. This other server had died this week and since I only cared about the static files on it I had done a full rebuild of the server including upgrading the OS from 2k3 to 2k8 server. I kept the same name, folder names, etc and installed the beremote agent on it. In retrospect, I think after doing that I should have wiped out the .idr file that automatically gets generated at C:\Program Files\Symantec\Backup Exec\idr\Data. The more I think about it, the more likely it is that by changing the whole OS/setup of a previously snapped IDR box, I had confused the job engine to the point of failure. Of course, for now it's only a theory.

SQL 2008 Transactional Replication and initializing from a backup file

2009-11-05T08:00:00.011-05:00

Now there's a fun process to go through, especially if like me you don't know jack about T-SQL. Let's face it, I currently know more words in Mandarin than I know commands in T-SQL; which isn't a lot. Having already done several tests with the automatic method of setting up Transactional Replication (where it does all the initial synch work for you and you just sit back and watch) I had assumed that Initializing from a backup would be a breeze. Famous last words.

There are some articles out there on the web but I found that most of them either assumed you knew more or just left out minor details. If, like me you're trying to set up replication of a huge database over a bandwidth limited connection or if you have some other reason that the initial setup has to be done from a backup file, then here's the walkthrough. By the way, I've only done the one-way Transactional Replication as in my situation this is just a failover site and will not need to send changes back to the original server.

Steps (order is very important)

Set up the Distributer – database and share – one time setup
Set up Publisher on source server - Don’t use either checkbox for snapshot.
Enable the flag under the Publication properties to allow “initialize from backup”. (Right-click on the publication, properties)
Disable the distribution cleanup agents. (Under SQL agent jobs)
Make a Full backup of the database. Keep a local copy as you'll need it later.
Copy database to other site. (Over the network, courier pigeon, magic, whatever)
Restore database with the same name
Create pull subscription on the destination server. (see scripts provided below)
Check status – Replication monitor -> drill down to publisher (add if needed), “View details on the subscription on the right to get a status report (3rd tab in window that pops up)
After it’s done synching up, turn off the “initialize from backup” flag or else the cache it keeps will never shrink. And re-enable the distribution cleanup agents.
TEST IT. Check the tables after synchronization and then check again after new transactions have been sent. (Wait a few minutes after each replication interval to give it time to catch up).

The reason that order is so important is that after you configure the publisher to enable the "Initialize from backup" and stop the cleanup jobs, it starts keeping a full record of all transactions that have occured since then. (Yes, the DB could grow a lot depending on how long this takes). The backup has a special value in it called an LSN number. This value tells the server to only send transactions that occurred after the backup was made.
Reference:
http://www.replicationanswers.com/NoSyncOn2005.asp

TIP 1: If you try to use a backup that was created before the publication was set up, it will fail.
TIP 2: If you get the Msg 21397 error mentioned in the link above, then you probably forgot to stop the Distribution cleanup agents and the server has thrown out some of the transactions that have occurred since the LSN (backup).

Step 10 is necessary because the distributor will keep waiting around for another subscriber and in the meanwhile your ms_replcommands table will continue to grow.
http://ilkirk.com/archive/2009/01/a-replication-fun-fact/

Now we'll move on to the actual subscription scripts that you will run around step 8. (I'll assume that you set up the Publication through the GUI keeping in mind not to create a snapshot). If you don't know how to create the publication, see the help file or http://msdn.microsoft.com/en-us/library/ms151160.aspx

On the Publishing server we're going to use sp_addsubscription to define the initial subscription, then we'll run sp_addpullsubscription and sp_addpullsubscription_agent on the Subscriber machine. I created the subscriber scripts by using the GUI and choosing the export to script option at the end instead of executing the change. Then I modified the subscriber scripts and that's how I recommend that you set them up. My generalized scripts below should just be used as a guide.

Script 1: (Yes, the exec line is really long. Run on publisher)

-----BEGIN: Script to be run at Publisher 'Publishing_SQLServerName'------------
------- backupdevicename has to be located on the Publisher machine -------

use [Your_DB_Name]
exec sp_addsubscription @publication = N'Your_DB_Name_PUB', @subscriber = N'Subscribing_SQLServerName', @destination_db = N'Your_DB_Name', @sync_type = N'initialize with backup', @backupdevicetype = 'disk', @backupdevicename = 'e:\BACKUP\Your_DB_Name090209.bak', @subscription_type = N'pull', @update_mode = N'read only'
GO
-------END: Script to be run at Publisher 'Publishing_SQLServerName'-------------

Replace Your_DB_Name, Your_DB_Name_PUB, Subscribing_SQLServerName, and the location of the backup with appropriate values.

Script 2: (run at the subscriber sql server)

-----BEGIN: Script to be run at Subscriber 'Subscribing_SQLServerName'-----------------
use [Your_DB_Name]
exec sp_addpullsubscription @publisher = N'Publishing_SQLServerName', @publication = N'Your_DB_Name_PUB', @publisher_db = N'Your_DB_Name', @independent_agent = N'True', @subscription_type = N'pull', @description = N'', @update_mode = N'read only', @immediate_sync = 0
-----END: Script to be run at Subscriber 'Subscribing_SQLServerName'-----------------

Same drill as before with changing out the placeholders with actual names.

Script 3: (still on the subscriber). Now we're going to set up the agents which will handle the data pulls for us. (once again, a really long exec command)

-----BEGIN: Script to be run at Subscriber 'Subscribing_SQLServerName'-----------------
exec sp_addpullsubscription_agent @publisher = N'Publishing_SQLServerName', @publisher_db = N'Your_DB_Name', @publication = N'Your_DB_Name_PUB', @distributor = N'Publishing_SQLServerName', @distributor_security_mode = 0, @distributor_login = N'dist_login_acct', @distributor_password = N'dist_password', @enabled_for_syncmgr = N'False', @frequency_type = 64, @frequency_interval = 0, @frequency_relative_interval = 0, @frequency_recurrence_factor = 0, @frequency_subday = 0, @frequency_subday_interval = 0, @active_start_time_of_day = 0, @active_end_time_of_day = 235959, @active_start_date = 20090902, @active_end_date = 99991231, @alt_snapshot_folder = N'', @working_directory = N'', @use_ftp = N'False', @job_login = N'domain\username', @job_password =N'user_password', @publication_type = 0
GO
-----END: Script to be run at Subscriber 'Subscribing_SQLServerName'-----------------

If you went through the GUI you will have seen where it prompted you for user accounts. The windows account is needed to access the Distribution share on the publisher that houses the snapshots(if we were using them) and updates. Fortunately both machines were on the same domain so that was easy for me. For the distributor I created a SQL login on both servers with the same username/password and granted that user rights on the publishing server. This account is used by the agents on the subscriber to check the distribution database on the publisher.

Provided you didn't get any errors when you ran those scripts, you'll want to start monitoring the replication now. Right click on the Subscription and View Synchronization Status.

Now right-click in SQL Management Studio on Replication and Launch the Replication Monitor. Drill down to the publisher (add if it need be) and then drill down to the publication. Right click on the right panel and View Details. The window that pops up is really useful to see how replication is going.

What's great about that window is that you can watch the # of pending transactions that are waiting to be synch'd. Initially this will be a very big number until it catches up. At this point the only thing left are steps 10 and 11. Turn off the flag on the publisher for Initializing from backup and actually go into the database and replica to see if data is being transferred properly. (taking into account replication intervals, etc)

TIP 3: If you get this error: The distribution agent failed to create temporary files in C:\Program Files\Microsoft SQL Server\100\COM directory. System returned errorcode 5.
Then you need to grant the user that the Distribution Agent is running as Write access to that directory. http://support.microsoft.com/default.aspx/kb/956032

TIP 4: You may start getting errors in your DB related to "Length of LOB data". This occurs because by default it only supports chunks up to 65535. Go into SQL management Studio, right click on the server and choose properties. Set the Max Text Replication Size to something higher. Or do what I did and use the max value of 2147483647.

TIP 5: I found a good reference book that just focuses on SQL replication called "Pro SQL Server 2008 Replication" (ISBN13: 9781430218074). It explains in detail the mechanisms behind replication and covers all types of replication for SQL and how to choose the one that's right for you.

backup exec remote agent stuck in starting state

2009-10-18T15:52:00.002-04:00

Server: Windows 2003 SP2
Symantec Backup Exec 12.5 SP2

So after a recent security patch, one of my server's started having backup problems. Then I noticed that the Backup Exec Remote Agent was stuck in 'Starting' under the services panel. Tried killing beremote, rebooting, reinstalling, etc to no avail. So I tried the internet and found a retarted solution that somehow works. Apparently one of the outlook express patches automatically changes the default mail program to outlook express. So you have to go into internet options and set it to Outlook. Even if you don't have outlook installed. Even though this doesn't make a darn bit of sense. Then try starting the service after making that change.

http://www.symantec.com/connect/forums/backup-exec-remote-agent-stuck-quotstartingquot-state

XP remote desktop problem connecting to Windows 7

2009-10-15T14:54:00.003-04:00

Before you ask, it's not the Network Level Auth problem.
And no, the computer is on and in the same domain.
And both computers are in the same subnet.
But all the DHCP based XP clients can RDP fine to the Windows 7 boxes. Hmm.

The problem I ran into is that some of the legacy XP clients had static IP addresses set but no "DNS suffix for this connection". So I added it in and voila it stated working.

I didn't really think it'd be that either but I tested it out on 2 more machines with the same results. Apparently Windows 7/Win2k8 place more trust in "Location Awareness" rather than depending on checking if the IP is in the same subnet or if the computer's in the same domain, etc. It just wants to know that your client thinks it's in the same logical DNS structure that it's on.

Exchange 2007 SP2 install error 6574fdc2-40fc-405a-9554-22d1ce15686b

2009-10-11T18:23:00.004-04:00

Never a dull moment in Exchange administration...

While attempting to upgrade my existing Exchange 2007 SP1 Mailbox/Transport Hub server to Service Pack 2, I ran into the following error during the Mailbox portion:
Unable to remove product with code 6574fdc2-40fc-405a-9554-22d1ce15686b

So I started doing Google searches and found the same error used to occur during the SP1 install. With no other leads, I figured what the heck.
http://www.eggheadcafe.com/software/aspnet/31251935/exchange-2007-sp1-partial.aspx

1. I ran this from a command prompt:
MsiExec.exe /X {6574fdc2-40fc-405a-9554-22d1ce15686b}
to remove the Search Indexer
2. Reboot
3. Tried running the Service pack again and it ran all the way through this time without error.

So far so good.

Getting started with MDT 2010 and windows 7

2009-09-29T11:00:00.011-04:00

Microsoft recently released an updated version of their Deployment Toolkit - version 2010. As with all Microsoft products, the first few versions start out 'okay' and then by the 3rd or 4th version become a feature rich juggernaut. And we're only going to just scratch the surface today on this product.

Let's start by downloading the Toolkit: (Preferably one that matches your processor type)
http://www.microsoft.com/downloads/details.aspx?familyid=3bd8561f-77ac-4400-a0c1-fe871c461a89&displaylang=en

Other things to have ready:
Windows 7 Enterprise DVD or ISO (Ultimate will probably work but I haven't tried it).
A simple application DVD/ISO/folder for something like Office or acrobat reader.
A blank CD or a usb flash drive.

Once you have it downloaded, install it and then open the Deployment Workbench. From there go under Information Center, then Components.

This view will show you what components are already installed on your machine and gives you the option to download and install the rest. For now we need MSXML 6.0 and the WAIK installed. If you don't have them, click on each one and then click on Download (or Queue). The WAIK is over a GB so it may take a while! I know this gloss-over won't do this toolkit justice but feel free to look over the other optional downloads later on. Once you get to the point where both of those show up under 'Installed' then proceed.

If you take a peek under the "Getting Started" tab they've got a diagram which will either enlighten you or give you a migraine depending on your level of familiarity with using Microsoft Deployment tools.

Skip down to the Deployment Shares icon, right click it and choose to create a new Deployment Share. This deployment share is going to be the heart of the whole project. All applications, drivers, OS images, etc will go into subfolders of this folder and all your remote clients will be connecting to it to install from. For now just leave all the default names. Make sure the drive you place this on has at least 10GB for this example project. Now your console should look like this:

Now right click on Operating Systems and then "Import Operating System". Select "Full set of source files" and then point it to your Windows7 source files location. (DVD, a mounted ISO, folder, etc). Leave the name as is for default and just continue through.

Now right click on Applications and choose "New Application". The first radio button will copy over the whole source. The second will just take a UNC share name and that's what the client will connect to directly. Choose whichever you want for now and hit Next. Provide an application name like Office 2007 or something, then a source folder, and finally a command line. (If you are publishing an office program, try using the customization setup to get nice, silent installs).

Now we need to create a Task Sequence. Give it an ID like 1 or Test1, etc and a name. On the next screen choose "Standard Client Task Sequence". Choose an OS. Product Key is optional at this point. Organization name on the next screen. Default admin password, next. Finish it up.
These tasks are what you'll be prompted with later when you boot off the media that we're going to make.

You can also choose to add in Drivers to be injected at build time. It appears to be pretty much automatic once you add them.

Now right click on your MDT Deployment Share and choose (Update Deployment Share). This will generate new ISO's, etc. You should do this after any major change to make sure it's up to date. Now open Windows Explorer and go to your deployment share folder. Under it you will find a Boot folder which contains ISO's and WIM's for x86 and .64. I'm doing all x64 personally so I'm only using the LiteTouchPE_x64.iso. Burn this ISO to a CD or you can mount it and transfer it to a USB stick.

Quick note on how to do the USB stick method:
run diskpart from a command prompt.
run list disk to find out which one is your usb drive
select disk 1 (or whatever yours is)
clean
create partition primary
select partition 1
active
format fs=fat32
assign
exit
Then copy the contents of the mounted litetouch ISO file to the root of the USB drive.

xcopy :\*.* :\*.* /s /e /f

Now boot a computer off your shiny new image and eventually you'll see the Microsoft Solution Accelerator screen: (in case you're wondering, I'm using Hyper-V which makes capturing these images easier and testing much faster.)

Choose the first option and on the next screen provide a user/pass/domain so that the installation can connect to network shares, etc. Choose the Task we created on the next screen that pops up. Then by default it generates a random computer name, you can rename this as needed. Then you can tell it to auto-join the domain when it's done by providing the missing information in each of the fields. Skip past the USMT screen, choose a language, choose a time zone, check off the application(s) to install (You should see your application listed here).

On this next screen you can choose to have it automatically capture a reference image at the end for you. This is useful if you have a WDS server or if you want to import the completed image back into the MDT server later as a new base OS image. If you choose this option it'll automatically run Sysprep, reboot, and upload for you. For now you can just choose not to do it.

The next screen let's you set up BitLocker! Pretty snazzy.
And then the final screen has a "Begin" button.

Now it'll install the OS for you, then the application(s), and if you went with the capture, then sysprep and capture.

The install will reboot itself as needed, etc. At this point this tutorial is done. If you're feeling confident, I recommend playing around with manually editing Task Sequences to get a feel for just how customizable this system is. You can insert applications, insert reboots, schedule windows updates before and after application installs.

Symantec Endpoint Protection 11.0.5 released - finally some windows 7 support

2009-09-22T12:49:00.003-04:00

Now the last hurdle has been removed for the start of my Windows 7 deployments; lack of a working anti-virus. Endpoint 11.0.5 was released to gold/premium customers yesterday as see on the forums and today I found it on my multi-tier page at Fileconnect. So those of you with active maintenance/support contracts with Symantec should be able to download it now.

Supposedly this new version also has some nice improvements for group updates. Windows 2008 R2 is now fully supported. Release notes here:

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009072315130848

powershell script to kill process by name that's been running for more than x minutes

2009-09-09T15:43:00.002-04:00

If you ever have some badly written program that you have to use that leaves orphaned processes running in memory and you need to end them - but only the older ones then use this script. You only have change the name of the process and the number of minutes that it has to have been running for. (Note: It's a negative number from the current time).

##############################################
#
# Powershell script to kill off orphaned processes
# Free for any Use
#
# Script is not 'signed' so you either have to digitally sign it
# or run 'Set-ExecutionPolicy remotesigned' or 'Set-ExecutionPolicy
# Unrestricted' from Powershell at least once prior to using this script.
#
# Batch File syntax: powershell "& 'c:\foldername\killorphanproc.ps1'"
#
# To figure out the process name you can go into powershell and just
# run get-process by itself for a listing
#
# Script is provided 'As-Is' with no support.
#
##############################################

#Get list of processes matching the name and older than x minutes.
$orphanProcs = get-process | where {($_.Name -eq "winword") -and '
($_.StartTime -lt (get-date).addminutes(-30))}

#Check if list is Null and if not kill them all:
If ($orphanProcs) {
#display list
$orphanProcs
#kill list
$orphanProcs | foreach { $_.Kill() }
} Else {
echo "no processes found older than specified"
}

Windows 7 x64 and my old HP Laserjet 1100

2009-08-20T21:14:00.002-04:00

It's always depressing when you install the latest OS only to find that your old reliable peripheral just isn't listed anymore. I scanned down the HP list twice and even tried the HP website (which doesn't even have a Vista one since it was on the DVD). I couldn't even get it to accept the driver off the Vista x64 install DVD.

And then a ray of hope, I found a link to the Microsoft hardware update catalog. I did a search for my laserjet 1100 and it returned results that were listed for Windows 7.

http://catalog.update.microsoft.com/v7/site/Search.aspx?q=%22windows%207%20laserjet%201100

You just add the drivers you need to your basket (it's kinda like shopping but the drivers are free) and then you just view the basket and download your drivers.

One hitch, the filename was so long that winzip wasn't happy. So I just renamed the .cab file to something shorter and then I was able to extract the files. Then I just browsed to it with the "Have Disk..." option and voila. My printer works now.

Windows 2008 R2 backup exec and failure occurred accessing the Writer metadata - Workaround

2009-08-19T09:51:00.007-04:00

Updated 9/7/09

Nothing tramples the joy of playing with a new operating system faster than finding out that your vendor is being a deadbeat and hasn't put out a compatible release yet. You'd think that out of the army of programmers that Symantec has that they'd have at least one technet or msdn subscription and that they'd have started working out compatibility issues in the meager half year that the betas were available. I was also amused to find that on their forums some of their staff didn't realize that the RTM was out yet for Windows 7 and 2008 R2... But I digress.

So you're using Backup Exec 12.5 and trying to backup a Windows 2008 R2 RTM server using the Advanced Open File option and you get this error:

V-79-57344-65225 - AOFO: Initialization failure on: "\\MyServerName\System?State". Advanced Open File Option used: Microsoft Volume Shadow Copy Service (VSS).
Snapshot provider error (0xE000FEC9): A failure occurred accessing the Writer metadata

Option 1: Wait a month or so till a hotfix comes out.
Option 2: Wait until Backup Exec 2010 comes out with official support for R2.
Option 3: Fix the VSS issue that's causing it in the first place!

During the installation of Windows 2008 R2 RTM, it creates a Recovery Partition that's about 100MB. When the AOFO agent kicks in, it works with the VSS providers in the operating system to create snapshots. However, VSS really doesn't like those tiny partitions like the 100MB System Reserved (Recovery) partition. So at this point you have two choices.

A) Wipe the partition out. (Note, if you used Diskpart to setup the drive instead of the windows 2008 setup program, this won't exist anyway.)
B) Find a workaround for the VSS snapshot.

I didn't really want to do option A yet as I'm not fully sure if that'll have any impact down the line so I decided on option B.

UPDATE: Some of you reported success with just assigning the partition a drive letter. Try it and if it works for you, then don't bother with the vssadmin parts.

I got pretty familiar with the VSSADMIN command while working with Hyper-V and backups so I knew that it could be used to redirect VSS snapshots to larger partitions. The problem I ran into is that it didn't like the fact that the System Reserved partition didn't have a drive letter. So I did the quick fix and used Disk Management to assign it a random drive letter - in this case P:

Then a quick drop to a command prompt and run vssadmin list volumes

C:\Users\Administrator>vssadmin list volumes
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Volume path: P:\
Volume name: \\?\Volume{a2b716d3-8c1f-11de-a5ed-826d6f6e6973}\
Volume path: C:\
Volume name: \\?\Volume{a2b716d4-8c1f-11de-a5ed-826d6f6e6973}\
Volume path: D:\
Volume name: \\?\Volume{75c2418c-8c0e-11de-ae3c-001143dd2544}\

You'll note there's an entry for all your partitions. Now we set up a ShadowStorage for P:\ (100MB partition). ShadowStorage basically sets aside space on a volume to store snapshots of a volume. In this case I'm going to store snapshots of P: on D:

vssadmin add shadowstorage /For=P: /On=D: /MaxSize=1GB

And you have to put a MaxSize so I picked 1GB.

Now run vssadmin list shadowstorage to confirm the link has been set up.

C:\Users\Administrator>vssadmin list shadowstorage
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.

Shadow Copy Storage association
For volume: (P:)\\?\Volume{a2b716d3-8c1f-11de-a5ed-826d6f6e6973}\
Shadow Copy Storage volume: (D:)\\?\Volume{75b2419c-8c5e-11de-af3b-001143dd23
44}\
Used Shadow Copy Storage space: 0 B (0%)
Allocated Shadow Copy Storage space: 0 B (0%)
Maximum Shadow Copy Storage space: 1 GB (4%)

If you have any other volumes configured for Shadow Copies you'll also see them listed there. (i.e. If you enabled "Previous Versions" for a file share, etc)

At this point you're done. I was able to do a successful backup of the server with the AOFO (Advanced open file option) enabled after making this change. My backup seemed a bit slow but it is an older server so I can't be sure if speed was a machine issue or an R2/Symantec issue.

Windows 7 RTM, SQL 2008 dev edition x64 and invoke issues

2009-08-11T14:57:00.006-04:00

While installing Windows 7 x64 is a breeze, putting SQL 2008 developer edition on top wasn't. Upon my first attempt the application compability warning popped up saying to install SQL 2k8 SP1 afterwards. Which would be fine if the install didn't die right after that. Or if MSDN had a already slipstreamed SP1 version on the download site...

So, for round 2 I used "Procedure 1" of this KB:
http://support.microsoft.com/kb/955392
Which basically walked me through download/extract the SP1 file and trying to launch setup with the PCUSource flag.

Setup.exe /PCUSource=C:\SP1

This did allow me to progress further and then I wound up with this error:

Invoke or BeginInvoke cannot be called on a control until the window handle has been created

So I dug around ye olde web a bit more and tried installing the SQLSupport.msi from the extracted SP1 files. That didn't work or at least not by itself. Another forum suggested rebooting but that didn't do squat either.

Finally, I had to resort to using "Procedure 2: Creating a merged drop" from the KB listed above. This time we had success.

I was going to reapply SP1 after the install finished as a just in case, but the SP1 patcher told me the machine was already updated and wouldn't let me proceed. So we'll call it a day.

How not to get stuck at Precopy preparation during a Dell system build

2009-07-15T21:47:00.004-04:00

So I unpacked the mini cardboard crate that my new Dell Poweredge R700 came in and did the usual inventory (BTW, it's a sweet, sweet machine). I noticed that they hadn't shipped the usual Dell Openmanage CD pack and since I was going to do some testing, I kinda needed it to do some OS reloads. I went to the website and downloaded the two ISO files (1.9GB and 1.8GB) thinking they were two different DVDs. The nifty thing about ISO files is that you can split them up any way you want and your dvd burning software will burn DVDs for you no matter how broken the result may be.
Anyway, I popped in the first DVD and booted off of it and then choose the System Builds and Update Utility. Then went through and choose my 2008 x64, time zone, etc and told it to apply. Then it stopped dead 15% into it at Precopy preparation.

Then began the troubleshooting. Suffice it to say that it wasn't any of the usual things. So I went back to the website to look for an older version of the OpenManage DVD. While digging through, I noticed an interesting comment buried down under 'Additional Information'.

To address a browser limitation around downloading large files (see Microsoft KB article 298618: You cannot download files that are 2 GB or larger - http://support.microsoft.com/kb/298618), the Dell Systems Management Tools and Documentation DVD as a single ISO file is no longer available for web download. You can do one of the following to get the content:

1) If you recently bought a server, please use the DVD that shipped with your hardware.

2) Download the two ISO file segments to a new, empty folder and concatenate them. Create a single DVD image file using the following commands:
Windows: copy /b OM* OM_610_SMTD_A00.iso
Linux: cat OM* > OM_610_SMTD_A00.iso

CONCATENTATE. Yes, this critical piece of information was neither located under "Description" nor was it under "Important Information". Nay, it was located under "Additional Information" due to it not being important... Still at the end of the day it technically qualifies as a RTFM moment.

Imagine my surprise when I actually followed the instructions and then re-burned the DVD, my install worked correctly.

The unequivocal joy of sharepoint and one way trusted forests

2009-06-25T07:44:00.002-04:00

Sharepoint is one of those products that's great once it's installed and configured. The configuration of Sharepoint, however, remains a real pain...

Today's challenge was setting up a WSS 3.0 server in the testing lab. The testing lab has a separate AD forest that only has a one-way trust to the production forest. The requirement was to have the WSS 3.0 server be part of the LABTEST domain AND be able to add users from both PROD and LABTEST to the application. Now that seems simple enough since the server already sees both domains as evidenced by the logon drop down box showing both domains. However, as I found out that doesn't mean that the web app will see both as well...

Finding the right command to run was a relatively easy google search which sent me to technet. Getting the syntax right and figuring out how to use the command correctly, now that was the fun part. With the assistance of these two blogs I got it to work:

http://blogs.msdn.com/joelo/archive/2007/03/08/cross-forest-multi-forest-configuration-additional-info.aspx

http://blogs.msdn.com/sharepoint/archive/2006/03/15/552331.aspx

First, in several discussion groups I got differing answers over whether or not the Sharepoint Application Pool Identity needed to be set to "Network Service" or as a domain user account in the domain (in my case, the LAB domain). I used a domain user account myself but had to make changes to the DCOM because my pool wouldn't start. (Component Services - Computers -> My Computer -> COM+ Applications -> DCOM CONFIG -> IIS WAMREG -> Properties -> Security Tab -> Edit Launch and Activation and just give the domain user permissions).

Next it's time to go to a command prompt and go to C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN . Now don't do what I did and think that just because you don't have a full web farm that you can skip the first instruction

stsadm.exe -o setapppassword -password SomeRandomPassword

Literally, it doesn't matter what is set to, as long as it's the same on all your front end servers. Even one lonely standalone installation...

The second command is a bit on the long side. The full syntax I ran (names and passwords have been changed for security purposes).

stsadm.exe -o setproperty -url http://WSSVM1 -pn "peoplepicker-searchadforests" -pv "forest:AD.PROD.COM,TrustUser,3t9sz9$b20pz;forest:LAB.LOCAL;domain:AD.PROD.COM,TrustUser,3t9sz9$b20pz;domain:LAB.LOCAL"

Where AD.PROD.COM is the FQDN of my forest and root domain and LAB.LOCAL is the FQDN of the forest and root domain. (keep in mind LAB.LOCAL is the domain that the WSS server is joined to. You'll notice that I had to use a domain user account in the Trusted domain in order to be able to search it since it's only a 1 way trust. Also, while digging I found on one of the forums that you DO need to include the domain the server is joined to as well as the domain you want to add to the search. I'm not really sure if it's necessary to include both the forest: and domain: for each but it works this way so I'm sticking to this method.

On a related note, there's also an alternative way to set this up that involves setting up shadowed, non-login accounts in the resource domain that map to the real users in the production domain. It's a bit more than I needed for this project but you might find it useful.

http://blogs.msdn.com/sharepoint/archive/2006/03/15/552331.aspx

vmrun - the grown up pain in the b** replacement for vmware-cmd

2009-06-08T17:20:00.005-04:00

Back in the VMWare Server 1.x days stopping and starting up VMs from the command line was easy with 'vmware-cmd'. Now with Version 2.0 on my win2k3 boxes, I was forced to learn how to use the replacement - VMRUN.

I do understand that those who use the 'real' VMWARE products - ESX, vSphere, etc are quite used to using VMRUN. But if you're used to the old easy way and you're still stuck on the free versions, it's a bit tricky to get to work.

1. First off, you'll want to make sure your %PATH% variable is updated for the path to the vmrun command. ("C:\Program Files (x86)\VMware\VMware Server" on my x64 box)

2. Now open a command prompt and enter in vmrun list. This will show you a listing similar to this:

Total running VMs: 5
[standard] MYWEB2B/Win2k3R2STD_vmsrv2.0.vmx

where [standard] is the name of the default datastore in VMWare 2.x, MYWEB2B is the immediate folder under that in the file system, and then you have the filename. IT IS CASE SENSITIVE. The whole @#$% thing. If you mess that up, it will just tell you that "The virtual machine cannot be found".

3. Now that we know how to reference the vm files properly, now we need to specify the -T, -h, -u, and -p parameters. For some unknown reason, they don't appear to have a 'just run it as the server I'm sitting on and as the users I'm running this as' setting'.
Since you're using VMWare Server 2.0, you'll use -T server -h https://YourServerNameOrIP:8333/sdk (yes, it needs the sdk at the end)
and then provide a username/password (-u,-p) that is part of the administrators group on the host machine. (or if you've setup custom permissions in vmware, use one of those).

At this point, we should be able to construct this command to stop a VM gracefully:

vmrun -T server -h https://MyVMHostServer:8333/sdk -u vmadmin -p thepassword stop "[standard] MYWEB2B/Win2k3R2STD_vmsrv2.0.vmx" soft

You'll note that I introduced the 'stop' and 'soft' parameters. I'll give you three guesses what 'stop' does. The shutdown type option 'soft' will run the shutdown scripts for you for the VM to gracefully power it down. If you wanted to drop it uncleanly, just use 'hard' instead.

4. To Start it back up:
vmrun -T server -h https://MyVMHostServer:8333/sdk -u vmadmin -p thepassword start "[standard] MYWEB2B/Win2k3R2STD_vmsrv2.0.vmx"

Now combine this will some old style batch files and robocopy or xcopy and you've got a cheap way to make VM backups using Task Scheduler.

Note 1: Sometimes it just doesn't like netbios names.

Additional References:
VMRUN reference:
http://www.vmware.com/pdf/vix162_vmrun_command.pdf

Tips and Tricks for vmware server 2.0:
http://www.google.com/url?sa=t&source=web&ct=res&cd=1&url=http%3A%2F%2Fcommunities.vmware.com%2Fservlet%2FJiveServlet%2FpreviewBody%2F9394-102-2-6307%2FVMware%2520Server%25202.0%2520Tips%2520and%2520Tricks.pdf&ei=O4ItStbKI5WEtweRtM2vCA&rct=j&q=VMware+Server+2.0+Tips+and+Tricks.pdf&usg=AFQjCNH0ZvlIVPIrc8N_UQ64Y1efSoIO_Q

SoftOSD and Dell latitude laptops with the Nvidia chipset

2009-05-13T18:21:00.003-04:00

I haven't confirmed it yet (and you'll understand why after I explain it) but I was told that the Dell Client Manager agent that comes with the Dell Management Console was causing issues on some D620 units that had the Nvidia chipset. On those units the entire LCD stopped working and require Dell to replace the motherboard and LCD. While this series of laptop has been plagued by Nvidia related issues, I was assured that these units had been running fine for a few years already and the sheer quantity of them failing at the same time was unlikely. The current suspect is the SoftOSD component which gets installed as part of the Dell Client Manager Agent. I looked up this component and it appears to be directly related to video card/output manipulation which only adds to our suspicions.

Also, these units seemed to all have been docked for at least some of the time prior to their failure and caused odd resets on the external monitor.

While this hasn't been verified yet, I would recommend that you uninstall the SoftOSD component off any D620 with the Nvidia chipset until we know one way or another. I'm not exactly willing to offer up any of my D620's for testing sacrifice. :)

KB 968078 (MS09-016) broke RDP on my ISA 2006 server

2009-04-22T09:32:00.002-04:00

I really shouldn't be surprised since the last time I installed a hotfix for my ISA 2006 SP1 (win2k3 sp2 with all offloading, etc turned off) it broke RDP as well. I've already seen other forum hits on this now as well. I uninstalled it for now as being without RDP access to that server is not an option right now. Others have reported VPN problems and problems starting up standard edition with 4+ cpu cores. I'm not going to fool with it until I see a new patch come out or a resolution for this problem.

some other references to this issue:

http://forums.isaserver.org/m_2002085188/mpage_1/key_968078/tm.htm#2002085188

http://blogs.technet.com/isablog/archive/2009/04/18/ms09-012-and-isa-server-standard-edition-14109-failures.aspx

Symantec Mail Security for Exchange Named Piped Error updating license

2009-04-15T16:08:00.002-04:00

Yes, you read that right, "The Named Piped could not be found" and because of that misspelling, you won't find the answer on their knowledge base.

I was trying to Add my new updated license files through the management console for Symantec Mail Security for Exchange and I got that error. The real error should read named pipe instead of piped and that's how you'll find it in their KB. When you get this cool error, you'll also notice the checkbox for "Enable Premium Antispam" gets whacked and your users start complaining about spam.

http://service1.symantec.com/support/ent-gate.nsf/docid/2007072606354254

Basically they'll have you stop both the services and manually wipe out the existing license files that are there. Then restart the services and try to add them again. Fortunately, this actually worked for me. Make sure to re-enable the premium antispam checkbox if you have that service.

Dell Management Console - free as in beer

2009-04-08T17:38:00.015-04:00

So if you're like me and your budget this year doesn't seem to cover anything more than replacing machines that are on fire and burning to ashes and you happen to have a mostly or all Dell infrastructure, then the new DMC (Dell Management Console) may be for you. It's based on the Altiris Server platform and can help you with everything from hardware inventories to pushing bios updates and even individual bios settings such as enabling bitlocker support. It slices, it dices, and can even manage your dell kvms, network switches, etc. If you want to find out more, click the link below.

DMC:
http://www.dell.com/content/topics/global.aspx/sitelets/solutions/management/openmanage_console?c=us&cs=555&l=en&s=biz

Dell DMC FAQ:
http://en.community.dell.com/groups/dell_management_console/wiki/dmc-faq.aspx

When you're ready, just fill out the short registration on their website and get your two sets of license keys that you'll need for the install to activate the Dell Client Manager and the Dell Management Console. You'll also be provided with a link to download the ISO to install it.
http://www.dell.com/openmanage/register

First off you'll need a halfway decent box. Symantec/Altiris/Dell recommends a dual processor box with 4GB of RAM in it. It also has to be running some variant of Windows 2003 Server and it has to be a 32 bit version. To top it off, they also only current support IE7. A copy of SQL 2005 Express edition is included in the installer but the docs and the installer deem it necessary to remind you at every corner that the performance will be much better with a real copy of SQL server. You'll also need to have .net framework 3.5 installed. (I've currently got it running on a Octiplex 755 until I'm done testing.)

So next we're off to the install portion and the first opportunity to trip you up. One of the first things you'll notice in the screenshot below is that the Altiris Server product is listed in addition to the Dell components. If you check that it'll install an eval license and a bunch more junk that you don't really need.

Here's a screenshot if you had gone that route. You'll notice the boatload of Trial licenses. If you didn't choose that Altiris checkbox you should only seen 1 Trial one. (yeah, I don't know why either)

Prior to the screen above, you'll have been prompted for the license text files that you received earlier. It's pretty straightforward for the rest of the install; stuff like smtp server, user account to use, etc. As with all Symantec installers the pre-install checks will have some yellow warning triangles left. Since they're only warnings and not Errors you can proceed. (Don't get me wrong, their installer is nice but I just can't ever seem to get all the warnings to go away.)

So it's installed, what now? Well, if it didn't do it for you, you'll need to open an IE7 window to https://yourservername.withfullfqdn.domain/ (provided you set up SSL ahead of time. (see README on the CD). Depending on whether or not you've ever used Altiris you may find the number of options and menus Daunting. Let's cut to the chase and click on the Home icon, then Dell Client Manager.

On the left you'll see a Quick Start tree which will walk you through network discovery, pushing the Altiris Agent, Agent settings, and quite importantly the Dell hardware client which will run on the Agents and collect hardware data for you. There's also some tutorial videos buried inside somewhere but I figured out more stuff just by clicking around and using the online help. You also have to keep in mind that the DMC only uses a fraction of the Altiris Server's abilities so you may see references to functions that you don't have.

You'll also notice that most things are turned off by default which is good. The idea is that you configure and enable them as you need them. To turn them on, just click on the red button and change it to On and then the Save button at the bottom.

Provided you've made it past the agent installs, you'll soon see them show up in the dashboard. Below you'll see the 5 test machines in my environment listed.

Click on it and it'll open up a series of Reports that allow you to drill down into each machine. (double-click in some places)

And yes, I too suffer from a 2 to 4 second delay on each page load.

And as you can see it gives you quite a bit of information about the client machine. Sometimes it's useful to know things like video card models, bios version, etc prior to working on a desktop call.

I was also impressed with the granular control it provides over bios settings:

*note - while it does support bios passwords, it doesn't like passwords with special characters or spaces.

Well, that's all for today. I still have to play around with it a bit more to see what else it can do.

Notes:
1. The free DMC edition is what they call Standard edition. Which I'm under the impression means that there's a Pro version that has more bells and whistles for the right price.
2. I haven't played with any of their other recent IT openmanage products so I can't tell you how many of these features are new in comparison.

Word 2007 (winword.exe) won't open, no gui, process dies quickly

2009-03-11T13:40:00.002-04:00

So I had a user report that they were having problems opening any office programs. They weren't being shown a GUI and when I checked the Task Manager I could see the process flash up for a few seconds then die. Running winword /a manually had the same effect. So I started troubleshooting:

1. Logged on as a different user - worked fine
2. Rebuilt the user's profile - still not working
3. Tried removing various Office registry keys as suggested on some web sites. - no change
4. Reinstalled office 2007 completely - no change.
5. Started using brain, downloaded Process Monitor from the old sysinternals site.
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

I started the capture, tried to open word, then stopped the capture. I then set the Filter to show Process Name - winword.exe and then went down the list. And then noticed about a hundred errors related to opening this one registry key.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-632034446-1996701954-922709458-10172\Components

(Note: On your computer, the SID will be different). It had some weird file in it with rgb in the name so I backed up the key and then ripped out the SID entry completely. And then Voila, I was once again able to open office applications as that user.

Solved: ISA 2006 WSS 3.0 extranet password prompt for office docs

2009-02-19T08:08:00.005-05:00

So I finally got around to publishing our Windows Sharepoint Services 3.0 server through the ISA box. I set it up with Kerberos Delegation as to avoid any authentication issues and of course Forms Based Authentication. First thing I found out was that you do not want anything on the initial landing page that takes time to load such as a world clock/weather web part that has 4 countries in it. Let's just say ISA tacked on an extra 30 seconds to the load time of the page. Anyway, the next thing was getting All the Link translation mappings right like redirecting http to https for internally hardcoded links, netbios to dns, etc. (And all this on top of setting up Alternate Access Mappings (AAM) on the sharepoint server.
Then I noticed that Extranet users were getting prompted for authentication when they tried to open Office docs (.doc/.xls/.ppt). After much digging, I found the resolution on a message board.

http://www.tech-archive.net/Archive/ISA/microsoft.public.isa.publishing/2007-11/msg00005.html

"turn on persistent cookies (Web Listener | Forms | Advanced Form
Options)"

Entertainingly enough, when I went into the help for that setting it specifically lists that this setting is exactly for this Sharepoint problem! ARGH.

So I enabled mine for the 'only on private computers' and voila, the darn things works fine now.

*Caveat: They do warn you when you turn this on that it does create a cookie on the client machine that may contain sensitive data. Personally, if you fall into the following two scenarios I don't think that's a problem.
1.) You encrypt your laptop users' machines.
2.) You can't stand users whining about extra prompts.

Make sure that you pay attention to how long the Private and Public session timeouts since you're now using a persistent cookie.

Note: Some vista boxes may need a patch:
http://support.microsoft.com/kb/943280

The Syntax for set-outlookanywhere decrypted

2009-01-22T20:54:00.004-05:00

Exchange 2007, SP1 (not rtm)

Okay, I know I can be a bit slow on the uptake for some of these powershell commands but this one took way too long to get right. All the nice friendly examples from msdn leave out the Identity parameter. Powershell will be more than happy to barf an error back to you if you leave it out.
http://technet.microsoft.com/en-us/library/bb124149.aspx

Just what is this identity thing anyway? It's pretty much your CAS_Servername\rpc (Default Web Site)

So next you're asking why am I bothering since we've got a nice GUI, etc for setting up outlook anywhere and the permissions on the IIS folder /rpc. Well, through the careful string of failures at getting NTLM to work transparently through my ISA server (whilst still requiring rpc validation at the isa server itself), I determined that Basic authentication was good enough for me. But I still use NTLM for the web publishing rule from the ISA server to the exchange CAS server. With the advent of SP1 for exchange 2007, you can easily setup your server to use different combinations of Basic and NTLM for the Outlook Anywhere and RPC folders respectively. When your server generates AutoDiscover.xml it provides the client with the authentication level that is specified in the -ClientAuthentication Method. But if you want your ISA server to communicate with the exchange CAS with NTLM, then you have to set the -IISAuthentication parameter. (yeah, headaches abound). To see what your CAS server is using, run Get-OutlookAnywhere from powershell

ClientAuthenticationMethod : Basic
IISAuthenticationMethods : {Ntlm}

In summary:
1. My remote users have outlook 2007 sp1 and get autoconfigured to use Basic Auth.
2. My ISA server publishing rule uses NTLM for Authentication Delegation.
3. My rpc folder in IIS just has Integrated Auth checked.

For more information including how to setup an Exch 2007/ISA 2007/Outlook Anywhere/etc check out the following links:

Great tutorial by Thomas Shinder - covers everything from the setup of the exchange server, through the publishing in ISA all the way to the outlook client config:
http://www.isaserver.org/tutorials/Publishing-Exchange-2007-OWA-Exchange-ActiveSync-RPCHTTP-using-2006-ISA-Firewall-Part1.html

The ever reliable petri database:
http://www.petri.co.il/outlook_anywhere_2007_w_isa_server.htm

More info on the set-outlookanywhere syntax:
http://www.exchange-genie.com/2008/02/configuring-outlook-anywhere-for-exchange-2007-sp1/

Paper on setting up transparent authentication/NTLM with isa 2006 and exchange 2007. I did eventually get it to work in a test environment.
http://blog.msfirewall.org.uk/2008/07/publishing-exchange-2007-services-with.html

ISA 2006 Remote Desktop problem

2009-01-20T07:55:00.002-05:00

So up until recently I was able to remote desktop into my ISA 2006 server from my management desktop. I verified that my management computers were still defined properly and I confirmed that the packets were being received on port 3389 at the firewall side. I decided to remove the recently applied KB956570 (08-037) and voila my remote desktop started working again! The patch was supposed to randomize NAT connections, etc but apparently it likes to kill RDP. Upon further research, I've also seen reference to it causing havoc for PPTP/VPN setups as well. As I have not found a real fix for it, I'd recommend you just uninstall it from Add/Remove programs (make sure the checkbox is marked for Show Updates).

Dell Latitude E6400 sound problem fixed - and dvd burning one as well.

2009-01-13T20:09:00.010-05:00

*Updated - 4/17/09* New drivers from Intel as provided by Anonymous
http://downloadcenter.intel.com/Product_Filter.aspx?ProductID=2101

*Update* I tried out the DPC latency tool recommended by Martin. Here's a screen cap of how much the latency drops if you just physically remove the CD/DVD drive.
(the additional spike afterward was just me opening SnagIt). It's obscene.

Update 2: Please see Martin's post in the comments section below for additional remediation steps.

Update 3: The Dell tech recommended switching the SATA mode in BIOS from IRRT to AHCI. Of course, if you do that you've got to completely reload your Operating system. I tried it on a spare drive with a fresh install of Vista 32 bit and I haven't had the audio skip yet though I'm still loading more apps on it to test with. The latency was still high but didn't appear to affect audio playback which seemed odd.

Update 4: I Disabled the eSATA port under BIOS and the latency issue with the DVD drive plugged in went away. (For a whole reboot) This just keeps getting better.

Original post:
So I noticed that the E6400 was having weird audio glitches with Vista while under light loads. It was behaving like the hard drive was under heavy load and interrupting the data transfer. But all the resource monitors only showed minimal load. I ran into this problem with all mp3 files and I tried just about everything on the help forums including a fresh load of XP and Vista respectively on a different hard drive. I tried turning off sound effects, changing power saving, turning off wireless, etc.

The solution: The latest Intel Matrix Storage Manager driver! While trying to fix a problem with DVD burning, I ran into a suggestion on the forums related to the SATA controller. After installing the latest driver I went ahead and tested the audio again and the darn thing works perfectly now. My guess is that the previous sata driver wasn't stable enough and was causing the audio problem as a side effect.

http://support.dell.com/support/downloads/download.aspx?c=us&l=en&s=gen&releaseid=R207267&SystemID=LAT_E6400&servicetag=&os=WLH&osl=en&deviceid=11530&devlib=0&typecnt=0&vercnt=2&catid=-1&impid=-1&formatcnt=1&libid=41&fileid=290228

Release Date: 1/8/2009
Version: 8.7.0.1007 Other Versions

Download Type: Application
File Format: Hard-Drive
File Size: 21 MB

Granted, if I push it hard enough I can still make it skip once in a while but it takes a lot of effort. Whereas previously I could do it with freecell.

Windows 2008 TS gateway rocks

2009-01-06T15:34:00.012-05:00

I set up a test win2k8 box and enabled Terminal Services Gateway on it. It enables you to use remote desktop to access machines inside the firewall from outside. And I haven't used my VPN connection since then!

The setup isn't too bad.
1. Enable the TS Gateway role (and the TS web access if you want)
2. Obtain an SSL certificate with the outside DNS name of the server. This will need to be setup on the TS Gateway server. If you are using an ISA firewall for SSL tunnel inspection, you'll need to install the cert on the listener as well.
3. Make sure your DNS records will resolve properly to the external IP address that matches the SSL certificates DNS name.
4. Create a CAP (connection authorization policy) to specify who is allowed to even connect to the server. You can restrict connection access to specific users or active directory groups as needed.

5. Create a RAP (resource authorization policy) to specify which servers can be accessed. You can also choose to enable all of them but IMHO that's less secure. It would also appear that you can further limit which users can access which RAP groups as well for more granular access. For your initial testing, try not to make this too complicated.

6. If you are just setting up a passthrough on your firewall, then just open up tcp 443 on the right external IP address that corresponds to your SSL cert and have it route the packets to your TS Gateway server.

7. If you are using ISA server you'll need to setup a new publishing rule.

For the listener properties, I left the Client Authentication Method on "No Authentication", No Forms, No SSO.

(Apologies if this isn't well structured, it's been a few weeks since I set this up.)

Now to access the server, you have to use Remote Desktop Client 6.0 or higher. (Basically Vista SP1 or XP SP3). Go to the Advanced Tab and enter in your server information.

Then OK out of that and go to the General Tab and enter in the internal machine name that you want to connect to through the terminal server gateway. (NOTE: Make sure the machine is listed in the RAP policy if you are not allowing all connections. If you used the FQDN in the RAP policy, then you have to use the FQDN in the client. The same goes for the Netbios name and IP address. I just put all 3 in the RAP).

At this point I normally do a Save As to create a shortcut so these settings don't interfere with my other connections.

When you go to connect you may be prompted for a security confirmation. Just accept it and move one. You'll notice in the confirmation window that it shows you both the gateway server name and the end target name/ip.

Additional notes:
a) Your client MUST trust the SSL certificate. I can't garauntee this'll work otherwise

Backup Exec, ISA, and V-79-57344-65072 - The connection to target system has been lost

2008-12-02T08:49:00.003-05:00

So out of the blue my backups started barfing when trying to backup one of my ISA servers. Which really sucks because it was working fine.

V-79-57344-65072 - The connection to target system has been lost. Backup set canceled

The only changes that were made recently were just the application of the latest security patches, etc from MS. (Of course, Symantec's support of ISA with Backup Exec has never been stellar so I can't rule out the possibility that it just stopped working randomly). I went ahead and checked the usual forums, KBs, etc and found a lot of references to the error. I did the usual logging on the ISA server to check the traffic flow, etc and did notice that the agent kept trying to use the external network adapter even though the initial connections were being handled from the internal adapter. For testing I even tried creating a bi directional full access rule between the ISA server and the backup exec server and it didn't fix it. The only thing that worked was to create a User Defined Selection and use that for the backup job definition instead of the server name as mentioned in this forum post here:

https://forums.symantec.com/syment/board/message?board.id=be11dOther&message.id=2121&query.id=62200#M2121

I created a new User Defined Selection and used the Internal IP address of that ISA server and the damn thing started working.

nortel i2050 and vista

2008-11-11T12:02:00.004-05:00

So I had given up on getting the i2050 to work since I still have an ancient BCM 3.7 system. But then I found out some of my users had gotten hold of the V2 version of the software (build 255) and had been using it successfully for a couple of months. Of course, I've yet to find anything from Nortel that says it's supported on the 3.7 but heck it seems to work so we'll use it for now.

I've seen some references online that the V2 version of the i2050 CD can still be purchased but I haven't found it in stock anywhere yet. They're heavily pushing the new V3 but I'm pretty sure that won't work on my old 3.7 system.

Backup Exec 12.5

2008-10-28T16:00:00.003-04:00

I was slightly hesitant when I got the upgrade emails from Symantec but I went ahead and downloaded it. The upgrade installation went through without a hitch, all my settings were retained, and the jobs are running properly. I'm not being sarcastic when I say that this is probably the best Backup Exec upgrade I've had in the past 4 years.

One of the reasons I wanted to roll this out is that I'm looking at rolling out a 2008 Hyper-V box next year and they've added a new agent specifically for Microsoft Virtual Servers. Now I'm not a licensing expert but it looks like they're going to focus more on licensing the Host Virtual server and not worry as much about how many virtual machines are on it. An Agent for VMWARE ESX is now available as well.

On top of that, they've released a new version of their System Recovery product (8.5) which like the previous version allows you to convert your backups into virtual machines. The new 8.5 version adds support for Hyper-V and scheduled conversions.
http://www.symantec.com/business/backup-exec-system-recovery-server-edition

So far so good with the new version. I'll keep my fingers crossed that it lasts...

vmware 2 install - system administrator has set policies to prevent this installation error

2008-10-16T21:38:00.003-04:00

Whilst trying to upgrade my VMWare server 1.0 to the new 2.0 version, I ran into a fun error.

So I tried a few resolutions I had found on the web which led me to this patch:
http://support.microsoft.com/kb/925336

Now granted, the title of that KB seems misleading but apparently it applies here too. Since VMWare made this big huge install file (500+ MB), you have to install this patch and reboot. Afterwards, the installer worked fine for me.

VMWare Server 2.0 problem with disconnected network cable

2008-10-10T10:32:00.005-04:00

I ran into an interesting problem with VMWare Server 2.0 this week on a laptop. When the network cable is not plugged in and you're not on a wireless network, you can't open a browser to connect to the console of currently running virtual machines. (I really miss the old Console app).

The workaround I use is to create a Loopback Adapter on the host machine:
2003 instructions:
http://articles.techrepublic.com.com/5100-10878_11-5647584.html
XP instructions:
http://support.microsoft.com/kb/839013

Once created, assign a static IP like 172.16.180.1 or something similar. The loopback adapter is always on and always appears connected. Reboot and then use the loopback adapter's address to get into the VMWare admin web console. https://172.16.180.1:8333 or whatever address you chose to assign your loopback adapter. (Keep in mind you want to choose an address that isn't likely to conflict with other networks when you travel. Using the loopback adapter is perfectly safe and won't affect how your virtual machines operate. This workaround just pertains to how the web console is bound to IIS.

copy user - parameter is incorrect error

2008-09-25T14:22:00.006-04:00

So recently I've been trying to fix an issue that was preventing me from copying existing user accounts. You'd get to the final step and click finish and be rewarded with an error box stating: Windows cannot create the object such and such because: The parameter is incorrect.

As it turns out, this error is caused by bad data in one of the user Attributes. The good news is that it can be fixed, the bad news is that it may require some perseverance to find it. The following steps and screenshots were done on a Win2k8 controller so some things might look different. The user and computers MMC is currently in 'advanced' mode (View-> Advanced Features)

Open up a known good user that you can copy and on another window or another dc open up the problem user. Go to the Attributes Tab and set the Filter in the bottom right to "Show only attributes that have values" and repeat in the other window. (That is unless you like spending LOTS more time doing this). This will narrow the search down considerably.

Now do a side by side comparison and look for values that either exist in only one user or that look odd.

In my case, when I went to Edit the msRADIUSCallbackNumber attribute, I found that it had garbage in it. Just hit the Clear button and OK out.

After I torched the msRADIUS values on mine, I was able to copy the user without any problems. And due to a shortage of time, I didn't get around to writing a powershell script to dump it out to excel but maybe if I get bored one day...

Dell Latitude E6400 first impressions

2008-09-13T11:57:00.002-04:00

Where to begin? It has a completely redesigned exterior and IMHO looks a bit more like the stinkpad laptops. That aside, the slick black top does look nice. The battery has been relocated to the rear of the unit and they added firewire, usb powershare (which allows you to charge devices off of it while it's off), HDMI output, SD Card slot, eSATA port, and an optional built in webcam for the lid. It also feels lighter but I'm haven't decided yet if it feels as sturdy as the D630 series that it replaced. The only downside so far is that it only has 3 USB ports but honestly it's a fair trade. The power cord has a glowing blue light near the plug which is probably just for bling but to me it's a power system troubleshooting tool (confirming power is getting there).

The new BIOS interface looks like it was designed by the guys who did the UI for the diagnostics CD. It has built in mouse support and a few menu tweaks. It didn't prompt with an option to go into BIOS from the boot Logo so I used the F12 boot menu option to get into it. One step backward is that it wouldn't let me use special characters in the admin password (ie $%^@). These type of things are common for major version changes and will probably be ironed out in a few patches.

The new docking station selection is pretty snazzy and come with multiple elevation options. The one I got has Dual DVI and HDMI ports as well as the base VGA port.

Overall the performance has been good so far.

Updated: 10/12/08 - Upon closer inspection, it's actually a DisplayPort in the back and not an HDMI, but you can buy an adapter from Dell. It appears they're still trying to push the DisplayPort technology even though the rest of the world is going HDMI.

Error when starting Data Collector Sets

2008-08-27T16:13:00.003-04:00

So if you're like me and went overzealous in locking down your 2008 servers, you may run into a nice error message when trying to start your Data Collector Sets in the Reliability and Performance Monitor:

When attempting to start the Data Collector Set the following system error occured:

The service cannot be started, either because it is disabled or
because it has no enabled devices associated with it.

I finally figured out which service it was complaining about - "Performance Logs & Alerts". It was set to disabled which I believe occurred after I had locked it down with the Security and Configuration Wizard. Set this service to Manual and then your data collector sets will be able to run.

You'll also want to set Task Manager to Automatic if you want to be able to schedule your Data Collector sets to run on a schedule.

Microsoft Press Practice Test - Errors on Vista - application.WriteTestRecord

2008-08-22T08:52:00.002-04:00

So I had just finished crawling through ye olde MCTS exam prep book and decided to install the Practice Tests. The installation went fine but when I tried to launch a Lesson Test, I kept getting errors.

An unacticipated error has occured in the application.WriteTestRecord

An unanticipated error has occured in the application.UpdateTimer

The latter was so much fun, I had to go and End Process Tree for MSLocalWare.exe to get rid of the endless error messages.

Since the practice tests were installed from a CD, I went to the C:\Program Files (x86)\Microsoft Press Training Kit Exam Prep folder and unchecked the Read Only checkbox. (The same thing happened on my 32 bit vista install as well). Sometimes you find that apps that have been copied from CDs love to retain their read-only flags on files. Just for overkill, I also added the Everyone Group as full control on the folder.

And voila, the practice tests have worked fine since.

Migrating from SYSVOL to DFS-R in 2008

2008-08-09T22:51:00.003-04:00

FRS will soon be obsolete. Microsoft has replaced it with DFS-R in 2k8 which offers better capacity, better performance, and is easier to troubleshoot.

First upgrade all domain controller to 2k8, then raise domain functional level to 2008.

Migration is done with DFSRMIG.EXE and consists of 4 states
0 - start
1 - copy SYSVOL to SYSVOL_DFSR. FRS still active
2 - SYSVOL redirected to SYSVOL_DFSR. all clients now use the new one
3 - SYSVOL replication stopped. original must be removed manually

To start, run dfsrmig /setglobalstate 1
then dfsrmig /getmigrationstate until it says that all domain controllers have been synched. It took 6 minutes on my single domain (3 DCs) but microsoft says allow up to an hour on larger setups. It's like watching grass grow so go get some coffee or something for a few minutes.
Then dfsrmig /setglobalstate 2
repeat the same /getmigrationstate

*Now you can rollback and go back to the way things were by running /setglobalstate 0 or 1. Once you change to state 3, you can't go back. You don't have to do step 3 yet in case you want to run it for a few days but keep in mind that you shouldn't do any changes to policies, etc until you complete this as replication to the old SYSVOL share isn't working anymore. I personally am only on step 2 and am going to give it a try for a few days this week. (checking event logs, listening for complaints, the usual). I'll update this post if anything goes wrong. :)

When you're ready to finish this, run dfsrmig /setglobalstate 3
Do the /getmigrationstate until it says you're done.

References (with much more detail):
http://blogs.technet.com/filecab/archive/2008/02/14/sysvol-migration-series-part-2-dfsrmig-exe-the-sysvol-migration-tool.aspx

http://redmondmag.com/features/article.asp?editorialsid=2516

quick way to check if a mailbox has delegates - exchange 2007 SP1 - powershell

2008-07-24T15:31:00.002-04:00

Sometimes you get those calls where a user is getting strange meeting invites and they just don't know why. Your first guess is that they're on another user's delegate list. So you go through the list of people on the meeting invite and try go figure out who the culprit is. Prior to Exch 2k7 SP1, you had to either track each one down or create a bunch of profiles and search. Now you can do it from powershell.

# script to check delegates for a particular mailbox
$UserToCheck = get-mailbox UserName
#check what users have access:
$result = $UserToCheck.GrantSendOnBehalfTo
#display results
$result

GlobalNames Zones - somewhat of a band-aid for phasing out WINS

2008-07-21T15:41:00.002-04:00

So I've been reading up in preparation for my Microsoft upgrade exams and I noticed a new DNS feature. Since WINS doesn't support IPv6 they came up with the GlobalNames Zone as an interim solution. Their description is:

"The GlobalNames Zone is a new feature that provides single-label name resolution for large enterprise networks that do not deploy WINS and where using DNS name suffixes to provide single-label name resolution is not practical"

In other words, you don't want or can't use WINS anymore but you've still got these irksome boxes that have to be referenced by simple names like "Webserver1".

To set it up, you first have to be using Windows 2008 DNS servers. (Note that they say that it'll work if not all the AD servers are upgraded). Now from a command prompt run:
dnscmd servername /config /enableglobalnamessupport 1
and repeat on all your authoritative DNS servers. Reboot them for good measure.

Note that if you run dnscmd /? or dnscmd /config /? you won't see this flag listed anywhere. Nothing gives you confidence like running switches that don't appear to be documented.

Once that's done, go into DNS Manager and create a new Forward Lookup Zone. The type will be Primary, and Stored in Active Directory. Name it GlobalNames

Now you should be able to start creating your single name records in the DNS Manager.
Since all the Microsoft examples I've seen so far use the command line to do this, I'll stick with that approach. Basically all we're going to do is attach a CNAME record to redirect requests for "HONEYPOT" to the FQDN "HONEYPOT.DECOY.LOCAL"

dnscmd /RecordAdd GlobalNames HONEYPOT CNAME HONEYPOT.DECOY.LOCAL

Now they don't view this as a complete WINS replacement since it doesn't do auto-registration from clients, etc but if you've got fairly static servers/resources and you're moving to IPv6 or away from WINS this should do the trick. I do recommend some caution as this is a pretty new feature and I'm going to wait awhile before trying this out in our production environment.

For more information:
Microsoft Paper: DNS Server GlobalNames Zone Deployment

Technet forum:
http://forums.technet.microsoft.com/en-US/winserverNIS/thread/8953820a-3f2f-4929-9a3e-2b0731b80e04

Exchange OWA 2007 Change Password Problem

2008-06-30T09:05:00.002-04:00

Some of my users recently complained that they were having problems with the "Change Password" feature in OWA 2007. I wasn't able to replicate it myself when I tried it with my own account though. After some searching on the web I did find some issues people were having with password changes and OWA 2007 and it came down to 2 popular resolutions.

1. "regsvr32 C:\WINDOWS\system32\inetsrv\iisadmpwd\iispwchg.dll" and then reset the IIS with the command "iisreset /noforce".

2. Edit your active directory group policy for passwords and set
"Minimum password age" to "0" days. It's been reported that even if it's
been more than X days since the user changed their password that this policy will cause the "The password supplied does not meet the minimum security requirements. Please contact technical support" error to show up.
(Note: You may need to either Restart NetLogon or reboot the DC for changes to kick in faster)

Now nothing left to do but wait and see if the problem shows up again.

2008 Hyper-V first impressions

2008-06-13T08:47:00.004-04:00

I've been playing around with the new Hyper-V (beta) that's included in server 2008 and I have to say it looks promising. Keep in mind that it's still in the beta stage so there are bound to be some kinks in it. I currently use VMWare Server in my production environments because it's a nice balance between cost and ease of management/maintenance as compared to the VMWareESX product. (It's a lot easier to train my techs to support vmware on a windows platform than to teach them how to support linux and vmware both). I know some of you will say that comparing VMWare Server to 2k8 Hyper-V is a bit of an apples and orange comparison since 2k8 has a Hypervisor but for me the comparison is more about running Virtualization on a Windows host platform.

I installed Win2k8 x64 standard edition on a dual core 2.6Ghz server with 2GB ram. Then I added the Hyper-V role, rebooted, then applied a hotfix related to it from windows update. Creating new Virtual images is a breeze, the wizard walks you through just like the vmware one does and provides you with all the usual options of how many processors, how much ram, disk space, etc. The very first thing I noticed was the absence of any noticeable I/O hit. The Hypervisor handles direct I/O calls very nicely and I only began to notice a performance dip after I started running 2 more Virtual machines at the same time.

Microsoft has updated all their licensing and Eula materials to cover virtualization. On 2008 Enterprise edition, you're allowed to have 4 virtual machines running with an OS that's covered by the host OS license. With the Datacenter Edition, it goes to Infinity! Which means that if you built out a monster cluster, and I do strongly recommend that you cluster your VM servers if you want high availability, then you could save a bundle on operating system licenses. Oh, and the standard edition allows you to run 1 virtual to match the 1 physical license. For the price difference, if you plan to have a few virtual machines on the box, just buy the enterprise edition.

I wish they would have just used the same key combinations that VMWare does. I'm used to using CTRL-ALT a lot and now I have to remember CTRL-ALT-Left Arrow. There are a few other like that in the interface. I do like that you can have them running without any active displays and that each one runs in a different window that's not embedded into the console.

You can read more about Hyper-V at:

http://www.microsoft.com/windowsserver2008/en/us/virtualization-consolidation.aspx

and

http://en.wikipedia.org/wiki/Hyper-V

Enumerate all Email groups a user is a member of

2008-05-17T19:09:00.002-04:00

Quick script to show all email distribution groups that a particular user is a member of:

#
# Cobbled together by Gnawgnu
# 5/17/08

#get the identity of the user by alias
$Username = (get-user gnawgnu).Identity

#search all groups for that user
$groups = get-group -Filter {Members -eq $username}

#display all groups that have an email address
#defined that's longer than 0 characters
$groups | Where-Object {$_.WindowsEmailAddress.Length -ne 0}

Review - Kensington DataTraveler BlackBox

2008-05-14T11:11:00.006-04:00

I've always had good luck with the DataTraveler series and so far I'm pretty impressed with the new BlackBox edition. It's got a good solid feel and weight to it and it's even FIPS 140-2 certified. Unlike some of the new secure drives that have come out, this one does Not require Admin access to work properly. I tested it out as a normal User on an XP SP2 box and didn't have any problems at all. The drive setup is a breeze and it is configured to lock out your data after 10 invalid password attempts. After that, they say you have to completely format the drive to be able to use it again.

I'm too lazy to detail all the screen caps for setting it up, you can find them in the manual pdf on their website.

When done, it'll just settle into a nice task tray icon.

The only downside so far is that on my x64 Vista box, I get an error every time I plug it in but if I hit Retry after a few seconds it'll work fine afterwards.

Overall I'm giving this one a thumb's up. It's probably only a matter of time until someone publishes a hack for it but ain't that always the case.

Link to the BlackBox page on Kingston's site:
http://www.kingston.com/flash/DTBlackBox.asp

Win2k3 convert to dynamic grayed out - GPT and me

2008-04-27T20:39:00.006-04:00

I decided to add another drive to an external vault that's attached to my backup exec system. It's used as an intermediary for disk to disk to tape backups and was getting a bit full. (1.9TB) So I added a disk to the array, let it rebuild and then went into computer management. Then I found that all options for adding or changing the drive were grayed out including "convert to dynamic", "convert to GPT", etc. This was puzzling but after some reseach I found out that I had hit a 2TB barrier that's caused by the old Master Boot Record (MBR) partitioning scheme. The solution Microsoft proposes is to go to the GPT paritioning scheme (GUID partitioning) which scales up to 2^64 logical blocks in length.
http://www.microsoft.com/whdc/device/storage/GPT_FAQ.mspx

Of course the hitch is that you have to wipe out everything on the drive before you can convert to GPT. Even if you try to do it from diskpart you'll get a "The disk you specified is not empty." "Please select an empty MBR disk to convert." So after whacking everything on the disk, it let me upgrade the partition scheme to GPT and I was then able to utilize all the space on the disk.

I have no idea how the performance is affected when you go from MBR to GPT as I haven't been able to find any reviews online. So far I haven't noticed any decrease in performance so that's good. Oh, and in case you're wondering, Symantec Ghost Solutions 2.0 and higher support ghosting GPT partitions.
http://www.symantec.com/business/products/newfeatures.jsp?pcid=2247&pvid=865_1

Workaround for the BCM 3.6 and Vista/IE/Java

2008-04-24T17:20:00.003-04:00

Previously I discussed how to get around this problem with the 3.7 version of the BCM software. But it's been brought to my attention that it doesn't work with the 3.6 version. So, after several permutations of playing around with Mozilla and IE I went with an entirely different option - Opera. http://www.opera.com

Step 1: Download it
Step 2: Install it
Step 3: Browse to your BCM and choose Install for the certificate

Step 4: Log in as normal, go to the Telephone Services Tree and Voila

Tested on Vista 32 bit with Opera 9.27

Upgrading a 2k3 domain to 2k8.

2008-04-21T16:12:00.004-04:00

Decided to upgrade the old 2k3 AD domain this week to 2008 AD. First stop was the Microsoft Technet page - strongly recommend you read it first.
http://technet2.microsoft.com/windowsserver2008/en/library/9c91be5f-df14-40b2-b176-2b1852a51e611033.mspx?mfr=true

I opted to install a new domain controller to start with just to ease into the process. Prior to that, I ran the ADPREP /forestprep, adprep /domainprep /gpprep, and just for kicks adprep /rodcprep and let the changes propagate for a couple of hours just to be on the safe side.

I decided to go with a VM for the domain controller this time. It seemed like a good way to future proof it as far as hardware and since it's a small site I'm not really worried about performance issues. Windows 2008 Enterprise installed right on, vmware tools followed easily enough. Then I added the AD DS role through the new snazzy Server Manager. Last step - DCPROMO, which now defaults to dummy mode but there's still an option for 'Advanced' for real admins.

Once completed, I ran all the usual netdiag, dcdiag, etc and all was well and left it to stew overnight to see if any cool errors would manifest. The first thing to get used to is the new server manager likes to make you aware of *ALL* warnings and errors no matter how trivial they may be. One valid one was from IIS and complained about WAS and the IIS_IUSRS group. A long search pulled up a nifty script from Microsoft that fixed it.
http://support.microsoft.com/kb/946139

So with renewed confidence that all was well, I went ahead and upgraded the rest of the Domain controllers with little problems. Prior to upgrading the existing domain controllers, I had to uninstall things like powershell and antivirus and backup exec, etc. The powershell was mandatory and of course was hidden under a hotfix name
so uninstalling it was impossible without figuring out which hotfix it was under. The other software I uninstalled just as a precaution. One domain controller had the Exchange 2003 management tools installed which caused MMC issues post upgrade with the Active directory User and Computers snap-in. The resolution there was just to uninstall it.

Once all the DCs were upgraded and working, I reinstalled backup exec agents, symantec antivirus, and applied new Security Configuration Wizard policies. Then made backups, documentation, etc.

Since all my DC's were running windows 2008 server now, I went ahead and upgraded the Forest mode to 2008 functional level. (keep in mind, functional level changes are ONE WAY, no going back). The 2008 functional level comes with some cool features like AES encryption on Kerberos, better DFS replication, and last interactive logon. I went ahead and tried to enable the "last interactive logon" according to Microsoft's help pages and my test Vista workstation could not longer unlock the terminal. So after some searching it turns out that you have to enable the policy on All Your Domain Controllers First!. Thanks go out to Steven Bink for his article I found on google to solve it:
http://bink.nu/news/showing-last-logon-info-at-logon-in-windows-server-2008.aspx

And now happily, the feature works perfectly when you log into win2k8 or vista boxes that have the policy set on the domain.

Backup Exec 12 - upgraded and running

2008-04-18T11:50:00.007-04:00

Okay, even this skeptic has to admit they're getting better. I upgraded my 11d server to version 12 this week.

Pros:
Now comes standard with Open file protection and the base level IDR option
New installer has a nicer layout
Win2k8 Support right off the bat
The new System Recovery agent looks cool and supports virtual machine conversions.

Cons:
Had a few hiccups getting the policy based jobs up and running again afterwards.

First off I like the new selection layout during the install. It breaks the modules up by what you're licensed for, then what you can eval, and then the stuff you can't even eval.

click for larger image

I went ahead and upgraded the antivirus to symantec endpoint prot 11 like it wanted. It also has a new antivirus integration but you have to install the full endpoint protection manager on the backup exec server. The upgrade itself went smoothly and I rebooted the server. Then I had to upgrade all the remote agents because it kept giving warnings about the old version.

As for my policy based backups, I had a few issues with the jobs not wanting to work - or cancel for that matter. So first I tried the old "Delete Jobs Created By Policy..." and recreating them but the Incremental parts kept failing. So I cancelled them and started the Full backup job part of the policy.

Once that finished successfully then the incrementals started working right again.
*Mental note to self, don't do upgrades in the middle of the week*

Overall I'm satisfied that Backup Exec is once again on the right track. The expanded feature set and those little extra UI tweaks really do help.

Separate VLANs for nortel ip phones and data

2008-04-14T15:47:00.003-04:00

For this week's project, I decided to split up the network to give IP phone traffic it's own VLAN with the eventual goal of QoS and all that good stuff in mind. The first challenge of course was getting my Dell and Netgear routers to play together nicely which actually wasn't that bad. I already have a Layer 3 routing Switch from netgear (FSM7352S) in place which I previously configured to support routing between our existing network and an isolated vlan for the testing LAB. The plan was to use the i2002 and i2004 phones to use VLAN 20 and to pass through untagged packets to the PCs attached to them.

Steps:
1. Setup VLAN 20 on the switch.

2. Change the access mode of all the ports involved to 'General' which would allow them to handle traffic from multiple VLANs including the default 'VLAN 1'. Then make sure VLAN 20 is selected and set all ports to 'tagged'. When done, each port should still have a PVID of 1, be untagged for VLAN 1 and tagged for VLAN 20.

3. Changed the ports connecting my switches to TRUNK mode. On the ones where trunk mode was not available, I just set that port to be tagged for VLAN 20 and made sure the port was set to 'General' mode.

4. Turned on GVRP which I naively thought was a great feature that would propagate all my vlans to all my switches, solve all the world's problems, perform miracles, etc. Which to be truthful, it did advertise the VLANs and the other switches acknowledged their existense but I wasn't able to tag any ports on the switches that had dynamically received the VLAN info. I'm still not sure if that's a problem with the Dell switches or the monkey writing this blog.

5. Turned off GVRP and just setup VLAN 20 manually on all switches.

6. Tested that an IP phone on one switch in each building to make sure that VLAN 20 was routing properly.

7. I hard-coded a block of switch ports to 'Access Mode' with a PVID of 20 for the nortel BCM phone servers to lock them into VLAN 20. Then I set up one of the BCM servers to be a DHCP server for that VLAN and rebooted it to make sure changes took effect.

8. I setup option 191 and 128 on the win2k3 DHCP server on the Data lan with the high hopes that it would redirect the ip phones automatically to VLAN 20. Option 191 tells the phones to use VLAN X which in my case is 20 and option 128 is a string which tells the phones settings like the ip of the BCM, etc. HAHAHA, didn't work right - probably my fault. It seemed to get the right server address but just wasn't DHCP'ing on VLAN 20.

9. Manually went to each IP phone and set the server IP, and VLAN to 20.

10. Backed up all switch configurations.

Lo and behold, it all worked. All ip phones were able to DHCP to VLAN 20, and all PCs hooked up through them were able to DHCP to vlan 1. Now all my IP phones are isolated away from the data network. Next project will be QoS. Don't forget, anytime you add a new switch you'll need to configure VLAN 20 on it unless you've got GVRP working.

For more information on option 191, 128, and IP Phone settings, I found some Very helpful posts on McNamara's blog.

Option 128:
http://michaelfmcnamara.blogspot.com/2007/10/dhcp-options-voip.html
Option 191:
http://michaelfmcnamara.blogspot.com/2007/10/dhcp-options-voip-part-2.html
and Ip phone settings:
http://michaelfmcnamara.blogspot.com/2007/10/nortel-i2002i2004-internet-telephone.html
(I went with Partial DHCP because I still haven't gotten the Full to work yet.)

Vista command prompt eccentricies, elevation/run as administrator and path fun

2008-04-09T15:59:00.003-04:00

First thing I like to do with the command prompt shortcut is to reduce the number of steps needed to open it and set it to have a unique font color so it's easier to track which command prompts are elevated and which aren't. To start, make a copy of the command prompt shortcut and rename it to something like "Elevated CMD". Then go into properties and click on the advanced button. Then check the box for "Run as Administrator".

Then click on the Colors tab and set a Screen Text color like Green, purple, whatever works for you.

Then just save your new shortcut.

Now for some fun things about command prompts in Vista. If you're using an elevated command prompt you can't change drives to mapped network resources. You can still access them by UNC but not by drive letter. And if you're using a non-elevated command prompt you can access network drives by drive letter but you don't get the same PATH variable as an elevated command prompt. So you have to manually run programs like Powershell from the full path. (C:\Windows\System32\WindowsPowerShell\v1.0>" So until I can crack this one, I've just got a batch file that I run that just contains:
path = %path%;C:\Windows\System32\WindowsPowerShell\v1.0

I can see how some of these annoyances are part of making it more secure but it can be a pain for power users or powershell coders to get up and running.

Vista - Admin tools (adminpak.msi) lost but now found

2008-03-31T11:50:00.004-04:00

So you've gone and upgraded your desktop to Vista and tried to install ye olde adminpak.msi only to find that it don't work. To add insult to injury, for the past year there was no hope in sight for fixing this sad state. Fear not, Microsoft has released the RSAT package. (Remote System Administration Tools) which will allow you to use Admin tools from a Vista box with SP1 and is compatible with 2k3, and 2k8 servers!

Download 32 bit version:
http://www.microsoft.com/downloads/details.aspx?FamilyId=9FF6E897-23CE-4A36-B7FC-D52065DE9960&displaylang=en

Download 64 bit version:
http://www.microsoft.com/downloads/details.aspx?FamilyId=D647A60B-63FD-4AC5-9243-BD3C497D2BC5&displaylang=en

*Note:
After installing, it'll add a help file to your local admin tools and you'll be wondering where the tools are. If you read the help file, it'll tell you to go into Programs and Features -> Turn Windows features on or off and check the box for "Remote Server Administration Tools"

Separate wallpapers for dual monitors in vista

2008-03-31T07:47:00.003-04:00

You know, I really thought they'd have this feature built into Vista. It just seems like one of those nifty GUI things they need to keep up with Mac...

Here's where DisplayFusion comes in. The basic version is free and will allow you to choose a different wallpaper image for each monitor. The app is pretty small (currently consuming 796K in RAM) and is really easy to use. Once installed, just launch it and it'll show up as an icon in the taskbar tray.

Go into the settings and then choose a monitor, then a background color (if needed) and the image you want to display on that monitor. Repeat for second monitor.

Download it here: http://www.binaryfortress.com/displayfusion/

Head's up - Win2k3 SP2 may cause networking issues

2008-03-27T19:31:00.002-04:00

There's a lot of buzz going around about problems being caused by SP2. By default it turns on a lot of features like TCP/IP Offloading (TOE), and Receive-side Scaling (RSS) which can play havok on older network cards and apparently some newer boxes as well. There's a really good write-up on the problem from the exchange team at http://msexchangeteam.com/archive/2007/07/18/446400.aspx
which goes into detail on what is happening. If you've got anything weird going on with your servers since applying SP2, there's a good chance it's because of this.

I personally haven't run into problems on my exch 2k7 box with win2k3 x64 sp2 but I'm going to update my drivers now anyway just in case.

FS116P Desktop POE switch review

2008-03-24T13:10:00.002-04:00

Sometimes you've just got more devices in a room than ports and whether it's temporary or not, you just can't get approval for more LAN drops. And to make matters worse, they're IP phones that run on POE (Power Over Ethernet). Now in your big network closets you can install those new big howling POE switches for your backbone but for a small room, a quiet switch will keep mad users from coming to your office with torches. (I just installed a 24 port Dell POE switch on the backbone last week and it would make an aircraft carrier deck seem quiet.)

Enter the Netgear FS116P - 16 port 10/100 with 8 ports of POE.
http://www.netgear.com/Products/Switches/DesktopSwitches/FS116P.aspx
It's a fanless desktop switch and out of the 4 I got for our small rooms, only 1 had a discernable buzz but it was faint and after being stuffed behind the printer stand wasn't really noticable. As far as performance goes, it works just like any run of the mill 10/100 desktop switch - not noticeable either way for end users. Only the first 8 ports are POE enabled but for smaller rooms that's really all you need. This switched worked fine with my Nortel i2002 phones and the Cisco 1131AG.

Exchange 2007 Powershell Script - Emails owners of all email distribution groups

2008-03-14T09:18:00.002-04:00

Last year I posted a generic script to enumerate all members of all email groups. My department was tasked with finding a way to keep all email groups updated for all departments. My solution has 2 parts:

Part 1 is configuring the "Managed By" field in Active directory or exchange for all distrubtion groups and checking the box for 'Manager can update member list'. This allows email distribution group owners to modify membership through their Outlook client directly. (via the Address book interface.)

Part 2 consists of the following Powershell script which finds all Email Distribution Groups in the forest and then sends an email for every email distribution group to that groups owner. The emails contain the primary SMTP address for reference and a list of all members of that group for quick viewing and confirmation.

# Enumerates all members of all Distribution Lists in Exchange 2007
# and all owners.
# Script will then proceed to email each owner a list of all
# members of each group.
# Uses cmdlets from exch2007
#
# 3/14/08
# By: Gnawgnu

#first get all distributionlists
$dl = get-distributiongroup

#then enumerate through them all and get all group members.
foreach ($group in $dl) {

#build group data
$groupName = "Group Name: " + $group.name
$groupAddr = "Email Address: " + $group.PrimarySMTPAddress
write-host $groupName -foregroundcolor Green
$dlgm = get-distributionGroupMember $group.name.ToString()
$gOwner = get-user $group.ManagedBy.Name

#setup email - make sure to add to your whitelist for
#antispam if applicable.
$sender = "PickASMTPSenderEmailAddress"
write-host $sender
#get Email Address of group owner
$recipient = $gOwner.WindowsEmailAddress
write-host $recipient
$server = "YourSMTPServerGoesHere"
write-host $server
$subject = "Monthly Review required - Email Group: " + $group.Name.ToString()
write-host $subject
#Note: `r`n is a carriage return
$bText1 = "`r`nOwner:" + $group.ManagedBy.Name.ToString() + "`r`n"
$bText2 = $groupAddr.ToString() + "`r`n"
$bText3 = "group members: `r`n"
$bText4 = $dlgm | fl Name | out-String
$bText5 = "Please use your Outlook Client to make changes if needed.`r`n"
$bText6 = "If you are no longer the manager of this group, please notify IT.`r`n"

$body = $bText1 + $bText2 + $bText3 +$bText4 +$bText5
write-host $body.ToString()
$msg = new-object System.Net.Mail.MailMessage $sender, $recipient, $subject, $body

#send email
$client = new-object System.Net.Mail.SmtpClient $server
$client.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
$client.Send($msg)

}

APC metered switches - remote power off

2008-02-28T08:27:00.002-05:00

If you've got some old stubborn legacy hardware that sometimes stops working unless you fully unplug it and power it down then you can relate to the pain of having to physically go onsite or call someone else to unplug the device. This clunky but functional arrangement works fine during normal work hours but can be a pain at 10pm on a weekend. My solution was to get some APC metered switches. Give it an IP address and custom name each outlet port to match the device that's plugged into it through the built-in web interface. If you're offsite and you need a reboot, just vpn into work, open a web browser to the APC's IP, and give commands to the individual ports to power down, then 30 seconds later, tell them to power back on.
This also works well for servers if they bluescreen or run into a hardware failure and just won't restart.

And as a unrelated side bonus, the APC switch has an amperage meter which is useful for measuring how many amps those ancient devices are pulling.

Link the APC 7900 Switched PDU series:
http://www.apc.com/products/family/index.cfm?id=70

Upgrading to Exchange 2007 SP1 with Symantec Mail Security

2008-02-23T10:41:00.012-05:00

*UPDATED - Read all updates before trying this - See Below*

I'd been holding off on applying SP1 for Exch 2007 for a while now until I had upgraded my backup exec to version 12 and to see if there were any issues with Symantec Mail Security which I have running on the exchange server. So after I got BE 12 up and running I figured it was time.

The download of SP1 was much larger than I was expecting as it was around 870MB. In fact after running this upgrade I'm under the impression that it pretty much just reinstalled the whole server while retaining all my settings and data. Make sure you perform the usual precautions like backing up your data and have a recovery plan in place before starting. And of course, stop all antivirus, backup exec, automatic update services, etc prior to starting. (leave the exchange and IIS services running)

The first machine you should upgrade is the server(s) with the Client Access Role installed. During my upgrade, the pre-requisite check failed with a "you must be a member of the exchange organization administrators group" which occured because the user I was installing it as was not a member of the Exchange Organization Group. To remedy this, go into the Exchange Mgmt Console and under Organization, click on Add Exchange Administrator and add in the account you are installing as. Then restart all exchange services for changes to take effect. After the pre-req tests pass, click Next and the upgrade will start. You'll see a lot of disturbing messages like 'uninstalling files', 'pre-compiling binaries', etc and wonder if you're running the right installer or not. Fear not, this is normal behavior for the service pack. My Front-End server took about 17 minutes. (Server specs: Win2k3 x64 SP2, dual 2.0Ghz, 4GB ram)

At this time, I went ahead and re-installed the backup exec agents on the server just as a precaution.

Now with that roaring success beneath our belts, we move onto the back end server. Now if you got that exchange organization admin error earlier, make sure you rebooted the back end server too for changes to take effect. Repeat the same precautions of backup up, stopping unnecessary services, etc.

After that's done, you may want to change a registry key for a feature that's disabled by default as part of Microsoft's new security initiatives. The downside is that by turning off "Remote Streaming Backup" is that programs like Backup Exec will have problems. To Enable this key, go into Regedit and navigate to:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\ParametersSystem

Create a DWORD key - "Enable Remote Streaming Backup" with a value of 1. At this time, I went ahead and re-installed the backup exec agents on the server just as a precaution. Reboot.

My Symantec Mail Security 6 appears to still be working properly and I tested my smtp server and it's still accepting messages so we're looking stable.

SP1 has some nice improvements such as being able to export a .pst file (very useful for archiving ex-employees for evidence), the rewritten OWA interface with lots of new features like server side rules, personal distribution lists, office 2007 support, etc.

And now you can change Send-As and Full Access rights from the GUI for those days when you just don't fell PowerShell-ish.

For details on the new changes, go to:
http://technet.microsoft.com/en-us/library/bb676323.aspx

Update 2/25/08: After applying SP1, the event logs are now starting to flood with Event ID:
8206 - EXCDO - "Calendaring agent failed with error code 0x8000ffff while saving appointmen". I went ahead and rebooted the server and that error went away. An odd issue occured with some recurring calendar entries. As users opened up invites and/or meeting entries in their calendar on monday, some of them ran into an error. This error triggered Exchange to do a repair/integrity check on their mailboxes and effectively locked them out of their calendar for a while. The corresponding error in the Application log looked like:

Event Type: Warning
Event Source: EXCDO
Event Category: General
Event ID: 8230
Date: 2/25/2008
Time: 4:49:12 PM
User: N/A
Computer: EXCHANGE_server_name_here
Description:
An inconsistency was detected in user@maildomain.com: /Calendar/Pinpoint Testing for blah blah.EML. The calendar is being repaired. If a problem persists, please recreate the calendar or the containing mailbox.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Everything appears to go back to normal after the ExchangeIS process finishes checking the mailbox out.

If this persists for a few days, I may have to take the Information Store down and run a manual Eseutil /G integrity check.
http://technet.microsoft.com/en-us/library/aa998361(EXCHG.80).aspx

Updated 2/27/08 - Calendar issues seem to have sorted themselves out during the first 2 days. Now I'm getting:

Unexpected error 0x50a occurred in "EcProcessVirusScanQueueItem"

After researching the web I see that it's not limited to Symantec as users of Trend, Forefront are also reporting the same error post SP1.

Dell Remote Console Switch 2161DS-2 and Vista SP1

2008-02-22T18:55:00.002-05:00

Prior to SP1, I'd been having a heck of a time getting the Dell Remote console software for the kvm to work on Vista. Of course, this was to be expected as Vista wasn't even listed as a platform option for the downloads. Now after upgrading to SP1, the XP version of the software went right on and actually works properly. (version 3.1.0.320)

Tested - D630 Vista SP1

2008-02-20T13:10:00.003-05:00

Test platform: Dell Latitude D630 BIOS A06. Fresh Vista build, latest intel drivers, AHCI enabled, Nvidia 135 vid chipset.

Prep - disabled Symantec A/V as a precaution. Downloaded RTM version of Vista Service Pack 1 from Technet Plus.

Total Time to apply SP1 - 34minutes including reboots.

Results: No apparent issues operating system issues, all device drivers appear to be working fine. No errors during upgrade. Symantec did not start after the final reboot but came back fine after another reboot.

Installing 2008 Server Core - VMWARE Server 1.0x

2008-02-19T19:05:00.007-05:00

When you go to create the new virtual machine, choose the "Vista" option for OS type (It's about as close as you're going to get). Insert the 2008 CD or mount the ISO as a CD instead. Server Core installs without a hitch. Click Other when the GUI comes up, login as Administrator and it'll force you to choose a new password.

To get VMWARE Tools installed, do the usual step in the VMWARE console of clicking VM-> Install VMWARE Tools which will mount d:\ to the vmware tools iso. Go to the command prompt in the VM and cd to d: and then run VMWare Tools.msi (add a /qn for silent install).

To rename the server, first run HOSTNAME to confirm the current name, then run
netdom renamecomputer InsertOldNameHere /NewName InsertNewNameHere
*Note, this will require a reboot to kick in fully. (Shutdown /r for those who still haven't gotten their old GUI-less legs back). Shutdown /r /t 0 for the impatient.

To update the license key for the server:
slmgr -ipk InsertKeyHereWithDashes

Then slmgr -ato to activate windows (may take several minutes)

To enable Remote Desktop (hehe, seems odd for a gui-less install but yet it does have its uses). This command should add firewall rules for RDP inbound for you.

"Cscript %windir%\system32\SCRegEdit.wsf /ar 0" Enable for vista/2k8 clients
"Cscript %windir%\system32\SCRegEdit.wsf /cs 0" Enable for older clients
This worked fine for me until I added it to a domain at which point RDP stopped accepting connections. So I added a manual rule for it:
netsh firewall set portopening tcp 3389 "Remote Desktop"

Now if you're like me and the 640 * 480 resolution is killing you and you're feeling brave there is a way to change it. Run regedit from the command prompt. . Navigate to the following keys:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Video\GUID\0000\DefaultSettings.XResolution
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Video\GUID\0000\DefaultSettings.YResolution
Just to make this confusing, there will be multiple GUIDs. Pretty much check them all and see which one has the XResolution set to Hex 280 and YRes set to 1e0. Figure out the Hex equivalent of what your desired resolution is (use calculator on another box if needed). I just went with 320*258 Hex (800*600 decimal) but you could probably run 400*300 (1024*768). Close out the registry editor and reboot for changes to kick in.

At this point you've got a good base VM image to backup and then start playing around with.

Tips from the guys at microsoft:
http://blogs.technet.com/server_core/

BCM, Internet Explorer 7, Java, and the disappearing Telephone menu tree

2008-02-12T22:24:00.003-05:00

So for a while I'd been having problems with IE7 and the Management Interface on the BCM (3.7). The tree below 'Telephone' would completely disappear but would show up fine on a box with IE 6 or an older version of Java. While I was talking with a Nortel tech about an RCC problem, we got into discussing the java problems and he mentioned that there’s a way to get the latest java to work with IE 7 and the BCM management interface.

Close all browsers, then go into Control Panel -> Java -> Advanced Tab -> Default Java for Browsers and remove the checkbox for Microsoft Internet Explorer. Yeah, it seemed goofy but I changed that setting and went into the system and voila, works fine now.

*Updated* For those of you who've been asking about the 3.6 version, the only way I found to make that work without downgrading IE or Java is to use Opera. http://www.opera.com

Vista client VPN to an ISA 2004 server

2008-01-28T11:34:00.001-05:00

New technologies, new woes. I was having problems getting access to resources over the VPN. I solved half of them by unchecking the IPv6 checkbox for the VPN connection and then restarting the laptop. I also went ahead and explicitly set the connection type to PPTP and made sure it was using the remote server as the Default Gateway under the Advanced tab of the IPv4 settings. For the old XP boxes we used to unset that to keep down crap traffic through our network from remote users. It's still a little flaky sometimes with mapping drives, etc but at least now I can get to internal web servers and RDP.

Netflix Instant Viewer and XP 64 bit fun

2008-01-21T16:08:00.000-05:00

It all started out innocous enough, go to netflix's site, download the client, and roll film. Needless to say, murphy's law kicked in. Netflix's module tried to upgrade media player to 11 and by default tries to load the 32 bit version. After that failed, then my browsers started randomly crashing during use.

So I upgraded the box to WMP 11 64 bit edition, then ran the netflix DRM reset program. C:\Program Files (x86)\Netflix\Netflix Movie Viewer\ResetDRM.exe
Then went back to the site and ran the installer again. It's still a little flaky but it's running now and I can now watch vids on the box.