David Owen's Blog

"You do not have permission to change your password"

2010-08-13T00:19:00.001+01:00

I haven’t posted anything in a while, sorry about that. I’ll try to post more often. :-)

We had a call recently regarding users changing their expired password whilst logging on to a computer attached to another domain. Unfortunately or fortunately, depending on which way you look at it, almost all of our clients are Windows XP, so our initial response to these sort of queries is to ask the Local IT Administrator to fully patch the client experiencing the problem. Taking an XP client to SP3 usually solves most of the problems listed on TechNet for this particular error.

Unfortunately, patching didn’t work in this instance, and we weren’t sure why this was happening, so we logged a call with Premier Support. One of the articles we had missed in our initial investigations was highlighted to us by Microsoft - http://support.microsoft.com/kb/555340/en-gb

The article explained that we needed to reverse a change that was made on our Domain Controllers by the application of Server 2003 Service Pack 1 that had cleared the list of Pipes configured on the “Network Access: Named pipes that can be accessed anonymously” property in our Default Domain Controllers Policy. The article explains that we should enable the new defaults introduced in Windows Server 2003 SP1 (COMNAP, COMNODE, SQL\QUERY, SPOOLSS, LLSRPC, BROWSER, NETLOGON, Lsarpc, samr) for that property to restore the ability for users logging on to a computer from another domain to change their password when it has expired.

The reason this happens is because an expired password prompt on a client appears before a user has actually logged on. To change the password at this point, a computer from another domain has to open a null session with a domain controller in the domain of the user, using an Anonymous connection to those named pipes that were removed with the installation of SP1.

You may ask, why I’m posting about this when it’s already detailed in the TechNet article above. Not entirely happy that we would enable anonymous access to all of the Named Pipes listed in the article, we asked Microsoft to identify specifically what Pipes we needed to enable to resolve the issue regarding changing expired passwords from computers on other domains. They came back to us with only two Pipes that needed to be enabled, LSARPC and SAMR.

These Named Pipes that allowed null sessions, have specific vulnerabilities and exploits that exist, hence the reason for their removal by Microsoft. In the end we decided not to make the change and migrate the affected computers to the users domain, but i thought it would be interesting to share that you didn’t need to allow anonymous access to all the named pipes detailed in the article above, if you need to make this work, you can now do it with as little risk as possible.

Delay on Enterprise Vault Web Pages on first access each day.

2010-05-26T13:17:00.001+01:00

After deploying a geographically dispersed cluster toward the end of last year, the next thing on my to do list, was to provide archiving services.

We use Symantec Enterprise Vault across the organisation, so I set about installing and configuring that. The installation went smoothly and all was working without any major issues.

The only issue reported by users was in regard to the search and browse vault web pages, usually viewed through Outlook were taking a long time to load for the first attempt each day.

I called Symantec Support and was pointed in the direction of the article below.

http://seer.entsupport.symantec.com/docs/324255.htm

In our case this didn’t apply. This article (http://seer.entsupport.symantec.com/docs/351109.htm) was closer to our solution, but still not our complete solution.

The runtime config below will be familiar to admins who run Exchange 2007 Servers where no internet access is available. For those who are not familiar with certificate signed code, at regular intervals a certificate revocation list will be checked to see if the certificate has been revoked. Where no internet access is available the delay occurs as the server attempts the connection anyway.

Symantec advised us to place the following inside the runtime tags inside the machine.config file. The reason this is different from the latter support article above is because were running the server on Windows 2008.

<runtime>
     <generatePublisherEvidence enabled="false"/>
</runtime>

This solved our delays nicely.

Convert Linked Mailboxes to User Mailboxes in Bulk

2010-05-24T21:27:00.004+01:00

My organisation has gone through a massive migration project to unify Active Directories and Exchange organisations. As a result of these migrations a lot of mailbox migrations have resulted in a lot of mailboxes ending up as linked mailboxes even though their not.

The official TechNet article on this explains how to disconnect the mailbox and re-attach it to the user account correctly as a user mailbox. http://technet.microsoft.com/en-us/library/bb201749(EXCHG.80).aspx

Another way to make this appear to be corrected is to manually change the “Recipient Type” AD property on the affected mailboxes. This though, is unsupported.

Using the official method from Microsoft results in the loss of any specific mailbox information such as SMTP, x400 & x500 addresses, mailbox sizes and any other individual mailbox settings.

Only e-mail addresses and mailbox sizes were important to me (I must admit, I forgot about mailbox sizes at first).

I came up with the script below that would properly convert all Linked Mailboxes on a particular server to user mailboxes in a supported way. The script is very effective, but you will want to check out the list of considerations below before running it, they might lead you to amend the script slightly. You will have to modify the $exchangeserver and $userdomain variables though.

$exchangeserver = "exchccr1"
$userdomain = "domain\"

$linkedmailboxes = get-mailbox -server $exchangeserver -resultsize unlimited|where {$_.recipienttypedetails -eq "LinkedMailbox"}

foreach ($mailbox in $linkedmailboxes){
Disable-Mailbox -Identity $mailbox.displayname -confirm:$false
}

Get-MailboxDatabase -server $exchangeserver|Clean-MailboxDatabase

start-sleep -s 90

foreach ($mailbox in $linkedmailboxes){
$usernamestring = $userdomain + $mailbox.samaccountname
Connect-Mailbox -Identity $mailbox.exchangeguid -Database $mailbox.database -User $usernamestring
set-mailbox -identity $mailbox.displayname -emailaddresses $mailbox.emailaddresses
}

start-sleep -s 90

foreach ($mailbox in $linkedmailboxes){
set-mailbox -identity $mailbox.displayname -EmailAddressPolicyEnabled $mailbox.EmailAddressPolicyEnabled -emailaddresses $mailbox.emailaddresses -UseDatabaseQuotaDefaults $mailbox.UseDatabaseQuotaDefaults -ProhibitSendQuota $mailbox.ProhibitSendQuota -ProhibitSendReceiveQuota $mailbox.ProhibitSendReceiveQuota -IssueWarningQuota $mailbox.IssueWarningQuota
}

Some things to consider…

The filter on this script doesn’t consider legitimate linked mailboxes.
Only E-Mail addresses and mailbox sizes are re-applied to the freshly attached mailbox. More can be added to the script though.
You can’t attach a mailbox to a disabled account. The script won’t stop, but will error on disabled user accounts.
Don’t stop the script as it’s running, even if it’s choosing the wrong selection of accounts. It will mean more manual work after if you do.
Ensure you have "Exchange Server Administrator" permissions on the server you wish to run this script.
Ensure you have permissions to run the Clean-MailboxDatabase permissions on the server you wish to run this script (You don't get this by default with "Exchange Sever Administrator" permissions). If you're an admin in my 0rg, we can give you this permission if you if you don't have it already.

There you go, a script that will do all your linked mailboxes in one go. I’ve not been able to find another online, so I hope this helps you.

Upgrading Delegated Exchange 2007 Clusters to SP2 - FIX

2010-05-17T14:40:00.001+01:00

Concerning a previous post “Upgrading Exchange 2007 Clusters to SP2 – Workaround”, Microsoft provided a fix for the issue of upgrading an Exchange 2007 Cluster using delegated privileges.

Microsoft provided us with a fix that allows this to happen without using the workaround described in the article above.

Download the file from here http://downloads.daiowen.co.uk/ExBPA.PreReqs.xml

How to use the XML…

Copy all the E12SP2 setup files to local disk.
Replace the original ExBPA.PreReqs.xml with the one available above.
Run the setup from local disk.

Exchange 2007 Public Folder Mail Routing

2010-01-19T00:31:00.001Z

We had a report recently that mail from outside the Exchange organisation destined for Public Folders was being returned in the form of an NDR, but all other mail was flowing fine.

To explain the problem, here’s a little background about the Exchange 2007 topology. We have two HUB servers that handle mail heading inbound and outbound of the organisation. Beneath that we have a lots of exchange deployments at physical sites with varying local configurations. To complicate things we have firewalls sat in front of these other deployments with some more strict than others. As we add more exchange deployments it can be a considerable task getting these firewalls adjusted to allow the new hub transport servers to communicate with the old, usually leading local administrators to notice queues forming on their sites.

I had all the information I needed to track the messages, so started by tracking the message at our two hub transports handling mail into and out of the system. The Public Folder that the message was being delivered to, only had one replica. I discovered that the message was being sent to what seemed to be a completely random hub server, not to the site where the replica existed. The messages were queuing there as the complaining administrators hadn’t opened their firewalls as requested. Fine I thought, get them to open the firewalls properly, but I wanted to figure out why the message was being sent to this strange server in the first place.

The answer lay in the following Microsoft TechNet Article - http://technet.microsoft.com/en-us/library/bb232041(EXCHG.80).aspx

The article explains how messages are routed for public folders. The start of our problems were because that our two Hub Servers that were receiving mail from the internet didn’t have a copy of the Public Folder Hierarchy to know where to route the message, in this instance it will look at the values of msExchOwningPFTreeBL a property of CN=Public Folders,CN=Folder Hierarchies,CN=First Administrative Group,CN=Administrative Groups,CN=Cymru,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=cymru,DC=nhs,DC=uk . All of the public folder stores should be listed in that property and the Exchange 2007 SP1 or SP2 categoriser filters them out in the following way…

1. Ranking by the age of the public folder database By default, public folder databases that have an age threshold of less than two days are not considered unless the age of all public folder databases is less than the threshold or the age is unknown.

2. Proximity The local server is preferred. If the local server does not contain a replica of the public folder database, a server in the same Active Directory site is preferred. If the local Active Directory site does not contain a replica of the public folder database, a server in a remote Active Directory site or routing group is selected as the preferred destination.

3. Cost If more than one remote Active Directory site or routing group contains a replica of the public folder database, the server in the Active Directory site or routing group that has the least cost routing path from the local Active Directory site is selected as the preferred destination.

In the long term, I’d want the messages routed directly from our two entry point Hub Servers, but in the short term point 1 stopped us from just creating a Public Folder Database to store only the Hierarchy for routing purposes, two days might have been a problem. I created the databases anyway.

Our AD site layout is fairly simple , its a snowflake design where all of the AD sites with connections to our central site had all the same costs. The quick way to resolve this was to drop the cost of a site where you wanted these messages to be routed via, this solved the problem short term until the mandatory two days expired until the newly created PF Databases could route the messages itself.

OR the local admin could have opened the firewalls properly, but that would have been too easy. :-)

Upgrading Exchange 2007 Clusters to SP2 – Workaround

2009-12-04T19:17:00.002Z

I posted last month about a problem delegating installs of Exchange 2007 SP2. Delegated Admins will receive an error message stating the following…

You must be a member of the 'Exchange Organization Administrators' or 'Enterprise Administrators' group to continue.

Have been looking into the issue and have had a case open with Microsoft. Turns out that you only get this issue on a fully patched server. If you try upgrading or installing as a delegated admin on a fresh install of either server 2008 or 2003 you don’t see the problem either with Exchange SP1 or SP2. I haven’t had time to identify exactly what patch causes this yet, if I’ll bother at all.

If you have patched your server though, MS came up with this workaround.

Disable update checking for the BPA by heading into the registry and HKCU\Software\Microsoft\Exchange\ExBPA and either creating or modifying a DWORD named “VersionCheckAlways” and set it to ‘0’
Copy the installation files to a local drive and replace Setup\ServerRoles\Common\en\ExBPA.PreReqs.xml with this Modified XML File [I have since updated this link to a properly working file provided to us MS, please read the accompanying post]

Once you’ve done this you can ignore all Pre-Requisite Checking for the install. I was strongly advised my Microsoft that you should ensure that there are no other Pre-Requisite Failures by running an unmodified setup before making the changes above.

Microsoft have said that they’ll pass this to the product group for a fix.

Upgrading Exchange 2007 Clusters to SP2 - Continued

2009-11-29T13:24:00.001Z

Regarding my previous post delegated installs and upgrades to SP2, see here - http://daiowen.blogspot.com/2009/11/upgrading-exchange-2007-clusters-to-sp2.html

Microsoft has informed us that this will be classed as a bug and is working on discovering the cause before saying if they will fix the problem or not.

Geographically Dispersed CCR Cluster

2009-11-29T12:02:00.001Z

I recently had the opportunity to install a geographically dispersed CCR Exchange 2007 cluster.

Server 2008’s cluster features can now handle clusters on separate subnet’s making the fact that the only data centres available were operating on Layer 3 wasn’t a problem. I didn’t need to stretch a VLAN across physical sites.

Configuring the networking for the cluster went slightly against the grain for me. Essentially the Private networking element has gone for these types of clusters, because all traffic, heartbeat and all has to go over the public network. That said, it was a simple process. I configured the networking using four NIC’s, three were teamed and another was on its own but it was set not to register in DNS. I didn’t want client traffic coming over the single NIC.

When you set up the cluster you simply enter two IP addresses that the cluster can use, and on failover, one, the one that’s not on the subnet the active node is in, will stay offline, sounds nice doesn’t it, but wait.

Even though you don’t have to stretch a VLAN anymore for this type of cluster. Exchange 2007 still requires cluster nodes to be in the same Active Directory site. This means that if you are planning for the disaster of losing a site, then you’ll need two DC’s in each site in the same AD site so that each node will always have a DC in the event that you loose one of the physical sites. You can’t use DC siteCoverage for this, as I discovered.

With the cluster set up I set up a combined HUB CAS in each physical site. Exchange will load balance mail flow to each HUB Transport Server by itself, but what about CAS connectivity. Autodiscovery service will handle Outlook Web Services, such as OAB & Out of Office etc, but what about Outlook Web Access. On the same subnet you’d use NLB to provide users with a single resilient point of entry to OWA. That’s no good on separate subnets unless you have a hardware load balancer, which I didn’t. So the OWA failover process became a manual process using CName’s in DNS. Not the nicest of solutions.

Another issue… You can’t put a Public Folder Database on a CCR unless it’s the on CCR in the Exchange Organisation. So Public Folders were to be sat on the HUB/CAS servers with content replication between each server. But in the event of a loss of one of those PF servers, it’s a manual failover process to get PF access back. You need to change the Default Public Folder Database for each Mailbox Database in the CCR. But that’s the same for any Public Folder failure.

So now we have two parts of the failover that requires manual failover, not nice, was starting to not like separating my Cluster over different subnets.

Issue number 3… When cluster failover occurs, the cluster IP changes. Meaning that unless all your clients are sat on the same AD site this change of DNS record will take time to replicate to them. By default the TTL of cluster DNS names is 20 Minutes. Meaning that in the worst scenario, your clients could be waiting 15 minutes for AD replication plus 20 Minutes for the DNS record to expire on their machines. 35 Minutes is a long time. Not really acceptable either. You can alleviate this issue by reducing the TTL of the record. I reduced mine to 3 Minutes. Another change you can make is by enabling change notification on the AD site links between the Cluster’s AD site and the AD site/sites where the clients sit. This brings the failover time down to 3 Minutes. Another change we made was in group policy… We created a GPO that configured Outlook not to complain about connectivity issues for 4 Minutes after disconnection from the Exchange Server.

This configuration meant that during a failover the majority of clients would not notice a problem unless they were sending emails and noticing that they were sitting in their outbox.

So with the exception of OWA and Public Folders, the system was quite acceptable. Just after covering off all of the above problems, space became available in our main data centre. We could now stretch a VLAN between these sites. So I reconfigured the networking and put each node in the same subnet. And guess what, most of the problems above went away. With the exception of Public Folder failover, but I can’t get these people to use the SharePoint servers available in the organisation, so I’m afraid that they’ll just have to live with that :-).

Duplicate legacyExchangeDN Properties

2009-11-17T13:40:00.001Z

Had a case recently that wasn’t immediately obvious to resolve.

We had reports of a user that no one was able to e-mail due to duplicate addressing. At first look there was no duplicate addresses on the object. We were receiving the following NDR’s

There is a problem with the recipient's e-mail system. More than one user has this e-mail address. The recipient's system administrator will have to fix this. Microsoft Exchange will not try to redeliver this message for you. Please provide the following diagnostic text to your system administrator and then try resending the message after the problem has been resolved.

IMCEAEX-_O=ORGNAME_OU=EXCHANGE+20ADMINISTRATIVE+20GROUP+20+28FYDIBOHF23SPDLT+29_CN=RECIPIENTS_CN=NAME+2ESURNAME@DOMAIN.SUFFIX
#550 5.1.4 RESOLVER.ADR.Ambiguous; ambiguous address ##

Further investigations showed that there was a problem with the way that the user was shown in the Exchange Address Books. It seemed as though the object was being confused with another user with the same name.

Comparing the properties of the two users revealed that their legacyExchangeDN properties were the same. The result was that the users were being confused in the Address Lists and no one was able to e-mail either due to this duplication.

The resolution was to change the container name that represents the user to another unique value, we changed ours to the users sAMAccountName value.

o=EXCHORG/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=firstname.surname

o=Cymru/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=sAMAccountName

The only problem with renaming this value is it will break reply ability if senders Outlook Cache is not removed.

As to how this happened, we believe it’s because we have multiple installations of the Quest Migration tools running against the same AD domain, and they happened to be migrating a user with the same name and populated the property with the same value.

Upgrading Exchange 2007 Clusters to SP2

2009-11-13T16:51:00.001Z

In the Exchange Organisation I look after at work, we have quite a few Exchange Clusters. We have SCR & SCC clusters across multiple sites and ran by different subordinate administrators.

With the release of SP2 for Exchange 2007 we went about testing implementing SP2 and getting it rolled out. Unfortunately, our test lab doesn’t include any clusters, something we’ll have to address now, but I digress.

We installed SP2 on the Exchange servers we manage ourselves without issue, again, no clusters.

When it came time for the local admins to install SP2, they hit a problem on their Exchange Clusters. Following the steps described in this Technet Article - http://technet.microsoft.com/en-us/library/bb676320.aspx the attempts failed with the following error…

You must be a member of the 'Exchange Organization Administrators' or 'Enterprise Administrators' group to continue.

on inspection of the ExchangeSetup.log the prerequisites check failed with the following error.

[ERROR] The operation could not be performed because object '<server>' could not be found on domain controller '<domaincontroller>.<domain>'.

The install works fine with Exchange Organisational Administrator permissions, but it’s not ideal to go around each cluster and do it ourselves, we have quite a few and don’t want the blame for any subsequent failures.

We logged a call with Microsoft over a week ago now, and have been troubleshooting with them. They can reproduce our problem in their labs. Until then, it looks like we’ll have to upgrade the clusters ourselves.

I’ll post an update as soon as / if Microsoft come back to us with a solution.

83-640 Exam “Windows Server 2008 Active Directory, Configuring”

2009-10-19T18:19:00.001+01:00

I passed 83-640 “Windows Server 2008 Active Directory, Configuring” today. The exam is a replacement of 70-640 with exactly the same tested skills. This was my first Microsoft exam with with a simulated testing environment so I thought I’d write a bit about it.

The exam itself is split into three parts, two Virtual Labs followed by the more familiar multiple choice questions, there were thirty questions.

The VM labs, in my case were identical, and most of the tasks are fairly simple to complete. I got caught out on a CA question that I couldn’t remember a command for. Things like adjusting the dataset of the Global Catalog, configuring site replication and bulk update of AD objects should all be fairly common place for most administrators.

The multiple choice questions posed no major difficulty. There were the odd one that I wasn’t familiar with, but some of the answers were obvious.

My main problem with the test was the speed of Virtual Labs. The machines are somewhere on the internet, and proudly show the speed of the VM CPU as 7MHz with 1024Mb of RAM on the desktop using BGInfo. Believe me, they are slow mouse clicks take seconds to register and MMC consoles take minutes to open. Even though this was an annoyance, there is still plenty of time in the exam to complete the tasks.

The best part of the new VM testing method is that help is available as it would be on a normal install. While this isn’t always a help, on one VM Task it saved my bacon.

Generally though, after sitting the exam, if you’ve learned about the new features of 2008, Rights Management & Federation services and update your knowledge of PKI’s you should be fine. Everything else is the same as the 2003 exam.

Next up is 70-642, a couple of weeks revising for that and I’ll let you know how it goes.

SharePoint 2003 Restore Problem

2009-10-11T23:18:00.001+01:00

I’ve blogged about this before, but I managed to loose the document from my server. I’ve had lots of emails requesting the document. So I’ll try to keep this short and sweet.

I encountered a problem when restoring a SharePoint 2003 portal to a newly built server.

All three SharePoint databases were stored on a SQL cluster and we relied upon backups of the SQL server for disaster recovery.

A failure on the SharePoint server required us to re-build another server and restore the SharePoint portal. We’d done this a number of times before with no problems, but on this occasion, we received the error “Unable to find entry for Portal Site” when restoring.

As this was a newly built server we instantly thought there was corruption in the SQL Databases. We restored them from a backup before the failure occurred with no success. We then moved backward to a weekly backup from five days before the failure, still with no success. We had earlier backups but didn’t roll back further because the data in them would be too far out of date for a useful recovery.

With no obvious solutions found on the Internet we turned to Microsoft. They spent some time with us looking at the problem and came up with a document instructing us how to correctly populate a single field to allow the restore to proceed.

Solution Document from Microsoft

I know this information is for a product that is fairly out of date, but SharePoint 2003 is still has a large user base.

Dan Brown’s the Lost Symbol

2009-09-30T13:22:00.001+01:00

Last night I finished reading Dan Brown’s latest. One of the longest books I’ve read in a while, but that’s more of a slur on my book reading habits than the book itself.

I’ve read all four of Dan Brown’s other books, and enjoyed each one. Angels & Demons being my favourite, closely followed by The Davinci Code. One thing I noticed during the previous for books, was there was a pattern shared between them all. A serious problem followed by a string of clues, codes or events that would get in the way, not always overcome, but resulting in a relatively happy ending. I think the lost Symbol throws in some surprises.

When your reading the first half of the book, you set expectations on what you think the ending of the book will revolve around. My initial expectations were were quickly resolved by half way through the book. At the half way point, the book takes a turn to tradition. Clues, puzzles and codes all with a pressing time limit and lives hanging in the balance. Even an ongoing hint at imminent global ramifications.

As usual Brown takes commonly known scientific theories, buildings and historical facts and adds his own twists, intertwining reality with the story he’s trying to tell. Every element of science and history in the book has a bedding in fact. Each claim made, justified and backed up enough for any layman reader, including myself, agree that it is plausible in the context of the story.

The final part of the book brings all the parts of the book into context and answers all the questions that were previously left hanging. The end reveals what man kind has been searching for all their lives with a magical reveal that is conceivable and humbling.

I’m sure some people will find truths in Brown’s book as they did in the Da Vinci code and that, when, not if, the film of this book is made it will be a great film.

Well worth the read!

Problems installing a CCR CMS Exchange 2007

2009-09-26T12:31:00.001+01:00

I’ve been meaning to Blog About this for a while, before Exchange 2010 comes out. So here goes…

I had pre provisioned five exchange objects, two for servers meant to hold the HUB/CAS roles, two for the CCR Cluster Nodes and one for the CMS. The delegated local admin had installed the HUB/CAS servers with no issues, but hit a problem after installing the mailbox role on the first node, the CMS creation failed with the following message.

Clustered Mailbox Server ......................... FAILED
The computer account 'Server' was created on the domain controller
'\\fsmoholder.domain.suffix', but has not replicated to the desired domain
controller (localdc.domain.suffix) after waiting approximately 60 seconds
. Please wait for the account to replicate and re-run setup /newcms.
The Exchange Server Setup operation did not complete. For more information, visit http://support.microsoft.com and enter the Error ID.
Exchange Server setup encountered an error.

The local admin tried a few things to discover what the problem was and resolve it himself with no success. So passed the problem back.

Waiting for replication as indicated in the error message, doesn’t solve the issue. So I checked the obvious oversights for causes of the problem.

Service Account for the Cluster has full control of the CMS Computer Object in AD
Manually re-creating the Network Name Resource in Cluster Manager before waiting for a replication cycle and then running setup /newcms with all the required switches again.
Checking TCP Chimney was disabled. This can cause timeouts when talking to Domain Controllers, especially on Exchange Boxes.
Removing all traces of exchange from the nodes. (Ensuring v8.0 registry hive is removed is often overlooked) Removing the provisioned objects from AD and going through the motions of installing again.

After a few hours of troubleshooting I logged a call with MS, getting the same error numerous times. So they went through a very similar troubleshooting process that I’d been through and reached the same point.

I should explain that this exchange installation was sitting in an AD Site with a 15 minute replication delay from the DC containing all the FSMO roles.

Microsoft eventually helped us get this resolved after a day of troubleshooting.

The problem here lies with the Server 2003 Cluster Service, not Exchange. When a network name resource is created, it insists on going to the PDC Emulator to take control / create the Computer Object. This means that when attempts to use the computer object on a local DC occur, it gets locked out, because the password set on the PDC Emulator for the object is not the password on the local domain controller, yet, due to replication delays. The CMS creation then fails.

Solution

When our AD was a lot smaller, with hardly any users, we had moved the PDC emulator to the local site to resolve the issue. This wasn’t an option any more, with upwards of 40,000 user accounts and active migrations taking place.

The solution was quite simple. Essentially, we removed the CMS Resource Group from the Cluster, pre-created a new one, along with the Network Name Resource and the IP Resource, and waited for an AD Replication Cycle.

We then added the /domaincontroller switch to the setup command we were using to create the cms.

Setup.com /newcms /DomainControler localdc.dom.suff /cmsname:ExchangeCMSName /cmsipaddress:10.0.0.10 /CMSSharedStorage /CMSDataPath:"M:\Storage Groups"

The reason we did this was to ensure we knew what local DC exchange was going to use. It didn’t change the fact that the Cluster Service was attempting to use the computer account on the FSMO holder.

We then kicked off the command, but that’s not it. As soon as we had kicked off the command, we had to monitor the computer account on the DC we specified in the setup.com command above and continually refresh its status. At some point in the setup, you would see that computer account getting disabled, sometimes more than once, we needed to enable it as soon as possible. Once we enabled the computer account, only once for us. The command to provision the CMS worked fine and we could watch the other Resources being created in Cluster Manager. All fixed!

I should point out that this problem doesn’t exists in server 2008 as the Cluster Service is a little more intelligent.

Creating a Windows PE 3 Bootable USB device

2009-09-25T19:08:00.001+01:00

I’ve used Windows PE for a long time. And I’ve grown to love it. It’s an extremely useful tool, not just for OS installation, but for diagnostics.

Since there’s a version of WinPe for x64 & x86 (& itanium) I like to keep both x64 & x86 on my USB stick. Essentially copying the each version to the root of the USB stick as needed. Meaning at any one time I have three copies of WinPE on my USB stick. Other applications I copy directly to my USB stick, so that I don’t have to remount the image every time i need another application added.

Shortly after Windows 7 was released came a new version of WinPE, WinPE 3.0 on the Windows Automated Installation Kit.

Preparing the USB stick.

You’ll need to prepare the USB stick. To do this open a command prompt using Run As Administrator and use the following commands.

diskpart
list disk
select disk 7
clean
create partition primary
select partition 1
active
format quick fs=fat32
assign
exit

Make sure you select the correct disk by adjusting the third command above.

Getting WinPE 3.0 Quickly

I’ve already done this so I’ve uploaded it to save you some time. The new Windows AIK is 1.75Gb my files are 170Mb & 146Mb for x64 & x86 respectively. I’ve detailed the packages I’ve used below.

Files are hosted with HotFile as I don’t have enough storage to host them myself.

Both x86 & x64 versions are available.
WMI, HTA & Scripting Packages
ImageX copied to the image (System32 folder).

Once you’ve downloaded the file above, you can either copy the contents of the version of WinPE you wish to use to the root of the USB stick.

Creating a WinPE 3 Image

To create your own customised WinPE 3 image, you can follow Microsoft’s instructions here. The page details all the packages you can install and how to install them. The commands I used for each version are below.

Remember to run the Deployment tools Command Prompt As Administrator.

32-Bit WinPE 3

     copype.cmd x86 c:\winpe_x86

    copy c:\winpe_x86\winpe.wim c:\winpe_x86\ISO\sources\boot.wim

    Dism /Mount-Wim /WimFile:C:\winpe_x86\ISO\sources\boot.wim /index:1 /MountDir:C:\winpe_x86\mount

    Dism /image:C:\winpe_x86\mount /Add-Package /PackagePath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\winpe-wmi.cab"

    Dism /image:C:\winpe_x86\mount /Add-Package /PackagePath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\winpe-hta.cab"

    Dism /image:C:\winpe_x86\mount /Add-Package /PackagePath:"C:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\winpe-scripting.cab"

    copy "C:\Program Files\Windows AIK\Tools\x86\imagex.exe" C:\winpe_x86\mount\Windows\System32\imagex.exe

    Dism /unmount-Wim /MountDir:C:\winpe_x86\mount /Commit

64-Bit WinPE 3

    copype.cmd amd64 c:\winpe_amd64

    copy c:\winpe_amd64\winpe.wim c:\winpe_amd64\ISO\sources\boot.wim

    Dism /Mount-Wim /WimFile:C:\winpe_amd64\ISO\sources\boot.wim /index:1 /MountDir:C:\winpe_amd64\mount

    Dism /image:C:\winpe_amd64\mount /Add-Package /PackagePath:"C:\Program Files\Windows AIK\Tools\PETools\amd64\WinPE_FPs\winpe-wmi.cab"

    Dism /image:C:\winpe_amd64\mount /Add-Package /PackagePath:"C:\Program Files\Windows AIK\Tools\PETools\amd64\WinPE_FPs\winpe-hta.cab"

    Dism /image:C:\winpe_amd64\mount /Add-Package /PackagePath:"C:\Program Files\Windows AIK\Tools\PETools\amd64\WinPE_FPs\winpe-scripting.cab"

    copy "C:\Program Files\Windows AIK\Tools\amd64\imagex.exe" C:\winpe_amd64\mount\Windows\System32\imagex.exe

    Dism /unmount-Wim /MountDir:C:\winpe_amd64\mount /Commit

Once you’ve followed all the instructions you can copy the contents of c:\<architecture>\ISO\ to the root of the usb stick you are using.

Samsung NC10, a 6 cell battery & Windows 7

2009-09-25T16:09:00.001+01:00

I’ve had my NC10 for a few days now and you can read about some of the things I've done to maintain the battery runtime XP delivered, but with Windows 7 in my previous posts.

I got my 6-cell batter delivered and wanted to let you guys know how I got on. With the three cell battery I managed to reproduce XP’s 2.5 hour life on Windows 7 after a bit poking around with services and drivers etc.

I charged up the new battery and run it from fully charged, just browsing the web. until it switched itself off. 7.25 hours it lasted. I was impressed. This battery had not been conditioned properly and it was already producing comparable run times to the advertised life.

The interesting thing here is that the batter life achieved with a 3-cell battery is not anywhere near half of what you get with a 6-cell battery. I’m sure there’ll be a scientific explanation about why this is, due to load sharing etc, but for now, I’m just happy that I’ve got a very portable machine that can last a full work day.

One other thing I wasn’t expecting was the battery sticks out of the case at the bottom. I wasn’t expecting this, as people only talk about how much the 9-cell battery sticks out of the body. Perhaps this is because most NC10’s come with a 6-Cell battery in the first place.

I can’t think of any other interesting things to say about my NC10, so this may be my last post about it. Well at least until Google Chrome OS is released :-).

My General Theme for Windows 7

2009-09-25T00:47:00.001+01:00

As in my previous post for Netbooks, I’ve compiled a theme for Windows 7 for my PC. The theme contains 25 nice images I’ve compiled with a resolution of 1280 by 1024. I thought I’d share this theme also.

Download it here [20Mb]

Scavenging Battery Life with Windows 7

2009-09-24T16:11:00.003+01:00

Since I installed Windows 7 on my NC10 I’ve been trying to find ways of getting the battery performance on a par with Windows XP. I’ve gone through Windows 7 Power settings with a fine toothcomb, I’ve gone through application settings to try and reduce requirements and am now looking at disabling unnecessary services.

As an aside, I previously mentioned that I like Google Chrome on the device. One tip that seems to reduce hard drive & Wi-Fi activity is to disable DNS pre-fetching. This actually saves you time, but produces activity while the browser resolves any domains that are present in links on each page you visit. Only a small overhead but I think it helps a little.

Back on topic, I started looking at the services that were started on my installation of 7 Home Premium. I then Googled for anyone that had done similar. I found someone had gone through the services and documented what ones he’d turned off.

Charles Sparks ‘BlackViper’ – Windows 7 Service Configuration

I did’t disable all the services he had, but there was a number that I disabled. Some of the ones I disabled are below, but you may find that you are able to disable other services and would like to keep these on.

HomeGroup Provider
Windows Media Player Network Sharing Service
Windows Search
Diagnostic Policy Service

I had a look at the scheduled task service and didn’t disable it as I wanted to see if any tasks were set to run even though the machine was on battery power. I’ll write another post on that.

But the result of disabling some services, was encouraging… The battery life appears to be back up to XP levels for the three cell battery. I now get two and a half hours of browsing with 7.

I’ve also thrown in the towel and ordered a 6 cell battery. So I’ll be able to let people know what results I get with that.

Google Chrome on Netbooks

2009-09-24T11:12:00.001+01:00

An Internet Browser is what I use most on my Netbook, so I sent some time looking at different browsers. They all do pretty much the same, rendering speed arguments aside. It was the interface that mattered to me. I tried all the big browsers, IE8, Firefox, Opera, Chrome.

In the end I settled on Chrome. The main reason I liked it, was because the toolbar area was the smallest of all the browsers. Allowing me to see more of the page. I know some of you will tell me about full screen modes etc, but I don’t like it. I prefer to have the Start Bar and the IE toolbar visible.

I’ve tried Chrome on my PC before, but I didn’t quite like it on systems with larger screens. But for Netbooks, Chrome is my browser of choice.

One thing I’m looking forward to is Google Chrome OS. The combination of this browser and Google’s work with Android will be something that I think will push Windows 7 aside on Netbooks.

Windows 7 Theme for Samsung NC10

2009-09-23T21:46:00.003+01:00

I’ve spent some time compiling some nice images that are 1024 by 600 for the Samsung NC10. There are 25 images in total. Thought I’d share for others to enjoy.

Download the Windows 7 Theme for Devices with 1024x600 screens.

Samsung NC10 with Window 7

2009-09-23T21:03:00.002+01:00

I got my hands on a Samsung NC10 this week. Call it a birthday present to myself. I’ve read so much about this Netbook that I’ve been refraining myself from purchasing one for a while. But I gave in when I had some disposable birthday cash. Just after ordering, I placed another order for a 2Gb memory DIMM. I think 1Gb isn’t realistic for anything anymore, even a Netbook running XP.

The first thing i did when I got my hands on the unit, was pop in the memory upgrade. There’s a nice access panel specifically for you to do this, it’s even labeled ‘Memory’, so it wasn’t a problem.

The next thing I did was boot to my newly created Windows PE 3 USB stick and install Windows 7. All the hardware was detected during the installation, but some operated better with a driver update. I was happy for example to just update the Graphics, Audio Drivers and Touchpad driver. Of the Samsung suite of tools, the only tool I installed was the Easy Display Manager. This tool reactivated some of the function keys and the ability to adjust the screen brightness. I would have liked to use the Easy Battery Manager tool, but I wasn’t happy with the way it worked with Windows 7. So I opted not to use it. The only feature I miss is the auto dim of the screen when you move from AC power to battery.

Windows 7 runs brilliantly on the device, in every area. A much more modern looking OS compared to the ageing XP. I tried Windows 7 on the NC10 with just 1Gb of memory, and it makes no difference to the OS itself. The difference becomes obvious when you start running memory hungry apps like a couple of Office 2007 apps at the same time.

With web browsing only, the average battery life I got on the three cell battery was just over two hours with WiFi on and the screen brightness at its lowest. This worried me, as I was expecting to get 3+ from this. Concerned, I restored XP as shipped and was surprised to only get 2.5 hours under the same circumstances. I’m not sure if it’s the combination of XP and sharing the power load over 6 cells that gives the NC10 it’s 8 hour battery life, but was quite disappointed with just 2.5 hours.

Not liking XP and an extra twenty minutes not being a deal breaker for me. I reinstalled Windows 7. Now, knowing I was happy with the OS, I started playing with the other applications I would use. I’ve got a set of applications that I use regularly, but was aware that some of them weren’t really suited to the confines of a 1024 by 600 resolution display. I’ll blog about some more experiences over the coming day’s but I’ll end by saying that Windows 7 is certainly a Netbook OS worth considering with only the sacrifice of a little battery life.