Andreas Gani's Blog

DPM 2012 R2 is backing up Hyper-V 2012 R2 in offline state

2013-12-05T13:41:00.003+13:00

I upgraded our Hyper-V 2008 R2 failover cluster to Hyper-V 2012 R2, but since then some of the VMs are not able to be backed up in online state.

If you look at the event log on the Hyper-V host you will straight away find your answer there.

As you can see from the error message above, it requires you to upgrade your Integration Services on your VM. You will have to restart your VM after the upgrade.

Once you have done it, you will be able to backup your VM in online state

Sharepoint workflow - The email message cannot be sent

2013-10-17T09:18:00.002+13:00

The issue really got me big time. I spent a long time trying to figure out what went wrong so I am hoping this post can help you.

Our Expense Claim workflow was unable to send out email notifications and the error message was "The email message cannot be sent. Make sure the outgoing email settings for the server are configured correctly"

I was damn sure that I have configured the email settings on sharepoint server. I double checked, and triple checked it and confirmed that it is there. For you who doesn't know where to check, it is on your Sharepoint Central Administration - System Settings - Configure outgoing email settings.

The next thing I needed to double check is the setting on our exchange server, but again I was pretty sure that I have added the Sharepoint server to the allowed list. Sure enough when I checked it is already listed there as you can see in the picture below (highlighted)

For long I was struggling to pinpoint the issue. I thought it was the workflow issue because it's trying to send the email out using System Account. Even when we called Microsoft support guy, he confirmed that the System Account sometimes does "crazy things" and that's it - no more suggestions...

After about three weeks battling, I decided to look at the issue from a different angle. I turned on the logging feature on our Exchange Server for the SMTP traffic. By default on Exchange 2010, the SMTP logging is off and you need to set it to verbose to capture the SMTP traffic.

Sure enough the log helped me pin point the issue. It shows me that the one that initiated the email out is our SQL Server - not the Sharepoint itself.

Default log location is on \Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\ProtocolLog\SmtpReceive

I then added the SQL Server IP address to the allowed list on our Exchange Server receive connector and it solves the issue.

Moral of the story: Never assume you know or have done everything. Always check your log first.

Synchronizing PDC time with Internet time

2013-07-24T12:10:00.002+12:00

To synchronize your PDC emulator with the internet time server, please run the following command on your server which holds PDC emulator FSMO role.

w32tm /config /manualpeerlist:internet-time-server /syncfromflags:manual /reliable:yes /update

Please replace the internet-time-server with the internet time server DNS name or IP address. If more then one is needed separate them with a space in between and don't forget the quotes: "time1.domain.com time2.domain.com"

List of Internet Time servers can be found here: http://www.pool.ntp.org

No chat history on Lync 2013 client

2013-07-15T15:36:00.001+12:00

During our testing phase, we found out that the chat history is not working. We had the exclamation mark on the chat icon and there is nothing under it. The error was "there is an error communicating with Exchange Server". When I looked at the Lync Configuration Information (Ctrl - right click on Lync icon), I could see that both EWS information (internal & external) are blank and the EWS Information was telling me that it is not deployed.

I have configured the autodiscover name record in DNS and also had the SRV record registered. Everything works well for our Exchange Server and outlook autodiscover. Google advised me to applied the February update for Lync client, but we have done the update before and the problem still exist. Finally I stumbled across this website which solved out the issue. This is what you need to do:

1. Go to C:\Windows\System32\inetsrv\config
2. Run notepad as administrator
3. Open aoolicationhost.config to edit it
4. Add the highlighted lines and save it
5. Restart IIS

<location path="Default Web Site/Autodiscover">
<system.webServer>
<directoryBrowse enabled="false" showFlags="Date, Size, Extension, LongDate" />
<handlers accessPolicy="Read, Script">
<clear />
<add name="ISAPI-dll" path="*.dll" verb="*" modules="IsapiModule" resourceType="File" requireAccess="Execute" allowPathInfo="true" />
<add name="ScriptHandlerFactoryAppServices-Integrated-4.0" path="*_AppService.axd" verb="*" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" preCondition="integratedMode,runtimeVersionv4.0" />
<add name="ScriptResourceIntegrated-4.0" path="*ScriptResource.axd" verb="GET,HEAD" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" preCondition="integratedMode,runtimeVersionv4.0" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" responseBufferLimit="0" />
<add name="svc-Integrated" path="*.svc" verb="*" type="System.ServiceModel.Activation.HttpHandler, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="integratedMode" />
<add name="AboMapperCustom-33656" path="*.xml" verb="POST,GET" modules="IsapiModule" scriptProcessor="C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_isapi.dll" requireAccess="Script" responseBufferLimit="0" />
<add name="TRACEVerbHandler" path="*" verb="TRACE" modules="ProtocolSupportModule" requireAccess="None" />
<add name="OPTIONSVerbHandler" path="*" verb="OPTIONS" modules="ProtocolSupportModule" requireAccess="None" />
<add name="StaticFile" path="*" verb="*" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />

</handlers>

Connectivity issue with DirectAccess 2012

2013-07-04T16:06:00.001+12:00

Few months after we deployed DirectAccess solution into our infrastructure, we start getting hammered by people having issue with it. The one that drives me nuts is when someone says he couldn't connect, but someone else could connect without any issue. My first remedy is to ask them to restart the IP Helper service and Network Connectivity Assistant (only IP Helper for Windows 7). That doesn't always help.

After a long time research on the internet, I found this link http://social.technet.microsoft.com/Forums/lv/forefrontedgeiag/thread/20657310-1e2e-4f66-b002-21d2a5edcab8 - which describes the same issue we are facing.

What we need to do was to run the following command to allow Teredo manage the connection instead of 6to4.

"netsh interface 6to4 set state disabled" from a command prompt on the laptop

I tested the solution on one of our laptops and it works great

Lync 2010 - "The address book is preparing to synchronize. Search results might not be current"

2012-11-08T12:22:00.000+13:00

We got this message when we deployed Lync 2010 into our environment.

This is how we solved it.

1. On Lync 2010 Server, launch Lync Server Management Shell and run this command: Update-CsAddressBook -verbose

2. Wait for a few minutes and you should see these events in your event logs.

Event 21005 = Sync has started

Event 21010 = Sync has completed

Event 21056 = Details of the Sync

Event 21005 = Schedule for the next Sync

3. Because Lync client would randomly schedule the address book download at different intervals within a few hours; the Lync client can exhibit this same behavior. So if the steps above doesn't fix the issue then do the steps below

4. Run Regedit and navigate to HKLM\Software\Policies\Microsoft\

Communicator

5. Create/edit the DWORD GalDownloadInitialDelay and set its value to 0

6. Close the Lync Client and delete GalContacts.db and GalContacts.db.idx files form that PC. You can find those files in the following locations:

Windows XP: %userprofile%\Local Settings\Application Data\Microsoft\Communicator\sip_<the_username@the_domain>\

Windows Vista/7: %userprofile%\AppData\Local\Microsoft\Communicator\sip_<the_username@the_domain>\

7. Restart Lync.

Setting up DirectAccess Server 2012

2012-10-23T15:56:00.001+13:00

I got a mission from my boss to set up a new way for external users to connect to our network. In the past they use Microsoft VPN to connect and the problem is there are places where this VPN port is blocked and they cannot connect.

We then decided to look at DirectAccess from Microsoft. This new version comes as a role that you need to enable in Windows Server 2012 from Server Manager

To set this Direct Server 2012 in your environment, you will need to install a Windows Server 2012 with Remote Access role enabled. For our implementation we also use a root CA, this is to issue Computer Certificates to our workstations here and will be used in the authentication process.

Once you have the DirectAccess Server ready, you can start the configuration wizard to help you setting it up. It will create two new GPOs for you and by default they are called DirectAccess Server Settings and DirectAccess Client Settings.
At the end of the wizard, you will be given an opportunity to review the configuration and make some changes if you wish. If you are happy with everything just complete the wizard and that will be enough.

Below is the Configuration page where you can always go back to modify your settings.

The screenshot below shows that you can always change the security group if you want to test it first.

Make sure you fill up the Helpdesk email address, otherwise if your Windows 8 clients are having an issue - they won't be able to generate the error log.

On the Remote Access setting part, you need to decide the network topology that match with your infrastructure.

Also choose a certificate to be used for the IP-HTTPS connection. You can use a self-signed certificate if you wish.

Because we have a mixed Win 7 and Win 8 environment here, we need to tick the Enable Windows 7 client computers to connect via DirectAccess option. With this option enabled, you will need to use a computer certificate for authentication.

Note: Windows 7 clients will need a DirectAccess Connectivity Assistant (DCA) 2.0 installed. You will also need to import DCA Group policy template files to your GPO.

Next is to decide where you want to have your Network Location Server.

You will also need to make exception for a few things you don't want your client to use internal DNS for name resolution.

If everything is working fine, you should get the green tick for all of the components, though this doesn't guarantee your clients will be able to connect to your environment straight away. Please look at the links at the end of this post to help you troubleshoot any issue you may have in your implementation.

1. Click on this link to download DCA 2.0 for Windows 7 clients; after you extract the zip file you will find DCA 2.0 administrator guide to help you with the deployment
2. Click on this link to get more details on how to deploy a single Remote Access Server using the Getting Started Wizard
3. Click on this link if you want to troubleshoot any issue related to DirectAccess Client Cannot Access Intranet Resources

How to kill hung Windows Services

2012-08-20T09:50:00.002+12:00

Have you ever been in a situation where you have a hung Windows Service and you cannot restart the server because it is a production server?

Well, with these steps below you can kill that hung Windows Service without a need to restart the server.

1. First, lets find out what the name of the hung service. by double clicking on it.

2. Open a command prompt with Administrative right and run sc queryex <service name>

3. Run taskkill /PID <Service PID> /F

How to remove non-existent domain from Active Directory

2012-08-15T20:45:00.000+12:00

I just installed a second domain controller in our environment. My predecessor didn't replace the second DC when it went faulty a year back. I noticed something weird is happening. The DC2 couldn't serve as a Global Catalog server, I have got many errors in the Event Viewer, in particular Event 1202 and Event 1926 like the screenshots below.

From the second screenshot, I could pinpoint the issue lies on non-existent child domain. For whatever reason, the server was taken out without properly demoting it. So the steps that are taken next are as below:

Run ntdsutil from command prompt
Type metadata cleanup
Type connections
Type connect to server <servername>
Type quit
Type select operation target
Type list domains
Type select domain <enter the number of you want to remove>
Type quit
Type remove selected domain
If you don't get an error 0x2012 like the screenshot below, you have successfully removed the non-existent domain. Just type quit twice to get out of the utility.
If you encounter this 0x2012 error, then do step 13 onward.

13. Open another command prompt and run ntdsutil
14. Type Domain Management or Partition Management
15. Type Connections
16. Type Connect to server <Servername>
17. Type Quit
18. Type List
19. Type Delete nc dc=domaindnszones;dc=<domainname>;dc=<domainname>
20. After you removed that, you will now be able to cleanup the metadata by going back to the
other command prompt and re-run the remove selected domain command
21. Type Quit twice to get out of the utility.

How To Get a User's Security Identifier (SID) in Windows

2012-08-14T14:50:00.003+12:00

In this post I am going to show you how to get a SID of a user account in Windows.

The command you need to use is shown below

wmic useraccount get name,sid <enter>

You will then get a result similar to the screenshot below

Windows 8 highlights

2012-08-14T11:17:00.001+12:00

I downloaded Windows 8 Release Preview to test it on my Hyper-V environment today and have a play with it. I have to admit that I love its feature where you can pause the file copying process. It's an awesome feature.

The other thing that I like is the way they design the new look of Task Manager. In this new look you can see Hard Disk and Network usage as well as CPU and Memory.

Another improvement in Windows 8 is the built-in application to read PDF documents. Windows Reader is capable to view PDF and XPS documents.

It has three reading modes, Two Pages, One Page and Continues.

One more cool thing is the built-in capability to mount ISO file.

If you are looking for a way to get to Command Prompt then here are two ways to get to command prompt.

Hover your mouse next to the Windows clock at the bottom right corner until the menu emerges, then click on Search where you can type cmd to get to the command prompt.

2. Go to Windows Desktop and click on Windows Explorer where
you can type cmd to open a command prompt.

Importing Thumbnail Photo from Active Directory into Sharepoint 2010

2012-08-07T13:37:00.000+12:00

We had been trying to figure out why the thumbnail photos we have in Active Directory are not imported to our Sharepoint 2010. Now I want to show the steps we took to solve the issue.

1. Make sure that the Picture property is mapped to Thumbnail
Photo.

Click on Manage Service Application on Sharepoint Central Administration
Click on User Profile Service then choose Manage User Properties

2. Do an incremental update.

Under User Profile Service choose Configure Synchronization Timer Job
Click on Run Now

3. Check if the photo has been synchronized. If it hasn't,

continue the next steps.

4. When the photos has not been populated, the next step is to

check if the import was successful using MIISCLIENT.EXE. This

tool is located on C:\Program Files\Microsoft Office Servers

\14.0\Synchronization Service\UIShell.

As we can see, the photo was imported successfully.

5. The next step is to do is to run this following command in

Sharepoint Management Shell

Update-SPProfilePhotoStore -CreateThumbnailsForImportedPhotos

1 -MySiteHostLocation http://mysite

Remember to run this with an authorized account. We ran this

with the farm account. If you run the command with

unauthorized account, you will get an error like below.

WSUS Agent - Not Yet Reported

2012-08-02T17:16:00.001+12:00

I installed and configured Windows Server Update Services (WSUS) 3.0 SP2 in our infrastructure. I don't use client side targeting to group computers' account. I noticed something's not right because after I had waited for more than half an hour, the status of all computers are still Not Yet Reported as per screenshot below.

I have tried to run wuauclt /resetauthorization /detectnow with no success. I even re-installed my WSUS, but the same problem exist. I finally found the fix for this on Microsoft website, I downloaded the hotfix for WSUS 3.0 SP2 from this link below

http://support.microsoft.com/kb/2720211

Hopefully this helps everyone who faces the same issue.

Adding Local Administrator Account Through Group Policy

2012-07-18T17:21:00.001+12:00

I wanted to deploy SCOM 2012 agent to all our Windows workstations and servers and I want to use a domain account which also a local administrator on each of workstation/server. Instead of adding the account to the local administrator group manually, the way to do it is to use Group Policy to assign my newly created Domain User account as the local administrator on each workstation/server. You can do this using Windows 2008 or Windows 7 Group Policy Console.

Go to Control Panel Settings then click on Local Users and Groups as shown below.

If you have never done, you need to right click - New - Local Group. Then choose Administrator (built-in) and choose Update for action then click on Add button to add you account as the local administrator group.

How to Remove Showing Posts With Label in Blogger

2012-06-22T14:39:00.001+12:00

When you click on a label in a blog, you will see a list of posts under that label and at the top of the list you will see a message similar to this

If you want to know how to remove the message "Showing Post With Label" in blogger, then you have come to the right place. This post will show you how to do that.

How to remove it

1. Backup your template before making any changes
2. Go to Blogger Dashboard - Design - Edit HTML
3. Click proceed on the warning message
4. Check the box next to Expand Widget Templates
5. Use Ctrl+F to find code below

6. Replace the code with the following code

7. Save it and you're done

Network Traffic Monitor

2012-06-18T14:35:00.001+12:00

If you ever need a free Traffic Monitoring Tools then go try MRTG. It will monitor SNMP network devices and provides you with nice graphs to show your network loads. It is written in Perl and works on Unix/Linux and Windows too. You can download it from http://oss.oetiker.ch/mrtg/download.en.html

Below are a few sample graphs of the my network.

Slow internet...

2012-06-15T17:07:00.000+12:00

When you are working in the IT department, I guess "My internet connection's slow" comment is not uncommon. Nowadays people will notice first if internet goes down than when other system is down :)

It was my second week on my new job; everything was fine until that day when everyone screams “Internet’s slow!!” Since nothing was changed on the network and it’s a normal load in the network, my first thought was to check with the ISP, but they said nothing's wrong. The next thing I checked was the firewall interfaces’ settings and surprise…surprise… the interface that is connected to the Internet Corporate Gateway (ISP) was set to auto and it chose to set itself as Half Duplex.

Sure enough, collisions happened and turned the network to custard. In five minutes it has already had 194 collisions.

Next step was to change the interface setting which is another challange because we are using PFsense firewall that runs on FreeBSD. I wish it was Cisco... :)

Before changing the setting we need to be sure what the interface is capable of by running the command below

# ifconfig -m bge1
bge1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        options=1b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING>
        capabilities=5b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,POLLING>
        inet 210.55.99.182 netmask 0xfffffffc broadcast 210.55.99.183
        inet6 fe80::216:35ff:fec3:c26%bge1 prefixlen 64 scopeid 0x2
        ether 00:16:35:c3:0c:26
        media: Ethernet 100baseTX <full-duplex>
        status: active
        supported media:
                media autoselect
                media 1000baseTX mediaopt full-duplex
                media 1000baseTX
                media 100baseTX mediaopt full-duplex
                media 100baseTX
                media 10baseT/UTP mediaopt full-duplex
                media 10baseT/UTP
                media none
Note: you need to replace bge1 with the interface you want to change.

After I am sure of the interface's capability, I can now change the setting by using this command below

ifconfig bge1 media 100baseTX mediaopt full-duplex

Everyone is happy again now...

SBS 2011 migration

2012-06-15T12:05:00.000+12:00

In the middle of May 2012 I needed to migrate a Windows SBS 2003 Server to SBS 2011 for one of our clients. The customer is only using Microsoft Exchange, so no Sharepoint involved. Equipped with a document from Microsoft (http://www.microsoft.com/en-us/download/details.aspx?id=14570), the initial job was completed without any major issues. We just need to migrate the mailboxes and shared folders.

Three days after, I went to Exchange Management Console to start the mailbox migration process then I found out that it didn't work anymore. We only have two weeks to complete the migration before the old server stop working (Microsoft only allow 21 days to complete the migration process). The error that I got is the one that complains about Kerberos authentication and to verify that the WS-Management service is running as you can see below.

The following error occured while attempting to connect to the specified Exchange Server <Server>

The attempt to connect to http://<server>/PowerShell using 'Kerberos' authentication failed. Connecting to remote server failed with the following error message: The connection to the specified remote host was refused. Verify that the WE-Management service is running on the remote host and configured to listen for request on the correct port and HTTP URL.

I don't remember I have changed anything prior. With the time pressure, I went to my best friend Google to ask for help. All the information I could find is about checking the Kerbauth module setting in IIS and also to configure the WinRM Service. I tried all those options and even tried to recreate the PowerShell Virtual Directory with no success.

On my third day after the issue found, I finally found an answer after I compared my working IIS configuration file from backup with the one that is not working. The culprit was the configuration on the applicationHost.config file. I was not aware that someone from a printer company installed a 32-bit application which had modified the configuration on that file. What the application changed it as below

and to fix it, you just need to modify the lines to be like this below.

You can change the configuration by manually go into the directory on C:\Windows\System32\inetsrv\config or you can run these commands below

appcmd set apppool /apppool.name:MyAppPool32bit /enable32BitAppOnWin64:true

appcmd set apppool /apppool.name:MyAppPool32bit /enable32BitAppOnWin64:false

Note: By default - it is false.

You need to restart your IIS after you changed that configuration by running "iisreset" on your command prompt.

Ahh..life is good again :) - the SBS 2011 migration has now been completed.