Luka's tech blog

How to enable strict replication consistency in AD

2014-09-19T12:35:00.002+02:00

I know it's one from the past, but today I just couldn't found instructions quick enough. So I decided to write instructions by my own and poste them.

There are few ways (links are at the bottom of this page) how to enable strict replication consistency in AD but this one will solve this issue permanently :)

How can we do that you're thinking. By using Group Policy (GPO) of course :)

And how do we do that? Well, here you have it.

Step 01: Open Group Policy Management console

Step 02: Create new Group Policy for Domain Controllers OU

Step 03: Give name to new Group Policy (for example EnableStrictReplicationConsistency)

Step 04: Edit new Group policy

Step 05: Browse to Computer Configuration - Preferences - Windows Settings and right click on Registry. Select New - Registry Item

Step 06: Under Key path browse to registry path HKEY_LOCAL_MACHINE\SYSTEM\Current Control Set\Services\NTDS\Parameters and click Select

Step 07: Under Value Name type "Strict replication consistency". Under Value Type select REG_DWORD and under Value Data enter 1 (select Base decimal). Confirm new settings by clicking on OK button

Step 08: Stop editing new Group Policy by closing Group Policy Management Editor window

Step 09: Force applying group policies by typing "gpupdate /force" in Command Prompt

Step 10: Open registry editor and check that new registry key (Strict replication consistency) was created under HKEY_LOCAL_MACHINE\SYSTEM\Current Control Set\Services\NTDS\Parameters with value 1.

So from now on all of your DC's will have strict replication consistency setting enabled :)

Few links to help you understand and configure this setting:
- Enable Strict Replication Consistency
- AD DS: Strict replication consistency should be enabled on all domain controllers in this forest
- Event ID 1388 or 1988: A lingering object is detected
- Fixing Replication Lingering Object Problems (Event IDs 1388, 1988, 2042)

This is it for today and have fun!

DirectAccess asking for proxy credentials

2013-04-05T11:04:00.002+02:00

I just love DirectAccess. It enables me to connect to my company network from any location and any internet provider.

But lately, since I started using Windows 8, I encountered a problem. If there was no problem then I wouldn't be writing this, would I ;)

The problem is related to proxy servers. Whenever I go to the place, where I need to enter proxy server to get access to the internet and then later remove this proxy, DirectAccess client starts to prompt me to enter proxy credentials!? The final result of this problem is that I can't connect to my company’s network using DirectAccess.

So I started digging and found this workaround. I tested it on my notebook and it worked. I cannot guaranty that this solution is universal and that it will work for all. I also can’t guarantee that by doing this we don’t “brake” something else. This is my finding, I don't say it's correct one but it makes my DirectAccess work again?

I found registry key under which few latest proxy addresses are stored:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\ProxyMgr

And now my solution:
- Export registry key ProxyMgr in case we need it later (link: How to export registry key).
- Remove (delete) all registry keys under registry key ProxyMgr (see on the picture below).

- All I needed to do next was to restart the computer and my DirectAccess started working again.

This is it for today and have fun!

Internal URL's instead of IE Searches

2013-01-24T10:09:00.003+01:00

A day or two ago I tried to reach our company's internal web site using short name in Internet Explorer 10 and was constantly diverted to my favorite search engine site.

By short name I mean that I entered InternalWebSiteName (without http:// in-front of it) in the address bar like shown in example below.

After entering InternalWebSiteName, I hit enter and was always diverted to my favorite search engine search results :(

Now here are two tips how to avoid this and reach internal web sites by it's short names. Quick and easy :)

Tip 1:
Enable setting in IE. Setting is hidden under:
IE \ Tools \ Internet Options \ Advanced.
Enable 'Go to an intranet site for a single word entry in the Address bar'.

Tip 2:
Just type a forward slash '/' after the InternalWebSiteName. That will send it out as an URL.

This is it for today and it's so easy.

Have fun!

Active Directory Delegation

2012-10-12T14:18:00.000+02:00

It's been a while since my last post and now is time to add new one :)

Today I was at the customer with a task to delegate some Active Directory permissions for Help Desk users.

My task was to create a "script" for:
- Delegate Unlock user account.
- Delegate Reset password to user account.
- Delegate Move computer account from default folder to designated OU.
- Delegate Add or remove users from security or distribution group.
- Delegate Change some of user object attributes (Telephone number, Mobile phone number, Office, Department, ...).

Of course you can do all of this with GUI but we're a bit lazy, we don't want to click a lot and the most important reason we sure want to look smart, so that's why we use command line.

If you still decide to use GUI you'll probably need to edit DSSEC.DAT (under Users add pwdLastSet=0), to display some attributes.

For this task I used command dsacls.exe, and here you can find more about it.

We also used two security groups approach. Resource security group (Change password, Unlock user account, ...) and Users security group (Help Desk). At the end we added Users security group into all Resource security groups. With this we achieved that members of Users security group are able to do all the necessary tasks regarding users and computers management.

So let's get to business :)

To delegate password reset and unlock user you can use this command lines:

dsacls ou=ou_name,dc=domain,dc=com /i:s /g domain\SecGroupName:ca;reset password;user

dsacls ou=ou_name,dc=domain,dc=com /i:s /g domain\SecGroupName:rpwp;pwdlastset;user

dsacls ou=ou_name,dc=domain,dc=com /i:s /g domain\SecGroupName:rpwp;lockouttime;user

Explanation:
"ou=ou_name,dc=domain,dc=com" is OU where users are located
"domain\SecGroupName" is Resource security group to which we delegate permissions

To delegate add/remove group membership you can use this command lines:

dsacls ou=ou_name,dc=domain,dc=com /i:s /g domain\SecGroupNam:rpwp;member;group

Explanation:
"ou=ou_name,dc=domain,dc=com" is OU where groups are located
"domain\SecGroupName" is Resource security group to which we delegate permissions

To delegate moving computers between OU's you can use this command lines:

dsacls ou=ou_name,dc=domain,dc=com /i:t /g domain\SecGroupName:cc;computer;

dsacls cn=computers,dc=domain,dc=com /g domain\SecGroupName:dc;computer;

dsacls cn=computers,dc=domain,dc=com /i:s /g domain\SecGroupName:wp;;computer

Explanation:
"ou=ou_name,dc=domain,dc=com" is OU to where you want to move computers
"cn=computers,dc=domain,dc=com" is folder from where you want to move computers
"domain\SecGroupName" is Resource security group to which we delegate permissions

To delegate changing user attributes you can use this command lines:

dsacls ou=ou_name,dc=domain,dc=com /i:s /g domain\SecGroupName:rpwp;telephonenumber;user

dsacls ou=ou_name,dc=domain,dc=com /i:s /g domain\SecGroupName:rpwp;company;user

dsacls ou=ou_name,dc=domain,dc=com /i:s /g domain\SecGroupName:rpwp;mobile;user

dsacls ou=ou_name,dc=domain,dc=com /i:s /g domain\SecGroupName:rpwp;physicaldeliveryofficename;user

dsacls ou=ou_name,dc=domain,dc=com /i:s /g domain\SecGroupName:rpwp;roomnumber;user

Explanation:
"ou=ou_name,dc=domain,dc=com" is OU to where users are located
"domain\SecGroupName" is Resource security group to which we delegate permissions

There are at least two approaches that can be used in bigger productions instead using command lines below. First is to use Excel (concatenate) and the second is to use batch scripts like in the sample below.

In this sample we'll delegate add/remove group membership with a batch script.

1. Create Delegate-AdRights.bat
2. Edit Delegate-AdRights.bat and copy paste code below into it.

dsacls %1 /i:s /g %2:rpwp;member;group

3. Run batch file in command prompt with additional variables as shown below

Delegate-AdRights.bat ou=ou_name,dc=domain,dc=com domain\SecGroupName

Explanation:
"ou=ou_name,dc=domain,dc=com" is OU where users are located
"domain\SecGroupName" is Resource security group to which we delegate permissions

This is it for today. Have fun!

Extended Windows Volume

2012-04-19T11:55:00.001+02:00

Extending Volume on virtualized Windows server is so easy this days. You just go to your virtual host server and extend virtual disk. After this is done login to your Windows server and open Disk Management then right-click Disk Management and select Refresh.

After this you'll see some Unallocated space.

Now right-click on Volume that you want to extend (in-front of unallocated space) and select Extend Volume ...

Extend Volume Wizard opens and by clicking Next you'll arrive to the part where you need to specify for how much you'll extend selected Volume. In my case I'll use all available space.

Click Next and Finish. After this your Volume will be extended and you'll have additional space on your server that you can use :)

But it's not always that easy. Sometimes can happen that you'll get an error: "The parameter is incorrect."

After that Disk Management shows different size of extended disk as if you check disk properties.

Solution for this problem is simple. Open Command Line (CMD) as Administrator and type DISKPART.

Diskpart
List Volume
Select Volume # (this is the number of the volume listed by the above ‘List Volume’ command)
Extend Filesystem
Exit

All good and now you can recheck disk properties for just in case.

Disk properties also show that disk was successfully extended :)

Few useful links:
http://support.microsoft.com/kb/325590
http://www.jonathanmedd.net/2010/10/windows-server-2008-extend-system-volume-error-the-parameter-is-incorrect.html

This is it for today. Have fun!

Blocking P2P programs with Group Policy

2012-03-02T09:31:00.003+01:00

Some time ago I needed to block as many as possible torrent and other P2P clients with Windows Group Policy. To do this I needed to find as many as possible names of torrent clients executables and prepare a list. The result of all this is this list:

ABC.exe
Ares.exe
Azerues.exe
BitComet.exe
BitLord.exe
BitThief.exe
BitTornado.exe
BitTorrent.exe
Btdownloadgui.exe
Deluge.exe
Emule.exe
Fdm.exe
FlashGet.exe
Giftl.exe
Imesh.exe
KGet.exe
KTorrent.exe
LimeWire.exe
Mediaget.exe
Miro.exe
MLDonkey.exe
Mp3rocket.exe
Msohtmed.exe
µTorrent.exe
Utorrent-2-0-beta.exe
Utorrentportable.exe
OneSwarm.exe
Opera.exe
qBittorrent.exe
Shareaza.exe
Tonido.exe
Swapper.exe
Tribler.exe
Vuze.exe
Wyzo.exe

I hope you'll find this list useful and I'd also like to invite all of you to post me names of the executables that I missed. This way we'll keep this list up-to-date :)

Here are two articles that describe how to block applications with Windows Group Policy:
http://www.technipages.com/prevent-users-from-running-certain-programs.html
http://www.windowsnetworking.com/articles_tutorials/Software-Restriction-Policies.html

This is it for today. Have fun!

Remove Receive Connector permissions

2011-12-28T15:48:00.000+01:00

Few days ago I started playing with permissions on our Exchange 2010 Receive Connector. I wanted to achieve that one of my service accounts users could send emails. During this testing I added all sorts of permissions to this Receive Connector. After I finished testing I wanted to get rid of all permissions I gave to this user. And how did I do it?

First I wanted to see all permissions that I gave to this user:

Get-ReceiveConnector "Server\Full Connector Name" | Get-ADPermission -User "Domain\Username" |? {$_.extendedrights} | select identity,user,extendedrights | Format-List

Second I got rid of all permissions that I got from previous command:

Get-ReceiveConnector "Server\Full Connector Name" | Remove-ADPermission -User "Domain\Username" -ExtendedRights ms-Exch-SMTP-Accept-Any-Recipient,ms-Exch-SMTP-Accept-Authoritative-Domain-Sender,ms-Exch-Accept-Headers-Routing,ms-Exch-SMTP-Accept-Any-Sender

At the end I run first command set again just to check if I really got rid of everything.

I hope this will help you clean up your Exchange server as it helped me.

This is it for this year. Have fun!

Change Internet Explorer default save location

2011-10-17T22:23:00.002+02:00

I’m sure some of you are interested how to change default save location in Internet Explorer (IE) because I know I was as soon as I started using it.
Until now I found two ways how to do this.

1. Users friendly version:- Open Internet Explorer and press Ctrl+J (I love shortcuts don’t you) to open View Downloads window.

- At the lower left corner find Options and click it.

- Choose folder by clicking on Browse and selecting new default Save folder of your choice.

- Confirm changes by clicking OK few times.

2. Advanced users version:- Open Windows Registry Editor (regedit.exe)
- Browse to HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

- Find String “Default Download Directory” and Modify it.
- Enter new default Save folder location. For example: c:\temp
- Exit Windows Registry Editor

Now you can just press Save button in IE and items will be saved to new location without the need of selecting Save As all the time :)

This is it for today. Have fun!

Window7 SP1 and group policy exception for RDP on clients firewalls

2011-08-11T19:36:00.002+02:00

I’ve been struggling with annoying problem on one of my virtual test machines running Windows 7 SP1. One of them suddenly decided that I can’t log on to it using Remote Desktop Services (RDP).

I know that I created group policy (GPO) exception to allow Remote Desktop connections for all my PC’s from LAN and VPN. For configuring I used this link.

I also know that it worked just fine not long ago. So I checked it and it seemed OK.

Group policy for Remote Desktop exceptions:

Group policy exceptions:

I did some Googling and found similar problem which lead me to solution. It seems that the problem was in Windows 7 SP1.

And finally the recipe for solution:
Solution was that I just needed to open for editing GPO that controlled RDP on computer running Windows 7 SP1 or on Windows 2008 R2 server with SP1. After I did that and run “gpupdate /force” on problematic PC I could finally connect to it using RDP.

This is it for today. Have fun!

Backing up all MS SQL databases

2011-07-31T19:04:00.001+02:00

Today I got a task to backup all databases on our Microsoft SQL 2005 running on Windows 2008. The solution also needed to satisfy two conditions:
- must always backup all databases even if we add new one's
- must remove backup files older than 3 days

So I started Googling for solutions. At the end I combined different solutions into script below. This script can be used on Windows server 2003 and 2008 with MS SQL 2005 and 2008 with slight difference in one line:

SQL 2008:
sqlcmd -E -S "%ServerName%" -h-1 -W -Q "SET NoCount ON;SELECT NAME FROM sys.sysdatabases WHERE [Name] NOT IN ('master','model','msdb','tempdb')" > %DBList%

SQL 2005
sqlcmd -E -S "%ServerName%" -h-1 -W -Q "SET NoCount ON;SELECT NAME FROM master.dbo.sysDatabases WHERE [Name] NOT IN ('master','model','msdb','tempdb')" > %DBList%

And what this script does?
- Gets system date for later use in backup file names.
- Saves names of all databases in temporary file.
- Removes backup files older than 3 days.
- Backup each database, prepending the server name and date to the filename.
- Clean up the temp file.
Warning: Text marked as this should be customized according to your specifications!

***************************************************

REM @ECHO OFF
SETLOCAL

REM: get computer name ad write it into variable
set ServerName=%computername%

REM: Get System Date to be used for DB backup file namesSETLOCAL ENABLEEXTENSIONS
if "%date%A" LSS "A" (set toks=1-3) else (set toks=2-4)
for /f "tokens=2-4 delims=(-)" %%a in ('echo:^|date') do (
for /f "tokens=%toks% delims=.-/ " %%i in ('date/t') do (
set '%%a'=%%i
set '%%b'=%%j
set '%%c'=%%k))
if %'yy'% LSS 100 set 'yy'=20%'yy'%
set Today=%'yy'%-%'mm'%-%'dd'%
ENDLOCAL & SET v_year=%'yy'%& SET v_month=%'mm'%& SET v_day=%'dd'%

REM Build a list of databases to backup
SET DBList=C:\BackupSQL\SQLDBList.txt
echo %DBList%
sqlcmd -E -S "%ServerName%" -h-1 -W -Q "SET NoCount ON;SELECT NAME FROM sys.sysdatabases WHERE [Name] NOT IN ('master','model','msdb','tempdb')" > %DBList%

REM Remove backup files older than 3 days
REM /d -3 defines how old must be files before they are deleted
IF EXIST "%DBList%" forfiles /p C:\BackupSQL /s /m * /d -3 /c "cmd /c del @file"

REM Backup each database, prepending the servername and date to the filename
FOR /F "tokens=*" %%I IN (%DBList%) DO (
ECHO Backing up database: %%I
SqlCmd -E -S "%ServerName%" -Q "BACKUP DATABASE [%%I] TO Disk='C:\BackupSQL\Backup_%ServerName%_%v_year%_%v_month%_%v_day%_%%I.bak'"
ECHO
)

REM Clean up the temp file
IF EXIST "%DBList%" DEL /F /Q "%DBList%"
ENDLOCAL

***************************************************

Now just copy/paste this script into BackupSQL.bat file and run it from Scheduled Tasks.

I also suggest to all that they test restore of their databases because you never know if it's OK until you try :)

This is it for today. Have fun!

Useful Command prompt (CMD) and PowerShell commands

2011-06-17T15:42:00.004+02:00

This time I’ll make it short. In this blog I’ll start collecting useful Command prompt and PowerShell commands that I frequently use. Commands are inside the quotes:

Command prompt:

Did you ever search what is the username of the currently logged in user? Here is an answer:

Windows XP: “echo %username%”

Windows 7: “whoami” or “echo %username%”

And command that shows computer name:

Windows XP, 7, 2003, 2008: “hostname”

************************************************
On the file server you need a list of all opened files:

“net file”

“net file < .\desktop\openfiles.txt” if the list is too long and doesn’t fit into command prompt window.
net file | find "Search string" filter results by specified search string.

************************************************
Get a list of all drivers installed to Windows computer:
driverquery

************************************************Display user logon server (domain controller) in command line:
“set”
“echo %logonserver%”

************************************************
This tool displays operating system configuration information for a local or remote machine, including service pack levels, original install date, system boot time, total physical memory, available physical memory, page file max size, page file available, page file in use and much more:
"systeminfo"

************************************************
Get a list of all roles applied to Windows 2008 server:
servermanagercmd -q

************************************************

Detecting memory leaks:

Create memory snapshots into a file, if you run this command repeatedly new memory snapshots will be added to the end of the file:

"memsnap /m memsnap.log"
Analyze memory snapshots for memory leaks:
"memsnap /ah memsnap.log"

************************************************

This tool enables an administrator to display the MAC address for network adapters on a system:
"getmac /v"

************************************************
Group Policy Results (GPResult.exe) is a command line tool that displays Group Policy Settings that are in effect for a specific user or computer.
"gpresult /s ComputerName /user UserName /r /v > gpresult_filename.txt"

************************************************
Display / list Active directory FSMO (Flexible Single Master Operations) roles. Run this command on domain controller:
netdom query fsmo

************************************************
Get a list of group members from AD:
dsget group "CN=Domain Admins,CN=Users,DC=domain,DC=local" –members

************************************************
Get a list of disabled user accounts from AD:
DSQUERY USER -disabled

************************************************
Get a list of inactive user accounts from AD (in weeks):
DSQUERY USER -inactive 4

************************************************
Get a list of inactive computer accounts from AD (in weeks):
DSQUERY computer -inactive 4

************************************************
Get a list of all computer accounts and servers from AD (name and OS):
dsquery * -filter "(&(objectClass=Computer)(objectCategory=Computer))" -attr sAMAccountName operatingSystem -limit 1000

************************************************
Get AD schema version. Run this command on domain controller:
dsquery * cn=schema,cn=configuaration,dc=domain,dc=local -scope base -attr objectVersion

************************************************
Klist is a command line utility included in the default installation of Windows Server 2008 and Windows Server 2008 R2 which can be used to list and purge Kerberos tickets on a given computer. To run KLIST, open a command prompt in Windows Server 2008 and type Klist:
klist tickets

************************************************
Get Exchange schema version:
dsquery * CN=ms-Exch-Schema-Version-Pt,cn=schema,cn=configuration,dc=domain,dc=local -scope base -attr rangeUpper

************************************************
Get a list of Service Principal Name (SPN) for specified server:
setspn -l ServerName

************************************************
Get AD site information for computer on which you're running this command:
Nltest.exe /dsgetsite

************************************************
Get DFS server list for computer on which you're running this command:
dfsutil /pktinfo

This is it for today. Have fun!

Problems connecting to Exchange 2010 from different AD

2011-04-14T12:32:00.000+02:00

Not while ago we suggested to our customer that has few other companies to merge all email traffic to one Exchange 2010 server. The plan is that all users use email addresses from their original company. This setup would be like some kind of email hosting. After we migrated first of this external companies to centralized mail server we encountered strange behavior on merged company client side.

External company has few users that use Outlook 2007, just like all other users, with a difference that they can't open Out Of Office Assistant (OOF). If they open this wizard they receive this error:

"Your Out of Office settings cannot be displayed, because the server is currently unavailable. Try again later."

They also receive Offline Address Book (OAB) synchronization error:

"Task 'Microsoft Exchange' reported error (0x8004010f): 'The operation failed. An object could not be found.'"

I started troubleshooting this problem and tried all sorts of suggested solutions that I could found on Google. Steps that didn’t help were:
- checked if there is a proxy problem
- check permissions inheritance in AD on problematic users
- reapplied permissions inheritance on problematic users
- created new user from problematic user (copy) and tested new user. New user doesn't have these problems
- other user, except problematic ones, on the same computer doesn't have problems
- problematic user have problems on different computers
- created new mailbox store, move test user there and test if it works
- checked Exchange autodiscovery

Then I noticed something that pointed me to what could be wrong, but still couldn’t solve the problem. When I deleted user, created new one (with the same username) and attached old orphaned mailbox everything worked well until I:
- Unchecked "Automatically update e-mail addresses based on e-mail address policy."
- Set primary email address from name.surname @ domainA.com to name.surname @ domainB.com

After I made this change problem came back. If I apply the setting "Automatically update e-mail addresses based on e-mail address policy." back the problem remains.

I was so desperate at this point that I went sniffing Outlook traffic with WireShark. After this I finally found out what is going on and prepared a workaround. It looks like autodiscovery messes up Outlook to the point that it thinks that OAB and OOF is located on different address (in our case domainB.com) as other services. I’m not quite sure if this is an Exchange 2010/Outlook bug or my misconfiguration.

Workround goes like this:
For existing user:
- change primary email address of a user back to original domain (name.surname @ domainA.com)
- create new profile in Outlook and open Outlook to setup/initialize new profile and wait to receive few emails
- check if OOF and OAB are working
- close Outlook
- change primary email address of a user back to hosted domain (name.surname @ domainB.com)
- check if OOF and OAB still works

For new user:
- leave primary email address as given by Exchange policy (name.surname @ domainA.com)
- create new profile in Outlook and open Outlook to setup/initialize new profile and wait to receive few emails
- check if OOF and OAB are working
- close Outlook
- change primary email address of a user to hosted domain (name.surname @ domainB.com)
- check if OOF and OAB still works

Customer is now happy and so am I :)

This is it for today. Have fun!

Unable to remove printer driver from Windows 7

2011-04-06T18:14:00.003+02:00

I was contacted by a customer few days ago with yet another challanging problem. He called and said: “Luka hi, we can't upgrade or remove some printer drivers from one third of our Windows 7 x64 SP1 machines.”

The error message when we tried to remove different printer driver packages was:
Failed to remove driver HP Universal Printing PCL 6 (v5.2). The specified printer driver is currently in use.
Failed to remove driver HP Universal Printing PCL 6. The specified printer driver is currently in use.
Failed to remove package hpcu111u.inf. Driver package is in use.

and

Failed to remove driver Kyocera Classic Universaldriver. The specified printer driver is currently in use.
Failed to remove package oemsetup.inf. Driver package is in use.

I started troubleshooting this and tried almost all suggested solutions I could found on the net like:
- stop / start spooler
- reboot to safemode and unistall driver from there
- msconfig disabling all non Microsoft services
- cleanspl.exe
- logged on as every user, deleted both the printer and the driver
- disabling bidirectional support
- RUNDLL32 PRINTUI.DLL,PrintUIEntry /dd /c \\MachineName /m "AGFA-AccuSet v52.3" /h "Intel"
- printui /s /t2
- MS forum post: Deleting Printer drivers from Vista system
- MS Answers question: Trying to un-ininstall print driver error message ...
- Skidzopedia post: How To Fix “Cannot remove or delete network printer” Error in Windows
- and probably other solutions that also didn't help ...

At the end I found interesting workaround that went like this:
1. First I removed printer in "Devices and Printers"
2. Then I stopped print spooler
3. In registry I opened

HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors\

4. I renamed all Print Processors that were listed. Like Winprint to Winprint.old, Hpcpp107 to Hpcpp107.old, and so on ...
5. I started print spooler
6. Removed problematic driver pack in Print Management MMC
7. Reopened registry location

HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors\

8. Renamed back all Print Processors to original name. Like Winprint.old to Winprint, Hpcpp107.old to Hpcpp107, and so on ...
9. Restart print spooler
10. Installed new printer drivers
11. Tested printing

Maybe this procedure will also help someone else with similar problems :)

This is it for today. Have fun!

This should be an easy task (push install Mozilla Firefox 3.6.x)

2011-02-12T16:30:00.006+01:00

Not while ago one of our partners gave me, what was supposed to be an easy task. He said: “Please help us install Mozilla Firefox on all our computers”. No problemo, I said. You have Script Logic Desktop Authority which is great for these kinds of tasks and Firefox also shouldn’t be a problem. How wrong could I be?

My objectives were:
- Preconfigure Firefox homepage to predefined web site
- Preconfigure Firefox so it won’t use proxy
- Do not configure Firefox as default browser. Do not ask to become default browser.
- Disable automatic updates Firefox.

After Googling for a while I found numerous blogs, notes and hints how to accomplish this task but no complete solution. The most useful links I found are Mike’s Musings, Glen Bettridge, Chris Ilias and Shivanand Sharm’s blogs. Mozilla Firefox turned out to be quite difficult to roll out and preconfigure.

For these task to accomplish I had one virtual Windows 7 to test on, Windows 2008 R2 AD servers, Windows 2008 R2 member server with Script Logic Desktop Authority. I also installed 7zip on test computer and added 7zip install folder to Windows PATH.

1. Prepare batch file to install Firefox
To script Firefox installation we need three files:
- FirefoxDeploy.ini
- Install_Firefox.cmd and
- Later also FirefoxSalus.exe

All these files should be copied to network share from where you’ll push installation.

- In FirefoxDeploy.ini is:
[Install]
InstallDirectoryName=Mozilla
FirefoxCloseAppNoPrompt=true
QuickLaunchShortcut=false
DesktopShortcut=true
StartMenuShortcuts=true
StartMenuDirectoryName=Firefox

- In Install_Firefox.cmd is:
REM x32 install Mozilla FireFox
IF NOT EXIST "C:\Program Files\Mozilla\firefox.exe" (
pushd \\SALFS\InstallPoint\FireFox
FirefoxSalus.exe /INI=\\SALFS\InstallPoint\FireFox\FirefoxDeploy.ini
popd
)

2. Preconfigure Firefox home page and proxy
- Unpack Firefox installer to some temp folder

- Change folder previously unpacked installer folder .\Firefox Setup 3.6.13\nonlocalized\ and cerate file named mozilla.txt.

- Open mozilla.txt and put these lines in it:
//
lockPref("network.proxy.type", 0);
lockPref("browser.startup.homepage", http://www.Hoponbike.com/);

- Download program ByteShifter and encode Mozilla.txt to Mozilla.cfg by simple “byte-shifting” with an offset of 13.

- Copy Mozilla.cfg to unpacked installer folder where Firefox.exe is.

- At the end of file named all.js located in unzipped installer folder ".\Firefox Setup 3.6.13\nonlocalized\greprefs\" add this line:
pref("general.config.filename", "mozilla.cfg");

Preconfigure Firefox to skip default browser checking and automatic updating

- Find file named firefox.js in unzipped installer folder ".\Firefox Setup 3.6.13\nonlocalized\defaults\pref\” and change these:
pref("browser.shell.checkDefaultBrowser", false);
pref("app.update.enabled", false);

3. Repackage Firefox and create installer
- Repackage installer by first zipping changes you made. To do this open command line and change directory to the root of unzipped installer folder. Enter these command to create a file called app.7z:
7z a -r -t7z app.7z -mx -m0=BCJ2 -m1=LZMA:d24 -m2=LZMA:d19 -m3=LZMA:d19 -mb0:1 -mb0s1:2 -mb0s2:3

- Download file 7zSD.sfx needed to repackage installer and save it to the root of unzipped installer folder.

- Create file named app.tag, also in the root of unzipped installer folder and put in it these lines:
;!@Install@!UTF-8!
Title="Mozilla Firefox"
RunProgram="setup.exe"
;!@InstallEnd@!

- Repackage installer by executing this command:
copy /B 7zSD.sfx+app.tag+app.7z FirefoxSalus.exe

- Copy newly created installer FirefoxSalus.exe to your install point folder.

So this is it, now you’re ready to test your Mozilla Firefox deployment on small group of computers with a help of Group policy or some other method. I personally did it with Script Logic Desktop Authority.

This is it for today. Have fun!

Where are my desktop icons?

2010-12-13T17:55:00.000+01:00

It happened again :( About a week ago I installed Windows 7 on my laptop, this time x64 version, and today it happened again. Some of my desktop icons, more exactly broken links, disappeared.
These happened to me before, when I installed my first Windows 7. I noticed that my icons keep disappearing. Until I found a solution. Don’t be afraid this is not a virus, neither a spyware but it’s a feature of Windows 7 diagnostic task.

To resolve this issue open Task Scheduler with administrative rights (Start-All Programs-Accessories- System Tools).

Expand the tree of Task Scheduler to Diagnostic (Task Scheduler-Task Scheduler Library-Microsoft-Windows-Diagnosis).

Right click on scheduled task and click Disable.

Simple as that, and no more disappearing icons :)

This is it for today. Have fun!

Virtualizing Windows 2000 server (P2V)

2010-12-12T19:55:00.005+01:00

Last week a customer called and said that a disk died in an old Dell PowerEdge 1500SC server with Windows 2000 installed. Since this is a really old server, my estimation is about 8 years, the best solution was to virtualize it. This was also my suggestion for the customer. They agreed and I started working.

At the beginning I didn’t prepare much since I made numerous P2V migrations with VMware Converter in my career without any problems, but none of it involved Windows 2000. I prepared server and network like I usually do:
- I checked latest full server backup.
- Installed and connected temporary Gigabit switch (pluged in server and my laptop which have VMware vCenter Converter Standalone Client installed).
- Wrote down IP settings (ipconfig /all).
- Stopped / disabled all unnecessary services and wrote down their names and startup type. We wanted to control services startup. I also stopped and disabled all Dell management agents and AV software.

After server was prepared I started VMware Converter and run P2V wizard as described in my previous blog.

During this wizard I was asked to point to newer version of Scsiport.sys file. My current version was 5.0.2195.7017 and I needed 5.0.2195.7059. I started searching and found it on some other W2k server. I pointed a wizard to this file and moved forward. After two hours server was virtualized and ready to start.

Before booting virtual machine I always change Power On Boot Delay parameter to value 9000 in Virtual Machine Properties. I do it because I don't like catching ESX at boot to choose whatever boot parameter I need.

Dammit, Blue Screen or so called BSOD! It says STOP: 0x0000001E (0xC0000005,0x804a6467,0x00000000,0x000000B0).

I checked on Google and quickly found out that the problem is in Scsiport.sys driver. Quote from MS KB904374: “This problem occurs because of a code problem in the Scsiport.sys driver that is included in Update Rollup 1 for Windows 2000 SP4”. I also found this two other links: KB Article 1879 and KB Article 1005208.

Here is few suggestions for solving this issue that I found but didn’t help:
1. Injecting SCSI controller device drivers into Windows (VMware KB 1005208). I tried it and it didn’t help.
2. I also tried changing Scsiport.sys with some older and newer versions and didn’t help either. I did this by booting virtualized server from Ultimate Boot CD and copying the files to proper location on server’s hard disk.
3. I downloaded and extracted Hotfix from KB904374 and copied files to virtualized server. Didn’t help.
4. I changed SCSI controller from BusLogic to LSI Logic and got different error “STOP 0x0000007B INACCESSIBLE_BOOT_DEVICE”.

The solution that worked was:
1. I installed hotfix from KB904374 to original server.
2. I also installed VMware SCSI controller driver to original server. I did this:
   a. Download the VMware SCSI Disk Controller driver floppy.
   b. Extract with vmscsi-1.2.0.4.flp with 7zip to original server.
   c. Start “Add new hardware” from Control panel.
   d. Add new SCSI device and point to extracted files.
3. Repeat server prepare steps and start P2V wizard from VMware Converter.
4. Boot virtualized server and “Voila” Windows 2000 virtualized server is now booting.

After successful first boot I prepared virtualized machine as described in my previous blog.

Next time I’ll do P2V of something for the first time I’ll probably Google first ;)

This is it. Have fun!

Virtualization and SAN upgrade on Windows 2003 cluster (part 2)

2010-12-01T11:27:00.022+01:00

In my previous blog I described how we migrated data from our old SAN to new one. In this blog I’ll describe how we virtualized (P2V) two cluster nodes from HP physical machines to VMware ESX 4 virtual environment.

So let’s go straight to the point. Before the actual virtualization we prepared a short plan how we’re gonna do it without too much impact on this 24/7 production environment. Our steps were:
- We informed users that there may be some troubles on the network.
- We prepared server environment.
- P2V virtualization of cluster nodes.

There is not much to talk about informing the users. The usually don’t read notifications and they always complain that they didn’t receive one.

The preparation of server environment was done like this:
- We assigned appropriate LUNs to VMware servers.
- We backed up both cluster nodes.
- We wrote down IP settings (ipconfig /all)
- We migrated all cluster resources to one node (Node1).
- We installed VMware vCenter Converter Standalone Client to one of the computers with Gigabit Ethernet.

After all this was done, we started virtualizing Windows 2003 cluster servers.
- We stopped / disabled all unnecessary services and wrote down their names and startup type. It is very important to stop and disable Cluster Service, because we don’t want it to accidently start after server is virtualized and not yet configured. We wanted to control services startup.

- We also stopped and disabled all HP management agents and AV software.

After server was prepared we started VMware Converter and run P2V wizard.
- Choose the server we wanted to virtualize.

- Choose the destination server

- Enter the name of the virtual machine

- Choose datastore and virtual machine version

- Setup parameters for the conversion task. Be careful to remove unnecessary disk drives from conversion. We only need local drives and not those located on SAN.

- Once again review the conversion parameters and start conversion.

After conversion was done and before we started this machine we edited machine properties to add RAW hard disks and change startup delay.

I always change Power On Boot Delay parameter to value 9000. I do it because I don't like catching ESX at boot to choose whatever boot parameter I need.

OK, everything looks great and we were ready to start the server. But before we did it we switched off the old one! This is very important, never leave both servers running!

After successful first boot we did these:
- Installed VMwareTools.

- Configured correct IP address.
- Uninstalled HP management agents.
- Checked and configured correct disk / SAN presentation.
- Checked DNS just to be sure that cluster node didn’t register itself with wrong IP address.
- Rechecked cluster communication on Node1

After all this was done we enabled and started services one-by-one, with Cluster Service being the last.

Cluster service started successfully and we could start testing resource migration to these newly configured virtual cluster node. After we tested all resources and few days passed we virtualized the second node. We did it the same as the first one.

I hope this blog will help someone at their cluster migration :)

This is it. Have fun!

Virtualization and SAN upgrade on Windows 2003 cluster (part 1)

2010-11-14T20:27:00.018+01:00

Recently we've got task that is not as frequent as we'd like on our territories. We needed to do virtualization and disk migration of two Windows 2003 clustered servers.

So in this and in my next blog I’ll describe how we approached this delicate task, without major downtime in this 24/7 production environment.

First of all we upgraded our HP DL360 g5 servers with additional processor, RAM and FC controller for VMware cluster. We also upgraded two HP DL360 g5, running Windows 2003 cluster, with FC controller. Then we installed, configured and presented LUNs on HP StorageWorks 2024fc G2 Modular Smart Array. And at the end we installed VMware ESX 4.1 cluster.

So now what? We have two VMware ESX clustered servers and two Windows 2003 clustered servers, we also have HP MSA2024fc and old HP MSA500 SCSI. We started Googling (useful link), testing different migration strategies and at the end we decided to do it like this:
- First we’ll migrate data from old SAN to new one (Blog - part 1).
- Virtualize Windows cluster nodes on by one (Blog - part 2).

Our MS Windows cluster has these resource groups that needed to be migrated to new disks:
- File Server resource group
- Print Perver resource group
- Quorum resource group
- MS SQL Server resource group
- Domino Server (Lotus Notes) resource group

Migrating data of different cluster resource groups from old SAN to new one was done in this order:
1) Quorum
- We added new cluster resource disk named NewQuorumDisk with drive letter X:

- Moved old Quorum to new resource named NewQuorumDisk like described in MS KB280353.

- Stopped cluster resource OldQuorumDisk and delete Q: drive from the cluster
- Opened Disk Management and change drive letter Q: to Y: and X: to Q:
- Before migration to second cluster node we deleted OldQuorumDisk on second cluster node
- Tested Quorum migration between nodes

- At the end we removed LUN mapping for OldQuorumDisk

2) File server (with as little as possible downtime)
- We notified users about migration and scheduled maintenance date and hour.
- We added new cluster resource disk named NewFSDisk with drive letter X:
- Started synchronizing data between OldFSDisk (S:) and NewFSDisk (X:). We did this with RoboCopy (download) and Total Commander - Synchronize Dirs command. We repeated synchronization for a few days until the D-day.

- Made print-screens from resources in file server cluster group, just to be sure we don’t forget some settings later.
- On scheduled maintenance we stopped all File Server resource group resources except disks.
- We run file synchronization for the last time.
- We checked if number of files and size in bytes are exactly the same on both disks.
- Then we changed “Dependencies” and “Parameters” on “File Share” resource with new NewFSDisk (X:) value.
- We also checked and if necessary replaced with NewFSDisk (X:) value all other resources in this group.
- We stopped cluster resource OldFSDisk and deleted OldFSDisk from cluster resource.
- In Disk Management we changed drive letters of OldFSDisk S: to Y: and NewFSDisk X: to S:
- Then we needed to changed “Dependencies” and “Parameters” on “File Share” again to fit new lettering NewFSDisk (S:).
- We also checked and if necessary replaced with NewFSDisk (S:) value all other resources in this group.
- Before migration to second cluster node we also changed lettering there OldFSDisk S: to Y:
- After all this we started all resources, checked if file sharing is OK and then we tested cluster group migration to another cluster node.
- At the end we removed LUN mapping for OldFSDisk.

3) Print Server disk migration is almost the same as File Server disk migration
- We added new cluster resource disk named NewPSDisk with drive letter X:
- Made print-screens from resources in Print Server cluster group, just to be sure we don’t forget some settings later.
- We stopped all Print Server resource group resources except disks.
- Started synchronizing data between OldPSDisk (P:) and Print Server (X:).
- We checked if number of files and size in bytes are exactly the same on both disks.
- Then we changed “Dependencies” and “Parameters” on “Print Spooler” resource with new NewPSDisk (X:) value.
- We stopped cluster resource OldPSDisk and deleted OldPSDisk from cluster resource.
- In Disk Management we changed drive letters of OldPSDisk P: to Y: and NewPSDisk X: to P:
- Then we changed “Dependencies” and “Parameters” on “Print Spooler” resource with new NewPSDisk (P:) value.
- Before migration to second cluster node we also changed lettering there OldpsDisk P: to Y:
- After all this we started all resources, checked if Print Server is OK, printers are printing and then we tested cluster group migration to another cluster node.
- At the end we removed LUN mapping for OldFPSDisk.

At the same time we also migrated MS SQL Server cluster resource group and Domino server (Lotus Notes) cluster resource group to new disks.

So as you can see from this blog, changing SAN in MS clustered environment is not so hard as it seems. But in real, you’ll see ;)

In my next blog, part 2 of these series, I’ll describe how we did Physical to Virtual (P2V) migratin of MS clustered servers with VMware vCenter Converter Standalone Client.

I think this is enough for this one. Have fun :)

Windows "Add a printer" wizard

2010-11-05T19:16:00.016+01:00

Yesterday I encountered interesting situation. I prepared new Windows 2008 R2 server with print server role installed on it and started publishing printers. This task is on Windows 2008 R2 not as easy as advertised by MS. But never the less I did it.

After that I tried adding published printers to our test computer (Windows 7 x64). I started "Add a printer ..." wizard from Devices and Printers.

Click on "Add a printer"

Choose "Add a network, wireless or Bluetooth printer"

On my surprise there were no newly added printers to choose from. But they were listed if I clicked on "The printer that I want isn't listed" wizard.

And Next with "Find a printer in the directory, based on location feature" selected.

So the printer was listed in Active Directory but didn’t show in the wizard. This is weird!? So I started googling for a solution.

Then I found MS forum post where someone had exact same problem. This is actually not a bug but a feature :) This "Add a printer" wizard default configuration is to show 20 printers. And you can change this setting by changing this group policy "Computer configuration\Policies\Administrative Templates\Printers\Add Printer wizard - Network scan page (Managed network)"

Change it to a number that works best for you. In my case I changed it to 50.

Well done. But then again why going thru all this trouble if you can easily add printer just by right clicking on desired printer in Windows Explorer and choose Connect?

Have fun :)

VMware Server 2 - slow response

2010-01-17T19:08:00.007+01:00

Foreword:
Few days ago I received a task to make a virtual testing environment. So after searching our warehouse I found one HP business PC on which I installed Windows 2008 R2 x64 server. On this platform I later added VMware Server 2.0. Both installs went thru without any problems. I also converted few physical servers on to this newly created virtual host.

The problem:
When I started to use these virtual machines in my test lab I noticed extremely slow response time. It was almost impossible to work on them over RDP. Copying files between hosts and virtual machines was also extremely slow (aprox. 30KB/Sec).

Solution:
1. I disabled Large Send Offload (IPv4) and Large Send Offload v2 (IPv4) in Advance setting of host's Broadcom NetLink (TM) Gigabit Ethernet card. I also disabled TCP/UDP Checksum Offload (IPv4) and TCP/UDP Checksum Offload (IPv6).

It didn't help so ...

2. I disabled IP v6 on host and virtual client.
Under Network Connections, select the network adapter, and then click Properties. In the properties window, click to clear the check box for Internet Protocol Version 6(IPv6).

Using Registry Editor, locate the following registry key:
HKEY_Local_Machine\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters

Right-click the Parameters key, click New, and then click DWORD (32-bit) Value. For the key, add the following values:
Name: DisabledComponents
Data: 0xFFFFFFFF

Reboot and problem solved :)

Links:
http://communities.vmware.com/message/1191782
http://technet.microsoft.com/en-us/library/cc671176(EXCHG.80).aspx

The Beginnings

2010-01-17T18:53:00.002+01:00

First of all I'd like to say that the content of this blog will in 90% cases contain solutions to the problems that I encounter while I work as an IT engineer. 10% of the blog's content will be... Well I really don't have any idea right now :)

So I hope some of these solutions, that I'll present, will come handy. This will be my little contribution to make our work a little bit easier.

Have fun,
Luka Obersnu