Blue Screen Win32k.sys 0x50

Yesterday we had one client lose 5 machines to a stop error when they rebooted. This is caused by a bad Microsoft update. Specifically, KB2982791 which updates fonts. If you search around there were previous issues cause by font updates and the font cache not being cleared properly.

Yesterday, we fixed up a couple of the machines by doing a system restore and delaying all updates because we were not sure of the cause. I'm now seeing postings that indicating that removing the font cache file may allow the system to boot. Delete this file:

• C:\Windows\System32\fntcache.dat

For your reference, this Microsoft forum with a post by Iaurens provides step by step instructions on how to recover by booting from a Windows 7 Install DVD.

• http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/blue-screen-stop-0x50-after-applying-update/6da4d264-02d8-458e-89e2-a78fe68766fd?auth=1

Such a pity, we had just started doing auto approvals of updates for some clients again. I guess we'll move back to the manual approval mode so that we can delay updates like this that are likely to get pulled.

I should note that I don't think this is widespread as we've only had one client with the issue. Strangely it was their Engineering users with the issue. So, I'm guessing it's some type of software interaction causing the issue.

If you are using WSUS, I strongly suggest you decline KB2982791.

Update: Further reading suggests that KB2970228 is also bad and should be declined at this time.

Update, Aug 29/14: More drama. Apparently the replacement update for this also has some issues. Although less severe. Read someone else's rant here:

• http://www.infoworld.com/t/microsoft-windows/microsoft-ships-replacement-patch-kb-2993651-two-known-bugs-249342

Remove OEMDRV Drive from Dell Server

I recently installed a Dell Server by using the Lifecycle Controller. This system uses a wizard to help with the installation of the operating system. In this case, I was installing Windows Server 2008 R2 to replace an existing Exchange 2010 server.

As part of the installation, an OEMDRV USB drive is created by the Lifecycle Controller that contains the drivers used during OS installation. OS installation went well, but I ran into an issue afterwards. The OEMDRV drive was using E:, which I needed for my Exchange data.

When you go into computer management, OEMDRV shows as a removable drive. However, you cannot change the drive letter or eject OEMDRV. By default the Lifecycle controller removes this drive after 18 hours, but I didn't want to wait that long.

To force OEMDRV to be removed earlier, restart the server and press F10 to enter the Lifecycle Controller configuration. Then exit the Lifecycle Controller and reboot again. You don't need to make any changes in the configuration. Just entering and exiting triggers the removal.

VDI Deployment Error: Failed to Create WMI Firewall Exception

Like a previous post I made, this is probably relevant only when doing VDI in a test deployment that's a bit kludgy. However, in case anyone else runs into this, here's my scenario:

• Hyper-V Host (Windows 2012 R2) to be configured for virtual machine-based VDI
• One network for VMs and host (not external) with static IP and DNS
• One network for external with dynamic IP and DNS
• Domain controller is a VM on the Hyper-V host
• On the internal network not the external network with static IP
• Is the DNS server for the domain

I ran the RDS installation from Server Manager and the first part was fine. The Hyper-V host reboots and then you wait for the DC to restart before logging on to the Hyper-V Host as the DC is required to complete the configuration. After logging on to the Hyper-V host the wizard continues. I got this error:

RD Virtualization Host Configuration Failed on machineName.domain.com With Error: Could not create the Windows Management Instrumentation Windows Firewall exception on machineName.domain.com.

In my case this was because the Hyper-V host started using the DNS from the dynamic interface instead of the internal network and lost track of the domain. The network that had the domain controller was being detected as a public network instead of a domain network. My fix was to change the IPv4 configuration on the external network to use static DNS servers and not enter any DNS servers. The Hyper-V Host then used DNS on the DC and detected everything properly.

Search the Message Tracking Log with Wildcards

I was trying to track down a delivery error today and was annoyed that I couldn't use wildcards when searching the log in Tracking Log Explorer. Instead, I used the Exchange Management Shell and filtered with Where-Object to get the information I wanted:

Get-MessageTrackingLog -Start "month/day/year hour:minute:second" -End "month/day/year hour:minute:second" -Resultsize Unlimited | Where-Object {$_.Recipients -like "*@domain.com"}

Putting Office 365 Room Mailboxes in Local Exchange

Recently I was working with an organization that had both an Office 365 tenant and on-premises Exchange 2007. Our project was to merge these two together into a single unit by configuring hybrid mode.

As part of this process, there are local AD user accounts that needed to be linked to Office 365 mailboxes in a way that the local Exchange implementation could understand. I've described that process here:

• http://byronwright.blogspot.ca/2013/11/converting-mail-user-to-remote-user.html

The existing Office 365 tenant has some room mailboxes. In order to allow on premises users to book those room, we need to perform a similar process for the room mailbox.

Here is the process I used:

1. Create a disabled user account with the same name as the O365 room.
2. Convert the disabled user to a mail user:
1. Set the External e-mail address to be for the O365 object. This should be XX@XX.mail.onmicrosoft.com.
3. Set the local domain as the reply email address. This needs to match the address in O365 because that is how Dirsync matches the disabled user account to the O365 object.
1. On the E-Mail addresses tab, uncheck the Automatically update e-mail addresses based on e-mail address policy check box.
2. Select the correct e-mail address XX@yourdomain.com and click Set as Reply.
3. Click Apply.
4. Check the Automatically update e-mail addresses based on e-mail address policy check box and click Apply.
4. Use AD Users and Computers to Edit the properties of the disabled user account. Advanced Features must be enabled in the View menu.
1. On the Attribute Editor tab, modify the following values to convert the disabled mail user to a remote room mailbox:
• msExchRecipientDisplayType: -2147481850
• msExchRecipientTypeDetails: 85899334592
• msExchRemoteRecipientType: 33

Finally, run Dirsync to replicate the object to O365. The object should be matched with the existing o365 room mailbox. You can now book meetings with the room from your on-premises Exchange.

UPDATE:
The above process seemed to work well in my personal environment with an Exchange 2010 hybrid server. However, on a recent project with an Exchange 2013 hybrid server, it didn't seem to work at all.

What we did as an alternative was link the room mailbox in O365 with a disabled mail user. Then we setup the proper mailbox ID to allow mailbox moves. Then finally, we moved the room mailbox from O365 to on-premises and then back to O365. This gave a properly configured room mailbox in O365 that showed up properly in the Exchange 2013 management tools.

IP Addresses for Office 365

When implementing a hybrid configuration of Exchange Server and Office 365, the configuration wizard automatically limits connectivity to the Exchange server by setting address ranges on the receive connector of Office 365 in the on-premises Exchange. If you want the additional security of limiting access to the hybrid server at the firewall level, you can copy the configured addresses into your firewall rule.

Alternatively, if you prefer the following links provide lists of the IP addresses used by Office 365 services.

Exchange Online Protection (EOP):

•  http://technet.microsoft.com/en-us/library/dn163583%28v=exchg.150%29.aspx

Forefront Online Protection for Exchange (FOPE)

• http://technet.microsoft.com/en-us/library/hh510075.aspx

Various Office 365 services:

•  http://technet.microsoft.com/en-us/library/hh373144.aspx

Replace Missing Cluster Name Object for DAG

Ran into a strange issue today with an Exchange 2013 DAG. The cluster name object (CNO) for the DAG had been deleted at some point. It must have been a long time ago because I couldn't find a tombstone objects for it to try and bring it back. What was amazing is that the DAG functioned fine except that the File Share Witness (FSW) was offline because the CNO is used to access the shared folder for the FSW.

When you create a DAG, a computer object is created that represents the cluster name. This is the CNO.

A quick search revealed a number of documents talking about how to recover the DAG object from Deleted Items. However, this was not possible for me. Instead, I had to recreate the CNO.

Before we go any further, let me say that the smart thing to do is probably break the DAG and recreate it in this scenario. If you have up to date copies of the data in the remote location, then adding the replica back after you recreate DAG should go quickly. However, I figured I'd give the repair a try. Let's just say this is not exactly MS approved.

First I searched and searched to make sure that the CNO was really not there. The CNO has the same name as the DAG and mine was not there.

Here is the process I followed:

1. Create a new computer account for the CNO named the same as the DAG.
2. Give the DAG nodes (computer accounts) full control permission to the CNO.
3. Identify the objectGUID attribute for the CNO and make note of it. This will be added to the cluster configuration.
4. On one of the DAG nodes, use Regedit and view HKLM\Cluster and identify the value of ClusterNameResource. It will be a long ugly number and is the Cluster Name Resource GUID
5. In Regedit, browse to HKLM\Cluster\Resources\ClusterNameResourceGUID\Parameters.
6. Edit the ObjectGUID key and replace the value with the value you copied in step 3. This tells the cluster to use the new CNO.
7. Perform steps 5 and 6 on all DAG nodes.
8. Restart the Cluster service on all DAG nodes.
9. Update share permissions on the FSW shared folder to give the CNO full control.
10. Update ntfs permissions on the FSW folder to give the CNO modify.

NOTE: In step 3, you cannot use the GUID value as shown in the Attribute Editor tab in AD Users and Computers. You need to view the objectGUID attribute and copy the Hexadecimal value. This is a reordered version of the value visible in the Attribute Editor tab.

At this point, I was still getting errors about the File Share Witness not being able to start because of failed logon. The event log had the following error:

Event ID: 1228

Cluster network name resource 'Cluster Name' encountered an error enabling the network name on this node. The reason for the failure was: 'Unable to obtain a logon token'.
The error code was '1326'.

The final step I needed to perform was:

1. In Failover Cluster Manager, take the cluster name offline.
2. Right-click the cluster name, point to More Actions, and click Repair.

The repair seemed to sync up the computer account name and computer account password with the failover cluster. I'm not sure this is entirely accurate, but at this point the cluster name started with no errors in the event log and the FSW resource started properly.

Some of the errors I received during troubleshooting were:

Event ID: 1069
Cluster resource 'File Share Witness (\\fsw.domain.com\dag.domain.com)' of type 'File Share Witness' in clustered role 'Cluster Group' failed.
Based on the failure policies for the resource and role, the cluster service may try to bring the resource online on this node or move the group to another node of the cluster and then restart it.  Check the resource and group state using Failover Cluster Manager or the Get-ClusterResource Windows PowerShell cmdlet.

Event ID: 1196
Cluster network name resource 'Cluster Name' failed registration of one or more associated DNS name(s) for the following reason: The handle is invalid.
Ensure that the network adapters associated with dependent IP address resources are configured with at least one accessible DNS server.

Event ID: 1207
The computer object associated with the cluster network name resource 'Cluster Name' could not be updated in domain 'domain.com' during the
Resource post online operation.
The text for the associated error code is: There is no such object on the server.
The cluster identity 'CNO$' may lack permissions required to update the object. Please work with your domain administrator to ensure that the cluster identity can update computer objects in the domain.

Some resources that were useful for troubleshooting:

• http://blogs.technet.com/b/askcore/archive/2009/04/27/recovering-a-deleted-cluster-name-object-cno-in-a-windows-server-2008-failover-cluster.aspx. A comment by Fred on this blog describes recovery of the CNO for Windows Server 2012, which is what I did.
• http://social.technet.microsoft.com/Forums/windowsserver/en-US/2ad0afaf-8d86-4f16-b748-49bf9ac447a3/ws2012-cluster-network-dns-issues?forum=winserverClustering. This blog clued me in to repairing the CNO.
•