All4Techie

AWS Elastic Site Recovery -upload in progress

noreply@blogger.com (Piyush Srivastava) — Fri, 04 Aug 2023 06:46:00 +0000

Azure DR- Azure Site Recovery- Learning - upload in progress

noreply@blogger.com (Piyush Srivastava) — Fri, 04 Aug 2023 06:45:00 +0000

Azure DR- Azure Site Recovery- Learning

Microsoft Azure - AZ-103

noreply@blogger.com (Piyush Srivastava) — Wed, 04 Sep 2019 14:00:00 +0000

Syllabus Microsoft Azure

Here we will be talking about more specific to Azure Technology. Microsoft is updating very frequently content and configuration on AZ Cloud, and you will be getting notification (under bell icon) as well in the portal after login on the right hand side. I will be updating here all the points which i gone through in my training period. That will include known issues, troubleshooting and there fixes as well.

Start with Azure Day-1

Learning Path
Certification Path
Exam Details

Deep Drive with Azure Subscriptions
Exploring Virtual Machines How, What and many if and but
Understanding of Storage Types
Deploy and Manage Azure Network
Azure Identity and Access Management- IAM
Backup and Restore - Azure Inbuilt tools with enable and manage option
Azure Active Directory and DNS
Azure Redundant Storage Concept
Security,Access and Compliance,RBAC
Azure Key Valut
Azure Monitoring In-built Tools and how to enable and manage
Log Analytics
Create or Customize the alert,event as per requirement
Azure Resource Manager
Azure Load Balancer
More on High Availability, redundancy and availability set and scale
Enable/Disable or perform any specific task with HOW TO questions
Azure Security Center
Migration from Other Cloud Providers to Azure Cloud
Azure Automation - Powershell, azure cli, Terraform
Known Issue
Azure Handy Tools, Tips and Tricks
Troubleshooting with there fixes

Learn and Earn....Share the Knowledge.

Enable Diagnostic and Logging Windows Logs

noreply@blogger.com (Piyush Srivastava) — Sun, 02 Apr 2017 10:47:00 +0000

Hello Professionals,

Today sharing a very useful details with all you guys, which seriously helps out in difficult troubleshooting,. Logging help admins to troubleshoot the issue of the failure or possible cause of the failure. with some advanced options you can get very details information of the possible cause of the issue.
Analytic and Debug logs are disabled by default. When enabled, they quickly fill the disk space with large number of log files with huge size.Its recommended that after finishing the troubleshooting steps disable the logging settings settings.

1. Enabling Kerberos Event Logging on a Specific Computer
    Start Registry Editor.
    Add the following registry value:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro\Lsa\Kerberos
    \Parameters
    Registry Value: LogLevel
    Value Type: REG_DWORD
    Value Data: 0x1

2.To enable Windows Time Service debug logging: First Create a folder to config to save the log file location. I made it like D:\W32Time_Log file, and then press ENTER. Then
w32tm /debug /enable /file:d:\W32Time_Log\w32time.log /size:10000000 /entries:0-116

3. Verbose logging: Verbose logging tracks all changes and settings applied using Group Policy and its extension to the local computer and to users who log on to the computer and SystemDrive \Debug
To Enable browse to below reg path
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows NT/Current Version/Winlogon key then Add Value , and enter the value name UserenvDebugLevel and Data Type to REG_DWORD with number 30002 in HEX value.
30002 value is for verbose logging, 30001 value is for errors and warnings only, and 30000 logs nothing.

To disable verbose logging, delete the UserenvDebugLevel from below path.
    HKEY_LOCAL_MACHINE/Software/Microsoft/Windows NT/Current Version/Winlogon

4.Netlogon Logging to troubleshooting Authentication Issue
run command with administrative privilege
Nltest /DBFlag:2080FFFF
then net stop netlogon
then net start netlogon

Stop Netlogon Logging
Nltest /DBFlag:0x0

The netlogon.log file located in %SystemRoot%\Debug and The NetLogon logging level is stored in the following registry value:
HKLM\System\CurrentControlSet\Services\Netlogon Parameters\DBFlag

Computers that are running Windows Server 2003 and after versions of the MS operating system, you can use the following policy setting to enable verbose Netlogon logging Browse to
\Computer Configuration\Administrative Templates\System\Net Logon\Specify log file debug output level
and type 0x2080FFFF in bytes value.

The Above method can also be used to enabling the netlogon by group policy to multiple computer, but its not recommended with the concern of practical scenario to do this by Group Policy.

5. Enable Analytic and Debug Logs:
a.Open event viewere
b.On the Action menu, click Properties
c.On the properties dialogue box, select Enable logging and click OK

this can be done by giving the command as administrative privilege
wevtutil sl <logname> /e:true

6.Diagnostic logging for domain controllers is drive for the following registry path:
HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Logging can be configured by modifying these REG_DWORD entries:
1 Knowledge Consistency Checker (KCC)
2 Security Events
3 ExDS Interface Events
4 MAPI Interface Events
5 Replication Events
6 Garbage Collection
8 Directory Access
9 Internal Processing
10 Performance Counters
11 Initialization/Termination
12 Service Control
13 Name Resolution
16 LDAP Interface Events
18 Global Catalog
19 Inter-site Messaging
20 Group Caching
21 Linked-Value Replication
22 RPC Client
23 RPC Server
24 Schema
25 Transformation Engine
26 Claims-Based Access Control

Diagnostic Logging Settings: The values below are used to configure the level of diagnostic logging provided by the host:
If you put 0 (Zero) then its not collecting any data and this is by default settings on the server.
If you put 1 (One) then its configured to collect that events that includes message/alert/information/warning for task that is performed by the service.
If you put 2 (Two) that means its configured to collect the Basic type of event details for each task.
If you put 3 (Three) that means its configured to collect the detailed information than the lower levels,This is very helpful and recommended when you have an issue and you want to go to depth of diagnose with the question like how, why and what.
If you put 4 (Four) that means its configured to collect the Verbose logging for task and activity.
If you put 5 (Five) then its configured for all events, including debug strings and configuration changes. A complete log of the service is recorded. Use this setting when you have traced the problem to a particular category of a small set of categories.

DCPromoUI.log :The DcpromoUI.log file contains a detailed progress report of the Active Directory installation and removal processes. Its default location is the % SystemRoot %\Debug folder.
Its Start with the dcpromo command. This file contains below important details
    1.The name of the source domain controller for replication.
    2.The directory partitions that were replicated to the target server
    3.The number of items that were replicated in each directory partition
    4.The services configured on the target domain controller
    5.The access control entries (ACEs) set on the registry and files
    6.The SYSVOL directories
    7.Applicable error messages
    8.Applicable selections that were entered by the Administrator during the installation or removal process

Netsetup.log:When joining a computer to a domain, the Networking Setup (NetSetup) installs all the necessary Microsoft supported networking components.
Userenv.log: This log file can be helpful in troubleshooting problems with user profiles and Group Policy processing. The log file resides in the % SystemRoot %\Debug folder.

Enabling LDAP logging :This is a great feature included in 2012 server.

Reg setting path
Domain controller: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics
LDS: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<LDS instance name>\Diagnostics.

Learn, Earn and share the knowledge. Never let sleep your zeal to learn.
please comment and feedback will be really helpful for us. I will be very happy to listen from you.

many many thanks for you guys to support.

Active Directory Replication and Lingering Objects

noreply@blogger.com (Piyush Srivastava) — Sat, 01 Apr 2017 09:44:00 +0000

FSMO Roles-Move and Seize theory

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

Active Directory Site and Services with Replication
Active Directory Right and Management
Move AD Database to Other Location
Imprtant Points for Active Directory Group Policy

Hello Professionals,

Today we will discuss about the Active Directory Object who will be responsible for replication failure in your environment most of time in the domain.

When there is a replication failure from long time in domain, there will a objects that will be created automatically called Lingering objects. In very straight forward you can say the attributes updates of active directory that failed to replicate in the domain controller from Root to child or other available domain controllers. As an example if user added to any security or distribution group from any domain controller but the updates are not showing to other available domain controllers.

For replication you can wait for 15 to 20 min but if it not updated then there is a case of failure.

There are different inbuilt windows tools and command, which gives youa better output of the replication status.

   1. command to check repadmin /showrepl * /csv >showrepl.csv,
   2. AD health analyser
   3. AD inbuilt tool

There are couple of ways too to detect and remove that culprit lingering objects. You can run this command to see what are the objects that are not replicated

repadmin /removelingeringobjects <ServerName ServerGUID DirectoryPartition> /advisory_mode

repadmin /showrepl <DomainControllerName> { to check GUID of Domain controller}

There is a registry key called StrictReplicationConsistency -- which we'll refer to as Strict Mode -- that will protect a DC from lingering objects:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters
ValueName = Strict Replication Consistency
Data Type = Reg_DWORD
Value Data = 1 = Strict 0=Loose

If this value is set to 1, it will prevent a partner from replicating lingering objects to the DC it is defined on. Thus, if every domain controller has Strict Mode enabled, they are protected from lingering objects being propagated to them. If the value is set to 0, however, it is said to be in Loose Mode, and will allow the lingering objects to be replicate and update in environment.

To check and troubleshoot any issue in windows servers, admin should follow and go through with event logs first. For Replication and Lingering Object there are couple of event which am sharing here.

Event ID 1864:This event will indicate if there are lingering objects are all-ready there or starting. Note that it contains a count of how many DCs have not replicated in a day, week, month, two months, or the tombstone lifetime. The last entry is important. Unfortunately, the event will not tell us the name of the domain controller that hasn't replicated in the tombstone lifetime.

Event 2042 (Error)Source: NTDS Replication: This identifies that strict replication is enabled, the "source DC" has not replicated in tombstone lifetime days and is attempting to replicate, thus replication has been disabled from the source. The event provides the GUID of the source in the format of the CName (alias) DNS record.

Event ID 1388 (Error) Source: NTDS Replication: Description: Another domain controller (DC) has attempted to replicate into this DC an object which is not present in the local Active Directory database. The object may have been deleted and already garbage collected (a tombstone lifetime or more has past since the object was deleted) on this DC.

Event 1988 (Error)Source: NTDS Replication: Description: Active Directory Replication encountered the existence of objects in the following partition that have been deleted from the local domain controllers (DCs) Active Directory database. This event is being logged because the source DC contains a lingering object which does not exist on the local DCs Active Directory database.

A very brief event logs details with there meaning and solution from Ask Active Directory Team

Fantastic tool from Microsoft to check Health check and Lingering Objects. You have to login with your Microsoft ID and check it,
If you are good with powershell command and script you can get and fix the issue very easily, let me know if you need any kind of help there.

I experienced this situation and very frankly it was very irritating to find this objects.As precaution your AD environment should healthy. There are lots of script and tool, where you can schedule to check and send email for replication status. The worst and horrible activity was when Group Policy folder was missing on branch domain controllers and policy folder were not matched with root Domain Controller.

Personally and on base of issue i faced AD Replication tool of 2012R2 and commnad repadmin /showrepl * /csv >showrepl.csv is awesome, they give you more deep data with details.Never get irritated when you are doing AD troubleshooting because for that you need to think act very smartly.
There are lots of real time issues on Replication, please free to ask or comment on the blog.We will be happy to listen from you.

Learn, Earn and Share the Knowledge. comment and feedback for this section will help me more. Really happy to listen from your side.

FSMO Roles-Move and Seize theory

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

Active Directory Site and Services with Replication
Active Directory Right and Management
Move AD Database to Other Location
Imprtant Points for Active Directory Group Policy

Citrix Apps getting disconnecting and disappeared

noreply@blogger.com (Piyush Srivastava) — Wed, 29 Mar 2017 09:49:00 +0000

Citrix Installation and Configuration-I
Citrix Installation and Configuration-II
Citrix Installation and Configuration-III

Hello Professionals,

Its being 15 days that am getting ping to suggest for some Citrix Apps Issue, Apps getting crashed and disconnecting after launch.Here updating some of scenario case what i found and worth to share it. Just tried to put all the issues with solution to techie plate. Review and comment and if any point or line is disturbing you for the solution or any other steps solve your issue.

Infrastructure Setup:
Domain Controller: 2 No's ( Windows 2012 and Windows 2016)
Citrix Farm: 2 No's ( Windows 2008 R2)
Client : 5 No's (Windows 7 32 bit and 64 bit)

Issue: Apps Console disappeared after some time Ater Launching the Apps in different scenario.
Resolution Steps: Here are some basic points to check with troubleshooting.

1. Any Recent changes
2. Apps is working fine with Citrix Server
3. Users are from Same domain or different domain.
4. Citrix Event Log diagnose
5. Create new Apps for test and see if the same behaviour with new Apps too.
6. Check you Antivirus behavious and logs, in some case i found due to AV Apps

traffic getting blocked.

Issue-1: The application initially begins to open. After loading the application, the dialogue box disappears and the application fails to appear.

Solution: To resolve the issue, re-provision the base image with the timeout value:

registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI (create the key if it is not available.)

Name: ApplicationLaunchWaitTimeoutMS

Type: REG_DWORD

Data: Required additional time-out, in milliseconds

Note: Set this value using Decimal. Specifying a value less than 10000 reverts to 10000 because 10 seconds is the minimum override.
Issue Explanation: The issue occurs when the default one-minute time-out is exceeded and the session logs off automatically because the application takes a longer time to start.

Issue-2 : Explorer.exe failing again and again and disconnecting after Launch.
1.The session initially begins to connect as expected. After the loading, the

dialogue box disappears and the explorer application fails to appear.
2.If the session is viewed in the Delivery Services console while the

application is loading, it initially shows as connecting, and later shows as

disconnected, until finally the session disappears.

Solution:
1. Update the Citrix farm server with Latest Hotfix and reboot.
2. On the XenApp Server use the following registry key to configure the

time-out:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix

\wfshell\TWI

Name: ApplicationLaunchWaitTimeoutMS
Type: REG_DWORD
Data: <required additional time-out, in milliseconds>

Note: Specifying a value of less than 10000 reverts to 10000 because 10 seconds is the minimum override.

Issue-4: On the XenApp Server use the following registry change to set the length of time a client session waits before disconnecting the session.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI

Value Name: LogoffCheckerStartupDelayInSeconds
Type: REG_DWORD
Value: An integer that denotes the time to wait for the application to start.

Note: Setting this value also increases the time it takes for a user to log off the server. Enter the delay time in seconds, up to 10 minutes (600 seconds).

It is more useful as a troubleshooting step to confirm that the issue is because of the length of time required for the application to launch.

Issue Explanation:The issue occurs when the default one-minute time-out is exceeded and the session exits automatically. The explorer.exe application takes longer time to start as it is integrated into the Windows shell.

Issue-5: Apps Getting crash and disconnecting.

Solution: apply CTX128953 and CTX131628 by registry or policy XA

Issue-6: MS Word is keep crashing after saving some time for all users.
Solution: There is an option in MS word called Auto-Save, that feature was causing that Apps to crash. Just set to turn off the Auto Save feature and it works.

Issue-7: Published Citrix application starts and then exits immediately on a Windows 2008 SP2-based Citrix server

Solution: From Microsoft there is a patch available for this issue, Refer this Link

Learn, Earn and share the Knowledge. Please comment and feedback will help me to understand more on the blogs side, where the suggested solutions worked or not. Appreciate your comment and feedback if any other solution worked for you.

Citrix Installation and Configuration-I
Citrix Installation and Configuration-II
Citrix Installation and Configuration-III

Vmware Tools Troubleshooting and Debugging Logging

noreply@blogger.com (Piyush Srivastava) — Sat, 11 Mar 2017 11:30:00 +0000

VMware More about Log files and Basic Settings with Vsphere
ESXi Troubleshooting-I

Known Issue and Workaround for Vsphere 5.5

Vmware Component Service-Failed to Start,Stuck on Starting

vmware vsphere 6 web client not opening

Hello Professionals,

VMware Tools is a package of utilities that enhances the performance of the guest vm and improves management of the vm. A Vm with out vmware tools face performance issues,no network connection with more over not capable of performing important functionality.VMware Tools process is a Service which appears as vmtoolsd.exe in Windows guests,
VMware Tools work/combined with these services and drivers.
   a. VMware Tools service
   b. VMware device drivers
   c. VMware user process
   d. VMware Tools control panel

When we talk about important functionality, its means a more over to guest OS. where vmware tools gives you multiple options to get the debugging logging to find the root cause of issues with vm.
To Enable Vmware tools logging to Windows Guest OS
1. Windows Server 2008, Server 2012, Windows 7, Windows Vista
C:\ProgramData\VMware\VMware Tools\tools.conf
and if the tools.conf is not there create a notepad and pasts the below lines and restart the vmware tools service.

[logging]
log = true

vmtoolsd.level = debug
vmtoolsd.handler = file
vmtoolsd.data = c:/temp/vmtoolsd.log

2. If you are looking for debug level logging on vm, the refer this configuration, which collect diagnostic log from different services and drivers and give you a output on a vm

[logging]
log = true

# Enable VMware Tools service logging to a file.
vmtoolsd.level = debug
vmtoolsd.handler = file
vmtoolsd.data = c:/tmp/vmtoold.log

# Enable "vmsvc" service logging to a file.
vmsvc.level = debug
vmsvc.handler = file
vmsvc.data = c:/tmp/vmsvc.log

# Enable new "vmusr" service logging to a file.
vmusr.level = debug
vmusr.handler = file
vmusr.data = c:/tmp/vmusr.${USER}.log

# Enable the "vmvss" snapshot service logging to a file.
vmvss.level = debug
vmvss.handler = file
vmvss.data = c:/tmp/vmvss.log

3. This vmware tools config help to troubleshoot VSS/backup issues. As per my expericence and most vmware admins share that these configurations are specifically for specific purpose, and not helpfull to getting and troubleshooting other VMware Tools issues.So before making any changes first try it in your test environment and see if you are getting the output for what you are looking.

    [logging]
    log = true
    vmbackup.level = debug
    vmbackup.handler = vmx

    vmvss.level = debug
    vmvss.handler = vmx

4. Dump file location of vmware tools in Windows Server under users profile location.
    %TEMP%\vmware-UserName

5. Its not recommended and suggested that enable the logging for always becuse ot occupy the space as well as resource too, which cause vm performance issue. Once you find out the issue or information disbale the logging.
open the tools.conf file in a text editor and remove the following lines:

log = true
vmtoolsd.data = c:/tmp/vmtoolsd.log
or
Log=false
vmtoolsd.data = c:/tmp/vmtoolsd.log

6.When you need to troubleshoot backup issues for Windows guest OS, Its recommended for certain not to set the debug logging to a file or file+ handler. As part of the backup process/services will disable writes to the guest disk during the operation, which prevents and create issues for logging from operating.
When troubleshooting this type of issue, always use a handler which will support writing to memory instead.
The Best Tool from Microsoft Download DebugView from the Windows Sysinternals collection.
    Launch the DebugView application (You should be using Administrator or same as Administrator privileges).
    Enable these options in the user interface:
        a.Capture > Capture Win32
        b.Capture > Capture Global Win32
        c.Capture > Capture Kernel
        d.Capture > Passthrough
        e.Capture > Capture Events
        f.Options > Clock Time
        g.Options > Show Milliseconds
Start the Backup now and Capture the contents of the DebugView to a file.
Other usefull command which gives you better understanding of the system writers status, process and information.
    a.vssadmin list writers
    b.vssadmin list providers
    c.vssadmin list volumes
    d.tasklist /v

Learn, Earn and share the Knowledge. Please comment if any query/suggestion or feedback. I will be happy to listen from you.
Thanks for your fantastic support.

Reference with VMUG and VMWARE Blogs

VMware More about Log files and Basic Settings with Vsphere
ESXi Troubleshooting-I

Known Issue and Workaround for Vsphere 5.5

Vmware Component Service-Failed to Start,Stuck on Starting

vmware vsphere 6 web client not opening

Active Directory Group Policy-I

noreply@blogger.com (Piyush Srivastava) — Fri, 10 Mar 2017 10:29:00 +0000

FSMO Roles-Move and Seize theory

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

Active Directory Site and Services with Replication
Active Directory Right and Management
Move AD Database to Other Location
Imprtant Points for Active Directory Group Policy

In Starting was not comfort with power shell commands but these days, every daily task or repetitive task is getting done by power shell, because of its greatness :). Even you can do big task with a power shell script. Only the thing that make sure it does what you want or for what activity you made it. In Active directory too, there are so many reports or task is being done by power shell. Instead of going to server and open any console just run the script and you got the output.Now we will be doing here a couple of task with power shell as well from group policy management console.

Lab Setup:

Domain Controller: Windows Server 2008R2,Windows Server2012R2 and Windows Server 2016

Client Side: Windows 7 for Test Purpose.

Here am creating one group policy for Wallpaper for all users.The Details tab contains information describing who created the GPO (the owner) and the status (Enabled, Disabled, or Partially Disabled) as well as some nuts-and-bolts information about its underlying representation in Active Directory (the GUID)

You can bypass restriction error by adding security_mmc.exe as a trusted website or turn off Internet Explorer Enhanced Security Configuration.

The Delegation Tab: The Delegation tab lets you specify who can do what with GPOs, their links, and their properties. You’ll find the Delegation tab in a lot of places, such as when you do the following:

a. Click a GPO link or click a GPO in the Group Policy Objects container

b. Click a site

c. Click a domain

d. Click an OU

First select WMI Filters node then WMI (Windows Management Instrumentation)

and then Click on the Starter GPOs section.

The Settings Tab: The Settings tab gives you an at-a-glance view of what’s been set inside the GPO. In our example, you can see the Enabled and Disabled status of the two policy settings we manipulated. You can click Hide (or Show) to contract and expand all the configured policy settings.

You can use PowerShell to save a report of a specific Group Policy Object or all GPOs using the cmdlet Get-GPOReport. For example,

type: Get-GPOReport –Name GPO123 –ReportType HTML –Path C:\temp\out1.html then replace -Name GPO123 with -ALL and you can get all group policies applied to Domain will be pulled as report in html format. Make sure if you have many policies ignore ALL options.

This pop up just remind you that you are going to do some thing with speific this policy.

Disabling the Link Enabled Status:Remember that all GPOs are contained in the Group Policy Objects container.you link back to the GPO. So,the quickest way to prevent a GPO’s contents from applying is to remove its Link Enabled status.

what if i disabled here user or computer option. Let me explain you, its not any magic that effect or impact will you show right now but on back ground there is a performance enhancement.Suppose there are 1000 computers and any policy set on 1000 numbers, so what will happen. I hope you understand what am trying to say.

Delete the GPO: Remove-GPO -name "PolicyName"
This power shell command will delete the policy from Domain

Block Inheritance: Use the Block Inheritance feature to prevent all GPOs (and the policy settings within them) from all higher levels from affecting your users and computers.

power shell commnad: Set-GPinheritance -Target "ou=OUName,dc=all4techie,dc=in" -IsBlocked Yes
and after that you can blue exclamation.

Here i created a new OU with APAC and under that India OU, to ignore accidently delete the objects, In 2008 that is great option available that if you selected this option that will not allow you to delete the specific object.

You can see here Block Inheritance option is not applied.

The Enforced Function: The Enforced function is simple: It guarantees that policy settings within a specific GPO from a higher level are always inherited by lower levels. It doesn’t matter if the lower administrator has blocked inheritance or has a GPO that tries to disable or modify the same policy setting or settings.
powershell: Set-GPlink –Name "PolicyName" –Target "dc=all4techie, dc=in" –Enforced Yes

Security Filtering and Delegation with the GPMC: Its not recommended that all admins have access to modify the settings in Domain Infrastructure,as well atleast a group of senior should have :)
Group Policy infrastructure will be always good if you plan and do everything in proper way, and it will be worst to worst if you are not taking care of the policies. It will mess up all the domain stuffs.
Always prefer on the base of group, where the policy require and where not. Like Wallpaper policy is subject to based on company standard it will apply for all but what for a specific deptt and there mapped folder, printer access, folder access and many more. So always recommend to put all the yes user to one security group and remove the other from scope and setting details of Group Policy.As and when you remove the other users they would not have read access to group policy and the specific policy will not apply for them.
If you see on any policy you will found authenticated users group, which having read access to group policy.

Learn, Earn and Share the Knowledge. Please comment if any query with feedback. I will be very happy to listen from your side.Thank U So much for Support.

FSMO Roles-Move and Seize theory

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

Active Directory Site and Services with Replication
Active Directory Right and Management
Move AD Database to Other Location
Imprtant Points for Active Directory Group Policy

vmware vsphere 6 web client not opening

noreply@blogger.com (Piyush Srivastava) — Thu, 09 Mar 2017 15:14:00 +0000

VMware More about Log files and Basic Settings with Vsphere
ESXi Troubleshooting-I

Known Issue and Workaround for Vsphere 5.5

Vmware Component Service-Failed to Start,Stuck on Starting
Vmware Tools Troubleshooting and Debugging Logging

Hello Professionals,

Once you installed a newly installed vcenter 6 in your infrastructure, and most of time it ask for latest update for Adobe Flash Player and it works.

But in my case with Windows 2012R2 and 2008R2 it was not loading after updating the latest Adobe Flash player.

Issue: vmware vsphere 6 web client not opening

Resolution:

Run the below power shell command with administrator privilege

Install-WindowsFeature Desktop-Experience

it will take some 5-10 min to add the feature. Basically we are adding desktop experience feature to Windows 2012R2 and 2008R2 server.That you can add from Server Manager too.

Once Reboot, Below are the steps for 2012R2 and 2008R2 servers

1. If you are accessing the vsphere web client from 2012R2 server

a.download and install Patch for KB2974008

b. Then install Flash Player

Then Reboot the server.

2. If you are accessing from Windows 2008R2 server

a. Install the Flash Player

Once server is up access the web vsphere clientURL: https://VCENTERIP OR FQDN:9443/vsphere-client.

Please share and comment. Learn,earn and share the Knowledge.

VMware More about Log files and Basic Settings with Vsphere
ESXi Troubleshooting-I

Known Issue and Workaround for Vsphere 5.5

Vmware Component Service-Failed to Start,Stuck on Starting
Vmware Tools Troubleshooting and Debugging Logging

Vmware Component Service-Failed to Start,Stuck on Starting

noreply@blogger.com (Piyush Srivastava) — Thu, 09 Mar 2017 14:37:00 +0000

VMware More about Log files and Basic Settings with Vsphere
ESXi Troubleshooting-I

Known Issue and Workaround for Vsphere 5.5
vmware vsphere 6 web client not opening
Vmware Tools Troubleshooting and Debugging Logging

Hello Professionals,

Today am sharing a very frustrating issue that was irritating, and because of this only re-installed full vcenter setup 3 times.God grace today got one solution which was very straight and clear according to my infrastructure.

It tools 4.5 hours me to get the solution for this issue and i got it.

Issue: Vmware component service stuck on starting and failed to start. Service name vmware-cm (VMware Component Manager).

Precaution steps: Backup all certificate that are related to VMWARE before making any changes to certificate.

Login to Vcenter server as administrator privilege and browse to C:\Program Files\VMwarevCenter Server\vmcad\certificate-manager
and run the certificate bat file.

Here you can lots of option after running certificate-manager bat file. Select option 4 and press enter. Here i gave option to regenerate a new VMCA certificate and register for this vcenter domain.
After this it will ask to update the following details one by one for server IP address, FQDN, Company Name, State, City etc..Then it will start it processing and will take approx 20-30 min to give you status final status.

Once this is 100% completed, you can see all services are started by automatic. In My case regeneration failed due to Adding cert to VECS Store Failed and rolled back all the process by after this even component service started. Looking on the Certificate-Manager log for checking exactly why this happens. This will generate Root Cert using VMCA with sha256WithRSAEncryption Signature Algorithm.
But i did again and its completed 100% successfully and all services are running properly.

Other Important Points for VMCA:
1. There is a known issue with version 6.0 U2 where the CSR created for the VMCA as a Subordinate will not have the all attributes. In case with Microsoft CA server will force to include the attributes based on the certificate template last time used or if you had created any template for your reference.
2. VMCA will only issue certificates to clients that can authenticate to VMware Directory Service in the same domain network as well as issues certificates for VMware solution users, machines that and services.
3. Must watch this Youtube Link.Here a good discussion about Vmware Licensing and other terms.
4. A vCenter Server with an Embedded PSC will have 4 Solution Users:vpxd,vpxd-extension,machine and vsphere-webclient
5. A vCenter with an External PSC will have 4 Solution Users:vpxd,vpxd-extension, machine and vsphere-webclient
6.An External PSC will have 2 Solution Users: machine and vsphere-webclient
7.vSphere 6.0 U3 has made very nice enhancement in Certificate-Manager.You need to update only cfg file under certificate-manager and other dependency creation and registernation will be taking care by this too it self.Its Automatic process.

This cert tool will regenerate and register the certificate for all these Solution users which are mentioned in point 4,5 and 6

I will be happy to listen from you. Learn, earn and share the knowledge.
Please comment and share the blog, Let your friends know the solution for this issue.
Thanks a lot for your support.

VMware More about Log files and Basic Settings with Vsphere
ESXi Troubleshooting-I

Known Issue and Workaround for Vsphere 5.5
vmware vsphere 6 web client not opening
Vmware Tools Troubleshooting and Debugging Logging

Important Points for Active Directory Group Policy

noreply@blogger.com (Piyush Srivastava) — Sun, 05 Mar 2017 10:36:00 +0000

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2

Active Directory Domain and Trust

Active Directory Site and Services with Replication
FSMO Roles-Move and Seize theory
Active Directory Group Policy-I

Hello Professionals,

Today am just sharing you very small but important points for Group Policy.

1. you cannot “Block Inheritance” between Local GPOs and Active Directory GPOs. But it is correct that you set within Active Directory to inverse a Local GPO setting is always marked with importance.You can, "turn off” Local Group Policy Objects from processing. In Windows Vista and later MS version, there is a policy setting with Computer Configuration ➢ Policies ➢ Administrative Templates ➢ System ➢ Group Policy entitled Turn off Local Group Policy Object processing, which, when set to Enabled, will prevent Local Group Policy Objects from affecting the machine.

2. Local Group Policy is stored in the %windir%\system32\group-policy directory (usually C:\windows\system32\grouppolicy)
1. You can also install the GPMC using the command line:
2. Open a PowerShell prompt as an Administrator.
3. In PowerShell, type Add-WindowsFeature GPMC.

3.The Possible Settings in GPMC
   a. Not Configured :“Don’t do anything” or type of “Pass through.” and in very simple way. The Setting is not configured and applied
   b.Enabled When a specific policy setting is enabled, the policy will take effect.
   c. Disabled : Disabled means the specific policy is marked to not to allow or allow for said objects. Hope am clear here.
     In Example of Shutdown Event Tracker Group Policy, Not configured option means this is not applied, Enabled means its applied and working and finally disabled means in the domain higher
     level its enabled but to specific to any servers or OU its mark as not to apply.

4. GPOs in Active Directory is like endless points of the domain called the Group Policy Objects container.

5. Using site level to implement GPOs : Users may roaming from one site to another site, and when ever login to new place they will be getting new settings and message. Until unless you dont have any security concern like an example of region wise users.Thats why its always recommended and suggested to apply the GPOs from Domain level not from site level.

6.Create hierarchy with Most Common and most unique policy. Like.There are 3 GPO's that need to be apply on 100,50 and 20 users so as per best practise apply the first policy to 100 users and put them in one OU then 50 and then 20.

7. For users to get GPOs to apply to them, Domain users must have rights
    access to the GPO.
       a. Read
       b. Apply Group Policy (known in shorthand as the AGP rights)
   By default, all Authenticated Users are granted the Read and AGP rights to all new GPOs.Until unless there is no manipulation or manual intervention.

8. GPO comments are placed in a plaintext file located here:
       \\<domain>\SYSVOL\<domain>\Policies\<GPO GUID>\GPO.cmt
   Individual comments for GPO settings are placed in 2 XML files for each
GPO, one for Computer Configuration and another for User Configuration.
The path is

\\<domain>\SYSVOL\<domain>\Policies\<GPO GUID>\Machine\Comment.cmtx
\\<domain>\SYSVOL\<domain>\Policies\<GPO GUID>\User\Comment.cmtx

9. Testing health of your group policy is very important in environment.There are different third party IT Audits ask to check the health for Backup and Restore process. Deleting by mistake of one group policy will not impact the environment but suppose if more than half of group policy deleted or something wrong then WHATTTT. production impact, login failures and so many issue.There are two parts of GPOs: the GPT (Group Policy Template) from Active Directory and the GPC (Group Policy Container) in SYSVOL. When a backup is performed, the GPT and GPC are combined and merged and placed as a set of files.To Take backup or delegate a group or user must have/atleast read acces to the GPO. Powershell commnad is there too for backup

    Backup-Gpo –All -Path C:\GpoBackups -Comment "DomainGPODated****"

10. The maximum wait time after a move or new GPO is created in Domain
      a. 30 minutes- within Active Directory sync)
      b. 90 minutes- Group Policy default background refresh rate to
          Domains)
      c. 30 minutes- Group Policy default background refresh rate offset)

11. Policies that affect Remote Desktop Connection
       1. Computer settings for Remote Desktop Services, Computer
           Configuration ➢ Policies ➢ Administrative Templates ➢ Windows
           Components ➢Remote Desktop Services.
2. Terminal Services clients, User Configuration ➢ Policies ➢Administrative
      Templates ➢ Windows Components ➢ Remote Desktop Services.

Group Policy Topic in Active Directory is like Sea, every time you find new things, a different way to do tasks. I will be updating more on this with Same Domain Trust GPO and Cross Forest Domain GPO.

Always Learn, earn and share the knowledge. Share the blog, feedback and comment on this. I will be very happy to listen from you.

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2

Active Directory Domain and Trust

Active Directory Site and Services with Replication
FSMO Roles-Move and Seize theory
Active Directory Group Policy-I

Citrix Installation and Configuration-III

noreply@blogger.com (Piyush Srivastava) — Sat, 04 Mar 2017 12:05:00 +0000

Citrix Installation and Configuration-I
Citrix Installation and Configuration-II

Hello Professionals,

For Citrix Setup, we had done installation and basic configuration.Now i will be sharing some information for below points

1.Basic Commands to check farm

2. Performance Check after Adding New Server to Farm

3.Delegating More Admins on Citrix Servers

4.Add Citrix snapin to powershell

5.Config logging.and enable auditing- Will do this part later.

6.Enable IMA Encryption

7.Enable Pass through Authentication

8.Configure Web Interface

9. Publish Application

Lab Setup:

Citrix Installed Servers- 2 (Windows 2008R2 )

Domain Controller- 3 (Windows 2008R2, Windows 2012R2, Windows 2016)

User System - Windows 7

Some Points random

In XenApp 6.5 there are two new roles added from the previous version,

1. Session Host only

2. Session Controller and Host Only

XenApp to XenApp Communicates with 2512 port.

1. Basically zone exist in xenapp represent different geo location

2. Each zone have a its own data collector
3. As well each server in the zone connect to zone data of its same zone location to update the

information
4. This zone data help to load balance and connect the users to the maximum available resources

server zone.

You can run the command to check which zone is default zone
qfarm /zone

I added another server i zone by running same setup with add this server in existing farm on the setup wizard.

by running this command you can get how many servers are are there in farm

By selecting server properties, you can change the preference, as first xenapp server will be dedicated as most preferred.

Once you added the server to existing farm, you can see the performance status from the performance tab to verify its working.

After open performance tool, i deleted all the parameters to bring the citrix to front, you can see the performance status too from performance monitor tool, that exactly what is going on this Xenapp server.here first will show you to see the zone election performance.You can see the selection process by stopping the Citrix IMA service.

The first Xenapp server always elected as most preferred and after that you manually change the option, like in maintenance or there is some operational or performance issue with the server.
By configuration based the election process depend on below points
a. IMA version
b. Manually assigned from configuration console
c. Host ID
the election process start when IMA services is started. The IMA version can be update with hotfix or hotfix rollup pack from Citrix.So always prefer to have latest patches to server.

The user created and completed the the farm configuration will be first and only the default administrator of the farm with full access. There are different privileges in farm which can be delegate based on professional role based and experience.
a. Full : This option have full access to the farm on the citrix environment.
b. read only : this option have read only access to the farm of citrix environment
c. custom : this option can have access on apps or servers or to perform any activity to the Citrix environment
Having a single administrator in the farm is not good and recommended solution, so we will add further administrators using with full or read or custom options. For better management, i created 3 different security groups by name CitrixAdmin, CItrixReadAdmin and CitrixCustomAdmins in Active Directory and will add those users to groups not to Citrix.
From AD point of view if there are not more administrator then adding individual id to server is good but if you have more users and in future its going for custom access then always create security group and add users to security group, this help to manage the access as well inventory too.

Now here adding other admins to farm

Custom Admins can have different types of option as per available options like this.

Now will add Citrix Snapin to powershell for smart Administration.

type add-pssnapin CItrix.XenApp.Commands and press enter

and once this is done you can confirm by typing get-XA press tab and you can see lots of available XenApp commands.

Now the very important IMA Encryption on Citrix Farms. This encryption enhance security in farm and the most important points that all servers use the and have the same key. Loss of the key means encryption will not work.
Copy the ctxkeytool.exe from support folder of the installation CD and create the key on first server and add to all servers before rebooting.

to Enable encryption we would need these two files, you can get from installation CD under support folder.

Browse the ctxkeytool from Administrative command prompt

There are different available options with this Tool

we will be first generating the encryption key for Citrix farm

In the directory, encryption key is saved

Now uploaded to Citrix Farm

New key is placed and marked as active and enabled.

copy the same folder to other Citrix servers and load the encryption key.

Finally, IMA encryption is enabled to Citrix Farms.

I configured Web Interface but am not getting logged in to Web Console.

and in the event logs, getting these two.

Tried and review the logs for almost 3 hours and got some things important and was missing to check.In Citrix Policy its allowed under port 8080. So modified the web interface port from 80 to 8080 and restarted the Citrix XML service.

Now will proceed how to enable Pass Through Authentication for Citrix Farms.

used by the enterprise client and default location is C:\interpub\wwwroot\citrix\PNAgent.
Enabling pass through authentication will enable and allow users credentials to passed to the web interface server and best practise says that should be enabled by group policy icaclient.adm.

First Will add ADM file to group Policy management console.

Create new policy with citrix named under domains section

right click and edit the policy will send you to this screen and then select Administrative Templates and right click then Add template and browse to icaclient.adm path

Then you can see all available group policies related to Citrix

and then select the Enable pass-through authentication

open command prompt and type gpupdate /force to apply the made changes.
then after update the PNA agent xml path to client side and gpupdate /force will update the settings.

Then users can access the published application as per access with there profile on start menu.

Will forward now for more configuration option on web interface site and its backup/restore options.

Sites can be configured bu using web interface MMC or using hte text file C:\intepub\wwwroot\citrix\<sites>\conf\webinterface.conf.
And to perform this the very interesting fact that no reboot of server or IIS is require.
You can take backup and replicate sites configuration too by this configuration file.webinterface.conf
you can manage your site configuration from here.

Server farms shows you number of server which are attached with this farm, Authentication method shows you types of authentication.

Now will test and see how to publish the applications on Citrix farm. Browse to the application and right click and publish new application

Here you can provide access to the published application as per requirement. Suppose you are publishing application for dept based then only that department should have access to this application.

and you can see the published application with user profile in Start menu.

Some times it gives you error, i got this error once i tried to access the published application from client side.

Solution of this issue i found the network connectivity.

Here another thing that you can block or stop the application with from the one server and the reg setting is this.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\fDenyTSConnections it should be "1"

By default its enabled with "0"

You can check the status with these commands

CHANGE LOGON /QUERY
QFARM /LOAD

I am trying to share more and more topics and you all will be notified with social media links.

Please comment and let me know if any query for any topic.I will be very happy to receive your feedback and questions. Thank you so much for support and sharing this.

Learn, earn and share the knowledge.

Citrix Installation and Configuration-I
Citrix Installation and Configuration-II

Move AD Databse to other location

noreply@blogger.com (Piyush Srivastava) — Mon, 06 Feb 2017 06:32:00 +0000

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

Active Directory Site and Services with Replication
FSMO Roles-Move and Seize theory
Active Directory Group Policy-I

Hello Professionals,

Lab Setup:

1.Active Directory server-

2. Access and Availability of other drive.

It is very much recommended to perform cleanup and maintenance of database if you are facing performance issue in AD level. Before starting this activity make sure you have healthy system state backup of this Domain Controller, Copy of NTDS data with robocopy tool and double sure no AD database level critical error and make sure to export the output for comparison os permission of get-cacls or get-acl.

This activity some times improve the performance of Active Directory.

1. You can do this with Directory services safe mode
2. Log in with Administrator Account and Stop the AD DS Service

Before moving of the AD database, first stop the AD DS service from Service console or command prompt. To Stop from command enter net stop ntds and it will ask your confirmation to stop finally. If you do this from service console it will pop up like this

Click Yes and it will stop all dependency service too.

Now open command prompt with Administrative Access and type ntdsutil

then activate instance ntds

then files

then type the drive path where you are planning to move, i did it for E Drive.

type move db to E:\NTDS

after this you will see on below its shows Move database is successfully.

Now will move the logs, type move logs to E:\NTDS

and same it shows successfully.

and after this you can see all files moved to New Drive.

After all make sure to verify the permission level must be as were on old path.Then Start the AD DS service from command or from Service console.

At the time of activity the registry entries that Ntdsutil.exe updates when you move the database file are as follows:

In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\
Parameters:
    Database backup path
    Directory System Agent (DSA) database file
    DSA working directory

At the registry entry that Ntdsutil.exe updates when you move the log files is as follows:
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\
Parameters:
    Database log files path

And in Event viewer you can see below alerts

Event ID 1046. “The Active Directory database engine caused an exception with the following parameters.” In this case, AD DS cannot recover from this error and you must restore AD DS from backup.Event ID 1168. “Internal error: An Active Directory error has occurred.” In this case, information is missing from the registry and you must restore AD DS from backup.

Feel free to comment, put a question and share it. We will be happy to assist.
Dont let sleep your zeal to learn and earn with share the knowledge.

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

Active Directory Site and Services with Replication
FSMO Roles-Move and Seize theory
Active Directory Group Policy-I

ESXi Troubleshooting-I

noreply@blogger.com (Piyush Srivastava) — Thu, 02 Feb 2017 05:01:00 +0000

VMware More about Log files and Basic Settings with Vsphere

Known Issue and Workaround for Vsphere 5.5
Vmware Component Service-Failed to Start,Stuck on Starting
vmware vsphere 6 web client not opening
Vmware Tools Troubleshooting and Debugging Logging

Hello Professionals,

Requirement for lab setup:
1. esxi host
2.VCenter
3. VI Tool Kit, download from here
4. Vsphere Cli, download from here
5. putty and updated version of powershell.

Today am going to share some interesting facts and point for esxtop command. which is used in esxi to see the performance in regard of vm, cpu, storage, memory and many more.
This command help to analyze the issue for cpu, memory, network or any issue with vm, the output can be analysed by VisualESXtop, perform and other tools available with vmware.
To see whats going on host level, will login to one of esxi host with putty. Remember to enable login with putty you have to enable ssh connections from security profile other wise it will not allow and give you error network refused on putty session.
After login and giving command for esxtop it will show you like this. where it will shows the current usage of esxi host.

it fetch the performance metrics from raw counters from VMkernel system info nodes.
and the description result stands for
ID – resource pool or VM ID of the running worlds resource pool or VM or world ID of running world.
GID – Resource pool ID of the running worlds resource pool or VM.
NAME – name.
NWLD – Number of members in a running worlds resource pool or VM.
%USED – CPU core cycles used.
%RUN – CPU scheduled time.
%SYS – Time spent in the ESX(i) VMkernel on behalf of the resource pool, VM or world to processor interrupts.
%WAIT – Time spent in the blocked or busy wait state.
%RDY – Time CPU is ready to run, waiting for something else
High %RDY and high %USED can imply CPU over-commitment

By default esxtop will refresh result every 5 sec, and you can modify by command s 2 (that will refresh in 2 sec). Esxtop run with "interactive" mode by default and collect and assemble a report for cpu, memory, disk and network statistics. Here are some commands which help to collect the specific task.
c – CPU resource utilization.
m – memory resource utilization.
d – storage (disk) adapter resource utilization.
u – storage device resource utilization.
v – storage VM resource utilization.
f – displays a panel for adding or removing statistics columns to or from the current panel.
n – network resource utilization.
h – help.
o – displays a panel for changing the order of statistics.
i – interrupt resource utilization.
p – power resource utilization.
q – quit.
s – delay of updates in seconds. w – write current setup to the config file.
and the base command is esxtop [h] [v] [s] [a] [c file] [d delay]

By pressing O or o you can re-arrange the esxtop output like this.

You can get access of esxi host by typing DCUI command on this putty session and perform the respective task.

From this putty session you can do more configuration for esxi host also like change host name, IP configuration, DNS settings and more. To do this you need to type vi /etc/host and screen will appear like this.

To modify here need to follow these lines
Without entering insert mode move to the character you want to change, press R, then press the key for the character you want to change to. To save and quit press Esc, :, w, q.
To delete any lines here, Press d twice to delete the whole line. You can also press x to delete only one character at a time when you are not in insert mode.
To see available commands here type cd /usr/sbin then ls and the output will be like and many more are there.

To update and see the nic status

vmware –l shows version of vmware

esxcli system-- shows more details about vmware

esxcli storage--about storage
esxcli storage nfs list--if any nfs storage is there

There is a fantastic tool kit VI Toolkit which works with windows powershell. After installing VI Toolkit you will see a icon on your desktop just double click and it will show you like this.

To use this first you can have connect the vcenter by typing connect-VIServer and it will pop up and credential screen to login like

After successful login this will be screen, you can see its show that you are connected with 443 port to vcenter with authorized user

Just type the get-VIcommand to see the available, there are lots of command to perform from vcenter level. Like show all vm, show only power on vm, show storage and many more.

Listing out some Known issues with VI Toolkit

The VI Toolkit (for Windows) 1.5 has the following known issues:(with Ref of Vmware Blogs)

Get-Datastore : (Get-Datastore).FreeSpaceMB might not return the actual datastore free space after a virtual machine is powered on. A refresh should be made first.

Get-Log : The output of Get-LogType cmdlet can not be pipelined to the Get-Log cmdlet.

Get-ScsiLunPath :When running Get-ScsiLunPath, the Scsi device can not be specified by name.

Get-VIEvent :When Get-VIEvent is run for entities other than virtual machines, an incorrect result is returned.
    When Get-VIEvent is run against an ESX host and a non-existing user is specified, a hundred entity records are returned.
    When Get-VIEvent is run against an ESX host whose time zone setting differs from the time zone setting of the local machine, no result is returned.
    Workaround: Run Get-VIEvent directly on the ESX host.

Get-View : Get-View might behave inconsistently depending on how the managed object is specified.
Get-VM :During the process of creating a template from a virtual machine, Get-VM returns both the virtual machine and template objects.

Get-VMHostFirmware:Get-VMHostFirmware can not be executed by users with read-only rights on the ESX or the VirtualCenter host.

Get-VMGuest: When Get-VMGuest is run against a virtual machine that is just starting, the properties of the returned VMGuest object are not filled at one time.

Invoke-VMScript: On 64-bit operating systems, Invoke-VMScript works only in 32-bit mode.
    Invoke-VMScript does not work if the guest operating system is installed on a hard drive different than C: or D:.
    Invoke-VMScript might hang when executed against a virtual machine running on ESX 3.0.

Move-Inventory:Move-Inventory does not work with virtual machine templates.

New-HardDisk: When New-HardDisk is run, the Split parameter can not be applied to the hard disk.
    New-HardDisk can not create an undoable disk on a powered on virtual machine.

New-VM: New-VM can not create virtual machines whose names contain special chars on VirtualCenter 2.0/ ESX3.0.

New-VMHostNetworkAdapter: New-VMHostNetworkAdapter cannot set the value of the MAC address on VirtualCenter 2.5 and ESX 3.5.
    New-VMHostNetworkAdapter does not accept object names as arguments for the VirtualSwitch parameter.
    Workaround: Pass to the VirtualSwitch parameter VirtualSwitch objects instead of their names.

New-OSCustomizationSpec :The operating system customization specifications with passwords created by New-OSCustomizationSpec, if edited with VIClient, throw errors when applied.

New-Snapshot: When invoked with the Quiesced switch parameter on, New-Snapshot creates a snapshot with Quiesced parameter value $false.

Remove-Template: When invoked with the DeleteFromDisk switch parameter on, Remove-Template is not executed synchronously.

Remove-VMHostNtpServer: The pipeline Get-VMHost | Get-VMHostNtpServer | Remove-VMHostNtpServer does not work.

Set-HardDisk: Set-HardDisk can not set the hard disk persistence to IndependentNonPersistent.

Set-ScsiLunPath: Set-ScsiLunPath does not work properly when the Active parameter is set to $false.

Set-VMHost: Set-VMHost throws an error when applied on a disconnected virtual machine host.

Set-VMHostDiagnosticPartition: Enabling a diagnostic partition with the Set-VMHostDiagnosticPartition cmdlet does not work on VirtualCenter 2.0/ ESX 3.0 platforms.

Set-VMHostNetworkAdapter:On VMware ESX 3.x/ VirtualCenter 2.x, the Set-VMHostNetworkAdapter cmdlet might take longer time to update the values of the FullDuplex and BitRatePerSec network adapter properties due to the hardware configuration being performed, and the object returned by Set-VMHostNetworkAdapter might still contain the current configuration instead of the updated one.

Set-VMHostSNMP: Set-VMHostSNMP fails to enable VMHostSNMP and to set the ReadOnlyCommunityString when called for the first time.
    Workaround: Run the command again.
    The default value of the Set-VMHostSNMP TargetPort parameter is a random number instead of the
     port number.

    Set-VMHostSNMP does not take in account the value of the TargetPort parameter.

Update-Tools: Update-Tools might hang if the mouse, VGA, and network drivers are not signed. A standard Windows dialog appears and a manual interaction is needed.
Inventory Provider: The output of the dir command, run while the Inventory Provider is running, might be difficult to read.

Datastore Provider: Files can not be copied in or out the Datastore Provider.
VI .NET Toolkit: The ScreenDimensions property of the VMGuestInfo object is not populated.

Working on 64-bit Platforms: Operations with ESX or VirtualCenter take long to complete when working on 64-bit platforms.
    Workaround: This is a .NET 2.0 issue and it is fixed in Service Pack 1. Install Service Pack 1 for .NET 2.0.

I will be updating admin task which can be done with vi-toolkit with powershell very soon.
Pls do comment and reply on page if any query or explanation needed, will be happy to listen and solve your technical issues.

Always try to learn the thing which enhance your current role.

VMware More about Log files and Basic Settings with Vsphere

Known Issue and Workaround for Vsphere 5.5
Vmware Component Service-Failed to Start,Stuck on Starting
vmware vsphere 6 web client not opening
Vmware Tools Troubleshooting and Debugging Logging

HYPER-V Networking Concept

noreply@blogger.com (Piyush Srivastava) — Wed, 01 Feb 2017 16:04:00 +0000

Installation, Configuration Phase-1
SCVMM Installtion,Configuration-I

Hello Professional,

HYPER-V Networking Concept:

There are 3 types of networking switch in HYPER-V

1.External Virtual Network: This network is basically bound or connected with network card that is installed in physical host, and vms have access to access this adapter.In different and easy way to understand this network can be called as Management NIC.

2.Internal Virtual Network: this is not bound with physical host network adapter. this is only being used to communicate with HYPER-V host and vm. It mainly used for enabling ISCSI. To understand this is used to connect shared storage.

3.Private Virtual Network: This is being used to communicate between vm to vm only. This type of network can be also used in cluster network model.

The Hyper-V networking stack is smart enough to know that the traffic is going to another VM connected to the same switch and directly passes the traffic to the VM without ever touching the physical network adapter or physical network. This is very strong recommendation to use same nomenclature over all network while configuring the network switches, so that you can understand what switch is responsible for what work. if you migrate the vm from one host to another host, it will look for the same name to destination also and if this doesn't match the vm network adapter will show as disconnected network. In the designing part you have to spend good time decide the naming for HYPER-V infrastructure.Soon will be update configuration of switches.

Extensible Switches: This feature provide feature like port mirroring, DHCP server advanced configuration, Route extra feature, bandwidth feature and many more.Even enable Cisco Nexus 1000v which is available in VMWARE environment.In earlier version of Microsoft 2008 and 2008 R2 this was also not supported by HYPER-V but in 2012 Microsoft made it. Basically lots of other feature require when you are working with third part vendor and software in production and this feature enable the ability to manage efficiently.The Windows Server 2012 R2 extensible switch also supports hybrid forwarding, which allows packets to be forwarded to different forwarding agents based on the packet type.
There are other advanced options when you are managing HYPER-V from SCVMM server,that we will doing very soon.

We will be uploading more topics on HYPER-V management. Any query or question, please comment, we are very much available to listen and solve.

Don't let sleep your zeal to learn and earn.

Installation, Configuration Phase-1
SCVMM Installtion,Configuration-I

The Vsphere Client Web server is initializing- Issue

noreply@blogger.com (Piyush Srivastava) — Wed, 01 Feb 2017 15:52:00 +0000

VMware More about Log files and Basic Settings with Vsphere
ESXi Troubleshooting-I

Known Issue and Workaround for Vsphere 5.5
Vmware Tools Troubleshooting and Debugging Logging

Hello Professional,

Here is an issue i face where vsphere web server was showing this error.
Below reason could cause the issue

Issues:
1. Web server service is in starting status or
2. Web server service stuck at starting or
3. All service running but its taking too much time to respond on Web.

Solutions:
1 Wait to Stable the Vcenter Server as after reboot it take some time to be
    in normal behaviour.
2. Try to Restart Dependency service and check the Event logs or see if the
   ports are not in use with Netstat command.
3.What i found in the case, After Reboot all vmware services are running
   properly but it showing initializing. Because of vCenter Server is very
   hungry in regard of resources (Memory and CPU) so wait for 15-20
   minutes to let this stable.

If none of the suggested solution works in your environment, please do let us know will be happy to assist you. Comment or reply.

VMware More about Log files and Basic Settings with Vsphere
ESXi Troubleshooting-I

Known Issue and Workaround for Vsphere 5.5
Vmware Tools Troubleshooting and Debugging Logging

Amazon Web Service Training

noreply@blogger.com (Piyush Srivastava) — Wed, 01 Feb 2017 15:37:00 +0000

AWS Technical Training Syllabus
Hi professionals,

Started an introduction with AWS Training Session this week. Sharing starting syllabus now. You will be getting updates very soon on all the topics.

1. Understanding of Networking concept:
        I.Virtual Private Cloud
              a. Characteristics and Infrastructure
              b. Creating and configuration
              c.Access Method
              d. VPC peering
              e. More Examples and Scenario

2. Groups and NACLs
            a.Layered security
            b.Configuration
            c.Understanding and configuring NACL

3.Understanding and Configuring VPC access
     a. What is VPC acces
   b. Direct Connection Menthod
     c. Configuring and understanding VPN
     d. More on with Configuration VPC Peering

4. What is EC2 Instance
    a. Introduction
    b. Functions and Importance in AWS

5. Elastic Block Storage
    a. What this mean
    b. What I/O stand here
    c. Instances- Configuring and Understanding

6. EBS Replication and Snapshot
    a. Characteristics
    b. Hands on Practical from console

7. Amazon S3
    a. Introduction
    b. Hands on from Console

8. Amazon S3 Website Hosting
    a. Static Website Hosting
    b. Configuring

9. Configuring ELB
    a. Introduction
    b. Deployment Scenario
    c. Configuration from Console

10. Auto Scaling
    a. Introduction
    b. Back-end Working Model
    c. Configuring

11. Route 53
    a. Introduction
    b. Relation with DNS
    c. DNS and Network Routing from Internal and External
    d. Hands on view from console

12. Identity Access Management
    a. Introduction
    b. Configuring
    c. Security Token services

13. Monitoring
    a. Introduction
    b. Configuring
    c. What terms used here Trusted Advisor

14. RDS HA and Load Sharing
    a. Introduction
    b. Configuring

15. Backup
    a. EBS Options
    b. S3 and RDS Backup

SCVMM Installtion,Configuration-I

noreply@blogger.com (Piyush Srivastava) — Fri, 30 Dec 2016 15:05:00 +0000

Installation, Configuration Phase-1
HYPER-V Networking Concept

Hello Professional

Here will go through with SCVMM, what this term means, what is feature and capability and so many questions with how, why, what and if

Lab Setup:
1 Domain Controller/ 2 HYPER-V/1 2012R2 Member Server/1 Member Server for SQL Database.
Pre-requisite of SCVMM:

1. Pre-Installed and 2012R2 Member Server.
2. 2012R2 ISO
3. MSSQL Installed Server with handy ISO
4. On Domain Controller, create these groups for easy administration
   DOMAIN\scvmmadmin                 Service Account account
    DOMAIN\scvmmadmin            account for managing hosts
    DOMAIN\scvmmadmin                 For SQL Purpose
    DOMAIN\scvmmadmin           SCVMM Administrators group

Add SCVMM Id as Local Administrator to SCVMM Server and SQL Server.

5.Windows Assessment and Deployment kit for windows 8.1from here(this link will give you small 1.4 MB software which will download rest of data from internet approx 2 GB patches and tools) and its time taking job so do this before a day.

Starting setup wizard on 2012R2 member server.
Selected VMM management server and VMM Console

Basic details

License Agreement, Just accpet

right now skipped windows update, because my plan is to update with SCCM

By default installation directory

got error for pre-requisite.

i downloaded the ADK tool and run on the lab setup. but this is giving file missing error. So i run this ADK tool on my internet system and downloaded the patch and tools by selecting the option for another computer. Frankly it took 1 hour.

Selected highlighted option but you please dont select SQL Express because this edition is not supported for SCVMM database.

and after click install

Once ADK setup completed, click check pre-requisite again

recommendation to increase the server memory, sure will do

installed dot net because getting some error which was causing the setup crash every time, and missed the pre-requisite that dot net 3.5 is must

It was 1:30 AM and instead of start from beginning because i may miss or not remember so i pause the vm and power off my desktop. next day again i start but got this error which gave me a thought ohhhh what is this.
to over come from this issue i restarted my desktop but finally removal of suspended file resolve this.

Selected MSSQLSERVER database. dont select the port until you customized your network communication port. let is be default

leave the port details as default

starting with creating new library, this is first setup. other wise you can select existing share.

Installation Summary

in progress

Setup completed

and after login the dashboard.

after that adding Hyper-V to this

right now will continue with basic options

added manually the HYPER-V servers and didn't skip AD verification.

after some time, it displayed this error

its showing pending for second HYPER-V, will see exactly what is causing this.

on Jobs tab, i can see running and history task. so it showing 50% for the pending server

to over come the above issue, i clicked on failed job and retry. basically the addition of HYPER-V to SCVMM server will install agent on both HYPER-V.
there are lots of other task and activity can be performed after that.

Finally both HYPER-V added to SCVMM server. There are lots of other things to do and understand that how it works.

Any query or question, please comment, we are very much available to listen and solve.
Don't let sleep your zeal to learn and earn.

Installation, Configuration Phase-1
HYPER-V Networking Concept

Citrix Installation and Configuration-II

noreply@blogger.com (Piyush Srivastava) — Fri, 30 Dec 2016 11:49:00 +0000

Citrix Installation and Configuration-1

Citrix Installation and Configuration-III

Hello Professionals,
In previous blog, have installed Citrix Xen App with basic configuration and were at this stage.
There are different tabs which shows different information about XenApp services and configuration.

This Hotfix management tab shows information about XenApp patching. A patch details will show here if any latest patch is released recently.

Now will start addition/ creation and advanced configuration from this dashboard.
To start it it need to run and discovery command that helps further for adding and configuring of sites and services.

here will select Active Directory for Single Sign-On environment.

After next got this error. To troubleshoot this issue gone through with so many events and logs.Then finally one thing remind me pre-requisite step before running this run and discovery command.

These configuration should be done with schema administrator privileges its mandatory to run the schema prep and domain prep command before configuration.This should be done from Citrix server and make sure not to perform from any of your Domain Controller.
this tools can be found on Citrix installtion drive\Suppor\Password_Manager\Tools
Before running schemaprep command, run this command with admin access on command prompt
regsvr32 schmmgmt.dll
then
ServerManagerCmd -i RSAT-ADDS
D:\Support\Password_Mamager\Tools\CtxSchemaPrep
D:\Support\Password_Manager\Tools\CtxDomainPrep and after it ask to reboot the server.
There are steps which i follow and got jump in to different issue. I run SchemaPrep and DomainPrep command it showing error for FSMO Server and domain controller connectivity issue. I found replication issue because for this Schema and Domain command a user ID should have Schema Admin access to Domain, but Id was not showing to any other controller. It took me 45 minute to replicate all the data forcefully and even Active directory user and computer console was not opening on citrix installed server. so i run the below command to check the replication status and force to replicate. As we run the Schema preparation and domain preparation command on the citrix server its very necessary that replication should be perfect.
REPADMIN /SHOWREPS
REPADMIN /SHOWREPL
REPADMIN /SYNCALL
once replication done both command run properly. So have learnt another pre-requisite that Active Directory Replication should work fine before you run the SchemaPrep and DomainPrep for XenApp further configuration.

and after that all goes fine.

Citrix Web interface: is a sharing connctor in farms that provide a centralized access for application which are on different farms. Its recommended to be hosted on dedicated web servers. XenApp support AD FS and recommended and trusted with Citrix web interface when its being used by different organization.Web Interface is configured in Infrastructure setup to user Access gateway.
Now we are moving with creation of XenApp Sites and XenApp Services from XenApp Dashboard.

first configure the web sites, where it start wih adding the server and farm

there are different options available for configuring authentication method

Windows supports two authentication protocols, Kerberos and NTLM, so applications such as Windows Explorer, Internet Explorer, Mozilla Firefox, Apple Safari, Google Chrome, Microsoft Office, and others, can use Windows passthrough authentication to access network resources without explicit user authentication prompts.When Kerberos pass-through authentication is used to start a XenApp session, there are technical limitations that may affect application behaviour. Applications running on XenApp that depend on the NTLM protocol for authentication generate explicit user authentication prompts or fail. Most applications and network services that support Windows pass-through authentication accept both Kerberos and NTLM protocols, but some do not. In addition, Kerberos does not operate across certain types of domain trust links in which case applications automatically use the NTLM protocol. However the NTLM protocol does not operate in a XenApp session that is started using the Kerberos passthrough authentication, preventing applications that cannot use Kerberos from authenticating silently. Kerberos pass-through authentication for applications expires if the XenApp session is left running for a very long time (typically one week) without being disconnected and reconnected. Kerberos is based on security tickets issued by domain controllers, which impose a maximum refresh period (typically one week). When the maximum refresh period has ended, Windows obtains a new Kerberos ticket automatically by using the cached network credentials that are required for the NTLM protocol. However, these network credentials are not available when the XenApp session was started using Kerberos pass-through authentication.
If you configure both smart card and explicit authentication, users are initially prompted to log on using their smart cards and PINs but have the option to select explicit authentication if they experience any issues with their smart cards.
Its recommended to use passthrough authentication for access scenarios of internal users on managed devices. and if windows is not configured with SSO it will automatically shift to Explicit authentication.
Here you can restrict the domain, if you want to allow to any specific domain only and if you limited the access for a specific domain, it can be changed in future(will share you the steps in next article).

Continued with Full Logon Screen.

in this option, its very much clear why are admins moving with on-line option

Will star with site now

Added Citrix installed server, i have only one right now.

And once done with Site and services, you can some new tabs and option under SSO with Default Policy and Domain Policy.

Will go through with more points in coming blog. Any query or question, please comment, we are very much available to listen and solve.

Dont let sleep your zeal to learn and earn.

Citrix Installation and Configuration-1

Citrix Installation and Configuration-III

Citrix Installation and Configuration-1

noreply@blogger.com (Piyush Srivastava) — Sat, 03 Dec 2016 16:33:00 +0000

Citrix Installation and Configuration-II
Citrix Installation and Configuration-III

Hello Professionals,

What is Xen-App : A Client software that enable access to available or configured resources from any device. A virtualization application tool that make available to access that application without installing on there device.All that require to install a plugins to deliver this from server end to client end.

Lab Setup:
AD Server: 2008 R2
Member Server: 2008 R2
Client : Windows 7

Here we are installing Citrix Xen App on member server.

Add Server Roles

It more and more depend on organization requirement then license, that for which edition you are authorise.

Accept License Agreement

I am installing all roles on same server, resource crush :)

Next with Default option.

prerequisites summary

prerequisite check is all green, we are good to go

Successfully added the role its time to configure role

By default option, as this is my newly and first server and am making this as License server.

Licensing for XenApp Model

Create a new server farm

I gave farm name as APPLE

The wizard will connect and test the database connection, provide Local Administrator Access.

Shadowing is very interesting part in this section.If we enable this shadowing option, it allows to see you other user session. You can monitor, interact, view. If this option is prohibited then to enable this, only re-installation is the solution. you can not change after completing the setup.So will go with Allow option.

next with default options.

enabling SSO option with Active Directory Integrated.

EdgeSight is a performance and availability management solution for Xen App systems. EdgeSight monitors applications, devices, sessions, license usage, and the network in real time, allowing users to quickly analyse, resolve, and pro-actively prevent problems

Like Default only.

XenApp configuration is also done now.

Updated wizard screen with green light for Licensing and XenApp

Start with Web Interface

Due to new installation, designating the server with web functionality

the very interesting part i found that after installing Citrix XenApp, you will not get Appcenter icon or console in program tab. for that you need to below path.
C:\Program Files (x86)\Citrix\Citrix Delivery Services\Framework
\cmilaunch.exe

For now, am done with installation and basic configuration. Will update the blog with more points very soon. Thanks guys for our kind support.

Any query or question, please comment, we are very much available to listen and solve.

Citrix Installation and Configuration-II
Citrix Installation and Configuration-III

Symantec BackupExec Installtion and Configuration-I

noreply@blogger.com (Piyush Srivastava) — Sat, 03 Dec 2016 15:02:00 +0000

Hello Professionals,

Here will be starting for Installation and Configuration for backup Exec R3 on Windows Server 2008R2.

Lab Setup:
AD Server: 2008 R2
Member Server: 2008 R2

The Installation process is quite simple like next and next. but its mandatory to understand how does it work, what are agents, and what is recommendation.
I have downloaded setup from Symantec site.
Click on Browser64.exe

Getting Started

Click on Backup Exec, will discuss later for Backup Exec Continuos Server Option.

Click Run

Environmental check, basically you can say pre check before running fianl setup.

As we are installing Backup Exec on this server only, so will continue with Local environmental check option. Support you want to install on other member server, so you can select remote option.

Pre check result, if any prerequisite is not matching with minimum requirement for this.Here it will show you as red option.

Will start with fresh installation of backup Exec, from this console also you can push and install backup agent to remote servers for that you are planning to schedule and take backup.

License Agreement, Accept and Next

We are doing here Typical installation, In custom installation you can select and install different agent and policies on other member server.

Continue with Blank license here, this will give you full feature enabled for a limited time period. This import from file option used when you are upgrading to new or installing fresh so you can browse the license file.
Note: The server which are all ready have Backup Exec, you can find the license on this path
Look for besernum.xml in c:\windows\ or windows\system32. license key are here stored.

This is different domain i created for Backup for further lab practise.
as this installation require local administrator access so performing with local admin ID. You can change the Installation directory also.

This Account is added and permitted as log on as a service, to create token objects and log in with Batch login type. So its recommended that before installation in Domain, you should create a different ID with Domain Admin Access and make this as only for Backp purpose.

From Here you can add servers to push the agent for Windows Servers.

Summary, click Install

Installation Started

It took approx 20-25 min to finish this installation and after that reboot.

You can login with same ID you created for Backup us only or any Administrator ID, as it require further configuration.

Finally installation part is done, and moving to configuration part.

Once you see on left side of console, here are some configuration require before proceeding any other task. Like create Logon Accounts, Configure Devices, Create Media Sets and Configure Intelligent Disaster Recovery.

Configure Devices is option where you can add your Backup Media, by which you are taking backups.
Media sets is the option, where you can create different sets like example
yearly, Monthly, Weekly and daily. That tagged backup tape number will automatically assigned to these media sets. You can configure as per your requirement.

Creating Logon Account.

I created different user with Domain Admin Access for backup purpose only.

here adding Tape device.

I will be moving with Backup to Disk Folder option.This option will enable to save the backup to a disk

This is home page of backup server console.
Job Setup: This tab gives you option and access to create backup jobs as per your requirement.

Job monitor: this tab gives you a detail about your backup history, that what job are running and successfully and failed

Alerts: will give you error, warning, information about Backup Exec update and services

Report: you can pull different reports, like backup passed, failed updates and all.

Devices: it will show you that how and what devices are connected for this backup server.

Media: this tab gives you a full detail of your media that you used for your backup server with more details and options.

For detailing on the service what will be in use for backup exec, you can go to services console and take a view. will discuss very soon.

There are lots of configuration remaining to move this in to production. will update the blog very soon. you can share your views, feedback and any query or issues in your environment, am happy to listen and work for you.

Active Directory Rights Management

noreply@blogger.com (Piyush Srivastava) — Sat, 03 Dec 2016 11:53:00 +0000

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

Active Directory Site and Services with Replication
FSMO Roles-Move and Seize theory
Move AD Database to Other Location
Imprtant Points for Active Directory Group Policy
Active Directory Group Policy-I

Hello Professionals,

what is exactly this term, where is used and how. After enabling what feature will be available for use.Having lots of questions for this term, and started to check on my lab setup.
got some explanation that AD RMS is basically feature that allow to provide users to give read,open, modify and further access/privileges/authorize on email messages,email messages from being forwarded,edited or copied by unauthorized individuals, internal websites and internal documents. AD RMS is integrated with AD FS, where 2 different organization can share information and only one need to install AD RMS feature.

Below roles help to delegate of AD RMS functionality.
1.AD-RMS Enterprise Administrators
2.AD-RMS Template Administrators
3.AD-RMS Auditors

After Installing this role, new role automatically created on server as local security groups.These groups allow and enable to manage the AD RMS environment more efficiently.
AD-RMS Service Group: At time of installing AD-RMS wizard ask to create or provide credential a user as service to communicate and gather informations.This is set as service account and with automatic startup stage.
AD-RMS Template Administrators:Users added to this group are authorised only for manage policy template. Like create, modify, update, export or import.
AD-RMS Enterprise Administrators: Users belong to this group having full access to AD-RMS environment.They can delegate permission, modify configuration. Just like Local administrator access to the server. Its adviced to limited with few people.
AD-RMS Auditors:Users belong to this group are allowed and authorised to audit, manage logs and reports.Its kind of read only access.

First will start with installing AD RMS and then will go through with basic and advanced configuration.

From Server Manage Add Roles and check AD-RMS to install

In very first installation it will create new cluster with root in your forest domain. After that you can add further AD-RMS to this cluster.

Here RMS require a database to save such information.You can select SQL or Windows Internal database. Only limit is with Windows Internal that after you can not add more server to this newly created root cluster.

A service account require to communicate with other RMS services in network.Its always recommended that create a different user for different services.Its best practise to ignore conflicts as well as identify the root cause in the time of problem easily.

Until you are not sure that your AR-RMS is fully deployed and configured with final setting, select Mode-1 and after that you can change it to Mode-2. Because if you selected and finish the setup with Mode-2, you can not undo or modify the changes in configuration after final deployment.Its like you need fresh installation after that to rebuild again.

I selected with central manage option.At least i can identify where i save the keys. other wise there are lots of stuffs for administrator and everyone is in always hurry.

Provided the password to cluster key. As the same authentication will be asked if you add other AD-RMS server in future.

On first installation, it will select Default only.

Updated the Cluster Address to enable and make easy for AD-RMS client to communicate.

Its SSL certificate is there, so selected automatically.

This is first AD-RMS Server, so i selected this server an License server

An Enterprise Admin Access is require to register this service connection point.This is the service for users to discover the AD RMS web services.Only one SCP service can be register in AD Forest. Further advanced configuration for SCP service can be done with ADSI or LDP Tool.For More on SCP and understand its importance, this is ref Link

here i confirm for the below details and next

Installation started

installation Result

After Completed, when you will open AD RMS tool, it will show like this. Proceed with Yes option.

But am not able to connect because by default its connecting to port 80 and i have selected 443. So i connected manually with port443

There are looots of option and policies to check. Will update in next blog very soon.

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

FSMO Roles-Move and Seize Theory

noreply@blogger.com (Piyush Srivastava) — Wed, 30 Nov 2016 13:24:00 +0000

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

Active Directory Site and Services with Replication
Active Directory Right and Management
Move AD Database to Other Location
Imprtant Points for Active Directory Group Policy

Hello Professionals,

FSMO Roles: In previous blog, its explained that what is FSMO role and there importance. Today am doing further practical on FSMO that is how to Seize and Transfer.

When to perform seize and when to transfer.

Every Forest level Domain controller having all 5 roles and other Domain level, Domain controller having 3 roles.Its very important to place them on correct place other wise there will be different issues in Domain Controller.

Lab Setup:

Forest Domain Controller: 2003 Standard Edition

Child Domain Controller: 2008R2

Additional Domain Controller: 2012 and 2016

As 2003 is EOL, so today am moving to 2008R2. FSMO roles can be delegate by command as well as GUI from Domain Controllers. Some of organization are delegate FSMO roles in maintenance time of Domain Controller and after maintenance activity roll back the roles to original servers.This is practise to minimize the down time of services and production.

netdom query fsmo is the command to see which server having what type of FSMO Roles. From GUI also you can see the server having what roles are possible.

As the Current server is domain level so having 3 roles and Forest having other 2 roles.

To view Schema Roles first regsvr32 schmmgmt.dll need to register on command prompt, then add the Active Directory Schema console from mmc.

Before proceeding the delegate the FSMO roles, its require to connect the destination domain controller from Forest Root DC.

Open Active Directory Domain and Trust, then click on connect to Domain Controller

Select the domain controller where you are planning to delegate the roles.

from here, first operation master need to delegate to destination domain controller.

and further Schema will me moved like this. First register the dll and add the schema from mmc console.

Then finally login to Destination server and move the schema, because at every role, the wizard will ask to connect the destination domain controller.

then finally, All roles are moved to my 2008R2 server. and i can power off 2003 DC.

Still there are lots of thing to modify on configuration based, will be posting very soon.
What is the server which was performed for maintenance didnt caem online or due to some un-wanted issue the server got crash. Then FSMO Seize option works here. Basically From Destination server, you need to follow the below command with administrator access.
ntdsutil
roles
connections
connect to server servername

quit

SEIZE INFRASTRUCTURE MASTER
SEIZE RID MASTER
SEIZE PDC
SEIZE SCHEMA MASTER
SEIZE DOMAIN NAMING MASTER

and then run forcefull sync command to update the data, as it will take some time to respond and update other domain controllers.

comment and share if any query or issue you are facing.We will try our best to solve the case.

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

Active Directory Site and Services with Replication
Active Directory Right and Management
Move AD Database to Other Location
Imprtant Points for Active Directory Group Policy

Known Issue and Workaround for Vsphere 5.5

noreply@blogger.com (Piyush Srivastava) — Wed, 09 Nov 2016 13:30:00 +0000

VMware More about Log files and Basic Settings with Vsphere
ESXi Troubleshooting-I

Known Issue and Workaround for Vsphere 5.5

Vmware Component Service-Failed to Start,Stuck on Starting

vmware vsphere 6 web client not opening

Here are some Knows issue for Vsphere 5.5 with its workaround solutions.

1.   Reinstallation of vCenter Single Sign-On node hangs indefinitely at "Configuration SSO Components.
    You install multiple instances (nodes) of vCenter Single Sign-On 5.5. When you uninstall one of the nodes, The VMware Directory Service, which has been replicated across nodes, is not cleaned up automatically. When you reinstall the node, duplicate VMware Directory Service information prevents the installer from completing the installation and from pointing the node to the existing vCenter Single Sign-On instance. Installation hangs indefinitely.

Workaround: Change the host name of the vCenter Single Sign-On server and clear out stale Windows registry keys. See the resolution section of VMware Knowledge Base article 2059131(http://kb.vmware.com/kb/2059131).

2.Storage profiles not visible in the vSphere Web client after you install and uninstall vCenter Server
If you uninstall vCenter Server from the Windows control panel item Add/Remove Programs or Programs and Features, Profile-Driven Storage is also uninstalled. When you reinstall vCenter Server, Profile-Driven Storage service is also installed, but you cannot see previously created Storage Profiles in the vSphere Web Client. New Storage Profiles can still be created.

Workaround: To uninstall vCenter Server without uninstalling Profile-Driven Storage, use an MSI command. Then, when you reinstall vCenterServer, either through the installer wizard or from the command line, you can still see previously created Storage Profiles in the vSphere Web Client.

To uninstall vCenter Server, use the following sample command as a model:
msiexec.exe /x vCenter Server Product code
For example:
msiexec.exe /x {E1F05550-4238-4378-87F0-105147A251D9}
The exact product code for vCenter can be obtained from the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VMware vCenter Server

3. Login might fail for Local OS users if vCenter Single Sign-On 5.5 includes more than one node
The Local OS identity source is available after install or upgrade, as follows: * The vCenter Single Sign-On installer adds the Local OS identity source to the vCenter Single Sign-On configuration. If you create more than one node, the Local OS from the primary node displays as an identity source on all other nodes. * If you upgrade a vCenter Single Sign-On High Availability environment, Local OS from the primary node displays as an identity source on all other nodes. However, even though the Local OS from the first node displays as an identity source in secondary nodes, Local OS users from the first node cannot log in on those secondary nodes.

Workaround:None.

4. Installation using Simple Install fails on Windows Server 2008 R2 and Windows 2012 hosts
If you use Simple Install to install vCenter Server and components on a Windows Server 2008 R2 or Windows 2012 host, and the host is configured to use DHCP IP addressing, the installation fails with warning and error messages.

Workaround: Take one of the following actions.
    On a Windows Server 2008 R2 or 2012 host: configure Windows Server to use a static IP and hostname.
    On a Windows Server 2008 R2 host only: map the DHCP IP and hostname to the system's HOST file in the operating system.

5. During vCenter Single Sign-On 5.5 installation, you cannot specify a host name that is different than the FQDN of the machine on which you are installing vCenter Single Sign-On.
The vCenter Single Sign-On installer does not have the option to specify a host name during installation. The installer always uses the FQDN of the machine on which you are installing vCenter Single Sign-On. You cannot use a CNAME instead of the FQDN during installation.

Workaround: None.

6.Installation on Software iSCSI LUN fails with the error Expecting 2 bootbanks, found 0
The full error that accompanies this problem is:
Error (see log for more info):
Expecting 2 bootbanks, found 0.

This problem occurs when the first network adapter is configured to boot from an iBFT iSCSI. The iBFT IP settings are used to configure the VMkernel network port that is created to access the iSCSI boot disk. In this case, the port is the management network port, because the first adapter is used for management traffic.
When the installation is approximately 90 percent complete, the installer reconfigures the management interface with DHCP. As a result, the iBFT IP settings are lost and the TCP connection with the iSCSI boot target breaks.
Workaround: Take one of the following actions:
>    If multiple network adapters are available, use the second network adapter to access the iSCSI boot
     disk.
>    If only one network adapter is available, configure iBFT to use DHCP. The iSCSI target should be on the management network. If the iSCSI target is on a different subnet, the default VMkernel gateway can roError message 25205 appears during installation of vCenter Server on Turkish version of Windows Server
On any Turkish version of Windows Server 2008 or 2012, when you install vCenter Server with the vCenter Server database on the same host machine, Error message 25205 appears.
Workaround: Install and run the vCenter Server database from a remote English version of Windows Serverute both management and iSCSI traffic.

7.Error message 25205 appears during installation of vCenter Server on Turkish version of Windows Server
On any Turkish version of Windows Server 2008 or 2012, when you install vCenter Server with the vCenter Server database on the same host machine, Error message 25205 appears.
Workaround: Install and run the vCenter Server database from a remote English version of Windows Server.

8. Simple Install checks space requirements only on system drive
Simple Install checks whether enough space is available before it starts the installation. However, it performs the check only if you install on a system drive. If you attempt to install on a non-system drive, the installer does not check whether enough space is available.
Workaround: Check the disk space available on the target drive before installation. The minimum required free space for Simple Install is 10GB. More space is recommended. See the Installation and Setup documentation.

9.If you use preserve VMFS with Auto Deploy Stateless Caching or Auto Deploy Stateful Installs, no core dump partition is created. When you use Auto Deploy for Stateless Caching or Stateful Install on a blank disk, an MSDOS partition table is created. However, no core dump partition is created.

Workaround: When you enable the Stateless Caching or Stateful Install host profile option, select Overwrite VMFS, even when you install on a blank disk. When you do so, a 2.5GB coredump partition is created.

10.If the vCenter Single Sign-On installation fails and rolls back, the vCenter Server Java Components (JRE) and vCenter tc Server component remain installed.When the Single Sign-On installation is canceled or fails, the installation rolls back to the pre-installation state, and a message states that the system was not modified. However, the vCenter Server Java Components (JRE) and vCenter tc Server component are still installed.

Workaround: Remove the components manually in the Windows Programs and Feature control panel.

11.vSphere Authentication Proxy installation fails if the installation path contains non-ASCII characters
If the installation path contains non-ASCII characters, the vSphere Authentication Proxy installation fails with the error message Error 29106. Unknown Error.

Workaround: Make sure the installation path contains only ASCII characters.

12. Installation of vCenter Server and related components fails if the user name of the logged-in user contains non-ASCII characters. If the user name of the user who is currently logged in contains non-ASCII characters, installation of vCenter Server, vCenter Inventory Server, vCenter Single Sign-On, or the vSphere Web Client fails with the error message: The user name contains non-ASCII characters. Please log in with a user name that contains only ASCII characters.

Workaround: Log in with a user name that does not contain non-ASCII characters and retry the installation.

13.During scripted installation, ESXi is installed on an SSD even though the --ignoressd option is used with the installorupgrade command
In ESXi 5.5, the --ignoressd option is not supported with the installorupgrade command. If you use the --ignoressd option with the installorupgrade command, the installer displays a warning that this is an invalid combination. The installer continues to install ESXi on the SSD instead of stopping the installation and displaying an error message.

Workaround: To use the --ignoressd option in a scripted installation of ESXi, use the install command instead of the installorupgrade command.

14.The autoPartition boot option might partition SSDs unintentionally
In Visor (an ESXi dd image written to a device), the autoPartition boot option is set to TRUE by default. This setting causes all blank local disks, including SSDs that you might have intended to use with vFlash and Virtual SAN, to be partitioned.

Workaround: Add skipPartitioningSsds=TRUE to the boot options line.

15.During vCenter Server Simple Install, a dialog box displays a warning that a script is causing the browser to run slowly.The vCenter Server Simple Install option takes a significant amount of time to install or upgrade all required vCenter Server components. This might cause the Internet Explorer browser process that runs the vCenter Server installer autorun screen to display the following warning message:
A script on this page is causing your browser to run slowly. If it continues to run, your computer might become unresponsive. Do you want to abort the script?

The warning dialog is displayed when the installation takes longer than the time set by the Windows registry entry: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Styles\MaxScriptStatements

This issue has been observed most frequently on the Windows Server 2012 operating system.
Workaround: Click No in the warning message, or set the value for the MaxScriptStatements registry entry to 0xffffffff.

16.Delay in Auto Deploy cache purging might apply a host profile that has been deleted
After you delete a host profile, it is not immediately purged from the Auto Deploy. As long as the host profile is persisted in the cache, Auto Deploy continues to apply the host profile. Any rules that apply the profile fail only after the profile is purged from the cache.

Workaround: You can determine whether any rules use deleted host profiles by using the Get-DeployRuleSet PowerCLI cmdlet. The cmdlet shows the string deleted in the rule's itemlist. You can then run the Remove-DeployRule cmdlet to remove the rule.

17.Applying host profile that is set up to use Auto Deploy with stateless caching fails if ESX is installed on the selected disk.You use host profiles to set up Auto Deploy with stateless caching enabled. In the host profile, you select a disk on which a version of ESX (not ESXi) is installed. When you apply the host profile, an error that includes the following text appears.
Expecting 2 bootbanks, found 0

Workaround: Select a different disk to use for stateless caching, or remove the ESX software from the disk. If you remove the ESX software, it becomes unavailable.

18.Installing or booting ESXi version 5.5.0 fails on servers from Oracle America (Sun) vendors
When you perform a fresh ESXi version 5.5.0 installation or boot an existing ESXi version 5.5.0 installation on servers from Oracle America (Sun) vendors, the server console displays a blank screen during the installation process or when the existing ESXi 5.5.0 build boots. This happens because servers from Oracle America (Sun) vendors have a HEADLESS flag set in the ACPI FADT table, even though they are not headless platforms.
Workaround: When you install or boot ESXi 5.5.0, pass the boot option ignoreHeadless="TRUE"

19.If you use ESXLIC commands to upgrade an ESXi host with less than 4GB physical RAM, the upgrade succeeds, but some ESXi operations fail upon reboot
ESXi 5.5 requires a minimum of 4GB of physical RAM. The ESXCLI command-line interface does not perform a pre-upgrade check for the required 4GB of memory. You successfully upgrade a host with insufficient memory with ESXCLI, but when you boot the upgraded ESXi 5.5 host with less than 4GB RAM, some operations might fail.

Workaround: None. Verify that the ESXi host has more than 4GB of physical RAM before the upgrade to version 5.5.

20.Upgrade to vCenter Server 5.5 does not detect expired SSL certificates
When you use Simple Install to upgrade to vCenter Server 5.5, the installer does not detect any expired SSL certificates.
If you upgrade from 5.1.x to 5.5 using the individual installers in a Custom Install, only the vSphere Web Client detects expired SSL certificates and stops the installation. vCenter Single Sign-On displays a generic warning message to verify the validity of SSL certificates. The vCenter Inventory Service and vCenter Server individual installers do not detect expired SSL certificates.

Workaround: Before you start the upgrade to vCenter Server 5.5, using either Simple Install or the individual installers in a Custom Install, check the validity of the SSL certificates of vCenter Single Sign-On, the vSphere Web Client, vCenter Inventory Service, and vCenter Server. Replace any expired SSL certificates with valid certificates before starting the upgrade process.

21.After upgrade from vCenter Server Appliance 5.0.x to 5.5, vCenter Server fails to start if an external vCenter Single Sign-On is used
If the user chooses to use an external vCenter Single Sign-On instance while upgrading the vCenter Server Appliance from 5.0.x to 5.5, the vCenter Server fails to start after the upgrade. In the appliance management interface, the vCenter Single Sign-On is listed as not configured.
Workaround: Perform the following steps:
    In a Web browser, open the vCenter Server Appliance management interface (https://appliance-address:5480).
    On the vCenter Server/Summary page, click the Stop Server button.
    On the vCenter Server/SSO page, complete the form with the appropriate settings, and click Save Settings.
    Return to the Summary page and click Start Server

22.After you upgrade vCenter Single Sign-On 5.1.x in a high availability deployment with a load balancer to version 5.5, you must reconfigure the load balancer
During the upgrade from vCenter Single Sign-On 5.1 to 5.5, the file server.xml is migrated, but you must update the file manually after the upgrade.
Workaround: See the topic Reconfigure the Load Balancer After Upgrading a vCenter Single Sign-On High Availability Deployment to Version 5.5 in the vSphere Upgrade documentation.

23.vCenter Server 5.1 not visible after you upgrade vSphere Web Client and vCenter Single Sign-On to version 5.5
Suppose you upgrade vSphere Single Sign-On and the vSphere Web Client from version 5.1 to version 5.5, but you do not upgrade the vCenter Server system. If you log in to the vSphere Web Client after the upgrade, vCenter Server system version 5.1 is not visible. This is a problem only for the Windows upgrade, and not when you upgrade vCenter Server Appliance.

Workaround: Restart the vCenter Server system and the vSphere Inventory service (services.msc). To see the vCenter Server 5.1 inventory, log in as admin@System-Domain. See VMware Knowledge Base article 1003895

24.The VMware VirtualCenter Server service might not start after you upgrade vCenter Server from version 5.0 Update 2 to version 5.5

Workaround: Start the VMware VirtualCenter Server service manually:

    From the Windows Start menu, open the Administrative Tools control panel item.
    Select Services.
    Right-click VMware VirtualCenter Server and select Start

25.When you use ESXCLI to upgrade an ESXi 4.x or 5.0.x host to version 5.1 or 5.5, the vMotion and Fault Tolerance Logging (FT Logging) settings of any VMKernel port group are lost after the upgrade
If you use the command esxcli software profile update <options> to upgrade an ESXi 4.x or 5.0.x host to version 5.1 or 5.5, the upgrade succeeds, but the vMotion and FT Logging settings of any VMkernel port group are lost. As a result, vMotion and FT Logging are restored to the default setting (disabled).

Workaround: Perform an interactive or scripted upgrade, or use vSphere Update Manager to upgrade hosts. If you use the esxcli command, apply vMotion and FT Logging settings manually to the affected VMkernel port group after the upgrade.

26.When you upgrade vSphere 5.0.x or earlier to version 5.5, system resource allocation values that were set manually are reset to the default value
In vSphere 5.0.x and earlier, you modify settings in the system resource allocation user interface as a temporary workaround. You cannot reset the value for these settings to the default without completely reinstalling ESXi. In vSphere 5.1 and later, the system behavior changes, so that preserving custom system resource allocation settings might result in values that are not safe to use. The upgrade resets all such values.

Workaround: None.

28.Networking is lost after you upgrade the vCenter Server Appliance, if the existing vCenter Server Appliance has a static IP configuration and the existing vCenter Server Appliance and the upgraded vCenter Server Appliance are in different subnets
Networking is lost after you upgrade a vCenter Server Appliance configured with both of the following conditions:
   a. The existing vCenter Server Appliance has a static IP configuration.
    b. The existing vCenter Server Appliance and the upgraded vCenter Server Appliance are in different subnets.
Workaround: To restore networking:
    Log in to the vCenter Server Appliance through the virtual machine console.
    Run /opt/vmware/share/vami/vami_config_net to reconfigure networking.

29.Attempts to upgrade the vSphere Web Client to version 5.5 results in warning message: Error: 29108
During the upgrade of the vSphere Web Client to version 5.5, the following warning message is displayed: Error: 29108. The unregistration of the service or Solution user failed.. This error occurs because the installer is unable to remove the application user programmatically.

Workaround:
   a. Record the exact vSphere Web Client solution user named in the warning message.
    b. Click OK to dismiss the warning message and complete the upgrade to version 5.5 of the vSphere
        Web Client.
c. Log in to the vSphere Web Client as the Single Sign-On administrator
d. In Administration, under Single Sign-On, click Users and Groups, and click the Application Users tab.
e. To remove the solution the application user named in the warning message, select the row for that user and click Delete.

30.IPv6 settings of virtual NIC vmk0 are not retained after upgrade from ESX 4.x to ESXi 5.5
When you upgrade an ESX 4.x host with IPv6 enabled to ESXi 5.5 by using the --forcemigrate option, the IPv6 address of virtual NIC vmk0 is not retained after the upgrade.
Workaround: None.

31.The vSphere Web Client service does not start after upgrade of the vCenter Server Appliance
When you upgrade the vCenter Server appliance from version 5.0 or 5.1 to version 5.5, the vSphere Web Client service does not start and the following messages appear in the Virgo Server log:
[ERROR] startup-tracker org.eclipse.virgo.medic.eventlog.default KE0004E Kernel failed to start within 300 seconds.
[INFO ] startup-tracker org.eclipse.virgo.medic.eventlog.default KE0011I Immediate shutdown initiated.

Workaround: Start the vSphere Web Client service by using the vCenter Server Appliance management interface.

32.Updated Error after switchover/failover on systems upgraded from vSphere 5.1U1a to vSphere 5.5 that use vCenter Heartbeat. An environment starts with the following configuration: vCenter Server 5.1U1a with vCenter Single Sign-On, Inventory Service and the vSphere Web Client, plus vCenter Heartbeat 6.5U1. You upgrade to vCenter Server 5.5, and upgrade vCenter Single Sign-On, Inventory Service and the vSphere Web Client at the same time. You upgrade vCenter Heartbeat to version 6.6.
All the VMware components and services start successfully on the primary/active node. If the primary node goes down and you activate the secondary node, the following error appears in the vpxd log when the vCenter Server service starts on the secondary/active node:
Unable to create SSO facade: Invalid response code: 404 Not Found. The vpxd service does not start on the secondary node.
Workaround: If you install the new versions of vCenter Server and vCenter Heartbeat instead of performing an upgrade, the second node starts up as expected. If you must upgrade Single Sign-On, follow the procedures listed in the Knowledge Base article Upgrading Single-Sign On 5.1 to 5.5 when vCenter Server Heartbeat is Installed(http://kb.vmware.com/kb/2059820).

33.Error 29107 appears during vSphere Web Client upgrade from 5.1U1a to 5.5
During an upgrade of a vSphere Web Client from version 5.1 Update U1a to version 5.5, Error 29107 appears if the vCenter Single Sign-On service that was in use before the upgrade is configured as High Availability Single Sign-On.
Workaround: Perform the upgrade again. You can run the installer and select Custom Install to upgrade only the vSphere Web Client.

34.If Active Directory services and vCenter services are in different locations, a login by a user who belongs to over 500 groups might take a long time
Your environment uses an Active Directory setup. This setup is in a different location from vCenter Server and its services. As a result, when a user who belongs to over 500 Active Directory groups logs in with the vSphere Web Client, login might take 10-20 minutes. With the vSphere Client, login for that user might time out.

Workaround: Change your setup so the Active Directory services and the vCenter Server system are in the same location, or log in as a user who does not belong to so many Active Directory groups.

35.Auto-discovery of Active Directory settings no longer supported with vCenter Single Sign-On 5.5
The vSphere 5.1 vCenter Single Sign-On version included an autodiscovery feature. That feature was removed from the vSphere 5.5 vCenter Single Sign-On service.

Workaround: Log in to vCenter Single Sign-On from the vSphere Web Client as a user with vCenter Single Sign-On administrator privileges and add the identity source manually. By default, administrator@vsphere.local has vCenter Single Sign-On administrator privileges.

36.After upgrade, domain administrators, who are part of the local administrators group, cannot log in to vCenter Server.In your vSphere 5.1 environment, you gave permissions to the local administrators group, which implicitly includes the domain administrator group. You can log in to vCenter Server 5.1 as a member of the domain administrator group. However, when you upgrade to vSphere 5.5, the domain administrator users no longer have the permissions to log in to vCenter Server. Permissions for local users are maintained after the upgrade.

Workaround: The simplest solution is to log in to vCenter Server as administrator@vsphere.local and to assign permissions directly to the domain administrators group. If other local users who were not inside a subdomain had permissions to manage to vCenter Server users before the upgrade, those users can also log in to vCenter Server and assign permissions to the domain administrators group or any other group.

37.vCenter Single Sign-On installation fails on Windows Server 2008 SP1
When you attempt to install vCenter Single Sign-On on Windows 2008 SP1 (64 bit), the following warning appears:
This application is only supported on windows server 2008 64bit, or higher. Make sure windows is not running as domain controller.
Installation does not complete.

Workaround: None. Install vCenter Single Sign-On on a Windows 2008 SP2 (64 bit) system.

38.No error occurs when you replace the certificate for a service with a certificate already in use by a different service. If you are using the Certificate Automation Tool to replace certificates, and you respond to the prompts by replacing an existing certificate with a certificate that is already in use by a different service, the tool does not display an error message. The tool proceeds with the replacement. Because each service must have a unique certificate in the vCenter installation on Windows, authentication does not work properly.

Workaround: None. Keep track of the certificates that you are using for the different services

39. Cannot change the password of administrator@vsphere.local from the vSphere Web Client pulldown menu. When you log in to the vCenter Single Sign-On server from the vSphere Web Client, you can perform a password change from the pulldown menu. When you log in as administrator@vsphere.local the Change Password option is greyed out.

Workaround:

    Select the Manage tab, and select vCenter Single Sign-On > Users and Groups.
    Right-click the administrator user and click Edit User.
    Change the password.

40.Login with vCenter Single Sign-On might require inclusion of domain name
In vSphere 5.5, vCenter Single Sign-On no longer supports multiple default domains. This might cause problems for users who attempt to log in to a vCenter Server system that is installed on Windows, or for users who log in to the vCenter Server Appliance.

Workaround: Include the domain prefix with the user name when you log in to a nondefault domain. For example, the user root on the local operating system can log in as localos\root. The user user1 in the domain DOMAIN1 can log in as DOMAIN1\user1.
This behavior is not considered a bug, but included in the release notes for completeness.

41.vCenter Single Sign-On installation fails if the destination folder includes non-ASCII or high ASCII characters. If you change the destination folder for vCenter Single Sign-On during installation, and if the new destination folder that you select includes non-ASCII or high ASCII characters, no warning appears but installation fails.

Workaround: Select destination folders that contain ASCII characters. Special characters are not allowed and generate the error listed in the next known issue.

42.vCenter Single Sign-On fails if the installation folder includes special characters
If you attempt to install vCenter Single Sign-On in a custom location, and the destination folder name includes characters such as percent (%) or ampersand (&), the installation fails. An error message similar to the following appears:
Error 20020. Failed to update values in server.xml file

Workaround: None. See the vSphere Installation and Setup documentation for a complete list of disallowed characters.

43.Warning during vCenter Single Sign-On installation on virtual machine with multiple network interfaces
You install vCenter Single Sign-On in an environment with multiple network interfaces. One or more of the network interfaces in the environment cannot be resolved with DNS. When the vCenter Single Sign-On installer performs the prerequisite check, a warning that is similar to the following appears:
DNS resolved IP(<ip_address_1>) does not match the machine reported IP(<ip_address_2>). Certificates will use the machine ip instead of FQDN. It is recommended that you have a static IP address for this to work correctly.

Workaround: If both the forward DNS lookup and the reverse DNS lookup for the primary interface are correct, you can ignore the warning and proceed with the installation.

44. An ESXi host stops responding after being added to vCenter Server by its IPv6 address
When you add an ESXi host to vCenter Server by IPv6 link-local address of the form fe80::/64, within a short time the host name becomes dimmed and the host stops responding to vCenter Server.

Workaround: Use a valid IPv6 address that is not a link-local address.

45. The vSphere Web Client lets you configure more virtual functions than are supported by the physical NIC and does not display an error message. In the SR-IOV settings of a physical adapter, you can configure more virtual functions than are supported by the adapter. For example, you can configure 100 virtual functions on a NIC that supports only 23, and no error message appears. A message prompts you to reboot the host so that the SR-IOV settings are applied. After the host reboots, the NIC is configured with as many virtual functions as the adapter supports, or 23 in this example. The message that prompts you to reboot the host persists when it should not appear.

Workaround: None

46.Attempts to name a Link Aggregation Group (LAG) port by using surrogate pair characters fails
In the vSphere Web Client, if you try to rename a LAG port and the new name contains surrogate pair characters, the following error message appears: The port name is not valid. Specify a valid port name. Surrogate pair is a pair of 16-bit values that UTF-16 uses to represent characters that require more than 16 bits.

Workaround: Do not use surrogate pair characters when you name LAG ports.

47. The ESXi Dump Collector fails to send the ESXi core file to the remote server
The ESXi Dump Collector fails to send the ESXi core file if the VMkernel adapter that handles the traffic of the dump collector is configured to a distributed port group that has a link aggregation group (LAG) set as the active uplink. An LACP port channel is configured on the physical switch.

Workaround: Perform one of the following workarounds:

   a. Use a vSphere Standard Switch to configure the VMkernel adapter that handles the traffic for the ESXi Dump Collector with the remote server.
   b. Use standalone uplinks to handle the traffic for the distributed port group where the VMkernel adapter is configured.

48. http://kb.vmware.com/kb/2044993

49.When you try to deploy a virtual machine on a vSphere Distributed Switch, the error message no free port is available in distributed_switch_name might appear although the switch has free ports
When you try to deploy a virtual machine on a vSphere Distributed Switch, the error message no free port is available in distributed_switch_name might appear although the switch has many free ports. vCenter Server handles race conditions incorrectly when reserving and deleting distributed ports. This issue causes vCenter Server to decide that no ports of the distributed switch are available if the first available port is being deleted but is not deleted yet. For example, vCenter Server deletes a port when a host disconnects or enters maintenance mode, or when a virtual machine is reconfigured.

Workaround: Wait for several minutes and redeploy the virtual machine. This time the race condition might not occur.

50.If you change the number of ports that a vSphere Standard Switch or vSphere Distributed Switch has on a host by using the vSphere Client, the change is not saved, even after a reboot. If you change the number of ports that a vSphere Standard Switch or vSphere Distributed Switch has on an ESXi 5.5 host by using the vSphere Client, the number of ports does not change even after you reboot the host.

When a host that runs ESXi 5.5 is rebooted, it dynamically scales up or down the ports of virtual switches. The number of ports is based on the number of virtual machines that the host can run. You do not have to configure the number of switch ports on such hosts.

Workaround: None in the vSphere Client.

51. Host Profile remediation fails with vSphere Distributed Switch
Remediation errors might occur when applying a Host Profile with a vSphere Distributed Switch and a virtual machine with Fault Tolerance is in a powered off state on a host that uses the distributed switch in that Host Profile.
Workaround: Move the powered off virtual machines to another host in order for the Host Profile to succeed.

52. Noncompliance messages appear after using Auto Deploy for stateless caching or stateful installs to USB
After a host profile is edited to enable stateless caching to the USB disk on the host, the host profile receives compliance errors when attempting to remidiate. The host is rebooted and caching finishes. After checking compliance, the following compliance error is received:
Host state does not match specification

Workaround: No workaround is required. The message is incorrect.

53. Host profile receives firewall settings compliance errors when you apply ESX 4.0 or ESX 4.1 profile to ESXi 5.5 host. If you extract a host profile from an ESX 4.0 or ESX 4.1 host and attempt to apply it to an ESXi 5.5 host, the profile remediation succeeds. The compliance check receives firewall settings errors that include the following:
Ruleset LDAP not found
Ruleset LDAPS not found
Ruleset TSM not found
Ruleset VCB not found
Ruleset activeDirectorKerberos not found

Workaround: No workaround is required. This is expected because the firewall settings for an ESX 4.0 or ESX 4.1 host are different from those for an ESXi 5.5 host.

54.New Changing BIOS device settings for an ESXi host might result in invalid device names
Changing a BIOS device setting on an ESXi host might result in invalid device names if the change causes a shift in the <segment:bus:device:function> values assigned to devices. For example, enabling a previously-disabled integrated NIC might shift the <segment:bus:device:function> values assigned to other PCI devices, causing ESXi to change the names assigned to these NICs. Unlike previous versions of ESXi, ESXi 5.5 attempts to preserve devices names through <segment:bus:device:function> changes if the host BIOS provides specific device location information. Due to a bug in this feature, invalid names such as vmhba1 and vmnic32 are sometimes generated.

Workaround: Rebooting the ESXi host once or twice might clear the invalid device names and restore the original names. Do not run an ESXi host with invalid device names in production.

55.Storage profiles without storage capabilities might be missing after you upgrade vCenter Server to version
    After you upgrade to vCenter Server 5.5, storage profiles that you created with an earlier version of
   vCenter Server are not visible in the vSphere Web Client. This problem affects only storage profiles that
    do not have any storage capabilities attached.

    Workaround: Before you perform an upgrade, attach storage capabilities to the storage profiles that need to be available in vCenter Server 5.5. After the upgrade, the existing storage capabilities are converted into tags in the Legacy User Label category, and the storage profiles are converted into storage policies referencing these tags.

56. The VMware vSphere Web Client service does not start on Turkish versions of Windows Server 2008 or Windows Server 2012.     When you install the server component of the vSphere Web Client on a Turkish version of Windows Server 2008 or Windows Server 2012, the service does not start after the installation finishes.
Workaround: Install the vSphere Web Client on a version of Windows Server 2008 or Windows Server 2012 that is in another language.

57.The vSphere Web Client displays error messages in zh, zh-hans, and zh-hant locales. If the browser locale has been set to Simplified Chinese or Traditional Chinese, the vSphere Web Client might display errors when you perform some operations, such as managing objects, licensing, and datacenter creation. In the Recent Tasks pane, the following message might appear: Unable to create the managed object for <string>. Additional error messages appear as notifications. The problem occurs in Internet Explorer, Google Chrome, and Mozilla Firefox.
Workaround: Change the browser locale and restart the browser.

58.You cannot access the vSphere Web Client by using some Firefox versions with certain operating systems in an IPv6 network environment. In the Windows and Linux versions of Firefox 18.0.2, you cannot access URLs in an IPv6 environment. On some supported Linux distribution, such as SLES/SLED 11, you cannot use the bundled Firefox 10.x browser, because the browser does not accept SSL certificates for IPv6 addresses. For information about this third-party issue, see Mozilla bug 633001.

Workaround: Use other supported browsers such as Google Chrome or Internet Explorer.

59.Error messages appear when you attempt to log in to the vSphere Web Client by using Google Chrome on Mac OS X 10.7.x in certain language and format locales. You encounter Error 2007 and Error 1009 and cannot log in when you use Google Chrome 23 running on Mac OS X 10.7.x. The problem is present if the operating system language and format are set to French, German, Japanese, Korean, or Russian. For the problem to appear, Google Chrome must be installed before switching the operating system locale and the browser must use Flash Player 11.5.31.5 or 11.5.31.139.
Workaround: Perform one of the following tasks:
        a. Change the Flash Player version to 11.5.502.136 or 11.5.31.137.
        b. Switch to English locale and restart the browser.
        c. Switch to English locale, uninstall Chrome, switch back to the locale of choice, and reinstall Chrome.

60. New I/O memory management unit (IOMMU) faults might appear when the debug direct memory access (DMA) mapper is enabled.The debug mapper places devices in IOMMU domains to help catch device memory accesses to addresses that have not been explicitly mapped. On some HP systems with old firmware, IOMMU faults might appear.
Workaround: Download firmware upgrades from the HP Web site and apply them.
        a.Upgrade the firmware of the HP iLO2 controller.
        b.Version 2.07, released in August 2011, resolves the problem.
        c.Upgrade the firmware of the HP Smart Array.
        d.For the HP Smart Array P410, version 5.14, released in January 2012, resolves the problem.

61.Sensor values for Fan, Power Supply, Voltage, and Current sensors appear under the Other group of the vCenter Server Hardware Status Tab.Some sensor values are listed in the Other group instead of the respective categorized group.
Workaround: None.

62.Under certain conditions, a virtual machine does not reset despite the appState being appStateNeedReset
    A virtual machine is not reset if the needReset appstate is issued using the Application Monitoring GuestSDK when the virtual machine is on a standalone host and the host is moved to a cluster which has VM and App Monitoring enabled. This could also occur if the FDM process restarts on the host while the needReset request is pending. For example this error can occur when reconfiguring vSphere HA or if the service crashes after a needReset state has been issued for a virtual machine using the Application Monitoring GuestSDK.

Workaround: Trigger a blank Reconfigure cluster task for the vSphere HA cluster containing the hosts. The virtual machine's needReset state is picked up by the FDM on the host, which resets the virtual machine. In the vSphere Web Client go to the Edit Cluster Settings panel and click Edit. Press OK on the Cluster Settings panel without changing anything on the cluster. This triggers a blank Reconfigure cluster task.

63. If vSphere HA fails to restart a virtual machine due to an anti-affinity constraint, no re-attempt is made if you change the vm-vm anti-affinity rule or remove it.
Workaround: The vSphere HA master host reattempts placing a virtual machine waiting for resources after the unreserved capacity in the cluster is increased. To increase this capacity, power off a virtual machine, migrate it to another cluster using vMotion, then
       a. bring back on-line a failed host, or
       b.add another host to the cluster, or
       c. reduce the resources reserved by any of the powered-on virtual machines.

64.vSphere HA might fail to restart a virtual machine with a vSphere Flash Read Cache reservation
    When a virtual machine with a vSphere Flash Read Cache reservation is powered on, the host it resides on uses some normal (RAM) memory to manage this flash reservation. If sufficient memory is not available, then the virtual machine power on fails. vSphere HA retries such failed power on operations but only four more times. If the fifth power on attempt fails, vSphere HA issues an event reporting that the maximum number of restart attempts has been reached.
    Note: To list the vSphere HA issued events, you can search the event history for the phrase "vSphere HA".
Workaround: If vSphere HA fails to restart a virtual machine and you observe a vSphere HA event reporting that the maximum number of attempts have been made to restart it, attempt to power on the virtual machine manually on one of the hosts. If the power on operation fails and a reason is given, address that issue.
However, if this power on task fails for an unexplained reason or if the task error stack reports that the vSphere Flash Read Cache cannot be attached, either try another host or reduce the memory needs of the vSphere Flash Read Cache and try again. You can do this by either
       a. configuring a larger vSphere Flash Read Cache block size for the virtual machine or another virtual machine running on the same host, or
       b. significantly reducing the vSphere Flash Read Cache reservation of one or more of these virtual machines.

65. If you select an ESX/ESXi 4.0 or 4.1 host in a vSphere HA cluster to fail over a virtual machine, the virtual machine might not restart as expected. When vSphere HA restarts a virtual machine on an ESX/ESXi 4.0 or 4.1 host that is different from the original host the virtual machine was running on, a query is issued that is not answered. The virtual machine is not powered on on the new host until you answer the query manually from the vSphere Client.

Workaround: Answer the query from the vSphere Client. Alternatively, you can wait for a timeout (15 minutes by default), and vSphere HA attempts to restart the virtual machine on a different host. If the host is running ESX/ESXi 5.0 or later, the virtual machine is restarted.

66. A successful Storage vMotion operation in a vSphere HA cluster might result in an orphaned virtual machine.After you migrate a virtual machine with Storage vMotion in a vSphere HA cluster, an orphaned virtual machine with the same name might remain in the vCenter Server inventory. This error can occur if vSphere HA attempts to restart the virtual machine that is being migrated, before the Storage vMotion workflow finishes. The attempt can be triggered in situations such as the following:
       a. The master host detects a possible failure impacting the virtual machine, such as a network
           interruption.
       b. In an environment without Virtual SAN, the master hosts regains access to the virtual machine
          datastore.
        In an environment with Virtual SAN, the master host detects a change in Virtual SAN object accessibility. For example, the host has recently rejoined the Virtual SAN network after a network partition.

    Workaround: Delete the orphaned virtual machine.

67. Changing datastores through migration is not allowed if the number of virtual disks is greater than 64
    Storage vMotion and vMotion without shared storage support migration of a virtual machine with up to 64 virtual disks. If the number of virtual disks to be moved is greater than 64, the migration operation is not allowed. However, if you use Storage vMotion to selectively move less than 64 disks or to move only the home directory of the virtual machine, the operation succeeds even for the virtual machine with the maximum supported number of virtual disks.
Workaround:
        For Storage vMotion, perform multiple migrations, each with up to 64 disks. Use the Advanced option on the Migrate virtual machine wizard to select disks to migrate and to specify the datastore location.
        For vMotion without shared storage, power off the virtual machine to perform migration.

68. Unable to add a host with IvyBridge-EP or IvyBridge-EX processors to an Intel IvyBridge Generation EVC Cluster.When you attempt to add a host with IvyBridge-EP or IvyBridge-EX processors to an EVC Cluster with the Intel IvyBridge Generation EVC mode enabled, you see an error message stating that necessary CPU features are missing from the host. The host cannot be added to the cluster.

    Workaround: None.

69.Virtual machine drag and drop is not supported across hosts
    You use the vSphere Web Client and attempt to drag and drop a virtual machine from one host to another. A red X indicates that drag and drop is not supported.

Workaround: Use the Migrate VM action or right-click the virtual machine and select Move to to start the migration wizard.

70. Attempts to increase the size of a virtual disk on a running virtual machine fail with an error
    If you increase the size of a virtual disk when the virtual machine is running, the operation might fail with the following error:
    This operation is not supported for this device type.
    The failure might occur if you are extending the disk to the size of 2TB or larger. The hot-extend operation supports increasing the disk size to only 2TB or less. SATA virtual disks do not support the hot-extend operation no matter what their size is.

Workaround: Power off the virtual machine to extend the virtual disk to 2TB or larger.

71. Virtual machines with Windows 7 Enterprise 64-bit guest operating systems in the French locale experience problems during clone operations
    If you have a cloned Windows 7 Enterprise 64-bit virtual machine that is running in the French locale, the virtual machine disconnects from the network and the customization specification is not applied. This issue appears when the virtual machine is running on an ESXi 5.1 host and you clone it to ESXi 5.5 and upgrade the VMware Tools version to the latest version available with the 5.5 host.

    Workaround: Upgrade the virtual machine compatibility to ESXi 5.5 and later before you upgrade to the latest available version of VMware Tools.

72. Error message appears and no vCenter Server instances are available in the vSphere Web Client inventory after you log in You might encounter this problem when the vCenter Server instance is managing an inventory that is too large and operating under a heavy load.

    Workaround: Log out and log in to the vSphere Web Client. If this does not resolve the problem, verify that your vSphere environment is running within the recommended configuration maximums.

73. vCenter Server Appliance checks user permissions based on case-insensitive user name matching
    In previous vSphere releases, the vCenter Server Appliance used case-sensitive matching for user names when checking user permissions. In the vSphere 5.5 release, the vCenter Server Appliance uses case-insensitive matching for user names when checking permissions. This means that two users whose user names differ only in case (for example, User1 and user1) are treated as the same user when vCenter Server checks permissions.

    Workaround: If your vCenter Server Appliance has users whose names differ only in case, rename at least one of the users, and reassign permissions to the renamed users.

74. Default folder names generated by the vCenter Server Appliance do not reflect the browser's language setting.When you access the vCenter Server Appliance using the vSphere Web Client, default folder names generated by the server, such as Discovered Virtual Machines, do not reflect the browser's language setting.

Workaround: Edit the vpxd locale setting:
       a. Select the vCenter Server instance in the vSphere Web Client inventory.
       b. Click the Manage tab.
       c. Click Advanced Settings.
       d. Click Edit.
       e. In the vpxd.locale text box, type the locale code.

        Valid options include de, en, fr, ja, ko, and zh_CN.
        Click OK.
        1.Restart vCenter Server:
        2. Log in to the vCenter Server Appliance configuration interface at https://hostname:5480.
        3. On the vCenter Server tab, select Summary.
        4.    Click Stop vCenter.
        5.    Click Start vCenter.

Reference from Vmware Blog

VMware More about Log files and Basic Settings with Vsphere
ESXi Troubleshooting-I

Known Issue and Workaround for Vsphere 5.5

Vmware Component Service-Failed to Start,Stuck on Starting

vmware vsphere 6 web client not opening

Active Directory Domain and Trust Issue-1

noreply@blogger.com (Piyush Srivastava) — Wed, 09 Nov 2016 06:20:00 +0000

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

Active Directory Site and Services with Replication
Move AD Database to Other Location

FSMO Roles-Move and Seize theory

Imprtant Points for Active Directory Group Policy

Issue: I got this issue once i tried to access Root DC from Child DC. Attached screen shot here to get more clearance.

Solution: To overcome from this problem, first i viewed the log on problem server (which is 2012 R2) and i found multiple error related to time sync, replication failure, LDAP authentication error and KDC error.
Basically this problem comes most often when your other DC's are not able to communicate with Root DC.
To fix the issue i Stop the KDC service on problem server.

The KDC is a process that provides two services in AD Environment:
1. Ticket-Granting Service : This service issues tickets for connection to computers in domain. if clients want access to a computer, then it first connect the ticket-granting service in the target computer's domain, and ask for a ticket to the computer(as authentication ). it can be reused. The same happen for all computer at firt time once it being accessed by any other device or service or client

2.Authentication Service: This service give raise ticket as authentication in domain as well as if this is in trusted domain.Before accessing a computer this ticket should be come as authentication permission.Once this is permitted , the computer can be accessed until this not expire.

In this issue, most of event are related to KDC service error, So i tried with KDC service start and stop.

This KDC service can be stopped in 2003 server by support tools but in 2012 its upgraded version and inbuilt with AD services so i run Klist help first to see more option.

Here lots of option so before proceeding with any thing i stopped KDC on problem server

net stop KDC as administrative privilege and then

Reset computer account from Root DC.

Run the command to purge the database, as in the event its was KDC error with computer account.

Then finally i run sync command to replicate all on Root DC.

and i got Domain and Trust Console fine.

There are couple other solution which work in different cases like

1. Restart Netlogon

2. In TCP/IP settings allow all conenction from Filterring options

3. See if port 80 is connected

Its depend on infra to infra. So better to check settings and configuration before proceeding to any solution.

Active Directory Installation, Configuration and Management-1

Active Directory Installation, Configuration and Management-2
Active Directory Domain and Trust

Active Directory Site and Services with Replication
Move AD Database to Other Location