IT That Should Just Work

List Computers That Logged into the Domain in the Past 60 Days

2026-10-09T13:40:37.645-04:00

The script below will need to run from a domain controller. Run this in PowerShell as Administrator or in Terminal as Admin.

$Cutoff = (Get-Date).AddDays(-30)

Get-ADComputer -Filter 'Enabled -eq $true' `

-Properties LastLogonDate,OperatingSystem,DNSHostName |

Where-Object {

$_.LastLogonDate -ge $Cutoff -and

$_.OperatingSystem -like "*Windows*" -and

$_.OperatingSystem -notlike "*Server*"

} |

Select-Object Name,DNSHostName,OperatingSystem,LastLogonDate |

Sort-Object LastLogonDate -Descending |

Format-Table -AutoSize

If you'd like to export this to CSV to work with it many way, run this command and it will export it to .csv. Just make sure the C:\Temp folder exists first.

$Cutoff = (Get-Date).AddDays(-30)

Get-ADComputer -Filter 'Enabled -eq $true' `

-Properties LastLogonDate,OperatingSystem,DNSHostName |

Where-Object {

$_.LastLogonDate -ge $Cutoff -and

$_.OperatingSystem -like "*Windows*" -and

$_.OperatingSystem -notlike "*Server*"

} |

Select-Object Name,DNSHostName,OperatingSystem,LastLogonDate |

Sort-Object Name |

Export-Csv "C:\Temp\AD-ActiveWorkstations-30Days.csv" -NoTypeInformation

Important distinction: LastLogonDate is based on the replicated lastLogonTimestamp attribute. It helps with inventory comparisons but can lag actual logons by about 9–14 days under default AD settings. It also represents computer-account activity, not necessarily an interactive user sign-in.

How to Remove a Stale DHCP Server from Active Directory

2026-10-05T13:18:31.688-04:00

When a Windows DHCP server is retired or removed improperly, its authorization can remain in Active Directory. This stale entry may continue to appear in the DHCP management console and should be cleaned up.

1. Check Authorized DHCP Servers

From an elevated PowerShell session on a domain controller or management system with the DHCP tools installed, run:

Get-DhcpServerInDC

You may see something similar to:

DnsName              IPAddress
-------              ---------
DHCP01.contoso.local 10.10.10.20
OLD-DHCP.contoso.local 10.10.10.15

Confirm that the server you intend to remove is actually retired and no longer providing DHCP services.

2. Remove the Stale Authorization

Remove the old DHCP server from Active Directory:

Remove-DhcpServerInDC -DnsName "OLD-DHCP.contoso.local" -IPAddress 10.10.10.15

Confirm the operation when prompted.

3. Verify the Removal

Run the following again:

Get-DhcpServerInDC

The retired server should no longer appear in the list of authorized DHCP servers.

Optional: Clean Up the DHCP Management Console

If the retired server still appears in the DHCP MMC console, right-click DHCP and select Manage Authorized Servers or remove the old server from the console.

Final Check

Removing a stale DHCP authorization does not delete DHCP scopes or modify another DHCP server. It removes the retired server's authorization record from Active Directory.

Before removing anything, verify the server name and IP address carefully—especially in environments where DHCP services have recently been migrated to a replacement server.

Migrating NPS Settings from Old Domain Controller to New Domain Controller

2026-03-27T11:23:00.003-04:00

If you're using RADIUS on your Windows network, and you need to do Domain Controller upgrades, rebuilding RADIUS can be a pain if there are a lot of entries. Using this process, you can easily back it up and then restore it on the new server.

NOTE: This process assumes you are using the same name and IP address on the new OS for your new DC.

1. Backup NPS on the old server. Run this command:

netsh nps export filename="C:\NPS-Export.xml" exportPSK=YES

2. For good measure, backup DHCP as well.

netsh dhcp server export C:\dhcp.txt all

3. Copy these two files to a place where you can access them on your new DC.

4. Once your new OS is promoted to a Domain Controller with the same name and IP address as the old DC, you can begin the import process.

5. Install NPS on the new DC.

Install-WindowsFeature NPAS -IncludeManagementTools

6. Import your NPS configuration file

netsh nps import filename="C:\NPS-Export.xml"

7. Register NPS in AD

netsh ras add registeredserver

8. Restart the NPS service

net stop ias

net start ias

PRO TIP: Just in case, it's a good idea to grab a backup of the NPS registry key. I personally haven't had to use it but it can't hurt to have it.

reg export HKLM\SYSTEM\CurrentControlSet\Services\IAS C:\NPS-Registry.reg

That's really all there is to it. Good luck!

Exchange Anonymous Connector

2025-05-12T18:47:00.001-04:00

If you're like most, you need an internal relay on your Exchange server to allow devices and applications inside to send email without the need for credentials. Since the connector can be scoped to the IP address of the source, this is a pretty good way to set it up.

I ran into a new issue on our new Exchange server today. When you create the new Internal Relay receive connector to allow anonymous access, you must run a PowerShell command to make the connector accept messages. This assumes you have the correct IP addresses in the relay.

Run this first:

Get-ADPermission "YourConnectorName" |

Where-Object { $_.User -like "NT AUTHORITY\ANONYMOUS LOGON" -and $_.ExtendedRights -like "*SMTP-Accept-Any-Recipient*" }

If this returns nothing, and it probably will, run this command to add the permissions:

Get-ReceiveConnector "YourConnectorName" |

Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" `

-ExtendedRights "Ms-Exch-SMTP-Accept-Any-Recipient"

Good luck!

Can't Remove Old Exchange UCC Certificate - Certificate Bound to Send Connector

2024-06-03T10:23:00.001-04:00

I've been running into this a lot lately where an old certificate can't be removed from Exchange as it is bound to a send connector and most commonly it's on a hybrid-mode Exchange configuration.

Here's how to get rid of it easily on Exchange and then delete the old certificate.

First, run the command to get the certificates on the Exchange server.:

Get-ExchangeCertificate | fl

This will return a full list of all certificates on the server. Make a note of the Thumbprint of the certificate you want to keep. That's the only one needed.

Now, shut off the "Microsoft Exchange Transport" service using Exchange PowerShell:

net stop "Microsoft Exchange Transport" or Stop-Service -Name MSExchangeTransport whichever you prefer.

Next is to get the name of your Send Connector shown in the error when trying to remove the certificate. You'll need that name in the next command to remove any certificates that are bound to the connector:

Set-SendConnector -Identity "Outbound to Office 365 - 5c10806d-35cb-6645-8b8f-fde431830769" -TlsCertificateName $Null

At this point you can now delete the old certificate(s) as they're no longer bound to the connector.

Now run these two commands to set the variables for the certificate you want to keep. This is where having the Thumbprint for the new certificate is needed.

$cert = Get-ExchangeCertificate -Thumbprint 6B6CB53DF162724D4F3AD97E508C5BBF072DCE8

$tlscertificatename = "<i>$($cert.Issuer)<s>$($cert.Subject)"

Do not change the syntax on the 2nd command. That's used to pickup that variable for the final command.

Use this command finally to assign the new certificate only to the Send Connector:

Set-SendConnector -Identity "Outbound to Office 365 - 5c10806d-35cb-6645-8b8f-fde431830769" -TlsCertificateName $tlscertificatename

Finally, restart the Microsoft Exchange Transport service and you're finished.

net start "Microsoft Exchange Transport" or Start-Service -Name MSExchangeTransport

This completes the removal of any old certificates bound to the Send Connector so you can delete them from the server. As a precaution, always test your mail flow service to make sure everything is working properly.

Good luck!

2024-04-29T22:55:00.000-04:00

Tonight I was trying to fully clear our older MSA 2040 SAN, which is getting a new storage lease, to life. To my surprise, when I tried to clear the volumes and vDisks off this SAN, I found one disk group that had been quarantined, and the GUI wouldn't let me remove it, no matter what process I tried. This MSA isn't under warranty, and there was no way to contact HPE support for help. HPE forums always finished with "contact support" and "I can't share the special commands in a forum". Beyond frustrating.

Just a note: the MSA family is a rebrand of Dot Hill (now Seagate) AssuredSAN. Lenovo and Dell both have the same products. It's the same CLI in the Lenovo at least.

To force a disk deletion:

From CLI, create a new user with the role of "diagnostic"

# show users (to verify existing user accounts and roles)

# create user <new username> role diagnostic

The admin will be immediately prompted for a new password; use a complex password (one special character, one number, A-Z, a-z)

Verify the new user has been created by entering “show users” CLI command

After the new user account is created, log into the A controller CLI using the new diagnostic user account.

From CLI prompt, enter the "show disk-groups" command to verify disk-groups and to identify the foreign disk group you want to remove. Unfortunately, your existing disk group and the foreign disk group have the same name, capacity and RAID version so your approach to removing based upon SN is the best way to specify the appropriate disk-group for deletion.

From CLI, enter the following command:

# set advanced-settings virtual-pool-delete-override on

User will be prompted, enter “yes”

Enter “show advanced-settings” to confirm the configuration successfully entered:

The user should see “Virtual Pool Delete Override: Enabled” near the bottom of the list; it appears only when enabled.

After entering the above command to enable virtual-pool-delete-override, you will only have 15 minutes to complete delete operations; otherwise, you will need to re-enable it under the diagnostic user and continue where you left off.

After enabling virtual-pool-delete-override, continue attempting to remove the disk group using the SN approach you previously tried.

Get the vdisk or disk-group serial number if you don't have it. When running the "show disk-group" command, the serial shows as the very long hex number.

Execute removal:

# remove disk-groups diskgroupserialnumer or

# remove vdisks diskgroupserialnumer

Restart both controllers (MC and SC).

# restart mc both

#restart sc both

This was done on an HPE MSA 2040, with storage firmware GL220P008-01. This process worked perfectly for me and allowed me to fully clear and recover all disks in the SAN. What was only 6TB before this process is now allowing me to use the full 11TB after configuring the new disk groups and volumes.

Credits: https://forums.lenovo.com/t5/Enterprise-Storage/S2200-3200-dequrantine-diskgroup/m-p/3682552

Hard to believe a Lenovo post helped me resolve this issue on an HPE 2040 SAN.

Entra ID Set User Account Password to Never Expire

2024-03-29T10:44:00.005-04:00

I ran into this one recently as a user account for Cisco CUC had been created in Entra ID only and not on-premise and allowed to sync. It's just a few PS commands and you can set the password to never expire.

NOTE: You must be a global admin or password administrator to perform these changes.

I ran all of these commands from an Exchange 2019 on-premise server running in hybrid mode.

1. Connect to Exchange Online

Connect-ExchangeOnline

2. Connect to Microsoft Graph PowerShell and to the required scopes.

Connect-MgGraph -Scopes "User.ReadWrite.All","Group.ReadWrite.All"

3. To check a user's account to see if the password expiration is set run this command:

Get-MGuser -UserId <user id or UPN> -Property UserPrincipalName, PasswordPolicies | Select-object UserPrincipalName,@{N="PasswordNeverExpires";E={$_.PasswordPolicies -contains "DisablePasswordExpiration"}}

4. To set the password of one user to never expire, run this command:

Update-MgUser -UserId <user ID> -PasswordPolicies DisablePasswordExpiration

These commands will allow you to set the password policy to never expire for just a single user account as needed. For more details on how to change it for all users and check for all users, you can reference the official Microsoft Learn article HERE.

Good luck!

"The namespace cannot be queried. Access is denied" error when you try to create a domain-based DFS namespace

2024-03-27T15:34:00.001-04:00

Working on setting up a new DFS Namespace today. Ran directly into this issue. When you sign in to Windows by using an account that belongs to the Domain Admins group, and then you try to create a domain-based namespace on any Distributed File System (DFS) namespace server, the operation fails. Windows returns an error message that resembles the following:

\\domainname.com\Public The namespace cannot be queried. Access is denied.

However, when this error occurs, you can still successfully create a standalone namespace.

The fix is to remove your account from the Protected Users group.

If you're curious, here's why it doesn't work: When you create a new domain-based namespace, the computer queries the Domain Name System (DNS) server for domain information. The DNS server responds by sending a list of the A records of the domain controllers for that domain. The computer then contacts one of the domain controllers and tries to use your account credentials to authenticate by using NTLM authentication.

If your account belongs to the Protected Users group, your account can't use NTLM authentication. In this situation, authentication fails and generates a STATUS_ACCOUNT_RESTRICTION error.

Is Port 80 Needed for On-Premise Exchange?

2023-07-06T10:24:00.004-04:00

Simply put...NO!

Now if you go digging you will see the official Microsoft documentation stating that it is needed for failback for some HTTPS services. From a security standpoint if the HTTPS services aren't working then I will refuse to go back to an unencrypted service just to keep it working.

Some will say if you're keeping Exchange patched and updated then having port 80 open to Exchange is no big deal. While that may be true why risk it?

I had a customer recently that was asking why their Exchange server was showing C&C callbacks being blocked from the outside, why are there other items being blocked from the outside. Each thing in the endpoint protection logs showed this server was being attacked on port 80.

I connected to their Cisco ASA and disabled the rule allowing port 80 to the Exchange server. Guess what, a week went by with no further attacks being blocked. Even though the endpoint protection was stopping them, it would only be a matter of time before an exploit is found via port 80 and then there goes the server's security posture.

I don't see a need to expose this port in 2023 on the modern Internet with all of the risks we already face daily.

Just be smart and disable port 80. If your application won't work without it then it's time to update the application or get one that is more focused on security. Don't compromise your network security to accommodate old software.

My $.02.

Good luck!

Start All Exchange Services Automatically

2023-04-20T13:24:00.000-04:00

One Command to Rule Them All!

Little joke there....this command will start all Exchange services on a server in the event they do not start automatically as they should after a restart.

Get-Service -DisplayName "Microsoft Exchange*" | Where-Object {$_.Starttype -eq "Automatic" -and $_.Status -ne "Running"} | Start-Service

The process waits for each service to start before moving to the next one. Really handy when you've got a lot going on and don't want to start them all by hand.

Good luck!

How to Configure a Startup Script to Map a Network Printer

2023-01-20T23:09:00.016-05:00

A Windows startup script can be used to map a network printer at logon. Here is an example of a simple script that maps a network printer using the "net use" command:


net use LPT1: \\printserver\printer /persistent:yes

This script maps the network printer located at "\printserver\printer" to the local LPT1 port, and the "/persistent:yes" flag ensures that the mapping will remain after a reboot.

You can also use the rundll32 printui.dll,PrintUIEntry command to map network printers at logon. Here is an example of the command to map a network printer with IP address 192.168.1.100 and share name printer:


rundll32 printui.dll,PrintUIEntry /in /n\\192.168.1.100\printer

You can also use a batch file that contains the above commands, and then schedule it to run at startup using the Task Scheduler.

It is important to note that you need to have the necessary permissions to map the network printer and that the printer should be shared and available on the network.

ADFS Web Proxy Service Won't Start

2022-08-25T12:45:00.000-04:00

I've seen lots of articles across the web on this. Here's a fast way to get this fixed so you can move on to other things. Sadly, I hit this too often when renewing certificates on ADFS servers.

NOTE: This does not require a server restart.

Source: https://blogs.technet.microsoft.com/rmilne/2015/04/20/adfs-2012-r2-web-application-proxy-re-establis....

1) Launch regedit.

2) Navigate to HKLM\Software\Microsoft\ADFS\ProxyConfigurationStatus.

3) Change ProxyConfigurationStatus from “2” (configured) to “1” (not configured).

4) Launch the Remote Access Manager snap-in.

5) Select Web Application Proxy.

6) Select Run the Web Application Proxy Configuration Wizard.

7) During the wizard it will prompt you to select a certificate. Select the certificate you were using before. Enter in some Domain Admin credentials (I don't think they're saved? Just used to authenticate?). Finish the config wizard.

9) Web Application Proxy now works again.

Works for me every time. Good luck!

Upgrade to ESXi 7.x: Missing dependencies VIBs Error

2022-07-23T22:48:00.000-04:00

I have been getting this error frequently lately while doing upgrades from ESXi 6.5 and 6.7 to 7.x regardless of the hardware vendor.

If you add an upgrade baseline to the cluster or host, and you try to remediate the host, the task fails with a dependency error. When taking a closer look into the tasks details, you were getting told that the task has failed because of a failed dependency, but not which VIB it caused.

You can find the name if the causing VIB on the update manager tab of the host that you tried to update. The status of the baseline is “incompatible”, and not “non-compliant”.

To resolve this issue you have to remove the causing VIB. This is no big deal and can be done with esxcli. Enable SSH and open an SSH connection to the host. Then remove the VIB.

You need to reboot the host after the removal of the VIB. Then you can proceed with the update. The status of the upgrade baseline should be now “not-compliant”. Just start the upgrade again and it will complete properly provided there are no other issues.

Good luck!

Fixing Windows Updates Failed with Error 0x80244022

2022-02-04T10:28:00.004-05:00

If you have a workstation failed to Windows Update with the error 0x80244022 from a WSUS, the fix is pretty simple and straightforward.

The reason why the error occurs is because the Application Pool that runs the WSUS service stopped.

Go to the WSUS server and open IIS Manager. Click Application Pools, select WsusPool and click Start to restart the Application Pool.

This takes care of it the bulk of the time.

Good luck!

Mount ISO in Windows Server

2022-01-10T12:02:00.000-05:00

I ran into an interesting issue today. Windows Server 2012 R2 had no options to mount an ISO file. I tried a couple of 3rd party programs to do it but they would not work either. I found a command that can be used with PowerShell to mount an ISO and it worked perfectly. Here's the text of the command.

Good luck!

Mount-DiskImage -ImagePath 'D:\Path\To\Image.iso' -StorageType ISO -PassThru | Get-Volume

How to Enable or Disable the News and Interests Taskbar Windows 10

2021-06-10T14:57:00.004-04:00

The latest updates to Windows 10 has now enabled the News and Interests taskbar by the clock on Windows 10. Right away this started generating questions from staff on what it is or why it was turned on. Again Microsoft pushes something out that you may not want running.

Since the GPO ADMX for it doesn't seem to be working on Windows 10 Professional, here is a quick command you can run that will make an immediate registry change and turn it off.

reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Feeds" /v ShellFeedsTaskbarViewMode /t REG_DWORD /d 2 /f

This fully hides it. If however you want it back on change the DWORD value. Enter 0 (show icon and text) or 1 (show icon only).

Disk Management and Explorer Show Different Drive Size

2020-11-09T13:35:00.002-05:00

I ran into this issue today when trying to extend out the drive size on a data drive on our primary file server. After expanding the virtual disk in VMware, I brought up computer management (compmgmt.exe if you want to go command line quicker).

I expanded out the disk and immediately noticed that explorer didn't reflect that change after a refresh. Also, disk management could no longer access the disk to make any edits. I restarted the virtual disk service with no success. A restart also proved futile.

MAKE A BACKUP BEFORE RUNNING THESE COMMANDS!

After some quick research, here is the fix. Use DISKPART from an elevated command prompt. Just follow the commands below and choose the proper disk on your VM. After running the command, a quick refresh of explorer now shows the correct size.

Good luck!

vCenter 6.7 Resizing Disk Fails Invalid Operation for Device 0

2020-10-13T11:11:00.002-04:00

This one has been around for some time but now due to the data drive on my Exchange server getting closer and closer to full, I had to find a fix and here it is. So simple and yet so hard to find on the web.

Checking the D: drive on the Exchange server showed the disk had a size of 150.254450347GB. This disk had been restored from Datto at some point in the past and since that date this was the size showing.

Whenever attempting to expand the drive vCenter thew this error: Invalid operation for device '0'.

I tried different sizes from adding just a few gigs to going all the way up to 200GB but getting the same error.

Ready for the fix? You won't believe how easy it was.

1. Log into vCenter using the flex (Flash) client instead of the HTML 5 client.

2. Resize your disk successfully.

THAT'S IT!! Can you believe it? After all of these articles I read about changing the parameters on the VMX file, cloning the server, etc. etc. it turned out to be the behavior of the HTML 5 client. Let's hope VMware fixes this in the next versions of vCenter before they fully remove the Flash functionality.

Good luck!

Fix Cisco ASDM Windows 10 Error "This app can't run on your PC"

2020-09-08T11:10:00.000-04:00

Seems that Microsoft has done some switching of how the Windows Scripting Host path is found.

This is a simple fix.

1. Install ASDM as you normally would

2. Right click on the shortcut.

3. In the "Target" line you will see a very long path to wscript.exe. Simply change this path to C:\Windows\System32\wscript.exe (leave the invisible.vbs run.bat on the end as these scripts are used to open ASDM).

4. Apply the change.

After doing this I was able to open ASDM normally and use it to update ASDM and AnyConnect files on my ASA.

Good luck!

Exchange Logging: Clear out the log files

2020-06-09T09:22:00.000-04:00

Here is a simple PowerShell script that you can run against Exchange either manually as part of your maintenance routine or with Task Scheduler to clear out files when you need to.

I must admit the first time I ran this on my Exchange 2013 server it took almost 5 minutes to complete and freed up over 30G of drive space from the multiple years of log files hidden all over.

At the top of the script make sure you change the drive letter if needed to match where your Exchange log files are stored. Sadly I have seen many Exchange servers over the years with everything installed on C: so this script just assumes that.

NOTE: Please make sure you have good backups in place and/or a snapshot of your virtual machine before running this. While I have tested the script with no negative effects, please do not assume this will always be the case. There is no substitution for good backups and a quick recovery plan if needed.

If you want to run the file manually, just open PowerShell as administrator, navigate to where you have your script file saved (Example Name: ClearFiles.ps1). From there just type in ./ClearFiles.ps1 and wait on the script to complete the cleanup.

Good luck.

Set-Executionpolicy RemoteSigned
$days=2
$IISLogPath="C:\inetpub\logs\LogFiles\"
$ExchangeLoggingPath="C:\Program Files\Microsoft\Exchange Server\V15\Logging\"
$ETLLoggingPath="C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\ETLTraces\"
$ETLLoggingPath2="C:\Program Files\Microsoft\Exchange Server\V15\Bin\Search\Ceres\Diagnostics\Logs"
Function CleanLogfiles($TargetFolder)
{
    if (Test-Path $TargetFolder) {
        $Now = Get-Date
        $LastWrite = $Now.AddDays(-$days)
        $Files = Get-ChildItem $TargetFolder -Include *.log,*.blg, *.etl, *.txt -Recurse | Where {$_.LastWriteTime -le "$LastWrite"}
        foreach ($File in $Files)
            {Write-Host "Deleting file $File" -ForegroundColor "white"; Remove-Item $File -ErrorAction SilentlyContinue | out-null}
       }
Else {
    Write-Host "The folder $TargetFolder doesn't exist! Check the folder path!" -ForegroundColor "white"
    }
}
CleanLogfiles($IISLogPath)
CleanLogfiles($ExchangeLoggingPath)
CleanLogfiles($ETLLoggingPath)
CleanLogfiles($ETLLoggingPath2)

Disable User Editing Connections HP ThinPro 7.x (T530)

2020-01-17T10:17:00.001-05:00

So I ran into this one yesterday. After pushing out a configuration to our new HP T530 thin clients I was shocked to discover that one of the users had the ability with the OS locked down to delete their RDP connection icon.

I quickly recreated it on the thin client so they could log back in. Today I set out to change the configuration and push it to all of our thin clients to prevent this from happening again. Here's how:

1. Go into Administrator mode on ThinPro
2. Right click on the respective connection on the desktop. Ex: RDP
3. Select Edit and then go to Advanced.
4. Remove the check box beside "Allow the user to edit this connection".

This process is the same for all connection types on the thin client. I read through the Administrator guide and wasn't able to find a global setting so you'll need to do this for each connection type you are using.

I hope this helps prevent you running into the same issue.

Good luck!

I'm Back!

2020-01-17T10:12:00.003-05:00

It's been quite a while since my last post as I had transitioned into a job where I was doing more sales and quoting than field work so I didn't really have anything to post.

Now, I have changed jobs and on a daily basis I'm back into engineering and field work again.

To that end, I'm sure I will run into new issues and processes that I'll put up here for everyone to see and use. I just hope the bits I add helps someone in IT like me get through a tough problem or issue and look like a champ doing it.

Thanks to everyone that has messaged me with questions and support these past few years. This blog just serves as my small way of helping all of the people that have posted articles and on forums over the years that helped me out of a tight spot.

I hope 2020 and beyond are great for all.

Thanks!

Change 2040/2042 HPE SAN Ports from FC to iSCSI

2017-10-30T11:27:00.000-04:00

As I work with these SANs a lot, one of the first things I have to do is change the ports over from the default FC mode to iSCSI mode so they can be connected to the SAN via 10G fiber connections.

Believe it or not this is very tough to find out the exact syntax in the HPE documentation.

Since it is a simple process, I have outlined it below:

1. Connect to the SAN controller via Putty
2. Run this command: set host-port-mode [FC | iSCSI | FC-and-iSCSI]

Parameters:

FC: Sets all ports to FC
iSCSI: Sets all ports to iSCSI
FC-and-iSCSI: Sets the first two ports to FC and the second two ports to iSCSI

That's all there is to it.

Good luck!

[SOLVED] Cisco VPN Client on Windows 10 (Including the new build April 2018 Update) - This works!

2017-04-11T18:55:00.000-04:00

***Updated 05/14/18 **
***Please see my edits below for notes on builds 1803, 1709, and back.**

Here's how to get it working in 2 easy steps:

1. Download and install the Sonicwall 64-bit VPN client from HERE (as of this writing).

2. Install the Cisco VPN client. Edit: If you get an error that it cannot run on this operating system then just extract the .exe file using WinRar or a similar program and run the .msi file. Problem solved.

64-bit file download (vpnclient-winx64-msi-5.0.07.0440-k9.exe)
32-bit file download (vpnclient-win-msi-5.0.07.0410-k9.exe)

3. Perform a quick registry edit: (This step is almost always not optional any longer)

Open Regedit
Browse to the registry key HKLM\SYSTEM\CurrentControlSet\Services\CVirtA
Select the display name to modify:

x86 - "@oem8.ifn,%CVirtA_Desc%;Cisco Systems VPN Adapter" to "Cisco Systems VPN Adapter"
x64 - "@oem8.ifn,%CVirtA_Desc%;Cisco Systems VPN Adapter for 64-bit Windows" to "Cisco Systems VPN Adapter for 64-bit Windows"

Reboot

The first two steps worked for me without the need for registry edit. I checked and the settings were already spelled correctly on my machine. Full disclosure my systems are clean Windows 10 installs without being upgrades.

Without installing the Sonicwall client first you will get Error 433 after trying to connect. Checking the logs shows that it cannot download the key to complete the secure connection.

What happens is that the Sonicwall client adds the DNE Lightweight filter network client on the machine. I tried getting it directly from Citrix and installing it that way but was unsuccessful.

Using this method you can now get some more use out of the Cisco VPN client. If you prefer you can uninstall the Sonicwall client afterward. I've been told by several people that the DNE software remains even after the Sonicwall client is removed.

Build 1803

WARNING: You should uninstall the Cisco VPN client prior to running this upgrade so repairing it afterward will make it much easier. All of the steps above still work on this latest build 1803 (OS Build 17134.1). No other edits required to keep it running.

Build 1709 Fall Creator's Update

WARNING: You should uninstall the Cisco VPN client prior to running this upgrade so repairing it afterward will make it much easier. All of the steps above still work on this latest "Fall Creator's Update" upgrade of Windows 10.

Build 1703 Creator's Update EDIT: Updated 04/11/2017

WARNING: You should uninstall the Cisco VPN client prior to running this upgrade so repairing it afterward will make it much easier. All of the steps above still work on this latest "Creator's Build" upgrade of Windows 10.

Now for the not-so-fun-details. I didn't uninstall prior to the upgrade and proceeded to spend the next 30 minutes clearing out registry entries until I finally found the right one to let me reinstall the product using the .MSI file. After doing that, and making the registry edit, my VPN client is again working properly.

Version 1607 Build 14393.10 EDIT: Updated 08/03/2016

All of the steps above still work on this latest "Anniversary" build of Windows 10. As with the 1511 build mentioned below, you will have to run a repair on the program or just do a clean install to get it working because Microsoft yet again determined that they would control which program we use.

You can go HERE to download the latest version of the media downloader and get version 1607.

And not to be left out HERE is a link to all of the new features in 1607 for IT pros.

As I update my Windows 10 machines I'll post updates if there are any issues or errors I run across with this build. As I always say.... good luck.

BUILD 1511 EDIT: Updated 1/20/2016

I'm getting a lot of feedback about networking being broken after 1511. I would highly advise you remove the Cisco VPN client and Sonic Global client software prior to installing build 1511.

I have now upgraded three different systems to 1511. By removing both the Sonicwall and Cisco VPN software first, I had zero issues with it working properly afterward.

However, if the upgrade went through already, here's what you can do to help mitigate these issues. There's no guarantee this is going to work but I have had two instances where the Cisco VPN software was removed by the 1511 upgrade and I was able to get it working by following the next steps below:

First just reinstall the VPN client using the .MSI file and not the .EXE file. This will bypass Windows 10 checking the compatibility as I listed at the top. Next just make the registry edits again and you'll be good to go. After the registry edits, I have not had to restart but you can if you feel the need just to be sure.

If this does not work as an extra effort you will need to reset all networking on Windows 10. Luckily this is pretty easy to do.

- Open an administrator command prompt
- Run "netcfg -d"
- Reboot and reconfigure your networking as needed.

Here's a sample of the output you will see:

Microsoft Windows [Version 10.0.10586]
(c) 2016 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32\netcfg -d
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
SetupDiCallClassInstaller Erorr: 0x6
NetSetup object deleted successfully on MUX
Successfully commited changes to the registry
Successfully commited changes to the registry
We are going to reboot now to complete the clean up. Save all of your work.

Press any key to continue…

I hope this helps out with the additional headaches caused by 1511. As always if I find any more useful information with future updates to Windows 10 that affect this software, I'll be sure to update the post.

Good luck!

[SOLVED] How to Resolve Error 8614

2017-03-10T15:39:00.000-05:00

I ran into this issue with two Domain Controllers that would not replicate. DC2 was getting this error: "The Active Directory cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime"

Below are the steps I went through in order to remedy this situation and worked like a charm.

1. Verify which Domain Controller raised the 8614 error by using:

> repadmin /showrepl
or
> repadmin /showreps

* Run this command line in any DC not DC-A.

* In addition, open Event Viewer, in Applications and Services Logs, Directory Service, you will see an error with event ID 2042

According to Mirosoft knowledge base, it's maybe because the domain controller contains what so called lingering objects: http://support.microsoft.com/kb/2020053. This is the most possible reason for the error, because everything else are OK (time, default tombstone lifetime).

2. So, I have to remove those lingering objects from all DCs:

> repadmin /removelingeringobjects DC-A.MYDOMAIN.COM 5b0b944e-de7b-4f96-942b-1e040169db36 "CN=Configuration,DC=MYDOMAIN,DC=COM"

+ DC-A.MYDOMAIN.COM : FQDN of DC-A

+ 5b0b944e-de7b-4f96-942b-1e040169db36 : the GUID of DC-A. You can get it from the command repadmin /showrepl DC-A.

+ "CN=Configuration,DC=MYDOMAIN,DC=COM": NC in which DC-A raise the error (from the output of the command repadmin /showrepl)

* Repeat in all other DCs in forest.

3. Evaluate setting strict replication on all DCs in forest:

> repadmin /regkey * +strict

4. Set "Allow replication with divergent and corrupt partner = 1" on all DCs:

> repadmin /regkey * +allowDivergent

5. Flush DNS Cache and restart netlogon service in DC-A:

+ > ipconfig /flushdns

+ > net stop netlogon

+ rename netlogon.dns and netlogon.dnb file which locate in C:\Windows\System32\

+ > ipconfig /flushdns

+ > net start netlogon (this command will re-create netlogon.dns and netlogon.dnb files)

+ > ipconfig /registerdns

6. Check the replication of all DCs again using repadmin and Event Viewer

> repadmin /showrepl

7. Delete "Allow replication with divergent and corrupt partner" or set "Allow replication with divergent and corrupt partner = 0" in the registry of all DCs.

> repadmin /regkey * -allowDivergent

8. Check the replication of all DCs again using repadmin and Event Viewer

If you performed everything correctly, the Domain Controllers will now replicate successfully.