Iwan Kurniawan - IT Admin - Tips & Trick

WSUS 2012 R2 problem

2020-12-17T09:18:00.096+07:00

Symptoms:

WSUS fails direct import from MS Update Catalog

(Error 80131509)

Cause:

The Active-X plugin or any other subsequent component involved in importing updates from the Microsoft update catalog utilizes .NET4 need enforce "strong" ciphers for .NET 4.0:

Solution:

Add registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\

Name: SchUseStrongCrypto

Type: DWORD

Value: 1

Restart

Symptoms:

Event ID 31 Windows Update failed to download an update (.msu)

Cause:

Missing mime-type on the IIS server

Solution:

- Open IIS

- Expand Sites > WSUS Administrator

- Double click mime-type icon from right

- Add new mime-type

File Name extension: .msu

mime-type: application/octet-stream

Restart WSUS

Symptpms:

Import Out of Band Updates to WSUS using Microsoft Edge error "This update cannot be imported into Windows Server Update Services, because it is not compatible with your version of WSUS"

Cause:

Solution:

- Open Microsoft Edge Options > Default Browser

- Internet Explorer (mode) is installed in Settings > Apps > Optional Features

- Change "Allow Sites to be reloaded in Internet Explorer Mode" to 'Allow'

- Add links to add to Microsoft Edge IE Mode

- Remove all other links in the scope of *.catalog.update.microsoft.com, and leave

https://catalog.update.microsoft.com/

https://catalog.update.microsoft.com/v7/site/Home.aspx

Other things:

If the "Default" setting will not be sufficient to allow the installation and use of the ActiveX plugin.

Go back to your update catalog tab, Install the ActiveX if you have not done on this box already.

Check if you have not setup restrictions to execute or install ActiveX plugins in IE directly or via group policy.

The boot configuration data for your PC is missing: EFI\Microsoft\Boot\BCD

2020-11-18T16:38:00.004+07:00

Symptoms:

The boot configuration data for your PC is missing or contains errors.

File :\EFI\Microsoft\Boot\BCD

Error code: 0xc000000f

Cause:

Windows bootloader configuration – Boot Configuration Data (BCD) has been corrupted or even completely removed

Solution (Manually):

diskpart

list disk

sel disk 0

list volume

find volume without drive letter, FAT32. sample 3

sel vol 3

you may need

for EFI

set id=c12a7328-f81f-11d2-ba4b-00a0c93ec93b

Or for Basic data

SET ID=ebd0a0a2-b9e5-4433-87c0-68b6b72699c7

choose unused drive letter

assign letter K:

exit

cd /d K:\EFI\Microfsoft\Boot\

attrib BCD -s -h -r

ren BCD BCD.bak

bcdboot C:\Windows /l en-us /s k: /f ALL

test using bcdedit

SCF Windows Resource Protection Could not Perform the Requested Operation

2020-11-16T08:55:00.001+07:00

Solution one of:

1 Scan disk

CHKDSK C: /r

2. Modify security descriptor

ICACLS C:\Windows\winsxs

3. Reinstall

DNS server loses all interfaces

2019-03-19T10:16:00.000+07:00

Symptoms:

Cause:
Possibly by multi-homed network card

Solution:
dnscmd servername /ResetListenAddresses

Outlook: IMAP - The account name is already being used. Choose another name whwn channging account option

2018-08-01T13:44:00.000+07:00

Symptoms:
Changing Outlook IMAP account / reconfigure or enabling "Purge deleted messages when leaving IMAP folders" failed with

"The account name is already being used. Choose another name"

Cause:
Corrupt Outlook Profile

Solution:
Recreate Outlook Profile

Note:
There is quick way to enable "Purge deleted messages when leaving IMAP folders" using regedit (may applicable for other option) without recreate profile

HKEY_CURRENT_USER/Software\Microsoft\Windows NT\Current Version\Windows Messaging Subsystem\Profiles\Outlook\9375cff0413111d3B88A00104B2A6676 (may be different, find with multiple subkeys).

In every subkey check by double clicking "Account Name" to get readable account

create/set DWord key EnablePurgeOnSwitch value = 1

Mikrotik RB750GL failed to create backup

2018-07-31T13:34:00.000+07:00

Symptoms:
Mikrotik RB750GL Backup gave error
echo: backup,critical error creating backup file: could not read all configuration files

and small size of .backup file

Cause:

Solution:

[admin@MikroTik] >/ip ssh regenerate-host-key
This will regenerate current SSH host keys, yes? [y/N]:
y                                       -> go with Ctrl C
[admin@MikroTik] >                      -> wait...
13:12:28 echo: ssh,critical SSH host key regenerated!
[admin@MikroTik] > 

[admin@MikroTik] >/system reboot         -> if needed

Microsoft Management Console: "An attempt was made to reference a token that does not exist"

2017-09-25T13:51:00.001+07:00

Symptoms:
"An attempt was made to reference a token that does not exist" when open Administrative Tools

Cause:
Broken Link or corrupt file

Solution:
Run a Command Prompt in ELEVATED MODE

Navigate to %WINDIR%\System32

Re-register the required DLL files using the following command:

For /F %s in ('dir /b *.dll') do regsvr32 /s %s

Piped logging program to rotate Apache logs

2017-01-13T18:35:00.001+07:00

This creates the files logs\access_yyyy_mm_dd.log where yyyy is the year, mm is the month, and dd is the day of the month. Logging will switch to a new file every day at midnight, local time for xampp in windows.

Solution:
Changed in xampp\apache\conf\httpd.conf

CustomLog "|bin/rotatelogs.exe -l logs/access_%Y_%m_%d.log 86400" common

option used
-l Causes the use of local time rather than GMT as the base for the interval or for strftime(3) formatting with size-based rotation.
%Y 4-digit year
%m 2-digit month
%d 2-digit day of month
rotationtime The time between log file rotations in seconds.

Reference: http://httpd.apache.org/docs/current/programs/rotatelogs.html

Synchronize Windows Server 2008 (R2) PDC time with external NTP server

2016-11-22T17:03:00.004+07:00

PDC need to synchronize to reliable external time source and other member need to synchronize to this PDC only.

For PDC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags
DWORD Value, type 5

net stop w32time

w32tm /config /syncfromflags:manual /manualpeerlist:"0.pool.ntp.org,0x1 1.pool.ntp.org,0x1 2.pool.ntp.org,0x1” /reliable:yes /update

w32tm /resync /rediscover

net start w32time

you can check result from:
- Event Viewer
- w32tm /stripchart /computer:id.pool.ntp.org /samples:2 /dataonly
error: 0x800705B4 means timeout or no access to NTP server
- w32tm /query /configuration and look for NTP server value
- HKLM\System\CurrentControlSet\services\W32Time\Parameters NTPServer value

to reset back to default
net stop w32time
w32tm /unregister
w32tm /register
net start w32time

For other DC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\AnnounceFlags

DWORD Value, type A

net stop w32time

w32tm /config /syncfromflags:DOMHIER /update

w32tm /resync /nowait /rediscover

net start w32time

Migrating 2003 AD to 2008 R2 (Part 1)

2016-11-01T09:00:00.000+07:00

Force promote DC2 as PDC when DC1 who hold FSMO roles no longer exist

Symptoms:
Want to migrate DC from Windows 2003 server to Windows 2008 R2 server. But DC1 who hold PDC no longer exist.

Solution:
Force moving FSMO to DC2 using ntsdutil

ntdsutil
roles
connections
connect to server DC2
quit
seize PDC
seize schema master
seize RID master
seize infrastructure master
seize domain naming master
quit

Remove DC1 from AD using ntdsutil

ntdsutil
metadata cleanup
connections
connect to server DC2
quit
select operation target
list domains
select domain 0
list sites
select site 0
list servers in site
select server DC1
quit
remove selected server
Confirm by click YES in message box (make sure removing DC1 server)

Remove any trails of DC1 record in:

Active Directory Sites and Services

remove from server object

Active Directory Users and Computers

remove from server object

remove all DC1 ip records
remove from replicate

Configuring IBM IMM IP from Windows Command Prompt

2016-05-17T10:53:00.000+07:00

To change IP of IMM using Advanced Settings Utility from IBM

asu64.exe set imm.hostipaddress1 192.168.xxx.xxx

asu64.exe set imm.hostipsubnet1 255.255.255.0

asu64.exe set imm.gatewayipaddress1 192.168.xxx.1

asu64.exe set imm.dhcp1 disabled

asu64.exe set rebootimm

Windows Server 2003 Error event 8194 with error code 0x8007000d

2015-02-23T21:27:00.007+07:00

Symptoms:

8194 Group Policy Files NT AUTHORITY\SYSTEM nodename The client-side extension could not remove computer policy settings for ' { }' because it failed with error code '0x8007000d The data is invalid.'

1085 Userenv NT AUTHORITY\SYSTEM nodename. The Group Policy client-side extension Group Policy Files failed to execute. Please look for any errors reported earlier by that extension.

Cause:

Error event 8194 with error code 0x8007000d is usually caused by a corrupt file in the server’s group policy cache and/or by corruption of Group Policy\History registry hive

Solution:

Clear the Global Policy cache and delete the registry hive on the Windows 2003 server that is exhibiting the problem and get the cache/registry repopulated as per the following:

Open Windows Explorer.
Save the contents of folder %ALLUSERSPROFILE%\Application Data\Microsoft\Group Policy\History to another location.
Delete all files and folders in the History folder.
Delete the following registry hives:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
Open Command Prompt and type gpupdate/force .

Setting the Refresh Rate for Connectivity Verifiers ISA Server 2006

2013-10-22T14:14:00.000+07:00

By default, connectivity verifiers that are enabled test connectivity every 30 seconds. This time can be changed to any value in the range from 15 through 1,440 seconds by setting the RefreshRate property of the FPCConnectivityVerifiers collection. The value of this property applies to all ISA Server computers in an array.

Using Registry:
- Browse To: HKLM\IsaStg_Eff1\Arrays\{D76B4872-115F-49FA-9136-610335ED7F8E}\ConnectivityVerifiers
- Change msFPCRefreshRate value (in dword) as needed

Using Script:
http://technet.microsoft.com/library/cc302480.aspx

You may use sets of Connectivity Verifiers to help you monitoring device such as: AP, WAN, Internal Router especially if combine with email alert triggering.

Export and Import a readable DHCP scope

2013-05-12T12:12:00.001+07:00

Export:

Readable:

netsh dhcp server \\SERVERNAME dump all > filename.txt

Unreadable:

netsh dhcp server \\SERVERNAME export d:\filename all

Full Export with policies (2012) using PS with Administrator Rights

Export-DhcpServer -ComputerName SERVERNAME -File "D:\filename.xml" -Force

Import:

Full Import with policies (2012) using PS with Administrator Rights

Import DhcpServer -ComputerName SERVERNAME -File "D:\filename.xml" -Force

for New 2003 server format

netsh exec filename.txt

for 2000 server format

netsh dhcp server import filename.txt all

Authorize:

1. Activate

2. Authorized from currently authorized DHCP server

The HTTP Filter DLL php5isapi.dll failed to load

2013-03-05T14:23:00.002+07:00

Symptoms:

- In the ISAPI filters of IIS, the php5isapi.dll with set the filter to "PHP" show red arrow pointing down and for priority it says *unknown*

- In event viewer under application shown these two errors.

"Could not load all ISAPI filters for site/service. Therefore startup aborted."

"The HTTP Filter DLL C:\php\php5isapi.dll failed to load. The data is the error."

Cause:
IIS user account doesn't have sufficient permissions to the php files & folders

Solution:
Add IUSR_computername account permission for all the php files and directories

Note:
You need to restart PHP on IIS to reload

How to enable PHP short tags?

2013-02-22T10:30:00.000+07:00

Need <? instead of <?php

Set in php.ini

short_open_tag=On

Or

Set in .htaccess

php_value short_open_tag 1

You need to restart PHP to reload

Exchange 2007, increasing e-mail rule limit

2011-12-27T17:20:00.001+07:00

Exchange 2007 rule sizes by default is set to 64kb (rather than 32kb for Exchange 2003).
You may change this using Exchange 2007 Management Shell (PowerShell) to max 256kb

To check setting on specific account: (to display RulesQuota : xxKB)
get-mailbox userlogin | fl rulesquota

To change setting to 256kb for specific account:
set-mailbox userlogin -rulesquota 256kb

To change setting to 256kb for all account:
get-mailbox | set-mailbox -rulesquota 256kb

VPN to remote network on same subnet as local network

2011-12-20T16:47:00.001+07:00

Symptoms:
You need to connect using VPN connection to remote client site and realize that you both using same IP subnet. You connect fine but can't access any resources on the remote subnet. Some people may suggest you to change one of the subnet, but you can't do that because both of subnet are office environment.

Cause:
It's network and route thing. Your PC think the remote IP is locally.

Solution:
You need to manually add routing for remote IP at your PC. You can do that using command ROUTE.
1. Connect to VPN site.

2. From command prompt run ROUTE PRINT to show status. In my case:

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 11 09 26 33 75 ...... VIA Rhine II Fast Ethernet Adapter - Packet Scheduler Miniport
0x60004 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.10.10.1 10.10.10.9 21
0.0.0.0 0.0.0.0 10.10.10.79 10.10.10.79 1
10.10.8.0 255.255.252.0 10.10.10.9 10.10.10.9 20
10.10.10.9 255.255.255.255 127.0.0.1 127.0.0.1 20
10.10.10.79 255.255.255.255 127.0.0.1 127.0.0.1 50
10.255.255.255 255.255.255.255 10.10.10.9 10.10.10.9 20
10.255.255.255 255.255.255.255 10.10.10.79 10.10.10.79 50
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
2xx.2xx.2xx.2xx 255.255.255.255 10.10.10.1 10.10.10.9 20
224.0.0.0 240.0.0.0 10.10.10.9 10.10.10.9 20
224.0.0.0 240.0.0.0 10.10.10.79 10.10.10.79 1
255.255.255.255 255.255.255.255 10.10.10.9 10.10.10.9 1
255.255.255.255 255.255.255.255 10.10.10.79 10.10.10.79 1
Default Gateway: 10.10.10.79
===========================================================================
Persistent Routes:
None

3. From here, we get information:

- 10.10.10.9 my current IP

- 10.10.10.79 my assigned VPN IP

- 0x60004 my VPN interface

- 2xx.2xx.2xx.2xx I need to hide my client public IP

4. To manually add route run:

ROUTE ADD <TargetIP> MASK <Mask> <GatewayIP> METRIC <Metric> IF <InterfaceID>

so for my case if I want to add route to single IP 10.10.10.18 on remote site:

ROUTE ADD 10.10.10.18 MASK 255.255.255.255 10.10.10.79 METRIC 1 IF 0x6004

5. Run ROUTE PRINT again to make sure the new route listed

===========================================================================

Interface List

0x1 ........................... MS TCP Loopback interface

0x2 ...00 11 09 26 33 75 ...... VIA Rhine II Fast Ethernet Adapter - Packet Scheduler Miniport

0x60004 ...00 53 45 00 00 00 ...... WAN (PPP/SLIP) Interface

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 10.10.10.1 10.10.10.9 21

0.0.0.0 0.0.0.0 10.10.10.79 10.10.10.79 1

10.10.8.0 255.255.252.0 10.10.10.9 10.10.10.9 20

10.10.10.9 255.255.255.255 127.0.0.1 127.0.0.1 20

10.10.10.18 255.255.255.255 10.10.10.79 10.10.10.79 1

10.10.10.79 255.255.255.255 127.0.0.1 127.0.0.1 50

10.255.255.255 255.255.255.255 10.10.10.9 10.10.10.9 20

10.255.255.255 255.255.255.255 10.10.10.79 10.10.10.79 50

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

2xx.2xx.2xx.2xx 255.255.255.255 10.10.10.1 10.10.10.9 20

224.0.0.0 240.0.0.0 10.10.10.9 10.10.10.9 20

224.0.0.0 240.0.0.0 10.10.10.79 10.10.10.79 1

255.255.255.255 255.255.255.255 10.10.10.9 10.10.10.9 1

255.255.255.255 255.255.255.255 10.10.10.79 10.10.10.79 1

Default Gateway: 10.10.10.79

===========================================================================

Persistent Routes:

None

Or You can use Portable GUI Application NetRouteView from nirsoft.net to show and manipulating your windows routing table.

Find Old Network Card not show under Device Manager

2011-12-15T09:52:00.004+07:00

Symptoms:

Popup error while setting IP

The IP address XXX.XXX.XXX.XXX you have entered for this network adapter is already assigned to another adapter Name of adapter. Name of adapter is hidden from the network and Dial-up Connections folder because it is not physically in the computer or is a legacy adapter that is not working. If the same address is assigned to both adapters and they become active, only one of them will use this address. This may result in incorrect system configuration. Do you want to enter a different IP address for this adapter in the list of IP addresses in the advanced dialog box?

But cannot find this old hidden device to remove even you already enabled show hidden device in Device Manager

Cause:

Show hidden devices option in the Device Manager (View > Show hidden devices) does not always show the old NIC (ghosted adapter) to which that IP Address is assigned.

Solution:

From cmd prompt:

set devmgr_show_nonpresent_devices=1

After that make sure in Device Manager:

View > Show Hidden Device Checked

Should show dimmed network adapter under network manager group.

Note:

For Some old OS, you may doing by add System Variable:

- In the System variables section, click New.

- Set the Variable name to devmgr_show_nonpresent_devices and set the Variable value to 1 to enable the parameter

FTP command line problem from Windows Server 2008 R2

2011-12-09T15:55:00.001+07:00

Symptoms:

Using FTP.exe server command prompt will allow you to connect out to an FTP site, but no response from ls or get commands

Cause:

Windows Server 2008 R2 has a strict firewall by default

Solution:

1. Go to: Administrative Tools > Server Manager > Configuration > Windows Firewall with Advanced Security

2. Right click on Windows Firewall with Advanced Security on Local Computer to pop-up Windows Firewall Properties

3. On the Domain Profile tab, settings, click customize

4. Change Display a notification to yes

5. Click ok twice for changes to take effect

For now, at first you run ftp.exe and login, Windows security Alert will pop-up. You check Domain Networks and click Allow Access

Opening Port for FTP and SQL

2011-12-09T15:15:00.000+07:00

FTP: 21
sometimes need to open incoming port 20

SQL: 1433

SYSVOL and NETLOGON location

2011-12-06T16:39:00.001+07:00

SYSVOL and NETLOGON are the shared from \\DOMAIN.NAME

Share name     SYSVOL
Path              C:\WINDOWS\sysvol\sysvol
Remark            Logon server share
Maximum users     No limit
Users
Caching           Manual caching of documents
Permission        Everyone, READ
                  BUILTIN\Administrators, FULL
                  BUILTIN\Authenticated Users, FULL

Share name        NETLOGON
Path              C:\WINDOWS\sysvol\sysvol\DOMAIN.NAME\SCRIPTS
Remark            Logon server share
Maximum users     No limit
Users
Caching           Manual caching of documents
Permission        Everyone, READ
                  BUILTIN\Administrators, FULL

fSMORoleOwner location on ADSIedit

2011-12-06T14:23:00.001+07:00

- Domain []
   -- DC (properties)

- Domain []
   -- DC
       --- CN=Infrastructure (properties)

- Schema []
   -- CN=Schema (properties)

- Configuration []
   -- CN=Partitions (properties)

Ncomputing over windows 2003 server problem and solution

2011-12-02T15:38:00.001+07:00

Symptom

Error “Server yet not ready, try again a bit later” an error where the hpvcard.dll failed to initialize.

Solution 1

Add the following key to the host:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
“SessionImageSize”=dword:00000020

Solution 2

Remove Security Update KB956572 also remove update KB958690

Symptom

Error "to log on to this remote computer, you must be granted the Allow log on through Terminal Services right. By default, members of the Remote Desktop Users group have this right. If you are not a memeber of the Remote Desktop Users group or another group that has this right , or if the Remote Desktop Users group doesn not have this right, you must be granted this right manually"

Solution 1

Add user to Remote Desktop User Group

Solution 2

Configure the security setting in Default Domain Controller Policy GPO:

1. Run gpmc.msc to open the Group Policy Management console.
2.    Expand Domain Controllers, right-click Default Domain Controller Policy, and click Edit.
3.    In the Group Policy Management Editor window, expand Computer Configuration\Windows Settings\Security Settings\Local Policies\User Right Assignment\Allow log on locally
4. Add User or Group and click OK three times to apply the settings.
5.    Run gpupdate /force to apply the policy.

Renewing the self-signed certificate Exchange Server 2007:

2011-10-14T15:57:00.002+07:00

Exchange Server 2007 need to renewal a self-signed certificate for use with services like SMTP,IMAP, POP, IIS and Um every one year.

1. Find out your exchange certificate thumbprint with full information and services list
Get-ExchangeCertificate -domain “yourdomain.com” | fl

2. Get a new certificate with a new expiration date and an exportable private key:
Get-ExchangeCertificate -thumbprint “your_old_thumb_print” | New-ExchangeCertificate -PrivateKeyExportable $true

3. Type Y to continue creation of certificate. It'll show new thumbprint

4. Check services of new certificate:
Get-ExchangeCertificate -thumbprint “your_new_thumb_print” |fs

5. To add required/missing services:
Enable-ExchangeCertificate -thumbprint “your_new_thumb_print” -services IIS

6. To remove invalidates/expired certificate
Remove-ExchangeCertificate -thumbprint “your_old_thumb_print”

You need to Publish them to ISA for WebMail user
1. Using MMC from your mailserver
2. Add/Remove Snap-in > Add > Certificates > Local
3. Under Personal/Certificates, Select Your New Certificate
4. Right Click > All Tasks > Export > Next
5. Select Yes to export the private key
6. Provide password and check required option
7. It generated PFX file
8. Generated CER and/or P7B if required
9. Import to Trust
10. Under Trust/Certificate Right Click > All Tasks > Import > Next
11. Chose the CER file
12. Same Snap-in for your ISA server
13. Right Click > All Tasks > Import > Next
14. Chose the PFX file
15. Import to trust
16. Open ISA Server Management
17. ISAServer > Firewall Policy > Webmail
18. Double click Mail Listener
19. From Certificate tab, Select Certificate
20. Select your new and active certificate then Apply