Field Notes of a Computer Geek

Windows Server Backup Cannot Configure Backup Schedule

2012-02-06T22:52:00.001-06:00

Just today I ran into an issue at a client with a new server. When we tried to configure backup on it we got the error:

Cannot configure backup schedule

It turns out that this occurs when a volume is over 2 TB. This was a new server and the disk configuration shipped from Dell included a 2.5 TB volume.

The solution was to shrink the volume in Disk Management and all was good.

WSS 3.0 Unable to Connect to Configuration Database

2012-01-23T21:24:00.001-06:00

We have an SBS 2003 server with a WSS 3.0 SharePoint site configured on it. As part of preparation for a migration to SBS 2011, a whole bunch of updates have been applied to it. Unfortunately, one of these updates killed SharePoint.

It appears that the SharePoint databases were orginally part of a server\SharePoint SQL instance but were migrated to MSSQL$Microsoft##SSEE. So, at some time the databases were migrated from the old SQL 2000-based windows Internal DB to SQL 2005 Express Edition. My best guess is that this was done by some of the updates.

There was an error:

SQL Database 'STS_Config' on SQL Server instance 'np:\\.\pipe\MSSQL$Microsoft##SSEE\sql\query' not found. Additional error information from SQL Server is included below.

Looking in the SQL error log at C:\WINDOWS\SYSMSI\SSEE\MSSQL.2005\MSSQL\LOG\Errorlog has further info:

Error: 17207, Severity: 16, State: 1.
FCB::Open: Operating system error 5(Access is denied.) occurred while creating or opening file 'C:\Program Files\Microsoft SQL Server\MSSQL$SHAREPOINT\Data\STS_Config.mdf

In SQL Server Management Studio Express for SQL 2005, I connected to the MSSQL$Microsoft##SSEE instance to see what was up. The SharePoint config database was not mounted and I couldn't view the properties of it. To connect to the MSSQL$Microsoft##SSEE instance, I had to enter the Server name in Management Studio as \\.\pipe\mssql$microsoft##ssee\sql\query.

After looking, I saw that the MSSQL$Microsoft##SSEE instance was configured to start as NETWORK SERVICE. The older instance of SHAREPOINT was configured to start as LOCAL SYSTEM. The error log was indicating that new instance didn't have the correct permissions. After changing MSSQL$Microsoft##SSEE to run a LOCAL SYSTEM, the permissions issue was resolved and the databases mounted.
Unfortunately when I tried to connect to SharePoint, I was still getting the error "Unable to connect to the configuration database. Looking at the SQL error log, we now see:

Error: 33002, Severity: 16, State: 1.
Access to module dbo.proc_getObjectsByClass is blocked because the signature is not valid.

It turns out this is caused by upgrades not completing properly. You need to manually force the upgrade to complete by using this command-line from C:\Program Files\Microsoft Shared\web server extensions\12\bin:

psconfig -cmd upgrade -inplace b2b -wait -force

For additional troubleshooting info:

http://social.technet.microsoft.com/Forums/en-US/sharepointgeneral/thread/8b3094a1-31ee-49d7-ab02-72ca0dc440a7/

My iPad Won't Turn On

2012-01-19T12:59:00.002-06:00

I am by no means an Apple product expert. However, here's my tip of the day.

Apple devices such as iPods and iPads have a deep sleep mode that they go into when the battery gets very low. When they are in this deep sleep mode, it appears that they can't turn on.

To bring an iPad or iPhone out of deep sleep:

Hold home button (lower middle) and sleep button(upper right edge) for 10 seconds

To bring an iPod touch out of deep sleep:

Hold the sleep button (upper right edge) for about 10 seconds

It may also help if the device is plugged into power when this is performed.

We've also seen some of these devices go into this deep sleep mode for no apparent reason. I suspect an odd user button combination, but can't tell for sure. So, even if the batter charge is OK, this may be your issue.

Register ASP.NET 4 on IIS

2012-01-06T11:10:00.000-06:00

I'm doing some work with the release candidate of System Center 2012 - Operations Manager. It requires .NET Framework 4 and I made the mistake of installing .NET Framework 4 before installing IIS on the server. As a result, ASP.NET for .NET Framework 4 is not registered in IIS.

Happily it's an easy fix:

Open a command prompt
Change to C:\Windows\Microsoft.NET\Framework64\v4.0.30319
Run aspnet_regiis.exe -i

After registering you still need to enable it in IIS Manager.

Open IIS Manager and browse to the server
Double-click ISAPI and CGI Restrictions
Allow both ASP.NET v.4 instances
Run iisreset.exe

Multiple SendOnBehalfTo in EMS

2011-12-30T08:51:00.000-06:00

If you use the Exchange Management Shell to define the SendOnBehalfTo property of an Exchange 2010 mailbox then the user that you provide overwrites any existing users with SendOnBehalfTo permission. This happens because the list of users is stored as an array. When you provide a single user, you overwrite that list with the single user. Instead, you need to add a user.

This is not the most concise way to do it. I just find it understandable this way.

#Get current list of users
$mailbox=get-mailbox "HelpDesk"
$SendList=$mailbox.GrantSendOnBehalfTo

#Add to list of users
$newperson=get-user "NewPerson"
$SendList=$SendList + $newperson

#Set new list
Set-Mailbox "HelpDesk" -GrantSendonBehalfTo $SendList

For more details about why this works see my posting on adding additional managers to a distribution group at http://byronwright.blogspot.com/2011/08/adding-additional-distribution-group.html. It uses a similar process to modify the list of managers

Messages Stuck in Submission Queue

2011-12-15T16:22:00.005-06:00

Today we got a call from a client that messages were stuck in the Submission queue on an Exchange 2010 server with all roles. There were no specific error messages in the Application log.

A little bit of searching indicated that this can be caused by locally installed anti-virus/anti-spam software that has hooks into the transport service. So, we disabled GFI MailEssentials on the server and mail began to flow. When we re-enabled it, mail stopped immediately.

The client is now contacting GFI, but my best guess is that it is a bad update that got pushed out. We've seen similar things with other anti-virus products in the past. It will probably be fixed in the next update.

Exchange 2010 SP2 Released

2011-12-07T08:56:00.001-06:00

Yesterday Microsoft released service pack 2 for Exchange 2010. I haven't had time to go through the details yet, but you can check it out on the Exchange team blog.

http://blogs.technet.com/b/exchange/archive/2011/12/05/released-exchange-server-2010-sp2.aspx

Due to the problems with rollup updates earlier this year (two of them were pulled and updated), I'd wait at least a month before considering implementation of SP2.

Update: Summary of New Features
Things I think will be useful to me:

Disable auto-mapping for mailboxes with full access. Auto-mapping automatically opens any mailbox to which you have full access when using Outlook 2010 (or 2007 with updates) and Exchange 2010 SP1. This is great if there are only a few shared mailboxes. There is a work around to stop this by editing an attribute with ADSIedit, but that is a bit clunky. Now there is an option to disable automapping when using the Add-MailboxPermission cmdlet.
Mini-version of Outlook Web App. I haven't tested this yet, but I'm hoping this actually works on my older BlackBerry device with a browser that isn't so good.

Things that I don't think will be very important for me:

Ability to disable or remove a mailbox with litigation hold enabled.
New multi-valued custom attributes for groups, contacts, mailboxes, and public folders.
Easier configuration of mailbox replication between forests
Address book policies to define the address lists presented to a user (including GAL)
Silent redirection to an alternate location for Outlook Web App
Simplified hybrid configuration wizard. This is useful when integrating with Office 365. I just reviewed the documentation for the pre-SP2 wizard and this appears much improved.

For more detailed information about new features see:

http://technet.microsoft.com/en-us/library/hh529924.aspx

Setting Message Size Limits in Exchange 2010

2011-12-01T16:06:00.001-06:00

Exchange 2010 has multiple levels where you can configure message size limits. You need to be aware of where they are located to ensure they provide the message delivery infrastructure you want.

The most common places that you configure message sizes are:

User. The maximum send and receive sizes that you configure for a user override the settings configured for levels. The allows you to create exceptions for specific users that are larger or smaller. Configure in the Mail Flow Settings tab of the user.
Organization. This controls the maximum send and receive message sizes used by all Hub Transport servers in the organization. The default size is 10 MB. Configure in Organization Configuration > Hub Transport > Global Settings > Transport Settings > General tab.
Receive connector. Each Hub Transport server has receive connectors with a default maximum receive message size. This should match the setting for the organization unless you want a specific connector to be more restrictive than the organization. Modify on the General tab of the receive connector.
Send connector. Send connectors are used primarily for message delivery to external systems, including the Internet. This setting should match the setting for the organization unless you want a specific connector to be more restrictive than the organization. Modify on the General tab of the send connector.

For more detailed information about message size limits in Exchange 2010 see Understanding Message Size Limits in the Exchange 2010 SP1 help at http://technet.microsoft.com/en-us/library/bb124345.aspx.

Offer Remote Assistance

2011-11-29T15:00:00.001-06:00

We do a lot of remote support for clients and the ability to see what the user sees is essential when troubleshooting. There are a few third party tools out there that allow remote control such as Mikogo and Team Viewer, but most of these have a cost associated with them for commercial use.

If you have remote access to a Windows server, you can use that server to connect to users within the site. The standard Remote Desktop works great for you to log on, but does not allow you to collaborate with the user. For that you need Windows Remote Assistance.Windows Remote Assistance allows you connect to a remote computer while the user is logged on and see exactly what they see. You can also take control if the user lets you.

In Windows Server 2008 R2, you need to install the Remote Assistance feature. In SBS 2011, it is automatically installed. After it is installed, you can run it from the Start menu or by running msra.exe. I tend to use the command-line. The options in the graphic below are for Windows Server 2008 R2.

Depending on the version of Windows that you are running, the graphical interface offers different options. Most of the same options are there between versions. Here are the ways you can use it:

User initiated - Invitation file. This method requires the user to create an invitation from remote assistance on their computer and then deliver it to you, typically via email. Generally, too complex for users to understand.
Helper initiated - Offer remote assistance. This method requires you to enter the IP address of the remote computer. It is also dependent on DCOM. Make sure that the firewall of the remote computer is configured correctly. SBS creates a Group Policy that opens up these ports. In a non-SBS environment, you'll need to do that manually. This is the option we use most often because the user does not need to initiate it.
User initiated - Easy Connect. This method generates a password when the user request is made. This password is entered in by the help to access the system. Unlike the above options, this method works over the Internet. However, it requires the firewalls on both sides to support Peer Name Resolution Protocol. This method also requires Windows 7 on both computers. Test your router support by using the Internet Connectivity Evaluation Tool at http://www.microsoft.com/windows/using/tools/igd/default.mspx.

Additional Remote Assistance information, including firewall configuration:

Corrupt OST File, Don't Repair It!

2011-11-24T11:57:00.001-06:00

I recently had my personal system freeze up on me and I shut it down hard with the power button. When I restarted the system, Outlook complained about a corrupt OST file and recommended using the inbox repair tool to fix it. Silly me, I followed instructions. The end result was 1.5 hours of waiting and a still corrupted 7 GB OST file that wouldn't open.

An OST file is a local cache of your mailbox. It is redundant data that is already held on the server. It is not worth your time to fix it unless your connectivity to the server is very slow. Which may be relevant for remote users. I, on the other hand, can reach over and touch the server in my office.

After the failed OST repair, I got smart and removed the corrupted OST file. When I started Outlook, it recreated the missing OST file and synced everything to my desktop. Total time to resync was less than 30 minutes. Much faster than the repair attempt.

Your only potential risk in deleting the OST file is a small chance that there is a message in the Outbox that has not yet been synced to the server. This message would be lost.

For reference the OST file is located in: C:\Users\username\AppData\Local\Microsoft\Outlook

Exchange Management Console Won't Close

2011-11-23T11:59:00.001-06:00

If you have installed IE 9 on your Exchange 2010 server (possibly also Exchange 2007) then you may get an error when you attempt to close the Exchange Management Console. The error is dependent on what you've looked at in EMC while you had it open. The error is:

You must close all dialog boxes before you can close Exchange Management Console

This error appears even though you don't have any dialog boxes open. It has also been reported in some other management tools. A fix has finally been released.

http://blogs.technet.com/b/exchange/archive/2011/10/17/a-fix-for-the-interoperability-issues-between-exchange-2007-and-2010-emc-and-ie9-is-now-available.aspx

iDRAC Problem on Dell Server

2011-11-22T11:01:00.001-06:00

We've starting ordering iDRAC Enterprise cards for all of our new servers. We do a lot of remote support for clients, and these cards give us complete remote control for the server via a dedicated network interface. With this, we can control all of the BIOS level stuff that we used to go onsite for. When some clients are an hour or two away, this saves a ton of time for us and clients.

Yesterday, I got a new server in and the iDRAC was behaving oddly. When I plugged in the network cable to the iDRAC network interface, the link light came on and it blinked for packets as it should. However, I couldn't connect to the default IP addresses of the iDRAC. In the status for the iDRAC, it was configured to use the dedicated network interface but said "No Active LOM".

Thinking that this might be an issue with the card not being seated correctly, I reseated the card. After reseating the card I had no link light on the network interface at all. Then I configured it to use one of the onboard network interfaces and it worked fine. So, at this point, the problem appears to be the dedicated network interface.

I popped it open again to take a look. It turns out that the dedicated network interface for the iDRAC is a small card that plugs into the motherboard. On this server, it was loose. After reseating the dedicated network interface, all was good.

I found a couple other references on the internet to fixing this by having Dell replace the motherboard or by changing firmware on the iDRAC. This reference provides documentation in case reseating doesn't fix it for you:

http://en.community.dell.com/support-forums/servers/f/177/t/19378355.aspx

Adding 64-bit Printer Drivers to 32-bit Windows 2003

2011-11-10T10:47:00.001-06:00

As more of our clients are adding 64-bit client computers a common concern is printer drivers with older Windows 2003 servers. The printers are installed on Windows 2003 and shared with clients. When 32-bit clients are connected to the printer, the driver from the server is downloaded to the client and installed automatically. Unfortunately, 64-bit clients cannot use the same driver and 32-bit Windows 2003 does not have an interface to add a 64-bit driver.

The solution is to use a 64-bit Windows 7 client to add the printer driver as follows:

Start the Print Management administrative tool (printmanagement.msc)
Add the Windows 2003 file server as a print server
Add the 64-bit driver

You can also browse to the shared printer over the network from the 64-bit client and add the 64-bit driver in the properties of the printer.

Please note that the 32-bit and 64-bit drivers need to be named the same. So, with different version of the driver, you may have issues.

SANs Make Me Nervous

2011-11-05T11:33:00.002-05:00

Exchange 2010 has been optimized for inexpensive direct attached storage. The idea being that you replicate data among multiple inexpensive servers instead of introducing an expensive SAN. Many organizations are uncomfortable with this because they have bought into the idea that a SAN is much more reliable and faster than local disk ever could be.

However, SANs make me nervous because they become a single point of failure. It is not unheard of for a SAN to go down or experience performances issues. A couple of examples that students have given me over the last while:

A SAN firmware update (installed by the vendor while the vendor is onsite) wiped an entire SAN. Restore of all the SAN data from backup took 3 days.
A SAN with unreliable cache disks. This results in downtime while the cache disks are replaced and poor performance until they are replaced. This has been an ongoing issue for this SAN.

And, just for fun, disk in general can be influenced by vibration. Which makes sense when you think about it, but just your shouting can influence disk performance. Imagine construction vibration when piles are being set for a building next door.

http://www.youtube.com/watch?v=tDacjrSCeq4

Modify Windows 7 Default Profile

2011-10-24T09:21:00.001-05:00

Many organizations are still in the process of figuring out Windows 7 deployment. One thing that can come into play with a new Windows 7 deployment is the default profile. When a user logs on to Windows 7 for the first time their profile is created from the default profile. If the default profile is configured as you want it to be for the users then there is not need to modify the user profile after log on. Sounds good right?

The problem with modifying the default profile as a method of standardizing user profiles is maintenance. After desktop computers have been deployed it is very awkward to modify the default profile. The officially supported method of configuring the default profiles is:

Create a blank install of Windows 7
Install applications
Log on as a local administrator and customize the profile
Sysprep the system using an unattend.txt file with the copyprofile tag
Take image of sysprepped system and deploy

Note: When you run sysprep, ensure that there is only one administrative user on the system. If there are multiple administrative users there is no way to guarantee that the correct administrative user is selected for the profile copy.

As you can see, this method is ok for new systems, but not already deployed systems. You can manually copy files and modify files in the default profile. You can also edit the ntuser.dat registry file that is part of the default profile, but it is pretty awkward. Also, modifying the default profile does not modify the profile of any existing user profiles.

The end solution is to avoid using default profiles as much as possible for configuration. Instead use Group Policy to push out as much of the configuration as you can. Group Policy can push out files, folders, and registry keys. However, you'll need to put some extra time into learning how to do it.

Here is a link to more discussion on how to do the sysprep and also how to edit the default user registry files:

http://blogs.technet.com/b/deploymentguys/archive/2009/10/29/configuring-default-user-settings-full-update-for-windows-7-and-windows-server-2008-r2.aspx

SBS 2011 Exchange Not Installing

2011-10-17T09:16:00.001-05:00

We have done several migrations from SBS 2003 to SBS 2011 without any significant incidents. This week we had a bit of hassle with Exchange 2010 not installing during the installation. No errors were reported by any of the premigration tools.

In the Exchangesetup.log and SBSSetup.log we got the following error:

[REQUIRED] A reboot from a previous installation is pending. Please restart the system and rerun setup.

Based on some quick research, the general recommendation seems to be that you should reinstall SBS 2011 rather than trying to add Exchange 2010 after the fact. So, to recover, we restored the system state to the old SBS 2003 server (which we cleverly created just before starting the installation).

At this point, we figured that maybe there was something weird because we had selected to download and install updates as part of the install. So, for attempt number two we did not install the updates and got a different error about being unable to find a domain controller. This one turns out to be an error that can occur if you have restored system state on Windows 2003. Apparently the file replication service gets confused. And although the KB for the hotfix below appears completely unrelated it seemed to resolve the issue. See the following:

Onward with further attempts and the original error continued. More searching and there were a fair number of references to registry keys specifying the restart was required, but we checked those and they did not exist on our server. However, for your reference:

http://technet.microsoft.com/en-us/library/cc164360(EXCHG.80).aspx

We also found a few references to automatic printer installation causing this issue. This client does have a GPO that automatically installs printers. So, we disabled that and still no fix.

We think the problem was that DHCP was not configured on the source server. This client has an IP-based phone system that provides DHCP. This was configured by the phone provider to ensure that the necessary options are pushed out to the phones. When you configure the answer file for SBS 2011 installation there is a checkbox asking you to select whether DHCP is installed on the source server. However, the documentation explicitly states that DHCP must be installed and configured on the source server.

When DHCP was installed on the SBS 2003 server, it would not run because it conflicted with the DHCP on the phone system. So, finally, SBS 2003 and the new SBS 2011 were isolated off the main network. Then installation proceeded as normal.

Just for the record, my business partner Darrin is the one who finally figured this out.

Resolving an External DNS Record to an Alternate IP Internally

2011-10-11T15:04:00.001-05:00

In some cases, you'd like a single externally hosted DNS record to resolve to a different IP internally than externally. For example, you may have an hostname such as webapp.domain.com to a valid external IP when on the Internet but an internal IP when on the internal network. The key here is that you want the same name to resolve to two different addresses depending on whether they are internal or external.

Let's also assume that domain.com is hosted externally on Internet accessible DNS servers that are different from your internal DNS servers. For example, domain.com is hosted by GoDaddy or your ISP. So, on GoDaddy, you would have webapp.domain.com resolve to an external IP address such as 1.1.1.1.

Now, you can't create domain.com on your internal DNS servers. If you do, you'll need to manually synchronize all external DNS names to your internal DNS server. This can quite the pain to keep track of. We have several clients where the web hosting company is in control of the externally hosted DNS and change the Web site address without notice based on their infrastructure changing.

To resolve only webapp.domain.com differently, you create the webapp.domain.com as a forward lookup zone on your internal DNS. Then create a host record for the domain in that zone that resolves to the internal IP address, such as 192.168.1.100. When you are creating the record, it should look something like the graphic below.

While I'd like to say I'm the first person to think of this, I'm sure many have in the past. However, I learned this from the installation of SBS 2011 which does this by default for the remote.domain.com record that is used for accessing Exchange Web services and SharePoint.

Hyper-V VM Unable to Start

2011-10-11T14:53:00.000-05:00

This is an error that is unlikely to occur for most of us because our servers are relatively up to date, but I work with training centers that use workstation images which are not updated on a regular basis. Today I helped a training center resolve a problem with a Hyper-V virtual machine that would not start.

Scenario:

Windows 2008 R2 (not SP1)
New hardware
The OS image with VM worked fine on older hardware

The errors:

An error occurred while attempting to start the selected virtual machine(s). <virtual machine name> could not initialize
<virtual machine name> could not initialize. (Virtual machine ID <virtual machine GUID>)
<virtual machine name> Failed to set/change partition property

The problem occurs only for new hardware because some newer Intel processors support AVX instructions (http://software.intel.com/en-us/articles/introduction-to-intel-advanced-vector-extensions/) and Hyper-V in Windows 2008 R2 RTM, doesn't know what to do with them.

The simple solution is to install Windows 2008 R2 SP1. However, there is also a hot fix and WMI workaround for Windows 2008 R2 RTM. You can view the Microsoft knowledgebase article with the hotfix and workaround here: http://support.microsoft.com/kb/2517374

Exchange 2010 Mailbox Permissions

2011-09-22T09:57:00.003-05:00

I freely admit that I don't do much with mailbox permissions and I've been stuck in thinking about them much like I did in Exchange 2003. That is, that you can give people the following permission to a mailbox:

Send As
Send on Behalf Of
Full Mailbox (Receive As)

Those permissions have been around for a long time and you can use them in combination to provide someone with access to a mailbox and the ability to send as that mailbox. This is useful for shared mailbox or sometime when an assistant needs to do things on behalf of someone. It can also be useful for vacation coverage.

In class this week I was asked about applying read only permissions to a mailbox and thought it could not be done. Turns out I was wrong.

In Exchange 2010 and Exchange 2007, you can use the Add-MailboxPermission cmdlet to assign read only access to an entire mailbox. If you want to assign permission to just a subfolder within the mailbox you can use the Add-MailboxFolderPermission cmdlet. The Add-MailboxFolderPermission cmdlet is new in Exchange 2010 SP1.

Add-MailboxPermission: http://technet.microsoft.com/en-us/library/bb124097.aspx
Add-MailboxFolderPermission: http://technet.microsoft.com/en-us/library/dd298062.aspx

ImageX vs Clonezilla

2011-09-14T22:11:00.004-05:00

In the last little bit I've been playing with imaging systems as part of a project trying to virtualize an old NetWare servers. As part of this I learned of Clonezilla. Clonezilla is open source disk imaging software that can be downloaded as a live CD.

Clonezilla has a lot of options:

Clone partitions
Clone whole disk
Clone to file (local disk, Windows share, SSH server, NFS)
Clone directly to disk

Clonezilla works with multiple partition types. From a Windows perspective, it understands both FAT and NTFS partitions. For any partition type that Clonezilla understands, the blank space in the partition is skipped. For any partition type that Clonezilla does not understand a sector by sector copy is performed.

Lately when I've been moving Windows computers with failing hard drives, I've been using ImageX. My general process has been:

Boot from WindowsPE disk with ImageX
Use ImageX to copy local partition contents to file over the network
Replace hard drive
Boot from Windows PE disk with ImageX
Use diskpart to create necessary partitions
Use ImageX to copy image file contents back to local partitions

This process allows me to make partitions on the new disk of any size, but requires me to manually make those partitions. The Clonezilla process can be simpler.

Add new disk to computer
Boot from Clonezilla Live CD and clone disk to disk.
Configure new disk as first in the boot order.

As you can see, there are definitely less steps. If you don't have the cables to connect the new disk internally, you can also use a USB drive for the initial cloning. Alternatively, even if I save the whole disk as an image file, it includes the partitions which saves me the hassle of creating them. Which also means that I don't forget about utility partitions included by many vendors.

The main problem with Clonezilla pops up if you are cloning to a smaller disk than the original. Clonezilla has no way to directly clone to a smaller disk. To overcome this, you can use GParted Live cd to shrink the NTFS partition before cloning. Clonezilla is smart enough not to care about unpartitioned space. So, as long as the partitions fit on the new disk, all is good.

I like Clonzilla because it is menu driven rather than me having to remember various switches to get things done.

Note: After using GParted to shrink the NTFS, the NTFS partition was in an unclean state. I had to boot the original OS and do a proper shutdown before Clonzeilla would image it. You can also get around this by manually force the status to clear within the live CD, but that was an unnecessary risk.

Links:

Clonezilla Live (http://www.clonezilla.org/clonezilla-live.php)
GParted Live (http://gparted.sourceforge.net/livecd.php)

Exchange 2010 Test Domain to Production

2011-09-13T13:17:00.004-05:00

A client recently implemented Exchange 2010 as a replacement for an existing externally hosted POP3 mail system. The client is relatively small. So, the plan was to have no coexistence and the real domain name was not used for testing. A new domain name was used for testing. Consequently during testing, all of the external URLs were configured as testdomain.com.

During switchover day, we obtained a new certificate with the proper names, including realdomain.com. During testing of OWA, the web browser was redirected to testdomain.com. Aha, I forgot to update the external URL. Exchange 2010 has a nice wizard for updating external URLs for all web services. All fixed up and tested in 10 minutes.

A week later, I get a call from the client indicating that there is a certificate problem and users are being redirected to testdomain.com. After some back and forth communication this is only for Outlook Anywhere clients.

Outlook Anywhere does not have an external URL, but it does have a host name associated with it. This host name is not updated by the wizard that updates all of the external URLs. Under Server Configuration, you need to go into the Properties of the server and modify the host name on the Outlook Anywhere tab. It's a 30 second fix as long as you remember to do it.

See here for detailed instructions: http://technet.microsoft.com/en-us/library/aa996902.aspx

Adding an Additional Distribution Group Manager/Owner

2011-08-18T14:23:00.000-05:00

In Exchange 2010 a group owner/manager is modified by using Set-DistributionGroup with the ManagedBy parameter. You can also configure this parameter in the Exchange Management Console in the properties of the group. Only users can be listed here, not groups. However, you can add multiple users.

If you are updating only a single distribution group then the graphical interface in the Exchange Management Console works well. If you have many distribution groups to update then you will probably be scripting the process in the Exchange Management Shell.

In the Exchange Management Shell, you allow multiple managers of a distribution list by including them as a comma separated list as shown below:

Set-DistributionGroup Accounting -ManagedBy Jeff,Susan

However, it becomes a bit more complicated if you want to add a new person as a group manager. Overall, you need to obtain the list of current managers in a variable, add the new user, and then set the ManagedBy parameter using the entire array. If you specific just a single user then the existing list is overwritten. Let's take a look at the process.

First, obtain the current list of managers:

$Grp=Get-DistributionGroup "All Company"
$List= $Grp.ManagedBy

The next bit is a little tricky. The $List variable is an array of Active Directory objects. You can verify this by displaying the contents of the $List variable as shown below.

If you attempt to just add a name to the $List array, it won't work because the name is treated as a string rather than the name of an Active Directory object. So, instead you need to create another variable with the Active Directory object of the user you want to add. The example below shows how put the Active Directory object for Anna in the variable $New and then add it to the existing $List array. If you are scripting this, the name "Anna" can be replaced with a variable containing the name of the user. The variable can be populated from a csv file.

$New=Get-User Anna
$List+=$New

If you display the contents of the $List variable, you can see that Anna has been added. The object is different from the original two objects, but it is similar enough for the Set-DistributionGroup cmdlet to accept it.

Finally, we can set the ManagedBy for the group:

Set-DistributionGroup "All Company" -ManagedBy $List

I should also note that while there is no built in functionality for a security group to manage a distribution list, you can fake it by using these instructions provided by the Exchange Team at http://blogs.technet.com/b/exchange/archive/2011/05/04/how-to-manage-groups-with-groups-in-exchange-2010.aspx.

SBS 2008 Monitoring Database Problems

2011-08-16T14:08:00.001-05:00

I've run into performance issues on SBS 2008 servers related to the monitoring database. I've noticed this issue as a disk access issue when a server is slow. From Resource Monitor, sorting processes under Disk by the Read Bytes has the SBSMonitoring.mdf file with far more activity that other sources. Typically processor and memory utilization are OK, but not necessarily.

Two separate issues can be the source of the problem:

SBS Monitoring database is too large and is using large amounts of disk space. If so, check this out: http://blog.korteksolutions.com/the-sbsmonitoring-database-is-nearing-maximum-size-on-sbs-2008/. I used the downloadable new database from this location and it worked great.
Missing indexes in SBS Monitoring database cause high disk and maybe processor activity. If so, check this out: http://social.technet.microsoft.com/Forums/en/smallbusinessserver/thread/d195baac-da8b-4387-9079-c55d5e1879b4

10135 Exchange 2010 Admin - Useful Links

2011-08-12T13:58:00.000-05:00

Each time I teach the Microsoft 10135 Configuring, Managing, and Troubleshooting Microsoft Exchange Server 2010, the students are trying to write down all the sites I show. This is a pain for all of them. So, here is a list of the sites I have noted in my manual along with relevant pages.

Companion MOC with zip of discussion answers (old CD content): http://www.microsoft.com/learning/en/us/training/companionmoc.aspx
1-19, Exchange 2010 pricing: http://www.microsoft.com/exchange/en-us/pricing-exchange-server-email.aspx
1-19, Exchange 2010 licensing: http://www.microsoft.com/exchange/en-us/licensing-exchange-server-email.aspx
1-27, Exchange 2010 installation prerequisites: http://technet.microsoft.com/en-us/library/bb691354.aspx
2-22, Large Exchange databases should be 64KB NTFS blocks: http://blogs.technet.com/b/mikelag/archive/2011/02/09/how-fragmentation-on-incorrectly-formatted-ntfs-volumes-affects-exchange.aspx
2-23, Mailbox Requirements Calculator: http://gallery.technet.microsoft.com/v144-of-the-Exchange-2010-1912958d
2-25, Exchange Server 2010 Design and Architecture at Microsoft: http://technet.microsoft.com/en-us/library/ff829232.aspx
2-37, ExFolders for graphical administration of public folders: http://gallery.technet.microsoft.com/Exchange-2010-SP1-ExFolders-e6bfd405
3-14, Migrating Resource Mailboxes from Exchange 2003 to Exchange 2010: http://technet.microsoft.com/en-us/library/bb232130.aspx
3-39, Filterable properties for get-user and more: http://technet.microsoft.com/en-us/library/bb738155.aspx
4-57, Supported features for versions of ActiveSync (both have different client versions): http://en.wikipedia.org/wiki/Comparison_of_Exchange_ActiveSync_Clients and http://social.technet.microsoft.com/wiki/contents/articles/exchange-activesync-client-comparison-table.aspx
5-27, Anonymous relay connector: http://technet.microsoft.com/en-us/library/bb232021.aspx
6-37, SPF Record Wizard: http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard
7-22, More RPC client access array info: http://blogs.technet.com/b/exchange/archive/2010/05/20/3409978.aspx
12-19, Common Outlook 2003 issues with Exchange 2010: http://msexchangeteam.com/archive/2010/04/23/454711.aspx

Objects Available to the Scripting Agent

2011-08-11T10:10:00.001-05:00

The Scripting Agent uses $ProvisioningHandler and $readOnlyIConfigurable to represent objects available during an action. I could not find any documentation on these objects and did some experimentation. The following is my results:

The variable $ProvisioningHandler contains information about the cmdlet being executed. This includes the name of the cmdlet, parameters for the cmdlet, and the user that ran the cmdlet.
The name of the cmdlet is stored in $provisioningHandler.TaskName
The user running the cmdlet is stored in $provisioningHandler.UserScope.UserID
The parameters passed to the cmdlet are stored in $provisioningHandler.UserSpecifiedParameters[“PName”] where PName is the name of the parameter that was passed. For example, Identity and Alias are common parameter names that would be used in place of PName.
The variable $readOnlyIConfigurable contains the properties of the object being acted upon. For example, when using the Set-Mailbox cmdlet, $readOnlyIConfigurable contains the object for the mailbox being modified. The values listed are those about to be applied, not the current values of the object.
The content of these variables can change depending on the ApiCall being used. For example, when using the Validate ApiCall the $readOnlyIConfigurable variable is populated but when using the OnComplete ApiCall the $readOnlyIConfigurable variable is empty. I’ve not tested all of the possible permutations.

The following example of ScriptingAgentConfig.xml shows how you can check the data available to you for various cmdlets:

As far as I can tell, it is not possible to have actions of the Scripting Agent displayed on the screen. However, you can have it dump to text file as shown in the example. I also attempted to get more information about the objects by using Get-Member, but no information was returned. You can modify this example to see what information is available for each of ApiCall options and different cmdlets. Each time you run it, any previous text files are overwritten.

ScriptingAgentConfig.xml Syntax

2011-08-10T14:32:00.000-05:00

The Scripting Agent for Exchange 2010 SP1 uses ScriptingAgentConfig.xml to define additional content used when running specified cmdlets. This file needs to be located in in C:\Program Files\Microsoft\Exchange\v14\Bin\CmdletExtensionAgents. This file uses the following generic format:

Line 1 <?xml version “1.0” encoding=”utf-8”?>
Line 2 <Configuration version=”1.0”>
Line 3 <Feature Name=”YouPickName” Cmdlets=”CsvList”>
Line 4 <ApiCall Name=”NameOfAPI”>
Line 5 The script goes here
Line 6 </ApiCall>
Line 7 </Feature>
Line 8 </Configuration>

Description of example:

Line 1 defines the version of XML . This line is always here and always the same.
Line 2 opens the configuration tag. The configuration tag exists once in the file.
Line 3 opens the feature tag. There can be multiple feature tags in the file. Each feature tag has a name that you define. The name needs to be unique, but can be anything that makes sense to you. Each feature tag also has a list of cmdlets that it applies to. If the feature applies to multiple cmdlets the they are separated by commas.
Line 4 opens the ApiCall tag. This defines how/when the following script is used. The name defines the ApiCall that is used. Valid values are: ProvisionDefaultProperties, UpdateAffectedIConfigurable, Validate, and OnComplete. Multiple ApiCall tags can be used in each feature tag.
Line 5 the script within the ApiCall tag is run when defined by the ApiCall name used. This is a PowerShell script that is typically short, but can be complex. It can include ligic structures such as if statements. It can also use data in the ProvisioningHandler and IConfigurable objects. These objects contain information about the request.
Lines 6-8 close the open tags started in Lines 2-4. Notice that these tags are nested and the last tag to be opened is the first tag to be closed.

You can also use the <Common> </Common> tag to define functions that are used by scripts within multiple feature tags. The common tag is placed inside the configuration tag at the same level as the feature tag, but not inside the feature tag.

I suggest liberally using comments within your xml file to document what each section is doing. For a single line the # symbol designates a comment. Block quotes are done by placing content within <!-- -->.

I will be posting some specific examples with explanations. You can also view the example file that comes with Exchange 2010 sp1 at C:\Program Files\Microsoft\Exchange Server\V14\Bin\CmdletExtensionAgents\ScriptingAgentConfig.xml.sample.

Customize Exchange Cmdlets

2011-08-10T13:28:00.000-05:00

There have been many times in class when students have asked me if there is a way to change default settings in Exchange 2010 when perform task such as creating users. If you had asked me two weeks ago, my answer would have been: “Nope. You’ll need to modify those users after you create them.” Turns out I was wrong.

Exchange 2010 SP1 includes a component called the Scripting Agent. The Scripting Agent lets you define scripts that run when specific cmdlets, such as New-Mailbox, are used. Since the Exchange Management Console (EMC) runs cmdlets in the background, this will apply there too.

First you need to enable the Scripting Agent:

Enable-CmdletExtensionAgent “Scripting Agent”

Next, you need to create an XML file that defines the scripts to be run and for which cmdlets. The file must be named ScriptingAgentConfig.xml and located in C:\Program Files\Microsoft\Exchange\v14\Bin\CmdletExtensionAgents. I’ll post some examples later. In this post I will limit myself to describing generally what it can do.

Each time a cmdlet is used, the ScriptingAgentConfig.xml file is checked to see whether there is a script defined for the cmdlet. If there is a script defined for the cmdlet, it is executed. There are four ways a script can be run. The documentation refers to these ways as APIs.

ProvisionDefaultProperties. This is exactly what you think it is. It lets you define default values for cmdlets parameters. For example, you could specify a default OU when creating new users. If a user running the cmdlet provides values, they override the defaults that you provide with this API.
UpdateAffectedIConfigurable. Instead of providing defaults, this will overwrite values provided by the user running the cmdlet.
Validate. This API is called just before the cmdlet writes data. The intent of this is to validate data that is being written before it is actually written. Your script provides the validation. If the script runs without errors, then the cmdlet proceeds to write data. Otherwise, your script needs to generate the error if the conditions you specify are not met. For example, you could verify that a valid database has been specified for a new mailbox to prevent it from being randomly assigned to a database.
OnComplete. This API is called after the cmdlet is complete. This provides you with an opportunity to modify setting related to the original cmdlet, but not part of the original cmdlet. For example, after creating a new mailbox, you could set calendar settings that are not possible with the New-Mailbox cmdlet.

After you create ScriptingAgentConfig.xml, you need to copy it to all of your Exchange 2010 SP1 servers.

Microsoft provides some very limited documentation here: http://technet.microsoft.com/en-us/library/dd297951.aspx

Exchange 2010 Management Pack for SCOM

2011-08-09T09:18:00.000-05:00

In April 2011 Microsoft released an updated management pack for System Center Operations Manager (SCOM) and Exchange Server 2010. The new version of the management pack is designed for Exchange 2010 SP1 and should be implemented by anyone monitoring Exchange Server 2010 SP1.

The installation of the management pack is fairly well documented, but for some reason I found it difficult to pull out the information that was relevant to me. So, here is my summary of important points for implementing the Exchange Server 2010 Monitoring Management Pack (http://www.microsoft.com/download/en/details.aspx?id=692)

SCOM 2007 R2 should be at minimum cumulative update 1 (KB974144) . There is a different patch level for SCOM 2007 SP1 (KB971541).
The SCOM agent installed on the Exchange servers should be at minimum rollup update 1.
SCOM agents need on the Exchange servers need to have the Agent Proxy enabled on the Exchange servers will not be discovered properly.
The management pack is distributed as an MSI file. When you run the MSI file, it installs the correlation engine and unpacks the management pack files that need to be imported into SCOM (C:\Program Files\System Center Management Packs). This should be done on the root management server.
There are 32-bit and 64-bit versions of the management pack. You should use the appropriate version based on the version of Windows that you are running.
The documentation of the previous version of this management pack referenced preventing Exchange 2010 DAG members from being monitored as a cluster. This was not required at that time and the reference has been removed from the documentation in this version.
The management pack runs many TEST-* cmdlets as part of monitoring Exchange 2010. Some of these will fail if test mailboxes have not been created by running New-TestCasConnectivityUser.ps1. This should be done for each Active Directory site you want to monitor.
You cannot override alerts generated by this management pack. You must use the health explorer to identify the monitor that is causing the alert and override the monitor. Generally you should override only for specific servers or groups rather than disabling the monitor.
A new monitor is created that monitors the version of SCOM agent for all servers. This monitor identifies any server that does not have the minimum version of SCOM agent required by the management pack and generates an alert. It is preferred to update the SCOM agent on all servers to prevent this from happening. However, you can also modify the monitor to apply only to Exchange servers as per this blog posting: http://anandthearchitect.wordpress.com/2011/04/02/scom-critical-hotfixes-required-for-reliable-operation-of-the-exchange-server-2010alerts-on-wrong-servers/.

*As a note, I'm told that the product group for Operations Manager hate the acronym SCOM, but for some reason I can't help myself.

Static RPC Ports for Exchange 2010

2011-08-04T09:03:00.000-05:00

By default Exchange 2010 uses a dynamic range of ports for RPC communication between Outlook clients and CAS servers. In most cases, dynamic ports are fine. However, you may want to configure static ports if there are firewalls between the clients and the CAS servers or to optimize load balancing. I was recently part of a project where we set static ports to optimize and simplify load balancing.

You can configure static ports for RPC client access, the address book service, and public folders.

A few notes to be aware of:

The registry key for the address book is a string (REG_SZ) not a number (REG_DWORD).
The registry key for public folders needs to be configured on the Mailbox server with the public folder database because clients communicate directly with the information store to get public folder data.
The ports for RPC client access and the address book service are configured on CAS servers. All CAS servers should be configured with the same port to support load balancing.
The method for changing the address book static port changes from Exchange 2010 RTM and SP1. The value from RTM is not retained when SP1 is installed.
You can verify the static ports have taken effect by using netstat or Resource Monitor. Both of these utilities allow you to view listening ports and the executable that is listening.

This article has the details about which registry keys need to configured: http://social.technet.microsoft.com/wiki/contents/articles/configure-static-rpc-ports-on-an-exchange-2010-client-access-server.aspx

Hyper-V High Availalbility for Small Business

2011-07-27T15:06:00.000-05:00

Many of our small business clients are still running older hardware with Windows Server 2003 or SBS 2003. Since the hardware is pretty much end of life, these clients are looking at both hardware and software upgrades. As part of this process, we are introducing the option of virtualization for many of them. Often even small businesses have multiple servers and virtualizing them on a single host makes a lot of sense for hardware costs.

Everyone likes the idea of high availability for virtual machines running on Hyper-V, but the price is always a concern.We recently researched this for a client and I thought I'd pass along high level estimates of the costs involved.

2 x Dell PowerEdge 510, dual processor, 48 GB RAM, quad port nic, 2 small mirrored drives, Windows Server 2008 Enterprise @ $6000
1 x Dell MD3200i (iSCSI) SAN with 8 x 600 GB 15K drives @ $15000
1 x 24-port 1Gbps switch for SAN network @ $400

When taxes are added in the total cost is about $30,000. In this configuration there is room to grow as the server RAM can be increased. The MD2300i can also hold an additional 4 hard drives if required.

The question becomes....Is this worth it? A single PowerEdge 510 with disk equivalent to the MD3200i listed above is about $9000. That is a lot less money overall.

Most smaller organizations don't have difficulty getting a maintenance window to apply updates on the virtualization hosts. So, the ease of maintenance where you can failover VMs to another host when updating the host operating system is of little benefit. Convenient, but certainly not important for most small organizations.

The server hardware components most likely to fail are disks and power supplies. These component are already redundant on any server that we sell. Consequently the risk of downtime due to hardware failure is already quite low. However, there is a small chance that other critical components such as a motherboard could fail and take down all of virtual machines. Each business needs to decide what the cost of that downtime is and whether they are willing to risk it. One way to mitigate the cost of downtime is increasing warranty service. For example, instead of next day service increase the warranty to 4 hour service. Or for the truly paranoid a second server with just hardware and less drives would be about $4000. You could keep that hardware as spare parts for quick recovery at a much lower cost that a full high availability

For right now, our clients have been willing to take the risk of outages for the cost savings. However, I should note that having a functional disaster recovery plan is an important part of this decision process. That plan identifies realistic time frames for recovery ins various scenarios and allows you to make intelligent decisions.

Unable to Edit SharePoint Document Library Template

2011-07-23T14:09:00.000-05:00

This week I ran into an issue where a client was unable to edit the document template being used by a SharePoint 2010 document library. In the Advanced Settings of the document library, the user would click Edit Template (see figure below), but the document would open as read only and could not be saved back up to the site.

The user was logged on to SharePoint as a user with administrative privileges for the SharePoint server, but logged on to Windows as a different user account. This was the cause of the problem. When the user opened the document template, Word started and retrieved the template, but Word was using the credentials from Windows which did not have administrative privileges on the SharePoint server.

The fix was to have user log on to Windows using the same account as used for administration on the SharePoint server.

Accidential McAfee Security Scan Plus

2011-06-19T12:36:00.000-05:00

I recently downloaded a new version of Adobe Flash Player or possibly Adobe Reader. Imagine my surprise when the Adobe Download Manager reports that in addition to installing Flash, it also installed McAfee Security Scan Plus. At the time I assumed that perhaps this was done only to secure the download process and didn't think much of it. At the time I did not see an option to not select this software, but it may have been there.

It turns out that this is security scanning software from McAfee. And while it is legitimate software, it only scans for threats and does not prevent or remove them. On their web page it is promoted as a "Free Download" and it "Actively checks your computer for anti-virus software, firewall protection, and web security, and threats in your open applications."

On the same page is a large link for "McAfee Virus Removal Services". Described as "McAfee Virus Removal Service detects and eliminates viruses, Trojans, spyware and other malware from your PC easily and quickly in the comfort of your home" for the low low price of $89.95.

So we'll try to lure you in with free software. In this case Adobe is complicit. And then after we find some sort of issue we will try to get $89.95 out of you because you don't know any better.

Needless to say, I've removed this software because I already have antivirus software running on my computer. There is an option to uninstall in the Programs menu.

I will be more diligent when downloading from Adobe in the future.

Exchange 2010 Management Tools Not Working

2011-06-09T09:43:00.000-05:00

We recently took over support for an SBS 2011 server that is having issues (to put it politely). Our first indication that we have a problem was the Exchange Management Console and Exchange Management Shell not running properly. When EMC or EMS started, we'd get the following error.

Connecting to remote server failed with the following error message: The WinRM client cannot process the request. It cannot determine the content type of the HTTP response from the destination computer. The content type is absent or invalid. For more information, see the about_Remote_Troubleshooting Help topic.

The exchange online help indicated that this can be cause by a user not having remote powershell permissions. The EMC and EMS in Exchange 2010 use remote powershell which requires WinRM to be properly functional. The exchange help suggests running set-user userid -PowerShellEnabled $true. However, you can't without the EMS properly loaded. Following several documents, I attempted to verify that WinRM was properly configured and ran both Enable-PSRemoting and WinRM quickconfig with no fix.

Then I tried accessing just the main server web site at http://127.0.0.1 and found the following error.

HTTP Error 500 - Internal Server Error Calling LoadLibraryEx on ISAPI filter "C:\Program Files\Microsoft\Exchange Server\ClientAccess\owa\auth\owaauth.dll"
Error code: 0x8007007e

This needs to be fixed because the EMC and EMS find WinRM by accessing the /PowerShell application in the Default Web Site.

After doing some more research I found that this is often a result of IIS not being properly configured. For Exchange 2010 CAS servers you should not enable 32-bit code. It should be 64-bit only. If you enable 32-bit code then you need to edit the applicationhost.config file and add the option preCondition="bitness64" in several lines for 64-bit DLLs that need to be loaded. This may be rewritten when you apply Exchange 2010 updates and is not recommended or required for Exchange. I made sure that 64-bit only was enabled by running cscript.exe C:\Inetpub\AdminScripts\adsutil.vbs set W3SVC/AppPools/Enable32BitAppOnWin64 FALSE.

What finally got IIS functional again is copying extrace.dll from the Exchange bin folder to C:\Windows\System32. For some reason, this allowed IIS to find it and consequently load owaauth.dll properly.
At this point, the Application log showed a WinRM error for an Exchange as follows:

Request processing failed because the WinRM service cannot load data or event source: DLL="%ExchangeInstallPath%Bin\Microsoft.Exchange.AuthorizationPlugin.dll"

After doing a quick bit of searching, it turns out that this is a result of the variable %ExchangeInstallPath% not being defined on the server. Defining a System variable ExchangeInstallPath with a value of C:\Program Files\Microsoft\Exchange Server\V14\ fixed it up.

Some links I found useful when troubleshooting this issue:

When Do You Need the Enterprise Edition of Exchange 2010?

2011-06-07T14:50:00.002-05:00

I've run into a lot of confusion lately about when you need to Enterprise versions of Windows Server 2008 and Exchange 2010. It's actually very straightforward to decide. You need to ask two questions:

Will there be more than 5 databases on a Mailbox server? If yes, you need Exchange 2010 Enterprise edition.
Will you have a database availability group (DAG)? If yes, then you need Windows Server 2008 Enterprise edition for each Mailbox server in the DAG.

That's it!

The only difference between Exchange 2010 Standard edition and Exchange 2010 Enterprise edition is the number of databases supported on each Mailbox server. There are no other differences. Database physical size is unlimited for both versions. DAGs are also supported on both versions.

A DAG requires the failover clustering feature that is only available in the Enterprise edition of Windows Server 2008. Failover clustering is configured and managed by the Exchange management tools, but it needs to be there.

It's worth noting from a design perspective that if you have a DAG and at least three copies of the database, then you can consider going backupless. In which case, you will likely use fewer large databases. Consequently, you often do not need the Enterprise version of Exchange Server building a DAG.

There is also an Enterprise Client Access License (CAL) for Exchange 2010. This CAL is required for all users accessing premium features. This includes unified messaging, the new personal archive feature, per mailbox journaling, and a number of other things. The Exchange Management Console identifies features that require an Enterprise CAL. A reference is here:

http://www.microsoft.com/exchange/en-us/licensing-exchange-server-email.aspx#Exchange2010CAL

Finally the new retention policies and personal archives require not only Outlook 2010, but specific versions of Outlook 2010. Retention policies are implemented on the server side, but user tagging is unavailable with the incorrect version. Personal archives are visible only in the correct version of Outlook 2010. A version reference is here:

http://office.microsoft.com/en-us/outlook-help/license-requirements-for-personal-archive-and-retention-policies-HA102576659.aspx

Exchange 2010 Server Not Added to Exchange Server Security Group

2011-06-07T14:30:00.000-05:00

During the installation of Exchange 2010, the computer account for the Exchange Server is added to the Exchange Server security group. This ensures that Exchange 2010 on that server has access to any necessary information in Active Directory.

In most cases, computer names are unique between domains. However, if the computer that Exchange 2010 is being installed onto has the same computer name as a computer in another domain in the forest, the process of adding the new Exchange 2010 server to the Exchange Servers security group fails and the installation of Exchange 2010 fails.

This error occurs based on an Active Directory search for the computer name. So, the computer account with the conflicting name may be left over from a long time ago.

Easy solution, if the conflicting computer account is no longer required, then remove it. If the conflicting computer account is required, then rename your server before installing Exchange Server 2010.

Unable to Delete Exchange 2003 Mailbox Store

2011-06-01T12:51:00.000-05:00

Several times during Exchange 2003 to Exchange 2010 migrations, we've run into an issue where we are unable to delete the last mailbox store before uninstalling Exchange 2003. We receive a message like:

One or more users currently use this mailbox store. These users must be moved to a different mailbox store or be mail disabled before deleting this store.

ID no: c1034a7f
Exchange System Manager

However, when we use System Manager to view the list of mailboxes, only system mailboxes are displayed. The system mailboxes do not need to be deleted before the mailbox store can be removed. There are references to the mailbox database in Active Directory that may or may not be valid.

The easiest way to identify the user accounts with references to this database is by using a query in Active Directory Users and Computers. Create a custom query and enter in the following LDAP syntax:

(&(mailnickname=*)(msExchHomeServerName=*OldServerName*))

This query search identifies mailboxes hosted on OldServerName. Since we are down to a single mailbox database on that server, it is unique enough to get us the information we need. Microsoft also has a list of other methods at http://support.microsoft.com/kb/279202/en-us.

After you identify the users with invalid references, you need to remove the references. In some cases, you can delete the mailbox from the user in Active Directory Users and Computers. Other times, you need to remove Exchange attributes from the user.

After you have cleaned up the Exchange information in the user accounts identified by your query, you should be able to delete the mailbox store and complete removing Exchange 2003.

Reparing Startup in Windows 7

2011-05-21T21:33:00.000-05:00

The best and fastest way to repair startup in Windows 7 is to use the Startup Repair tool available on the install DVD. This tool automatically scans your system, finds the cause of the problem, and repairs the problem without user interaction. I've only ever had to run this tool once to repair a system, but I've read in some blogs that depending on the exact nature of the problem, it may take up to 3 Startup Repair attempts to completely fix the problem.

Generally speaking, if Windows 7 won't start, it is likely this tool will help. It can perform tasks such as:

replace missing boot files
update the master boot record
update the boot sector
repair the boot configuration database (BCD)

Things this tool will not do:

repair driver issues
remove invalid operating system files added by malware
remove faulty services

To access Startup Repair, you need to:

Boot from the Windows 7 DVD
Click Repair your computer.
Click Use recovery tools that can help fix problems starting Windows.
Click Startup Repair.

You can manually perform some of the same repair tasks by using the Command Prompt option and the Bootrec.exe tool. You can use Bootrec.exe to:

Fix the MBR without losing the partition table (bootrec.exe /FixMbr)
Fix the boot sector to load bootmgr (bootrec.exe /FixBoot)
Scan disks for Windows installations (bootrec.exe /ScanOs)
Add all Windows installations to the BCD (bootrec.exe /RebuildBCD)

To perform tasks where you need to go back to a previous state, using System Restore is your best best. This tool restores Windows 7 system files (OS updates, registry, and drivers) and programs back to the time of the restore point that you select. It does not affect data such as documents. System restore points are created periodically and each time updates are installed. This tool can be useful for removing malware if you can identify the approximate date of installation.

You can perform a System Restore from inside Windows 7. Or, if the system is too unstable to perform a System Restore from inside Windows 7, you can boot from the Windows 7 installation DVD and perform a System Restore from the same menu as a Startup Repair.

Troubleshooting 0x8004010f in Outlook

2011-05-10T15:16:00.000-05:00

If you are reading this post, I assume that you are experiencing error 0x8004010f in Outlook when syncing the address book to Exchange 2007 or Exchange 2010. This is a result of the client computer not being able to contact the web service providing the offline address book.

The most common reason this occurs is that autodiscover is not configured properly. If autodiscover is not configured properly then the URL for the offline address book is never passed on to non-domain joined clients. This error is not typically an issue for domain joined computers because they locate an SCP object for autodiscover in Active Directory and the query the autodiscover service for the correct configuration information.

Non-domain joined computers locate the autodiscover service based on a DNS name or SRV record. The two URLs used for locating autodiscover are:

https://myemaildomain/autodiscover/autodiscover.xml
https://autodiscover.myemaildomain/autodiscover/autodiscover.xml

Using either one of these options requires you to an SSL certificate on your server that supports multiple host names. These certificates tend to be quite expensive. So, if you're cheap like me, the other alternative is to create an SRV record that points to the autodiscover service instead. You can use this to point at the DNS name already in your certificate. The following is a screen shot of the SRV record I've created in our DNS hosting at GoDaddy (click it to see the whole thing).

A client recently had another issue with this error being received on a single domain joined Windows XP computer. Because the error was affecting only a single computer, it was quite puzzling. It turned out to be proxy settings that were pushed out as registry changes. The proxy was not visible in the IE Internet Options. However, you could view it by using the Proxycfg.exe tool. This tool is depreciated in Windows 7 and it is now recommended to use netsh instead (http://wmug.co.uk/blogs/r0b/archive/2010/01/08/proxycfg-on-vista-and-win2008.aspx).

Exchange 2007/2010 with Single Name SSL Certificate

2011-04-25T16:05:00.000-05:00

One of the ongoing pain points in implementing Exchange 2007 and Exchange 2010 is the need for a SAN certificate with multiple names in the certificate. Exchange 2007/2010 has web-based services for free/busy searches, offline address book downloads, and autodiscover. By default it is assumed that the name used internally is different from the name used externally. This results in the need for a certificate with multiple names.

From a technical perspective, this is fine. From a cost perspective this is less desirable. A SAN certificate costs in the range of about $350 per year from a Microsoft supported vendor or about $80 per year from GoDaddy.

If you want to use an existing single name SSL certificate, you can. You just need to change the names for the URLs to all match.

First, install your certificate in IIS for the web site hosting the Exchange services. In a standalone install of Exchange Server 2007/2010, these are in the default web site. In SBS 2008, it is a site named SBS Web Applications.

There are a number of article with the syntax for setting the internal URL for the necessary services to support Outlook with a single label SSL cert. They recommend that you change the internal URL to match your external URL. Something like https://mail.conexion.ca/OAB.

Here is the issue I just had. With the internal URL as https://mail.conexion.ca/OAB on an SBS2008 box, the client credentials were not automatically being passed up to web services. The user was being prompted for a login. I believe this is because a name that is not a single label name is not considered part of the Intranet zone (think IE security zones) and the credentials cannot be automatically passed on. So, we change the URL to http://sites/OAB and all was good.

Two things to note about this:

SBS 2008 already had sites set up as a host header for the SBS Web Applications site. Otherwise, you would need to configure at least DNS resolution for your site.
HTTP is used on the assumption that SSL is not required internally. We needed to do this to get a single label domain name. If we didn't the name wouldn't match the certificate and the users would get warnings about certificate errors.

All told, this seemed a bit weird today, but this is what got the job done and the client working properly.

The simple way is to just use a SAN certificate to begin with and avoid the weirdness. GoDaddy is not officially supported, but it does work. Otherwise, Digicert is the cheapest of the officially supported certificate providers.

Free Windows iSCSI Target

2011-04-15T11:52:00.001-05:00

For years, Microsoft has had iSCSI target software that lets a Windows Server act as shared storage for clustering. However, this software was only available as part of the Windows Storage Server and you couldn't use it in production environments (unless using an actual Windows Storage Server). As of April 2011, the target software is now available for free and supported in production use!

You can use this for:

highly available VMs
clustering of file and print services
testing environments

I know I'll definitely be using this in classes where we do high availability of VMs. Not sure about the production side yet.

Check it out: http://blogs.technet.com/b/canitpro/archive/2011/04/05/the-microsoft-iscsi-software-target-is-now-free.aspx

Temporary Profile in Windows 7

2011-04-08T10:58:00.000-05:00

I'm not sure if there is any real world relevance to this because I created my problem as part of messing around while creating a lab activity. But on the off chance it's useful to anyone.....

Steps to force a user to have a temporary profile:

Log on as an Administrative user.
Delete profile folder for user from C:\Users

Basically, we manually deleted the profile without informing Windows. So, Windows still thinks the profile is there. You should delete a profile from the System Properties Advanced tab. However, if you try to use this now, the deleted user profile is not listed.

To resolve the issue, use Regedit. The list of profiles is maintained in:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Each profile has it's own key based on the SID of the user. To identify the key for the failing profile to delete look at the ProfileImagePath value. This value is the file path to the profile and contains the name of the user.

After you've identified the correct key, delete it. On next logon the user profile should be created and work correctly.

Exchange Anonymous Relay for External POP User

2011-04-05T11:46:00.000-05:00

I have a friend with an office that is prone to flooding in the springtime. This year, she has moved her office before the flood hits, just in case. She uses a POP account with a third party, not her ISP. However, she uses the SMTP host of her ISP. Basically, she downloads messages from the mail provider and then sends them out through her ISP SMTP host.

One of her clients has been kind enough to provide temporary office space for the next month or so. Unfortunately the ISP servicing this office does not allow anonymous relaying. So, I offered to setup relaying for her on our Exchange 2007 server.

Initially I though it would be as easy as creating a mailbox to allow for authentication. It was a bit more complex than I expected.

Here are the steps that were required:

Create an exchange mailbox for authentication of her traffic (we'll call it EXTERNAL). The POP client authenticates outbound traffic with this username and password. The email address of the account is never used, but is EXTERNAL@mydomain.com.
Add her domain (herdomain.com) as an accepted relay domain. Without this Exchange will not send out the message. Exchange will look at the source email address and error out indicating that it is not allowed.
Create a contact for heremail@herdomain.com.
Give EXTERNAL SendAs permission for the contact hermail@herdomain.com. If this step is not performed you will get an error about not having SendAs permission.

At that point it was good to go. The POP client is authenticated which avoids the need to create an anonymous relay which is inherently risky. And Exchange allows a message from hermail@herdomain.com to be sent out because it is an accepted relay domain and because EXTERNAL has SendAs permission.

You can't configure Send As permission for a contact in EMC. You can do it either in EMS or AD Users and Computers.

RDP for Win7 not working

2011-03-28T13:55:00.001-05:00

I recently ran into an issue where my laptop running Win7 would not properly connect to a terminal server. The TS is load balanced with some Win2008 servers and some Win2003 servers. Regardless of the server I was directed to, I got the following error:

The remote computer disconnected the session because of an error in the licensing protocol

When you do Google searches, many of them talk about removing a licensing key in the registry. However, this did not work.

The eventual fix was to run Remote Desktop as Administrator. Then it connected fine. I can only assume it needed the elevated priviledges to modify the necessary registry keys. However, that is an assumption and I have no facts to back that up.

Free Wi-Fi Analysis Tools

2011-02-18T10:33:00.000-06:00

I'm putting in a Wi-Fi network for a clieent in a couple of weeks and need to a good way to find out whether we are placing the access points properly. So, being the somewhat cheap guy that I am, I've gone looking for free tools and found a couple of good ones:

inSSIDer (http://www.metageek.net/products/inssider/)
Heat Mapper (http://www.ekahau.com/products/heatmapper/overview.html)

The first one I looked as was inSSIDer. This is a nice survey tool that shows you all of of the wireless networks that it sees, the signal strength, and what channel each is on. I like this one for getting an idea of what is currently on a site. This one is open source, and can hook into a serial port based GPS. An advanced paid version can also look for sources of interference.

Heat Mapper is a site mapping tool that you can use to identify signal strength at various locations in your organization. First, you import a graphic with your floor plan. Then you wander around with your laptop running Heat Mapper and click on the map corresponding to where you are. When you are done, it generates a map that shows signal strength in different areas on the map. It is displays much like a topographical map. There are more advanced paid versions of this product, but this one does a nice job for free.

I'm going to be keeping both of these tools on my laptop.

Cheap Exchange 2010 Storage

2011-02-09T14:54:00.001-06:00

I continually run into resistance when discussing the idea of ditching the SAN and using direct attached storage (DAS) for Exchange 2010 implementations. There are a number of reasons that are thrown out there ranging from reliability to managability. However, in my opinion, in most cases, all of those issues can be overcome. At the very least you owe it to yourself and your organization to consider the possibility of saving some large $$ by implemementing multiple data copies in a database availability group (DAG) with DAS rather than using an expensive SAN.

This is one of the best posts I've seen regarding storage for Exchange 2010: http://msexchangeteam.com/archive/2011/01/07/457471.aspx

Using Network Monitor Captures in Wireshark

2011-02-07T20:35:00.001-06:00

I'm a big fan of packet sniffing for troubleshooting. Just today I was trying to resolve a problem with a SharePoint site behaving inconsistently. Sometimes and only for some computers, the site would not open. After putting a packet sniffer on it, it appears to be a network problem as there are a lot of packets being resent and a lot of duplicate ACKs.

My two favorite programs for packet sniffing are both free:

Wireshark (open source)
Network Monitor (Microsoft)

Both of these packet sniffers are good, but each has difference strengths.

I was pleasantly surprised today to find out that if you save a capture in Network Monitor, that you can open it in Wireshark. This gives the ability to look at the same data in both tools. Sometimes the way one tool interprets or displays the data is easier to understand when you are looking at something specific.

Manually Restoring Registry Files (offline System Restore for XP)

2011-01-18T14:26:00.000-06:00

The process in this post is not relevant for Windows Vista or Windows 7. For Windows Vista or Windows 7, boot from the installation DVD and perform a repair. The repair process can perform a system restore.

I recently had an unbootable computer that complained about registry corruption on startup. I attempted a last known good for recovery but it didn't work. Which makes sense because last known good works within the registry rather than replacing registry files. A system restore on the other hand replaces the registry files, unfortunately I couldn't get the system bootable to the point of performing a System Restore.

Here is how I replaced the registry files manually:

Boot the computer from a bootable DVD such as WindowsPE or Ultimate Boot CD 4 Windows.
Browse to C:\Windows\System32\Config and rename:

DEFAULT
SAM
SECURITY
SOFTWARE
SYSTEM

Change security on C:\System Volume Information to allow Administrator access
Browse to C:\System Volume Information\_restore{xxxxx}\RPxxx\Snapshot (choose the RPxxx folder based on time of creation)
Copy the following files to C:\Windows\System32\Config and rename to match step 2.

_REGISTRY_USER_.DEFAULT
_REGISTRY_MACHINE_SAM
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM

Reboot and good to go.

It's a pity I'm learning this as Windows XP is slipping out the door. However, this has only become relevant in the last few years when a lot of XP machines are starting to have registry corruption issues due to failing drives.

ImageX Gotchas

2011-01-18T14:07:00.001-06:00

As of late, ImageX has been my imaging software of choice. Mostly because it is free and I already have it installed. I've been using it to move existing computers to a new drive when a hard drive starts to report errors.

To use ImageX, I attach the drive to my server by using an external USB case. Then run imagex /capture to gather data from the drive. Then I use imagex /apply to put the image down onto the new drive also attached via USB.

The first few times I did this, I was worried the MBR on the new disk would not be configured correctly, but no special preparation is required. Just format the disk ahead of time and mark the partition active.

System Restore Files Not Captured
The files used by System Restore are not captured by the default configuration of ImageX. I was moving to a new drive and then planning on repairing Windows XP. Not such a good plan. This forced me to manually copy system restore registry files from the old drive to the new drive by using a boot CD. However, despite the pain, the system started booting again.

System Restore files are stored in C:\System Volume Information. By default only System has permission to read that folder. To image the files, you may need to modify those permissions. You will definitely need to create a configuration file for ImageX to specify that the folder should be included in the image. Documentation on creating the configuration file is here: http://technet.microsoft.com/en-us/library/cc766147(WS.10).aspx

Don't Forget the Utility Partitions
The hard drive I was capturing data from yesterday had a utility partition installed by the manufacturer in addition to the operating system partition. However, I forgot all about the utility partition and only moved the operating system partition. Then the new drive would not boot.

To get the system bootable, I needed to edit the boot.ini file on the root of C: to point at the single existing partition. The original arc path was pointed at partition 2, I needed to point it at partition 1 as in the example below:

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Professional" /fastdetect

Unable to Run New-TestCASConnectivityUser.ps1

2010-12-10T15:59:00.000-06:00

I don't normally run the test cmdlets on most Exchange installations. The installation I'm working on this week just installed the Exchange 2010 Management Pack for SCOM. The default installation for this management pack runs the test cmdlets every 5 minutes.

By default Exchange 2010 does not have users created to use for the testing done by some of the CMDlets. So, you need to run new-testCasConnectivityUser.ps1 from the scripts folder to create them.

This script normally creates users in the "users" container. However, it uses a relative path which fails if there are multiple "users" OUs in your AD structure.

To resolve the issue, either make the "users" container unique or edit the script to use the distinguished path "CN=Users,DC=domain,DC=com"

However, this guy figured it out first: http://www.snowland.se/2010/01/19/problems-with-new-testcasconnectivityuser-ps1/

Exchange 2010 in a Secure Environment

2010-12-06T13:10:00.000-06:00

I'm performing a new installation of Exchange 2010 for a large organization this week and ran into a couple of security related issues that were interesting.

This organization limits the processes that can run on computers and when performing the installation, we are domain admins, but not the "Administrator" account. Because we are not the "Administrator" account, UAC applies.

Issue #1
Installation failed because the ngen.exe service was disabled. Ngen.exe is used to compile .NET code to make it run faster. This service was disabled as per the security rules. This prevented the original installation and likely would have prevented installing the rollup update as it spent a lot of time compiling .NET code.

I'm not sure if this is an issue only when not using Administrator. Obviously in production, I'm not going to test all the possible permutations.

The relevant part of the exchange setup log is here:

[12/01/2010 21:52:06.0346] [2] Active Directory session settings for 'precompile-ManagedBinary' are: View Entire Forest: 'True', Configuration Domain Controller: 'dc.nowhere.com', Preferred Global Catalog: 'dc.nowhere.com', Preferred Domain Controllers: '{ dc.nowhere.com }'
[12/01/2010 21:52:06.0346] [2] Beginning processing precompile-ManagedBinary -BinaryName:'C:\Program Files\Microsoft\Exchange Server\V14\bin\microsoft.Exchange.PowerShell.configuration.dll'
[12/01/2010 21:52:06.0361] [2] Starting: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe with arguments: install "C:\Program Files\Microsoft\Exchange Server\V14\bin\microsoft.Exchange.PowerShell.configuration.dll" /queue /nologo /verbose
[12/01/2010 21:52:06.0517] [2] Process standard output: Installing assembly C:\Program Files\Microsoft\Exchange Server\V14\bin\microsoft.Exchange.PowerShell.configuration.dll
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. (Exception from HRESULT: 0x80070422)

[12/01/2010 21:52:06.0517] [2] Process standard error:
[12/01/2010 21:52:06.0517] [2] [ERROR] Unexpected Error
[12/01/2010 21:52:06.0517] [2] [ERROR] Process execution failed with exit code -1.
[12/01/2010 21:52:06.0517] [2] Ending processing precompile-ManagedBinary
[12/01/2010 21:52:06.0517] [1] The following 1 error(s) occurred during task execution:
[12/01/2010 21:52:06.0517] [1] 0. ErrorRecord: Process execution failed with exit code -1.
[12/01/2010 21:52:06.0517] [1] 0. ErrorRecord: Microsoft.Exchange.Configuration.Tasks.TaskException: Process execution failed with exit code -1.
[12/01/2010 21:52:06.0517] [1] [ERROR] The following error was generated when "$error.Clear();
$fullPath = [System.IO.Path]::Combine($RoleInstallPath, "bin\microsoft.Exchange.PowerShell.configuration.dll");
precompile-ManagedBinary -BinaryName $fullPath;
" was run: "Process execution failed with exit code -1.".
[12/01/2010 21:52:06.0517] [1] [ERROR] Process execution failed with exit code -1.
[12/01/2010 21:52:06.0517] [1] [ERROR-REFERENCE] Id=AllRolesPrecompileManagementBinaries___922e3423e7724c0e8892fe798af5ca08 Component=EXCHANGE14:\Current\Release\Shared\Datacenter\Setup
[12/01/2010 21:52:06.0517] [1] Setup is stopping now because of one or more critical errors.
[12/01/2010 21:52:06.0517] [1] Finished executing component tasks.
[12/01/2010 21:52:06.0580] [1] Ending processing Install-Bridgehead

Issue #2
The rollup update for Exchange 2010 SP1 was not UAC aware. So, when we ran it, it failed. Quick and easy fix. Go to a command prompt elevated to administrator and run manaully, just like you'd run an exe file.

Exchange 2010 SP1 on Win 2008 (not as easy as I thought)

2010-11-06T13:55:00.000-05:00

Yesterday was my first time to get an install of Exchange 2010 SP1 up and running in a production environment with Windows 2008 as the OS. I ran into a few hiccups and would like to share.

In this particular project, the original OS install was done by someone else. This may have caused part of my confusion as I didn't closely checkout the installation before starting.

This is an Exchange 2003 environment where Exchange 2010 is being added and coexistence will continue for about a week. Exchange 2010 was installed from the Exchange 2010 SP1 download rather than any sort of upgrade.

During the installation, an option exists to install necessary prerequisites. I figured I'd try it out and see. Unfortunately, even on a fully patched Windows 2008 server, I was still forced to download 6 hotfixes and additional chunks of software. I don't recally downloading any of these for Windows 2008 R2. So, it may be OS specific.

The Web server role was added, but did not have the necessary service roles. So, I added everything that was requested by setup. I'm not sure whether the Web server role was added by setup or whether it was preexisting when I started and that is why the setup was off.

When the installation was done, I patched it with rollup 1 for Exchange 2010 SP1. Finally it's time to test.

The first big issue was OWA not working properly on Exchange 2010. It went to a blank page instead of providing the logon screen and no errors were generated. It turns out that the Web server role did not have redirection or static pages enabled. I enabled both and then it worked fine. I'm not sure that the static pages were required as it appeared to be a redirection issue, but since it's a normal option to me, I turned it on.

Again, I'm not sure whether the odd IIS configuration was due to the installation routine or the original setup performed by another tech. However, it is interesting that Exchange setup did not tell me that the redirection was required. And it definitely is for correct OWA logons with forms-based authentication.

When searching related to my OWA issue, I saw that there are a number of people that have various OWA problems after applying Rollup 1 for Exchange 2010 SP1. However, my issue was not related to that.

My second big issue was that no routing group connector was created between Exchange 2003 and Exchange 2010 as should have been. I created it manually (New-RoutingGroupConnector) and all was good. During my multiple install attempts after applying updates, I seleted the option to reuse the existing installation options. I think the requirement to create the routing group connector may have been lost because of that, but I'm not sure.

The Best Little KVM Cheap

2010-10-26T15:04:00.000-05:00

I've used a number of inexpensive KVM switches in the past, starting way back with the mechanical ones. Until now, I've always found them to be quirky. Often they don't handle higher video resolutions well, or the mouse and keyboard don't reconnect properly on the first try.

Recently we've been buying D-Link KVM-221 2-port USB KVM switches for about $50. I can say this is the first time I've never had any hiccups at all in implementation. It even includes the cables.

Unable to Use a USB Mouse in XP

2010-10-26T11:58:00.000-05:00

I ran into one of the strangest things a while back. An XP computer that could not use a USB mouse. You could plug the mouse in, the drivers would load, but it would not be usable.

Yesterday, I needed to replace the hard drive in that computer. After imaging the new drive I cleaned up some old junk software. One of the things I cleaned up was Flip software leftover from a Belkin KVM. It was running automatically at Startup.

After the Flip software was taken out of Startup, the mouse worked fine.

Oddly, the USB keyboard worked fine whether the software was installed or not.

Word Has Command-Line Switches

2010-09-24T15:42:00.000-05:00

Until today, I had no idea that there were command-line switches (options) that you can use when starting Word.

I have both Office 2003 and Office 2007 installed on my PC. All of the doc files were opening automatically in Word 2003, but I wanted them to open in Word 2007 by default. I tried changing the file association, but it wouldn't take.

My final solution was to run winword.exe /r from the Office12 folder. This re-registered the registry keys for Word 2007.

If you are curious about other Word switches check them out here: http://support.microsoft.com/kb/210565

Blackberry Activation Error with Transport Rules

2010-09-20T15:38:00.000-05:00

A few months ago I spent an entire afternoon trying to figure out why a BlackBerry would not activate with a BES server. Activation failed when the PIN was entered and sent back by the BlackBerry.

As I searched I found a few possible causes:

forwarding on the user mailbox
firewall blocking BES access to blackberry servers on the Internet

None of these applied. Further investigation in the SERVER_MAGT log found this:

[40239] (05/12 01:29:44.514):{0x117C} {Userx@Companyx.com} Still handled by desktop
[30160] (05/12 01:29:44.514):{0x117C} {Userx@Companyx.com} GetDeviceId() did not return a PIN, PIN currently is not set for this user.
[40371] (05/12 01:29:44.514):{0x117C} {Userx@Companyx.com} UserControl::HandleDatabaseChange - CalSyncState is empty
[40442] (05/12 01:29:44.514):{0x117C} User settings: email=Userx@Companyx.com, routing=Userx@Companyx.com, service=, device=, calendar=0, MDS=1, userOTAFM=0, incradle=0, SMIME=0, sentItems=1, dir=Userx, server=Exchange1

As you can see, it is complaining about being still handled by Blackberry Desktop. On further investigation, this really just means that the message coming back from the Blackberry for the activation has been modified. So, the BES server refuses to touch it.

It turned out that there was an Exchange transport rule that was being used for add a CC for all messages delivered to this user. It was configured as an alternative to forwarding in the user mailbox, but had the same effect. After disabling the transport rule activation completed properly.

Disaster Recovery Is Not Just a Technology Issue

2010-09-20T15:08:00.000-05:00

A basic disaster recovery plan for small business (and some larger ones) consists basically of redundancy in the server (RAID, redundant power) and a nightly backup. The theory is that server redundancy protects you most of the time and if that happens to fail, then you get your data from backup. We recently had a server failure just like that but with a twist.

A RAID 5 array failed in a server and took out information that was business critical. The failure occured on an Thursday evening. Reviewing the backup log, the backup Thursday night appeared to complete successfully, but in fact it hadn't. The RAID 5 array failed partway through the backup. This leaves us restoring to Wednesday nights backup. All of Thursday's data changes were lost.

Here is where the twist comes in. This organization scans in historical documents and then shreds them afterwards. After the document has been shredded there is no backup copy except on the computer system. This is one of the databases that was lost.

Because the document is shredded before a backup is taken, there is small window where loss of data is an issue due to only a single failure. To protect that data, shredding needs to be delayed at least one day to ensure there is a good backup. And depending on how paranoid you are, maybe two.

In this case, no documents were processed in the lost window, but it could easily have happened.

Virus and Malware Removal

2010-09-13T09:51:00.001-05:00

There are many web sites out there devoted to removing viruses and malware from your computer. All of them describe long and difficult processes required to identify and remove unwanted software. What makes the removal difficult is that many viruses and malware hide in memory. As you remove infected files from disk, the program in memory adds itself back to another location.

By far the fastest and easiest way to remove viruses and malware is to remove the hard drive and scan it in a different computer. By doing this, you ensure that the virus or malware is not running in memory when the scan is performed. As a best practice you should scan with multiple tools to be sure you catch everything.

I do this by using external USB enclosures for hard drives. I have three separate enclosures for SATA 3.5 inch, PATA 3.5 inch, and PATA 2.5 inch drives. This allows me to externally mount both desktop and laptop drives.

As an alternative, you can boot up by using something like the Ultimate Boot CD for Windows and scan from there. It gets you to the same place, but you are limited to the tools included on that CD instead of your preferred antivirus tools.

Microsoft Exam Vouchers cheap

2010-08-19T11:19:00.000-05:00

If you are at all thinking about doing Microsoft Certification exams, now would be a good time. You can buy packs of discounted exam vouchers that includes a second try on any exam you fail.

The free retry (second shot they call it) means you can study less and just go for it. If you fail the first one, at least you know the gist of the exam content, and you know what to study more.

For more info: http://www.microsoft.com/learning/Career/en/us/career-offer.aspx#certification

iPad for Business?

2010-08-19T08:52:00.000-05:00

I recently had the pleasure of configuring (playing with) an iPad for a client. The iPad itself is a beautiful device and I'm sure there are many useful things you can do with it. For one, the ActiveSync for email works great with Exchange server. Configuring the 3G service was a bit of a pain, but that was due to poor instructions from Rogers.

The real problem with the iPad is that it can't run many business applications, even Web-based ones. The iPad does not support Flash or Silverlight content. These are used for many Web-based applications. You don't realize how many applications until you don't have them.

This client is using the iPad as a remote access device for Terminal Services. They have a Windows application installed on the terminal server that can now be used by sales people on the road. So, the irony is, that iPad is a great remote access device for Windows, but not all that useful by itself.

I installed the iTap Terminal Services/RDP client for the iPad and it works very well. I strongly recommend it for $12.

Edge Transport Servers and Certificates

2010-08-10T11:32:00.000-05:00

First let me say, that I'm not convinced that most organizations require an Edge Transport server for Exchange Server 2007 or Exchange Server 2010. An Edge Transport server is an SMTP relay that sits between your Exchange Server organization and the Internet. The purpose of an Edge server is to isolate Exchange from the Internet and perform anti-spam and anti-virus filtering. Most organizations have another device or service that is already performing this task.

However, if you choose to implement and Edge server, you need to understand that it uses certificates to secure communication between the Edge server and Hub transport server on the internal network. Normally you want certificates to come from a external certification authority so that they are trusted by all computers in the communication process. However, for SMTP between Exchange servers, you can and should use internally generated certificates. This is the default configuration. However, the default certificates expire after 1 year.

The certificate assigned to SMTP for message transport can be (and typically is) different than the certificate you use for SSL on Web services such as OWA. Also, the same certificate cannot be used for SMTP message transport on multiple servers. If the same certificate is used for SMTP message transport on multiple servers, communication will fail with an error indicating LDAP lookup failures (ID 10104 and 1024).

When the certificates are close to their expiry events will be generated in the Application event log warning you. This is the error description: http://technet.microsoft.com/en-us/library/bb217963(EXCHG.80).aspx

The fix for this is easy. On the server that is experiencing the error, in the Exchange Management Shell, run the New-ExchangeCertificate cmdlet and say Yes to overwriting the SMTP certificate. Then restart the ExchangeTransport services for it to take effect immediately.

If you create a new certificate on an Edge server, then you also need to recreate the Edge Subscription. Run the New-EdgeSubscription cmdlet on the Edge server to create an XML configuration file. Then use that XML file to create a new Edge Subscription on the Hub Transport server by using the Exchange Management Console. You can also delete the old Edge Subscription as it is no longer required. To force the new Edge Subscription to start, use the Start-EdgeSynchronization cmdlet. If this fails, try restarting the ExchangeTransport service or reboot the box.

If you know it's coming, it's easy to fix up. If you don't know it's coming, this can result in hours of downtime due to communication failing between Edge Transport server and the internal Exchange organization.

Expanding Wireless Networks

2010-07-27T15:08:00.001-05:00

I have done a lot of work with small and mid-sized wired networks, but I have only worked with single access point wireless networks until recently. The first thing I noticed is that the documentation on configuring wireless networks for multiple access points is poor. So, with the idea of helping others, here is what I’ve figured out.

For the purposes of my examples, I’m assuming that the clients will be accessing the wireless access point (WAP) by using a shared-key (password) and that all users will be using the same key. The use of 802.1x for authentication is beyond the scope of what I’m dealing with.

Vendors use slightly different terminology for the same scenario. I've attempted to use generic terminology that is similart to most vendors.

You can often use just the WAP functionality of a wireless router. However, many of these do not have as many wireless configuration options. If you use a wireless router as a second WAP, be sure that you disable DHCP on the device. Only the internal IP address of the device will need to be configured.

Scenario 1 – Wired WAPs

If you have Ethernet ports close to the location that you want each of your WAPs, then this is the simplest scenario. Obtain as many WAPs as you need and place them where required to get coverage. Ideally the signals from the WAPs should not overlap too much. The rule of thumb appears to be 25%. However, you’ll need equipment or software to measure that. Most WAPs have an option to reduce signal strength if required.

All WAPs should be configured with the same SSID (network name) and key but be using different channels. Wireless clients are configured with a single SSID and key. It is the responsibility of the client to select the appropriate WAP based on signal strength. If the client moves while it is connected roaming should occur with very little interruption as the connection changes from one WAP to the next.

Scenario 2 – Wireless Repeater

This scenario allows you to extend your wireless network without requiring an Ethernet port for the WAP. The WAP accepts connections from wireless devices and also connects with another WAP that connects back to the main network (typically via Ethernet, but could be wireless). Be aware that network speed is halved in this scenario as half of the network capacity is devoted to clients and half to the other WAP connection.

Some devices support a protocol called Wireless Distribution Service to support this. However, this protocol has many interoperability problems between vendors. So, don’t count on it.

The WAPs should be both be configured with the same SSID and key. The WAP configured as a wireless repeater should not be connected via Ethernet to the main network. If you do connect the wireless repeater to the Ethernet network, you may cause all devices on the network to get duplicate IP address errors. The duplicate address errors in the Windows event log will indicate the MAC address of the WAP.

Scenario 3 – Wireless Bridge

This mode is used to connect two or more wired networks via a wireless network. For example, two computer labs without a physical wire between them or two offices separated by only a short distance. A computer in one physical location is able to communicate with computers in the other physical location. This could allows you to share an Internet connection or other network resources.

A WAP in bridge mode is connected to each wired network. Each WAP is configured with the same SSID. You also typically have the option to allow wireless clients to connect to each WAP.

Find a Process Using a Port

2010-05-13T12:57:00.000-05:00

Every once in a while you run into a situation where two applications are attempting to use the same port number. Of course this means that one application is blocked out and doesn't function properly.

In a perfect world, we'd know all the ports used by various pieces of software on our servers and instantly understand where the conflict is. However, we don't live in perfect world, and some apps pick random port numbers.

On a Windows server, you friend is netstat -ab > C:\portlist.txt. This command dumps a list of ports and the processes using those ports to a text file. Then you can find out which process is conflicting with your failed service/application.

I used this just today to find out that a watchguard logging process was using port 4101 that a BES routing service wanted to use. I've also used it in the past to find out that Symantec Mail Security was randomly selecting a port in the low 10xx range that another application wanted to use.

ODBC oddness for 64-bit clients

2010-04-22T15:54:00.000-05:00

ODBC connections allows a Windows computer to connect to a data source. Typically the datasource is a database. In a 32-bit version of windows, you just create the ODBC connection and it works. In a 64-bit version of windows, then it is more complex.

In a 64-bit version of Windows, you need to create an ODBC connector to that matches the application. For a 64-bit application, you create a 64-bit ODBC connection. For a 32-bit app, you create a 32-bit ODBC connection.

The most common problem is creating an ODBC connection by using the ODBC Data Source Administrator tool in control panel and then you are unable to see of view the ODBC connection from a 32-bit application. The ODBC Data Source Administrator tool that you can open from control panel creates only 64-bit ODBC connections. To create 32-bit ODBC connections you need to run Odbcad32.exe from the C:\Windows\SysWoW64 folder.

Bad McAfee, Go to Your Room

2010-04-22T08:22:00.000-05:00

McAfee sent out a bad update yesterday that wiped out a Windows System file (svchost.exe) and rendered Windows very unhappy. The system I was dealing with initially lost network connectivity and many programs stopped running properly. I ran a Repair installation for XP to fix the issue.

They now supply a tool to fix the problem: http://vil.nai.com/vil/5958_false.htm

You figure that sort of thing would show up in testing. XP SP2 and XP SP3 were affected.

So, you deleted that object, eh?

2010-04-09T10:55:00.000-05:00

Ok, so let's say, you accidentally deleted a group. Or, thought it wasn't needed and turns out that it was. People can no longer access files, and you can't remember exactly which files the group was assigned access to. The good news is that you can recover from this.

Option 1 - Restore AD objects from backup
If you have a system state backup of a DC (and you should!!), you can restore the deleted object from backup. Then you mark it as authoritative. However, to have group memberships restored correctly, you need to perform an ugly process where objects are restored twice to make sure the links are correct. Also the DC needs to be down during this mess. Doable, but not the preferred option.

Detailed info: http://support.microsoft.com/kb/840001

Option 2 - Reanimiate the deleted object
Yes, just like a zombie, you can bring back an object from the dead. And also like a zombie, it is a shadow of its former self. Only some properties are kept in the deleted object. When you reanimate it, many properties are lost. However, it does keep the SID. So, a reanimated objects retains file permissions that were assigned to it.

In the case of a reanimated user, the group membership is lost. I expect that you would also need to recreate the membership of a reanimated group, but I haven't tried it out recently.

Detailed info: http://www.microsoft.com/technet/technetmag/issues/2007/09/Tombstones/default.aspx

Simplified reanimation with ADRestore: http://www.microsoft.com/technet/sysinternals/utilities/AdRestore.mspx

Intermittent DNS lookup failures for Exchange Server

2010-04-08T13:03:00.003-05:00

I have one ISP where we have intermittent problems delivering messages to mailboxes hosted by that ISP. It is something related to DNS lookups, because when I clear the cache on our DNS server, the problem goes away. So, presumably it's changes on their end that cause the issue.

By default the Windows DNS server caches DNS lookups for 24 hours. However, I don't want to be manually clearing the cache on this each time the error occurs (or wait up to 24 hours to automatically resolve). The solution: modify the cache TTL.

In all of the forward lookup zones that you create, you can set the TTL for the zone or individual records. However, in the cache, you can't set the TTL by using the DNS Manager console. You can either use dnscmd.exe or edit the registry.

In HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters, create a REG_DWORD value named MaxCacheTtl and provide a value in seconds. I did not find any documentation saying that this registry key works in Windows Server 2008, but tested it, and it does. There is documentation for Windows Server 2003 and earlier versions.

After setting the registry key, you need to restart the DNS server for the change to take effect.

UPDATE: A client started having this issues and I found a knowledgebase article that talks about this exact issue. Oddly the recommendation is to set the MaxCacheTtl at two days rather than shorter as I had done. See here: http://support.microsoft.com/kb/968372.

There is also a similar issue with 2008 R2 and 2008 R2 SP1 for which there is a hotfix. See here: http://support.microsoft.com/kb/2508835/en-us

UPDATE#2: We have now had several clients with this problem and the solution has always been to implement the MaxCacheTtl at two days. The hotfix has not ever resolved the issue for us.

Back to Basics: RTFM

2010-03-27T09:39:00.000-05:00

Purchased a new brand of print server this week. As usual, every product has it's quirks. In this case, I needed to know the port name used for LPR/LPD printing on this device.

The print server came with a tiny (literally physically tiny, like you get with kids toys) set of instructions that worked great only for the basic windows printing scenario. Unfortunately, I was in the ancient NetWare printing zone (NetWare 5.1, shiver...).

So, the basic manual did not provide enough info. Step 2....Vendor web site.

Nope, same tiny manual as came with the box.

Step 3....Google.

Unfortunately the product is sold by so many places that all I got was sale listings.

I was about to give up when it occurred to me that perhaps there was some thing on the CD that came with the product. Turns out there is a one hundred and some page manual that covers just about everything conceivable, but only on the CD.

Free Tool for Remote Control of Customer Desktops

2010-03-19T15:33:00.002-05:00

I always want to be able to remotely control client computers quickly when needed. There are a number of solutions out there but most cost a fairly significant chunk of $ for something I only need a few times per month.

Well, I finally found a freebie. Mikogo is free presentation/remote control software. It appears to be originally designed for more collaboration, but works well for servicing clients remotely.

The application does not require an install. They visit a web site, put in a sessionID, and then download and run an executable. A person with standard user rights can do it.

Obviously this won't help in advanced scenarios when you need to reboot and retain control or go into safe mode. However, if all you need to do is a bit of configuration or show/see steps on the remote computer, it works great.

Check it out at www.mikogo.com.

Your List of Passwords

2010-03-19T14:55:00.004-05:00

Everyone has a list of passwords somewhere. The question is, how do you store and where?

I'm asking myself this question because a client recently had a breakin where a server storing backups was stolen. The server happened to contain a file that had a list of passwords. Lots of passwords. This particular organization was storing not just a few admin passwords for devices and such, but also the passwords for all users.

First, I'd argue that there is no need to store user passwords. If I need to log on as user, I can reset the password and then inform the user. Unfortunately in this scenario, we needed disable remote access, force password resets, and then enable remote access again only after passwords were changed. A hassle for everyone.

Now, for the ones you need to document, what do you do? Storing them on a server protected by file permissions is apparently not enough, because if anyone steals the server, getting around file permissions is trivial.

At this point, I'm thinking that encryption is the obvious solution. AxCrypt is a nice free solution for encrypting files as an EXE. It would be a bit of pain but it's certainly a step up from just putting a password on a Word doc.

Blackberry Server on the Exchange server

2010-03-14T16:57:00.002-05:00

I've been a little slow to see this one, but Blackberry has released a new product this month called Blackberry Enterprise Server Express. This replaces Blackberry professional which was originally designed for smaller offices, but had not been updated to run on 64-bit operating systems.

The biggest changes:

total freebie, no licensing
runs right on the Exchange server or SBS server
runs on 64-bit and supports up to Windows Server 2008

From my perspective this means we can start installing BES right on the SBS box and save our clients a Windows Server license fee and hardware costs. In some cases, it will mean we can retire an old box that was being used just for BES.

While I think of this from the perspective of our smaller clients. It is scalable up to 2000 users on a dedicated box. There are a number of policies and add-ons that don't work with BES Express, but if all you need is the basic e-mail, calendar stuff. This one is a winner and helps compete with ActiveSync on the iPhone which is effectively free.

Learn more at: http://na.blackberry.com/eng/services/business/server/express

Resolve Random Problems with Update Installation

2010-03-07T14:34:00.002-06:00

I've been seeing a number of Win2008 servers with issues installing updates for no good reason. Turns out it's an internal Windows thing that is getting corrupted. Microsoft has released a tool to resolve a number of potential issues as described in KB947821 (http://support.microsoft.com/kb/947821).

The error I was trying to resolve was was 0x80070490 when installing update KB967723 via Windows Update. However, it did not successfully install for me afterwards and the logs indicated that no errors were found or fixed.

I was able to manually download the file and install it. So, it seems to be a specific issue with Windows Update.

A repair install is the next step, but I don't think I'll go there yet. As only one update would not apply. If it becomes an issue for all updates then I'll do the repair.

SBS 2008 Console Crash

2010-02-16T02:07:00.002-06:00

I recently took over maintenance of an SBS 2008 server where the console would crash immediately on startup. Turns out it would run in safemode.

It turned out that someone had been changing the default network settings for the SBSMonitoring database instance and had enabled IP. This caused a conflict with another database running on the server that was also using port 1433. If the SBSMonitoring database was down, the console crashed.

The solution was to disable IP communication for the SBSMonitoring database. By default it uses only shared memory for communication.

Recovering from a Removed Exchange Organization

2010-02-16T01:58:00.002-06:00

A few weeks back I got a call from an organization that had accidentally removed their Exchange Server 2007 organization. There was some confusion during the removal of the Exchange 2003 server after the migration was complete and some essential data was lost. There was no backup of Active Directory. So, a restore of AD was not possible.

Fortunately it was a relatively small environment with a single Exchange 2007 server and about 120 mailboxes.

Here's what we did:

use ADSI Edit to completely remove the existing Exchange organization
completely wipe out and reinstall Windows on the Exchange 2007 box
reinstall Exchange 2007 creating the same organization name
recreate the storage groups and copy databases into the storage groups.
Disable and reenable all users in EMC to recreate Exchange attributes
Disable and reenable all distribution groups in EMC to recreate exchange attributes
Configure certificate and smtp connectors.

Basically a whole rebuild. In retrospect, I should have tried just running /PrepareAD to see if that resolved the AD issues.

Note that the organization name needs to be the same during the reinstall or the databases will not mount.

Me Talking About Wireless Security

2009-11-27T08:53:00.004-06:00

This one is me talking about wireless security on a spot with the local TV news in Winnipeg.

http://winnipeg.ctv.ca/servlet/an/local/CTVNews/20080904/wpg_personal_info_080904/20080904/?hub=WinnipegHome

Runas for Windows Explorer

2009-11-26T14:11:00.002-06:00

We do a lot of our support for clients remotely. The offer remote assistance functionality in SBS is a real timesaver for us. Although, offering assistance based on username rather than computer would be a nice touch.

Today I was providing remote assistance to a desktop computer that was out of disk space. The user didn't have sufficient permissions to clean up the disk and I didn't want to work outside of the user's profile. So, I wanted to run Windows explorer a Administrator.

Here's the command line:

runas /user:domain\username "explorer /separate"

Ballad of the Duplicate SPN

2009-11-07T15:10:00.002-06:00

So, here's the scenario. We need to replace defective hardware with a new computer. We don't need to restore anything in particular, we're just going to put a new server in with the same name as an old one to save some reconfiguration issues.

Step 1: Dcpromo down the server
Step 2: rename Server1 to Oldserver so there is no conflict
Step 3: rename new server as Server1
Step 4: Join Server1 to domain

So far, so good. However, after joining the domain we get this error:

The security database on the server does not have a security account for this workstation trust relationship

Verify that the computer account is there and try several combinations of different rejoining and deleting the computer account. No resolve.

After a bunch of searching, it turns out that there is a property of a computer account that cannot be repeated in other computer accounts. The servicePrincipalName propery cannot have conflicting values with other computer accounts. Each computer account should have values that correspond only to its own computer name. However, sometime when you rename computers, not all entries in the attribute get updated.

You can view the entries for a single computer account by using ADSI Edit. However, that doesn't really help you find conflicts. Instead you can you this command to list the SPNs for all computer accounts and then look for duplicates associated with another computer.

Ldifde -f C:\spn.txt -t 3268 -d dc=domainname,dc=local -l serviceprincipalname
-r (serviceprincipalname=*) -p subtree

Looking in this text file we found that the computer account for Oldserver still had references to Server1. We didn't need Oldserver. So, we deleted the computer account for Oldserver and all was good. We could also have used ADSI Edit to change the entries.

Virtualization on Windows 7

2009-11-03T08:36:00.005-06:00

Windows 7 has a nifty new feature called XP mode that uses Windows Virtual PC in the background. My first surprise is that I had to download the software for this from MS which was about 500GB. However, that was the least of my worries.

It turns out that Windows Virtual PC will only run with hardware assisted virtualization. On AMD processor systems this isn't an issue because almost all AMD processors have hardware assisted virtualization. Intel, on the other hand, has been using hardware assisted virtualization as a differentiator between upper and lower end chips for the last several years. Basically trying to get a premium out of it. Many computers with Intel processors do not have hardware assisted virtualization. Unfortunately, my laptop is one of these.

Fortunately, even though it is unsupported (like I'd be calling for support) Virtual PC does run on Windows 7. A blog documenting it is here: http://blogs.msdn.com/virtual_pc_guy/archive/2009/08/19/running-virtual-pc-2007-on-windows-7.aspx.

You can also get Virtual Server 2005 to install on Windows 7 if you really want to, but it is a pretty nasty process. Details are here: http://tfl09.blogspot.com/2009/08/windows-7-and-virtual-server.html.

UPDATE: Microsoft has released an update for XP Mode and Windows Virtual PC so that hardware visualization is not required. See http://support.microsoft.com/kb/977206

The End of Novell (for me)

2009-10-15T08:53:00.003-05:00

Last week I taught a Novell class for what I think is the last time. It was an eDirectory course for some guys in Vancouver. Overall fun class with good students. However, with limited market share and consequently limited training opportunities, I don't think it is worth my while to update my certs to teach the newer content.

I remember when......

about 70% of organizations used Novell NetWare
file and print services were all that were expected of a server
NetWare was more stable than Windows (by a lot)
GroupWise had reasonable market share
Microsoft was the underdog for server side computing
IPX/SPX meant I didn't really need to understand the network configuration

Goodbye NetWare, eDirectory, and GroupWise. It was fun while it lasted. SUSE I hardly knew you.

MTS BlackBerry in Vancouver

2009-10-06T22:43:00.002-05:00

I'm in Vancouver teaching a course this week and have my BlackBerry along for the ride. In downtown Vancouver, data support for an MTS Blackberry is very spotty. What I mean is that it sucks.

Right now, my data synchronization for e-mail and even BlackBerry messenger is sporatic at best. Data connectivity is for brief periods of time every hour, two hours, or even four hours. Occasionally, disabling my connections and reenabling them will trigger the data to go on again. Removing and reinstalling the battery sometimes triggers it as well.

If I came here often, I'd need to look at a different provider....Or an iPhone.

Java Woes

2009-10-06T22:35:00.002-05:00

One of our clients uses a Java-based financial app that loads from a web page. As part of resolving another issue, I removed and reinstalled Java from the workstation. It never occurred to me that I should test the financial app because it had not given me problems in the past when I applied updates. Also, I don't have a logon for that app because it would give me access to the data related to their customers.

Anyway, on Monday morning I get a polite call telling me that the app is not working. This app requires the user to accept a certificate from the vendor the first time it is run, and I assumed that the user accidentally said no to accepting it. So, I took remote control and it definitely did not work. The error, complained about security in a roundabout and cryptic way.

After some testing and tweaking, no fix. Later when doing some research (ok, Google searches) I found out that this is a bug in the last two releases of Java for apps with certain characteristics. I had installed Java 6 update 16. The last version without the bug was Java 6 update 14. Remove the new version, install the old and all was fine. Fortunately all the older versions of java are archived and easily available.

RDP on an Alternate Port

2009-09-14T20:38:00.003-05:00

Sometimes we have multiple computers in location that we want direct RDP access to. The simplest solution is to change the port that RDP is listening on. This article has the necessary registry key: http://support.microsoft.com/kb/306759

Yesterday I did this on our new Windows 2008 e-mail server to allow outside access, but could not connect to the new port number or the old port number. It turns out that Windows Firewall was the culprit. I assumed that the Windows firewall rule would be hooked in to the service executable. However, there is a rule with a hard coded TCP port instead.

So, when you change the RDP port number, remember to create a new incoming rule that allows that port.

IE8 HTTPS warning

2009-08-14T09:26:00.002-05:00

Over the last few days I've been using Outlook Web access to read e-mail. A lot of the bulk mail messages I get have graphics in them. OWA uses https, be the graphic are using http. So, IE8 gives you a warning asking:

Do you want to veiw only the webpage content that was delivered
securely?

My instinct is to hit the Yes button to show the graphics. However, you need to select No.

However, you can disable this warning. The steps are located here: http://blog.httpwatch.com/2009/04/23/fixing-the-ie-8-warning-do-you-want-to-view-only-the-webpage-content-that-was-delivered-securely/

Links = File System Flexibility

2009-08-07T14:17:00.004-05:00

I won't pretend to know the results of all the possible configuration options. However, I think that using links in the file system is a great way to expand space on an existing C: drive.

I have one workstation that I do 90% of my work on. This computer has a lot of apps and a ton of data (no lectures about the home server please). My 250GB drive is almost out of space and I'd like to increase performance of my VMs.

The MS courses use C:\Program Files\Microsoft Learning for the VMs. I don't have an option to move this. However, I can configure that path as a symbolic link to another location instead. So, my C:\Program Files\Microsoft Learning is now a link to V:\Microsoft Learning. This allows me to put all my VMs on a separate drive. If I get inspired later on, I may split the differencing drives from the base drives for even better disk performance.

The MKLink command creates the links.

For God Sakes, Plan for a Disaster

2009-08-05T20:56:00.004-05:00

Two incidents recently drove home the importance of planning disaster recovery for me this week. One was a client. Sadly, the other was our server.

First the client. Like many clients, this one is using a USB drive for backup of a computer that does peer-to-peer sharing on the network. All of their accounting data is on this computer as well as other files. After a period of time they stopped doing the backup. You know the excuses, none are good, but all of us start to slack off over time.

So, the hard drive in this computer dies, no backup. We got lucky and after I moved the drive to a different computer, it was readable, and we got the data. But it was coming up as a hardware failure in diagnostics.

Now for our server. It is located in a basement. The water main in the basement broke and filled the basement with 6 feet of water. We did have a backup, but it was with the server. So, always do an offsite backup. Fortunately for us, all we lost was some configuration documentation and the billing info for the last month. We were able to recreate the billing info and we can figure out the documentation again.

We will not be caught like this again. We will be implenting a full offsite recovery plan. And it will be automated, so we can't get lazy about it.

Multiple instances of Excel

2009-07-31T14:37:00.002-05:00

I do a lot of work with multiple spreadsheets, many of them open at the same time. It has always annoyed me that when you double-click a spreadsheet it opens in the same Excel window.

In the past I found that the work around was to open one spreadsheet. Then open Excel from the Start Menu and open the second spreadsheet from within the second instance of Excel. Another workaround on the web talked about disabling OLE in some way, but that one killed functionality I needed.

However today I found a better solution for me. I created a shortcut in the Send To menu that directs files to Excel. When I use this is opens in a second Excel instance.

Details on the Send To: http://www.howtogeek.com/howto/windows-vista/customize-the-windows-vista-send-to-menu/

Still not quite as good as just double-clicking, but much better than a manual open of Excel.

Office 2007 Trial as a Marketing Tool

2009-07-28T14:28:00.003-05:00

We have a relatively new client, in which we are replacing another support provider. A number of the computers have Office 2007 Trial version installed that is just now expiring. I am sure the point was to demo the software and make the sale, but there was no communication with the staff.

End results of installing trial software without a formal evaluation process:

Staff are annoyed when trial software expires and ceases to work
Productivity is lost while staff figure out they can still open documents manually in Office 2003, but not by just double-clicking the doc
Client pays $$ for me to uninstall Office 2007
No sale is made because no actual evaluation is done
Waste of everyones time and $

Stop SBS from Shutting Down

2009-07-18T08:19:00.002-05:00

We are currently migrating a client from SBS 2003 to SBS 2008. We've joined the new computer to the the domain, and run DCpromo on the SBS 2003 computer to remove the DC status. However, after seven days, SBS 2003 will start giving an error stating that it needs to be a DC and will shut down every 60 minutes (http://support.microsoft.com/kb/555087)! We need another few days to work on the migration.

The Microsoft recommended solution for this is to insert disc 1, run setup, and remove the SBS 2003 component. This will leave a plain Win 2003 server without the shutdown issue. However, when I attempted to do this, setup errored out indicating that I was trying to upgrade to an older version which was not possible. Removing service packs may have worked, but here is a faster work around taken from a guy named Alan (http://social.microsoft.com/Forums/en-US/whssoftware/thread/af4fc3b4-bb50-4c5e-b09a-72ef2c3ac687)

I've found a slightly more elegant solution to this problem rather than just
aggressively killing the process until Windows gives up trying to start it
again, and I'd like to share it in the hope that Google will re-index and pick
it up for others to use. You may have noticed this service cannot be disabled
via the MMC snap-in.
My search term on google was: how to stop the SBCore
service. Anyway, down to business…
- Tools you'll need – Process Explorer from http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx
As you probably know, you have a service called SBCore or "SBS Core Services",
which executes the following process: C:\WINDOWS\system32\sbscrexe.exe. If you
kill it, it just restarts – and if you try and stop it you are told Access Denied.
If you fire up Process Explorer, you can select the process and Suspend it, now we can start to disable the thing. Run regedit and expand the nodes until you reach the following hive /key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SBCore Right click this, hit permissions and give the "Administrators" group on the local machine full access ( don't forget to replace permissions on child nodes ). F5 in regedit and you'll see all of the values and data under this key.
Select the "Start" DWORD and change it from 2 to 4 – this basically sets the service to the "Disabled" state as far as the MMC services snap-in (and windows for that matter) is concerned.
Next, adjust the permissions on the file C:\WINDOWS\system32\sbscrexe.exe so that EVERYONE account is denied any sort of access to this file. Then go back to process explorer, and kill the sbscrexe.exe process, if it doesn't restart – congratulations!
Load up the services MMC snap-in and you should find that "SBS Core Services" is stopped and marked as Disabled.
Enjoy,
Alan :)

Note: When you run Process Explorer through Terminal Services, you are unable to suspend the process. I had to go on site to perform this process.

Fault in Wininet.dll

2009-07-18T08:11:00.002-05:00

Yesterday I had a Windows XP client computer that generated a fault in Wininet.dll each time Internet Explorer 7 was started. And since IE seems to have hooks into a whole bunch of applications, those applications would error out as well. These included, Help and Support and Simply Accounting (seems that the .NET Framework was affected).

My first thought was to go back to an earlier restore point, but I couldn't because it would crash each time I opened Help and Support.
Next I created a new user and logged on as that user. this new user didn't experience the same issue, so I knew is was related to user settings rather than system settings.
Restored a restore point, but the original user issue was not resolved. However, now at least I could do some research by using IE and the new user account.
During research, I found a few articles talking about clearing cache with this issue. They were for older versions of Windows and IE, but I figured I'd give it a shot.
I was unable to clear the cache by using the Internet Options in Control Panel because it errored out. I was able to delete the files manually.
After the cache was cleared, all was good.

Desktop Support for the Server Guy

2009-07-18T08:05:00.003-05:00

For the last number of years, I've been mostly a server guy. Lately due to changes in workload at the office I've been doing more desktop support as well. Most server guys I know do not like working on desktops. It is not because we think the work is beneath us, or even dislike interacting with users (for most of us anyway). The main reason server guys don't like working on desktops is the variability.

A server is a controlled environment. Most servers run a limited number of applications and the applications installed are known. In addition, there is a limited range of settings that are commonly configured. On a desktop computer, all options are open, because there is no telling what a user has done with their computer. This can be challenging for sure, and sometimes even intimidating when a problem occurs. Not to mention that the solutions sometimes are just crazy.

Yesterday, I was working on a desktop computer with multiple applications erroring out. The solution ended up being to clear the cache in IE. That's just plain weird.

When in Doubt, Reinstall

2009-07-09T08:10:00.002-05:00

I think all of us with a technical orientation have a tendency to get too fancy on occassion instead of keeping it simple. This applies at a lot of levels, including design. Usually on each project I have at least one moment where I have to smack myself and get back to basics.

Yesterday I was troubleshooting a Java application that launches from a Web page, but is a stand-alone app when it runs. It was complaining that the server could not be contacted. Here was my process:

Verify only one computer is affected
Clear the java cache - no fix
Install latest Java update - no fix
Reboot computer just to be sure - no fix
Start monkeying with java settings - no fix
Try from a different user profile on the same computer - still broken
Install a packet sniffer to monitor traffic - no obvious errors

What was the fix? Easy. Uninstall all Java components and then download and install the latest Java. Wish I had tried that a bit earlier.

BES Calendaring Weirdness

2009-07-03T15:04:00.002-05:00

This has only happened with one client. So, I'm not sure how widespread it is. However, based on Googling the issue, it seems to be pretty frequent.

Some users were getting a red X when attempting to reply to meeting requests. Also, some meetings were not being synchronized properly.

To resolve this issue we had to update the cdo.dll file on the BES server. The version on the Exchange server was relatively recent. The version on the BES server was several years old. Apparently it is a best practice for BES to use the most recent cdo.dll file from any of your Exchange servers.

The steps to resolve were:

Copy C:\program files\exchsrvr\bin\CDO.dll from Exchange server to BES server (same path.
Reregister the dll (regsvr32 cdo.dll)
Restart BES server (probably could just restart services, but why mess around)

Problem resolved.

Props to Shaw Cable for good service

2009-07-03T14:50:00.002-05:00

My Internet service has been flakey for about the last week. So, yesterday I finally decided to try and get to the bottom of what was happening.

2pm...Try an Internet speed test - results showed same upload and download speed of about 1Mbps. Hmmm. I should have about 10 Mbps download.
2:05pm...Reboot router - No change.
2:10pm...E-mail Shaw - They request results from internal speedtest at speedtest.shaw.ca. Hmmm. Only 500Kbps now.
3:30pm...Restart cable modem - Ooops. Internet gone and not coming back.
3:35....Call Shaw tech support- they check signal strength and it's low. Appointment schedule for next day (not bad for consumer level stuff).
3:45....Start to panic about what to do with no Internet, but remember that e-mail still comes in on the Blackberry. Take a deep breath.
4:00pm...Take laptop to the second floor to search for unsecured wireless. Find about 8 networks, but all secured. Phooey.
4:30pm...Remember that I have splitter on the cable. Remove it and Internet comes back. Whoo Hooo.

When the Shaw guy got here today I explained about the splitter. He indicated that it was likely the cause, but wanted to test signals anyway.

After about an hour of him troubleshooting. It turns out that the line into the house from the street is bad. He's recommended replacing it, but they likely won't get to it for a few months. In the meantime, he put a booster on the Internet line and all it's good.

Total turn around 24hrs.

Common Blackberry and BES Issues

2009-06-24T08:19:00.004-05:00

We have several clients using Blackberry devices and Blackberry Enterprise Servers (BES), which allow the Blackberry devices to integrate with Exchange mailboxes. I should also note that there is a version of BES called Professional edition (or something similar to that). The Professional edition is the same as BES, but is free and limited to 25 users. Where I live (Winnipeg, Canada) you get a free Professional licence with each Blackberry device.

The two most common issues we see:

Device suddenly unable to send or receive email. We are seeing this on newer devices and seems to be a weird hardware/OS issue in the device. The only fix we have found for it is removing and replacing the battery. This forces a full reboot (no data lost). We have not been able to determine any specific circumstances that cause the issue.
Device able to receive new messages, but not send. This occurs when the service account for the BES server does not have the correct permissions to the mailbox of the user. The fix for this one is to give the BES service account Send As permissions to the user. Again, this seems to be a somewhat random error. It happens to individual users sometimes and we've never found a source.

Windows Server 2008 Foundation

2009-06-23T10:05:00.003-05:00

I thought I knew all the editions of Windows Server 2008. Apparently I missed the Foundation edition. I think it's relatively new. It is also available only through OEMs.

Here is the basic rundown of the Foundation edition features that make it different from Standard edition:

Does not include Hyper-V
Does not include server core
Limited to 15 simultaneous user connections
Separate licencing from CALs (may be cheaper)
Lower cost
Only available through OEMs

The Foundation edition can still be used for:

Domain Controller
Terminal Services (need the TS CALs, limited to 15 users still)
Remote access
Application server
File and Print server

Looks like an interesting option for smaller environments that need a basic server and don't want to kick out the $ for a full server or SBS. I can think of one client right now who could use this.

Free AV Software

2009-06-23T09:59:00.002-05:00

There have always been a few free anti-virus products out there. They lure you in with a base product and then try to upsell you to a more configurable product. AVG antivirus is probably the best known.

Well, Microsoft is about to become one of the biggest AV software providers out there. Microsoft Security Essentials is now in beta. This replaces the One Care product that I don't think was overly successful in the market place. However, MS Security Essentials is free, and that's an important distiction.

Only 75,000 downloads of the beta are allowed here: http://www.microsoft.com/security_essentials/market.aspx.

I'm in Canada. So, I can't try it out. Only for the US, China, and Brazil.