Fixing the Automatic Updates Service

Sometimes I suspect that my users have maliciously found a way to avoid having to deal with Restart prompts by sabotaging the Automatic Updates service. On some of the machines I keep running into errors when trying to start the Automatic Updates service. The solution I found on Microsoft's site at:

Basically you can make a batch file to run on the client machine. I dump it on their c:\ drive and then use Dameware to open a remote command prompt on the client and run the batch file directly. Alternately you could tell the user to run it or put it into a logon script temporarily.

Symantec - Veritas backup exec 11 second impression

When backup exec 11 first came out I had been ready to upgrade to it right up until I read the message boards. The boards were full of hate and frustration due to bugs, lack of exchange 2007 support, the recent shift of tech support to somewhere in BFE, and the breaking of many features that used to work when it was still veritas. So a year and a service pack and a few hotfixes later, I'm taking the plunge. Their license management site gave some minor difficulties but overall wasn't as bad as my previous experiences with it.
Installation breezed through and the LiveUpdate window was a welcome change from the old patch system. Once I confirmed that all my backup jobs were still there I uncrossed my fingers and started upgrading the remote agents. They've added a new remote agent utility which adds a GUI to the remote agent and publishes current IP and port information back to the media servers at regular intervals. Hopefully this'll make it easier for it to keep track of servers outside the firewall or in the dmz.
All in all I'm cautiously optimistic about this upgrade.

** If you're upgrading exchange 2k7 to SP1, pay close attention to the readme when it talks about remote streaming support. I've seen this pop up on some of the boards with backup exec and exch 2k7 when doing individual mailbox restores.


**Update** Had some weirdness with the jobs that were scheduled from policies. I deleted the jobs from the policies menu and recreated them so we'll see if it works better tonight.

Minimizing the Word 2007 Ribbon

Seems basic enough I know but those are the features that we often can't find because they're so simple but still elusive at times. Some of our users who run lower resolutions weren't happy with the new super sized ribbon that comes with office 2007. Simple fix, set the ribbon to minimize.



Voila, you're done.

Finally got rid of those annoying SSL Security Prompts for outlook 2007/exchange 2007

So the new Exchange 2007 FE and BE system's been up and running fine for a few months now and I finally decided to fix that damn security prompt for the certificates. Essentially I needed a certificate that could handle the Back End server's FQDN and Netbios, the front end's FQDN and Netbios, the Autodiscover dns name, the smtp dns name, and the whole email domain name. Found few articles at the usual places (Tom Shinder's pages/forums, petro.co.il, etc) and started building out the syntax needed. There seem to be different priorities on what's included but my final one was: (and the one that worked mind you since Entrust barfed the first try back out at me)

New-ExchangeCertificate -GenerateRequest -SubjectName "c=US, O=MyCompanyNameHere, CN=FESERVER.YOURDOMAIN.com" -DomainName FESERVER.YOURDOMAIN.com, exchange.YOURDOMAIN.com, autodiscover.YOURDOMAIN.com, FESERVER.ADsubdomain.YOURDOMAIN.com, FESERVER, BEServer.ADsubdomain.YOURDOMAIN.com, BEServer -PrivateKeyExportable $true -keysize 1024 -path c:\certrequest_FESERVER.cer

(the subdomain was for the internal DNS names since Active Directory is a sub-DNS domain)

Also make sure the CN matches the first server name in the DomainName section if you want ISA to work with this.

Now take your .cer file and head over to Entrust and get a "Unified Communications Certificate". http://www.entrust.net/ssl-certificates/unified-communications.htm
Follow the instructions and keep in mind they require a separate contact for Technical and Authoritative for security.



Now you take the response certificate and import it into your back end server. (adjust services to match the roles of your boxes.)

Import-ExchangeCertificate -Path D:\entrustcert.crt ¦ Enable-ExchangeCertificate -Services SMTP,IMAP,POP,IIS

(The saves you the trouble of dealing with the thumbprint separately)

Do the same for your front-end server. You'll need to export the certificate with private key and full certification path to a file first. Then import it into the certificates MMC on the Front End server. Then do a get-certificates at the exchange shell and see if it shows up.

Then run Import-ExchangeCertificate and it'll prompt you Services, then the thumbprint.

The End

Endpoint kills remote access connection manager (Error 5: Access is denied)

To add to the fun, the uninstaller for Endpoint doesn't always get rid of all the problems that came with it. In one case, all the remote access services crapped out so VPN's were unavailable. If you try to create a new VPN, the window options all gray out. I saw a solution on the symantec boards which recommend doing a full manual uninstall.
https://forums.symantec.com/syment/board/message?board.id=endpointcust&thread.id=1844
Uninstall instructions:
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007073018014248?Open&src=ent_gold_nam
One user did comment on this blog that reinstalling Endpoint resolved issues that another admin he knew was experiencing. You may want to try that or a combination of a full uninstall/reinstall, etc.

Multiple VLANs behind an ISA 2006 firewall fun

Scenario: Introduce a couple of VLAN's into the internal network.
Objective: Full communication between segments, internet access for all VLANs.

The first part was easy, I got a Layer 3 switch in to handle all the routing between VLANs. If your company is cheap like mine they probably won't let you buy all VLAN switches at the same time so to start out, you can just do a port based setup so the old dumb switches don't know they're on a VLAN. (i.e. port 48 - vlan 20, port 47 vlan 30, etc and cascade dumb switches on).

Then came the problem of getting ISA to allow them to go out onto the Internet. ISA didn't want to add the other subnets to the network definition for "INTERNAL" because it didn't think those subnets were attached to it. Since ISA doesn't do VLAN's very well and I couldn't just add another NIC for every VLAN. The solution: Add a permanent static from the command line on the ISA server to point to the layer 3 switch's IP. Once there's a static route setup, ISA will allow you to add those subnets to the network definition for "INTERNAL". Now you can setup your firewall rules to allow internet access, etc. Since all IP's show up as coming from their original subnet you can set granular policies on traffic per subnet if you set up address ranges.

Installing XP on an Octiplex 755

Similar problem to what I ran into on the D630's. XP just doesn't like the new AHCI mode for SATA controllers. Go to BIOS -> Drives -> SATA Operation and change it to RAID Autodetect/ATA mode instead. Of course, this only affects you if you bought the desktop with the "Vista" operating system preloaded. For now it just makes better financial sense to buy it with Vista and take liberal use of downgrade rights until we're ready for a full rollout.

x64 SQL 2005 native client error during installation

Apparently the SQL 2005 x64 Standard DVD installs some screwed up version of the Native Client which causes the whole installation to barf. After searching a lot of forums the solution that worked for me was to rip out the whole thing, download the x64 native client from http://www.microsoft.com/downloads/details.aspx?familyid=DF0BA5AA-B4BD-4705-AA0A-B477BA72A9CB&displaylang=en and then I rebooted and ran the installer again and it worked fine.