Rahul's corner

SCCM reporting, SQL 2014, AG setup

2018-07-31T16:30:00.002+10:00

SCCM reporting DB was moved to an AG cluster 2014 with SCCM reports locally on standalone server.

Db connectivity between SCCM and AG was fine.

However, SCCM reports created would not connect to the Datasource with the error

the Datasource was connecting to ag01.mydomain.local

A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 0 - The certificate's CN name does not match the passed value.)

Seems lots of people are experiencing this issue, and logging a case to MS didnt go too far.

Setup

SCCM server with Reporting Role
SCCM DB on a AG called for e.g AG01.mydomain.local with two node cluster where Clustername is Clu1 and Node1 and Node2 are part of the AG cluster.

After lots of searching, wireshark, tracing logs, sql server logs and stumbling on bits and pieces, the solution that worked for us is as below:

Created a Server Auth cert with CN name as AG01.mydomain.local (FQDN of AG)
and SAN with DNS names
ag01
clu1.mydomain.local
clu1
node1.mydomain.local
node1
node2.mydomain.local
node2

References:
https://support.microsoft.com/en-us/help/316898/how-to-enable-ssl-encryption-for-an-instance-of-sql-server-by-using-mi

https://thesqldude.com/2012/04/21/setting-up-ssl-encryption-for-sql-server-using-certificates-issues-tips-tricks/

This is assuming you have a pki infrastructure and can generate proper certs and the CA root certs are on the servers.

Make sure certs created have proper permissions assigned for the SQL service accounts if SQL running under SVC account.

Once you have the appropriate certs as per above.

Follow the article below

https://support.microsoft.com/en-us/help/316898/how-to-enable-ssl-encryption-for-an-instance-of-sql-server-by-using-mi

And most likely if you copied the Thumbprint as i did from the MMC console then you will need to follow this

https://support.microsoft.com/lo-la/help/2023869/sql-server-fails-to-start-with-error-17182-tdssniclient-initialization

Once the SQL services are running successfully, the issue should get resolved.

Failover was successfully tested and reporting worked fine there after.

Best of Luck

Hope it saves someone sometime... my colleague spent weeks...

Setup and Enable Certificate Authentication on ADFS 3

2017-11-22T15:32:00.001+11:00

Scope:

Get ADFS to do Certificate Auth so IOS Users do not need to login using their AD creds. From Internal Wifi network and from External network. Setup Sharepoint to allow CERT based auth.

Current Setup:

ADFS farm with 2 servers on the Internal Lan and 2 WAP servers on the DMZ. Firewalls exit between External to DMZ and DMZ to Internal.

Does ADFS currently work? YES NTLM, Kerberos and Forms

X.509 isn’t enabled.

One cert used for Service communication and proxy trust adfs.contoso.com public cert via GoDaddy

Things done:

· Allowed traffic from External to DMZ WAP servers on port 443 and 49443

· Setup f5 with adfs template and/or VS with L4 layer no SSL offload, automap and source address persistence for 443 and 49443

· Connectivity between WAP and ADFS servers via the Firewall on port 443 already existed.

· Enabled Certificate Auth on ADFS for Extranet zone and Intranet zone.

· Added for AD Claims provider claims rules (not mandatory but added it to be prepared for Office 365 if need be)

o c:[Type == " http://schemas.microsoft.com/ws/2008/06/identity/claims/serialnumber"] => issue(claim = c);

o c:[Type == " http://schemas.microsoft.com/2012/12/certificatecontext/field/issuer"] => issue(claim = c);

· Enabled WIA only for Windows machines, Macintosh machines (not all IOS devices), Mozilla and chrome, else Ipad and iphones wont get prompted for X.509 if they connect internally (intranet). The commands below are references. Work out yourself how to run these commands and get the desired outcome. Hope you know a bit of powershell.

1. Execute the following command to get the current list of supported user-agents for NTLM authentication

[System.Collections.ArrayList]$UserAgents = Get-AdfsProperties | select -ExpandProperty WIASupportedUserAgents

2. Execute the following command to inject the user agent into a temporary array of user agents already added to ADFS.

$UserAgents.Add(“Mozilla/5.0 (X11”) and Mozilla/5.0 (Macintosh AND Mozilla/5.0 (Windows NT

3. Execute the following command to commit the change.

Set-ADFSProperties -WIASupportedUserAgents $UserAgents

· Make sure all your ROOT CAs and Intermediate CAs are installed on local machines in the correct containers.

· Check ADFS certs are the same on ADFS and WAP

o Get-adfssslcertificate

o Get-webapplicationproxysslcertificate

· IOS devices need all the organisation CA certs on the devices along with the user cert. So the Browsers that you would use to auth using Cert auth. Else you wont get prompted for Cert selection.

Things that were wrong or went wrong:

Adfs.contoso.com cert was renewed after the initial ADFS farm installation. This was done via the MMC console and ADFS console, by created new CSR, get a new public cert from Godaddy CA and then importing and enabling it for service communication on ADFS. After a lot of hours of troubleshooting I found out that the certificate was installed and although ADFS for NTLM, Kerberos and WIA was working fine, X.509 wasn’t working. Would not get a prompt for choosing a cert.

Turns out, if you renew and import the adfs ssl cert via the gui, the following parameter in bold is not flagged correctly for the SSL binding on port 49443

Hostname:port : adfs.metrotrains.com.au:49443

Certificate Hash : b9852b75fc0ba578f1a141172dcbf0e328950140

Application ID : {5d89a20c-beab-4389-9447-324788eb944a}

Certificate Store Name : MY

Verify Client Certificate Revocation : Enabled

Verify Revocation Using Cached Client Certificate Only : Disabled

Usage Check : Enabled

Revocation Freshness Time : 0

URL Retrieval Timeout : 0

Ctl Identifier : (null)

Ctl Store Name : AdfsTrustedDevices

DS Mapper Usage : Disabled

Negotiate Client Certificate : Disabled (should be enabled)

To fix it I had to set the ADFS ssl cert again using powershell

Set-AdfsSslCertificate -Thumbprint

This fixed the issue of not getting prompted for cert when trying to connect to ADFS from the internal network.

The same fix above applies if you don’t get a prompt for user cert when connecting to the WAP boxes. The commands are a bit different.

Get-webapplicationproxysslcertificate to check if the WAP is using the same cert as the ADFS one which is adfs.contoso.com

If it ISN’t you won’t get prompted for user cert when connecting from outside to the WAP and the page will just sit there forever. To fix it,

Run

Install-WebApplicationProxy -CertificateThumbprint “adfs.contoso.com cert thumbprint” -FederationServiceName “adfs.contoso.com“

NOTES:

Restart ADFS services after EVERY change you make on the ADFS server. The cert changes need to be performed on every server in the farm. Same applies for the WAP server and WAP also has an additional WAP service that needs to be restarted.

The above task was accomplished with help of various forums. All the articles I looked at were referring to user cert auth as part of MFA, however, I needed user cert auth as a separate signon option.

The articles, links and forums that were helpful with accomplishing the above task were:

http://www.mistercloudtech.com/2016/07/07/resolving-web-application-proxy-error-code-0x80075213/

https://blogs.msdn.microsoft.com/samueld/2016/07/19/adfs-certauth-aad-o365/

https://technet.microsoft.com/en-us/library/gg491215.aspx

https://technet.microsoft.com/en-us/library/hh305235.aspx

https://social.technet.microsoft.com/wiki/contents/articles/1600.ad-fs-2-0-how-to-change-the-local-authentication-type.aspx

https://blogs.technet.microsoft.com/rmilne/2016/03/21/updating-windows-server-2012-r2-adfs-ssl-and-service-certificates/

https://devcentral.f5.com/articles/big-ip-and-adfs-part-1-ndash-ldquoload-balancing-the-adfs-farmrdquo

Disclaimer:

I’m no expert at ADFS or SAML. I’m still learning. The above solution might not be the perfect fit or so called best practice but it works.

Hopefully someone out there who is facing a similar challenge might find the above useful.

Cheers

System Center 2016 - SCOM - Operations Manager Installation issues, SQL 2014 cannot create database

2016-12-14T10:40:00.001+11:00

Setup is unable to create database on SQL server instance ''. Please make sure the current user has permissions to create database on the SQL Server instance specified.

The above is what i was getting when trying to attempt to install SCOM 2016 using the installer and getting to the Operations Manager settings window.
Im using SQL alias,
it detected and acknowledged the SQL alias. However, kept giving me an error dialog with the above error message.

Spent few hours, trying to check every possible permission,
gave SA permission on SQL, local admin on SQL and SCOM mgmt server where i was running the installation. No Luck...

Digging further using SQL profiler and help from someone who knows SQL and app dev.. it seemed the installer was looking for an AG name as part of the checks. I'm assuming SCOM isntaller was designed such that if it detects SQL 2014 it assumes its an AG setup. In my case it wasnt.

Obviously, the error message indicated nothing to represent that.

Anyways, got more help from a friendly DBA, who provided me an SQL AG.

Using SQL alias pointing to the AG, I tried another attempt.

New issue...

the SQL server with AG is running on Mount Points.
So now the installer is complaining that the F:\SQL_DB drive and F:\SQL_LOG drive do not have enough space. which is correct, F: drive is the mount point drive.
What now..
To get around it, I shared the SQL_DB and SQL_LOG folders after reading forums where users had similar issues.

https://social.technet.microsoft.com/Forums/en-US/c3992d51-07dd-4560-a0d6-c44fa67e1b2a/scom-2012-r2-with-sql-2014-and-alwayson-installation-error?forum=operationsmanagergeneral

\\sqlserver\sql_db1
\\sqlserver\sql_log1

Did the trick.

Same issues were encountered and addressed in the OPS DW settings dialog.
Hope the above helps someone... Best of luck

Oracle RAC installation on Windows 2008 R2 - User equivalence and Remote Registry Gotcha

2014-06-23T17:43:00.001+10:00

Setup:
2 Windows 2008R2 ent servers which have identical local accounts created for Oracle installation for e.g. svc_oracle with identical password setup as per the Oracle RAC admin guide.

All UAC and policy changes are implemented.

However for Remote registry to work using the identical local accounts.

You need to do the following on each rac node.

1. Open Regedit

2.Then navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

3. Enter a new value called LocalAccountTokenFilterPolicy and set it to type DWORD(32-bit).  Set the value data to 1.

It is very important to set the value name correctly with no trailing 
spaces.  This new value allows remote access to the Windows operating 
system from a named account that exists on this machine as well, 
provided the passwords are the same.

This allows the oracle user/installation account/service account mentioned earlier to

access the resources between both the nodes.

HAve fun...

"DHCP...." followed by "PXE-E53: No boot filename received"

2013-09-18T15:26:00.001+10:00

SYMPTOM

When being started, the PXE client comes up with the PXE copyright message, then displays

DHCP....

After a while, the following error message is displayed:

PXE-E53: No boot filename received

Depending on the PXE client's system setup boot device list configuration, the PC then either stops or tries to boot from the next boot device in the system setup boot device list.

CAUSE

The "PXE-E53" error indicates that the PXE client received a reply to its DHCPDISCOVER message, but the "boot filename" information was missing in this reply.

RESOLUTION

Make sure that the "boot filename" option is present on your DHCP or BOOTP server, and that its value is set to the filename of the boot loader.

When using Microsoft DHCP server, add option 067 (Bootfile Name) to your scope. When using a Unix/Linux based (ISC) DHCP server, use the "filename" parameter for this purpose.

In the context of the BootManage Administrator, the boot loader filename is "pxboot" for PXE clients and "bpboot" for TCP/IP BOOT-PROM clients. So, if you have exclusively PXE clients, set the boot filename option to the value "pxboot". If you have exclusively TCP/IP BOOT-PROM clients, set the boot filename option to the value "bpboot". In a mixed PXE and TCP/IP BOOT-PROM client environment, you must configure your DHCP or BOOTP server so that it provides the PXE clients with the "pxboot" boot loader, and the TCP/IP BOOT-PROM clients with the "bpboot" boot loader.

____ IMPORTANT Thing to note:

We were trying to troubleshoot the above issue with the recommendation above, however, make sure you can see the dhcp server leasing out the ips to the machine you are trying to pxe boot.

Secondly and most important, if they are 64 bit client, run the command below

WDSUTIL /set-server /architecturediscovery:yes

2013-09-18T15:25:00.000+10:00

Setting up ADFS Farm with ADFS proxy and F5 Load balancer....

I'm no expert at ADFS and/or Certificates.... so feel free to correct me at various places.

You can use self signed certs for Token signing, however at startup i had to use the same SSL for all.
I started off with a self signed SSL cert to test my setup. then replaced it with 3rd party.

Would recommend checking out SQL database options before installation, to plan. I didn't have a need for SQL database as oppose to WID.

I have followed a articles from Technet and other various blogs, the links to these articles is at the bottom...

ADFS Implementation & Installation guide

Contents

ADFS SERVERS:

DNS CONFIGURATION:

SSL CERTIFICATE:

Service Account Setup for ADFS:

Installing Federation Server Farm:

First server in the ADFS Farm:

Configuring AD FS

Second server in the ADFS Farm:

Installing ADFS Proxy Server:

Failover for ADFS:

Error Fixes:

ADFS SERVERS:

Name	Location	IpAddress	Subnet Mask	Gateway
FIRSTINTERNALSERVER	SER1	10.48.9.123	255.255.252.0	10.48.9.1
SECONDINTERNALSERVER	SER2	10.48.10.123	255.255.252.0	10.48.10.1
FIRSTPROXYSERVER	SER1	172.16.200.123	255.255.254.0	172.16.200.1
SECONDPROXYSERVER	SER2	172.16.201.123	255.255.254.0	172.16.201.1
ADFS VIP INTERNAL	LOAD BALANCED	10.48.9.233
ADFS VIP DMZ	LOAD BALANCED	172.16.200.233

DNS CONFIGURATION:

Internal DNS = adfs.fabrikam.com 10.48.9.233

External DNS = adfs.fabrikam.com 201.204.193.84

SSL CERTIFICATE:

Obtained SSL certificate from from a 3^rd party CA for adfs.fabrikam.com

Service Account Setup for ADFS:

Create a dedicated user/service account in the Active Directory forest that is located in the identity provider organization. This account is necessary for the Kerberos authentication protocol to work in a farm scenario and to allow pass-through authentication on each of the federation servers. Use this account only for the purposes of the federation server farm.

The account svc_adfs has been created for this purpose

Edit the user account properties, and select the Password never expires check box. This action ensures that this service account's function is not interrupted as a result of domain password change requirements.

To set the SPN of the service account

Because the application pool identity for the AD FS AppPool is running as a domain user/service account, you must configure the Service Principal Name (SPN) for that account in the domain with the Setspn.exe command-line tool. Setspn.exe is installed by default on computers running Windows Server 2008. Run the following command on a computer that is joined to the same domain where the user/service account resides:

setspn -a host/

For example, in a scenario in which all federation servers are clustered under the Domain Name System (DNS) host name fs.fabrikam.com and the service account name that is assigned to the AD FS AppPool is named adfs2farm, type the command as follows, and then press ENTER:

setspn -a host/adfs.fabrikam.com svc_adfs

Installing Federation Server Farm:

Download ADFS 2.0 setup file

http://www.microsoft.com/en-us/download/details.aspx?id=10909

First server in the ADFS Farm:

· When you launch the install program, click Next.

· Accept the license and click Next.

· On the Server Role screen, choose Federation Server and click Next.

· The wizard will automatically install the required prerequisites. Click Next to begin the installation.

· When the installation is complete, uncheck “Start the AD FS 2.0…..”

· Install the Godaddy certificate for adfs.fabrikam.com to local computer account.

· On IIS make sure the default Website has a 443 binding and set to use the adfs.fabrikam.com certificate.

Configuring AD FS

Now that we have the certificate installed, we can start the AD FS configuration. To launch the AD FS configuration wizard, just go into Administrative Tools and click on AD FS 2.0 Management.

· When the AD FS Management Console opens, click the AD FS 2.0 Federation Server Configuration Wizard Link.

· Select the option to Create a new Federation Service

· On the next screen select New federation server farm.

On the Federation Service name, choose the adfs.fabrikam.com certificate to use.

You must then specify a Service Account in Active Directory that will be used by AD FS.
Service account: Svc_adfs

On the Summary Screen review the changes that will be made and click next to begin the configuration.

When the installation is complete, click Close.

Second server in the ADFS Farm:

· Install ADFS 2.0 using the setup file.

· Before configuring the second node, export the Export the cert from the first ADFS Server in the Farm. NOTE: This setup is very important, as I was getting Thumbprint errors for the SSL cert while setting up the second node without following the steps below…

1. Open the Certificate MMC console.

· Log on to the original ADFS server which contains the service communications certificate with the private key.

· Open the Start Menu and type “MMC” in the search box and press enter.

· When the console opens click “File” and select “Add/Remove Snapin”.

· Select “Certificates” from available snap ins and click the “Add” button to move to the “Selected Snapins” window and click “OK”.

· When the “Certificate Snap-in” windows appears, select the “Computer Account” radio button and click “Next”.

· On the “Select Computer” window, select the “Local Computer” radio button.

· You will now see that it has been added to the selected snap-ins. Click “OK”.

2. Now that you have the local certificate MMC open you can start to Export the cert.

· Expand “Certificates (Local Computer)” then expand “Personal” and highlight “Certificates”.

· Right click the certificate to be exported (in my case adfs.pipe2text.com), select “All Tasks” then “Export” from the menu.

· Click “Next” on the “Welcome to the Certificate Export Wizard” screen.

· On the “Export Private Key” screen Select “Yes, Export Private Key” and click “Next”.

· On the “Export File Format” screen Select the “Personal Information Exchange = PKCS #12 (.PFX)” radio button and Check off “Include all certificates in the certification path if possible” and “Export all extended properties”. Make sure “Delete the private key if export is successful” is deselected. Click “Next”.

· On the “Password” screen, enter a password and make note of it (This is the password you will use when importing the cert to the new server).

· On the “File to Export” enter a name and location for the file and click “Next”.

· On the “Completing the Certificate Wizard” screen review your settings and Click “Finish”.

· Retrieve the cert file and copy it to the new ADFS server you will be adding to your farm.

· Use the previously saved certificate

With the Certificate name:

ADFS_FirstInternalServer.pfx

· Import the above certificate to Localcomputer\personal\certificates

· Bind the Imported Cert to the Default Website

1. Open the IIS Manager and right click the “Default Website” and select “Edit Bindings”.

2. Under “Type” choose “https” and under “SSL Certificate” choose the cert that you imported and click “OK”.

3. You will now see “https” and “443″ in the list of site bindings. Click “Close”.

· Launch the ADFS Configuration Wizard

· On the Welcome page, verify that Add a federation server to an existing Federation Service is selected, and then click Next.

· If the AD FS database that you selected already exists, the Existing AD FS Configuration Database Detected page appears. If that occurs, click Delete database, and then click Next

· On the Specify the Primary Federation Server and Service Account page, under Primary federation server name, type the computer name of the primary federation server in the farm, and then click Browse. In the Browse dialog box, locate the domain account that is used as the service account by all other federation servers in the existing federation server farm, and then click OK. Type the password and confirm it, and then click Next:

· On the Ready to Apply Settings page, review the details. If the settings appear to be correct, click Next to begin configuring AD FS with these settings.

· On the Configuration Results page, review the results. When all the configuration steps are finished, click Close to exit the wizard.

Installing ADFS Proxy Server:

· Run setup for ADFS 2.0 and install ADFS

· Import the certificate exported earlier from the Federation server to Localcomputer\personal\certificates

· Bind the Imported Cert to the Default Website

1. Open the IIS Manager and right click the “Default Website” and select “Edit Bindings”.

2. Under “Type” choose “https” and under “SSL Certificate” choose the cert that you imported and click “OK”.

3. You will now see “https” and “443″ in the list of site bindings. Click “Close”.

· Run the ADFS Configuration Wizard.

· On the Welcome page, click Next.

· On the Specify Federation Service Name page, under Federation Service name, type “adfs.fabrikam.com”

· Uncheck Use an HTTP proxy server when sending requests to this Federation Service check box, under HTTP proxy server address type the address of the proxy server, click Test Connection to verify connectivity, and then click Next.

· When you are prompted, enter ‘fabrikam\svc_adfs’ and password.

· On the Ready to Apply Settings page, review the details. If the settings appear to be correct, click Next to begin configuring this computer with these proxy settings.

· On the Configuration Results page, review the results. When all the configuration steps are finished, click Close to exit the wizard.

Failover for ADFS:

The WID database on the primary server is read/write and the WID database on the secondary server(s) are read-only. Changes made to the configuration are made only on the primary Federation Server and those changes are replicated (5 minutes interval by default) to the secondary servers via WID database synchronization.

In the event that the primary Federation Server becomes unavailable and will not be brought back online, the administrator needs to promote one of the secondary Federation Servers to primary for the farm.

· Command to run on the secondary server which you want to make primary:

Add-PsSnapin Microsoft.Adfs.PowerShell

Set-AdfsSyncProperties -Role PrimaryComputer

Now that you have set a new Primary Federation Server, you need to configure the other Secondary Federation Servers to sync with the new Primary Federation Server

· Command to run on the other farm member servers:

Add-PsSnapin Microsoft.Adfs.Powershell

Set-AdfsSyncProperties -Role SecondaryComputer -PrimaryComputerName {FQDN of the Primary Federation Server}

Error Fixes:

In the event you get an error message when try to start the ADFS service, like

"Windows could not start the AD FS 2.0 Windows Service service on Local Computer - Error 1053"

Try the fix below:

1. Navigate to C:\Program Files\Active Directory Federation Services 2.0
2. Find and open Microsoft.IdentityServer.Servicehost.exe.config file
3. Modify it as follows:
under tag, add this line:

So it would look like this:

References:

When to Create a Federation Server Farm:

http://technet.microsoft.com/en-us/library/dd807062(v=ws.10).aspx

How to change ADFS Service communication certificate after initial installation:

http://social.msdn.microsoft.com/Forums/vstudio/en-US/acad4d8a-898a-4113-b608-bf322f45282e/how-to-change-adfs-service-communication-certificate-after-initial-installation

AD FS 2.0: How to Set the Primary Federation Server in a WID Farm (move ADFS role to another server) - Fatshark's Personal Blog

http://www.edunnewijk.nl/fatshark/index.php?/archives/465-AD-FS-2.0-How-to-Set-the-Primary-Federation-Server-in-a-WID-Farm-move-ADFS-role-to-another-server.html

Adding an additional ADFS Server to your ADFS Farm when using SQL for the Configuration Database

http://pipe2text.com/?page_id=395

Verifying ADFS Computer Settings and Connectivity:

http://technet.microsoft.com/en-us/library/cc778709(v=ws.10).aspx

2013-08-23T15:40:00.001+10:00

How to enable or disable hyperlink warning messages in 2007 Office programs and in Office 2010 programs particularly for PDF do documents that open up in Internet Explorer.

I had an issue whereby, a hyperlink in excel, which points to a pdf document on our intranet/sharepoint site throws up a warning message which is because of HWLink.dll as per the articles below

http://support.microsoft.com/kb/829072
http://support.microsoft.com/kb/925757

I had tried the fix mentioned in the links above, all of them. However, the HWLINK.DLL warning seems to still come up.

This only happens when the pdf reader (i have tried Adobe and Nitro) have their web plugins for IE installed. As soon as i uninstall Adobe reader and its plugin, the warning message doesnt come up and the link opens up in the PDF reader, not in IE.

was there a way to allow the pdf hyperlink to open up in IE without excel throwing the Warning message ?

The message comes up only when going ot the intranet sites on sharepoint. If the link is pointing ot a pdf on a file server, it doesnt show a warning. Other file extensions like jPG open without any warnings in IE from Excel.

The site is in the intranet zone on IE as well.

Had tried the links above as a fix on office 2003, 2010 and 2007, but no joy.

Troubleshooting information gathering:

Logged a job with Microsoft.

Was requested to follow the steps below to get more information:

A. Please locate one testing client machine which could reproduce the specific “issue” behaviour there. (We’d better to focus on one version of Office product. For example, Office 2010).

Please help to export the following registry keys (if you could find it) from this testing client machine to .reg files:

- HKEY_CLASSES_ROOT\Installer

- HKEY_CLASSES_ROOT\.PDF

- HKEY_CLASSES_ROOT\AcroExch.Document

- HKEY_CLASSES_ROOT\AcroExch.Document.7

- HKEY_CURRENT_USER\Software\Microsoft\Installer

- HKEY_CURRENT_USER\Software\Microsoft\Office

- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer

- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall

- HKEY_LOCAL_MACHINE\Software\Microsoft\Office

If the specific problem machine is a 64-bit machine, please also export the following registry keys to .Reg files:

- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Installer

- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall

- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office

Rename all exported .reg files to .txt files and then compress them into a .zip file. Send the .zip file to me.

(Note: Please must export the above registry keys to .reg files instead of .txt files directly. Also please don’t forget to rename them to .txt files before compressing them into the .zip file. Otherwise, the mail scan software between us may be able to filter out those .reg files from the .zip file directly.)

B. Please download and install/configure the Network Monitor utility and Process Monitor utility on this testing client machine:

Network Monitor: http://www.microsoft.com/en-us/download/details.aspx?id=4865

Process Monitor: http://download.sysinternals.com/files/ProcessMonitor.zip

Please open an Excel workbook including the link to .PDF file there. Please start capturing Process Monitor trace and Network Monitor trace, then click on the link to .PDF file to reproduce the specific warning message pop-up. After the warning message pop-up, please stop the Process Monitor trace and Network Monitor trace capturing then save all captured Events/records to default format files

SOLUTION:

The below was the Final finding and step2 was the fix

1. When reviewing/analyzing the captured dump file with the specific warning/error message pop-up when opening .PDF file through http URL link from Excel file, I could see the pop-up warning message box appearing when calling to the function “hlink!HrAllowUnsafeUrl”.

For more relevant details on this, please refer to the following dump checking/analysis:

0:000> knL

# ChildEBP RetAddr

00 0013f424 7e419418 ntdll!KiFastSystemCallRet

01 0013f45c 7e4249c4 user32!NtUserWaitMessage+0xc

02 0013f484 7e43a956 user32!InternalDialogBox+0xd0

03 0013f744 7e43a2bc user32!SoftModalMessageBox+0x938

04 0013f894 7e4663fd user32!MessageBoxWorker+0x2ba

05 0013f8ec 7e4664a2 user32!MessageBoxTimeoutW+0x7a

06 0013f920 7e450877 user32!MessageBoxTimeoutA+0x9c

07 0013f940 7e45082f user32!MessageBoxExA+0x1b

08 0013f95c 76828406 user32!MessageBoxA+0x45

09 0013fa98 76824e00 hlink!HrAllowUnsafeUrl+0x101

0a 0013fab0 781362f7 hlink!HLNK_Bsc::OnProgress+0xc6

0b 0013fad0 78136247 urlmon!CBSCHolder::OnProgress+0x3c

0c 0013faec 7816180b urlmon!CBinding::CallOnProgress+0x30

0d 0013fb58 78164128 urlmon!CBinding::InstantiateObject+0xb7

0e 0013fbb4 78164019 urlmon!CBinding::OnObjectAvailable+0x15d

0f 0013fbe0 781382ee urlmon!CBinding::OnTransNotification+0x173

10 0013fc10 78137c84 urlmon!CBinding::ReportData+0x77

11 0013fc30 7813638f urlmon!COInetProt::ReportData+0x6e

12 0013fc58 78136205 urlmon!CTransaction::DispatchReport+0x37e

13 0013fc84 78136424 urlmon!CTransaction::DispatchPacket+0x31

14 0013fca4 781423a7 urlmon!CTransaction::OnINetCallback+0x92

15 0013fcbc 7e418734 urlmon!TransactionWndProc+0x28

16 0013fce8 7e418816 user32!InternalCallWinProc+0x28

17 0013fd50 7e4189cd user32!UserCallWinProcCheckWow+0x150

18 0013fdb0 7e418a10 user32!DispatchMessageWorker+0x306

19 0013fdc0 30024572 user32!DispatchMessageW+0xf

1a 0013fdcc 30024534 EXCEL!DispatchMessageU+0x2d

1b 0013fde4 30024441 EXCEL!DispatchEvtNaked+0xb2

1c 0013feb0 3000424b EXCEL!MainLoop+0x7b3

1d 0013ff30 30003f0a EXCEL!WinMain+0x391

1e 0013ffc0 7c817077 EXCEL!__tmainCRTStartup+0x140

1f 0013fff0 00000000 kernel32!BaseProcessStart+0x23

0:000> lmvm hlink

start end module name

76820000 76835000 hlink (private pdb symbols)

Loaded symbol image file: hlink.dll

Image path: C:\WINDOWS\system32\hlink.dll

Image name: hlink.dll

Timestamp: Mon Apr 14 08:09:44 2008 (4802A0C8)

CheckSum: 00018C11

ImageSize: 00015000

File version: 5.2.3790.2748

Product version: 5.2.3790.2748

File flags: 0 (Mask 3F)

File OS: 40004 NT Win32

File type: 2.0 Dll

File date: 00000000.00000000

Translations: 0409.04b0

CompanyName: Microsoft Corporation

ProductName: Microsoft® Windows® Operating System

InternalName: hlink.dll

OriginalFilename: hlink.dll

ProductVersion: 5.2.3790.2748

FileVersion: 5.2.3790.2748 (srv03_sp1_qfe.060717-0810)

FileDescription: Microsoft Office 2000 component

0:000> .frame08

08 0013f95c 76828406 user32!MessageBoxA+0x45

0:000> dv

hwndOwner = 0x00f20946

lpszText = 0x0b528060 "Opening http://www.vmware.com/pdf/ha_datasheet.pdf..Some files can contain viruses or otherwise be harmful to your computer..It is important to be certain that this file is from a trustworthy source...Would you like to open this file?.."

lpszCaption = 0x0013f990 "Microsoft Office"

wStyle = 0x121

0:000> .frame09

09 0013fa98 76824e00 hlink!HrAllowUnsafeUrl+0x101

0:000> dv

pwzUrl = 0x0025f320

hr = 0x80004004

pszUrl = 0x00212050 "http://www.vmware.com/pdf/ha_datasheet.pdf"

szCaption = char [258] "Microsoft Office"

pszBuf = 0x0b528060 "Opening http://www.vmware.com/pdf/ha_datasheet.pdf..Some files can contain viruses or otherwise be harmful to your computer..It is important to be certain that this file is from a trustworthy source...Would you like to open this file?.."

pszMsg = 0x0023fae8 "Opening %s..Some files can contain viruses or otherwise be harmful to your computer..It is important to be certain that this file is from a trustworthy source...Would you like to open this file?.."

2. Based on the above output from dump checking/analysis, I further reviewed and compared the captured Process Monitor trace in problem scenario and normal scenario. I found the key point is the following record “Excel.exe process tried to query one registry key value ‘EditFlags’ under the key ‘HKCR\htmlfile_FullWindowEmbed\’ instead of the PDF file extension related registry key location. But could not find it there.”:

11:02:57.1658855 AM 0.0000039 EXCEL.EXE 5208 RegQueryValue HKCR\htmlfile_FullWindowEmbed\EditFlags NAME NOT FOUND Length: 144

So the current suggestion to resolve the specific issue and suppress the warning message box pop-up when trying to open .PDF file through the http URL link is:

Please try to create/add the REG_DWORD type registry value “EditFlags” (with the value data "EditFlags"=dword:00010000) under the registry key location “HKCR\htmlfile_FullWindowEmbed\” on the same problem client machine. After that, please restart the client machine and then try to open the PDF file through the http URL link from the Excel file again.

Prishu at Daycare... with friends

2013-05-22T12:16:00.001+10:00

Prishu photos while at Daycare...

2013-02-18T15:39:00.002+11:00

'VBScript to check file creation date and extension name
'Script checks for files with particular extension in the specified folder and checks their creation date
'Rahul Patel

option explicit

dim objFSO, objStartFolder, objFolder, colFiles, ObjFile, DFC, count, objMessage
Set objFSO = CreateObject("Scripting.FilesystemObject")

'Change the directory you want to check for the file generation
objStartFolder = "C:\Temp"

Set objFolder = objFSO.GetFolder(objStartFolder)
Wscript.Echo objFolder.path

Set colFiles = objFolder.Files
Set objMessage = CreateObject("CDO.Message")

count = 0

For Each objFile in colFiles
'the FileExtension is CASE SENSITIVE... so make sure the extension check has the correct CASE
If objFSO.GetExtensionName(objFile.Name) = "txt" then
    DFC = objFile.Datecreated
    wscript.echo DFC
    ' change the "D" to "h" and then the < 2 to check on hours..
    IF (DateDiff("D", DFC, Date) < 2 ) then
        count = count + 1
        ' Can comment the filename output below... this was for testing only.
        Wscript.echo objFile.Name
    End IF
END IF

Next

IF count < 1 Then
'edit the text you want in the email sent to whatever you like if the FILES were NOT Generated...
'Wscript.echo "Files not generated"
objMessage.TextBody = "Files were NOT generated."
ELSE
'edit the text you want in the email sent to whatever you like if the FILES were Generated...
'Wscript.echo "Files were generated Fine... "
objMessage.TextBody = "Files were generated....."
END IF

objMessage.Subject = "File Generation check"
'FROM field
objMessage.From = "rahul.patel@met.com.au"
'TO Field
objMessage.To = "rahul.patel@met.com.au"
'objMessage.TextBody = "This is some sample message text."
objMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
'you will need anonymous allowed on the mail server to be able to run this script to send email without authentication. Else
'objMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate") = 1
'Recommend using Basic Auth
'Your UserID on the SMTP server
objMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendusername") = "youruserid"
'Your password on the SMTP server
objMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendpassword") = "yourpassword"

'The server below is for test purpose only. Suggest you get the correct server name.
objMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "mtbexc08v.met.local"
objMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
objMessage.Configuration.Fields.Update
objMessage.Send

'just to test the count output.
'wscript.echo Count

Find service pack levels for Windows using powershell

2012-08-17T15:31:00.001+10:00

Compile a list of servers, may be using another powershell script querying your AD container for servers.

The script below also does a ping test. To be honest, ping test doesn't really tell me if wmi query is going to work.

#$erroractionpreference = "SilentlyContinue"
$serverlist = Get-content 'C:\temp\Serverslist.txt.txt'

Foreach ($server in $serverlist)
{
    if((test-connection -computername $server -count 1 -ea 0 -quiet) -eq $true)

    {
    $serveros = Get-wmiobject -class win32_operatingsystem -computername $server
        foreach ($objserver in $serveros)
    {
        $server + "; " +$objserver.caption + "; " + $objserver.ServicePackMajorVersion
    }

    }
}

Time settings on Windows machines and Domain Controllers

2012-07-17T11:07:00.000+10:00

To check windows time settings use the command below

check config using the command

w32tm /query /configuration
AND
w32tm /dumpreg /subkey:parameters

Recommend to use the following structure for windows time settings with in a Windows Domain.

Set the Domain controller with the PDC emulator to get the time from a reliable NTP source.
for e.g. 1.au.pool.ntp.org
Run the command below to set the settings for the above
w32tm /config /syncfromflags:manual /manualpeerlist:1.au.pool.ntp.org /update

If you cant get to the internet via port UDP 123 from the PDC emulator, then i recommend pointing the ntp server to a router or a esx host or a xenhost or a proxy server. You would need to then set the time source on the proxy to be a reliable source.

FOR Member servers, other DCs and Workstations on the Domain

RUN the commands below as bat if you like

@echo off
w32tm /config /syncfromflags:DOMHIER /update
w32tm /resync
@echo on

You can apply the above bat as a startup policy on workstations.

Have fun.

Hope it helps.

RDP issue rdpcorekmts.dll Application error Event id 1000, Windows Server 2008 R2

2012-04-26T12:01:00.003+10:00

One of the Win2k8R2 running client access Exchange as upgraded to SP1. Did the same for other servers. Only one came up with issue. Checked the version of rdpcorekmts.dll version on the server with issue
with issue: version 6.1.7600.16952
without issue with sp1 version: 6.1.7601.17514

Followed the solution from here:

http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/f5855b60-f29c-4c90-b364-e364589e5267

Just a quick note the file is update by Windows Update KB2667402 not KB2621440. Please see http://support.microsoft.com/kb/2667402 for more details.
1) Connect remotely to affected server using the Computer Management Console
2) Stop the Remote Desktop Services
3) Take Ownership of file C:\Windows\System32\rdpcorekmts.dll and assign full NTFS permissions to your account
4) Rename file to rdpcorekmts.old
5) Copy file rdpcorekmts.dll from a non-patched server. I used another one of our domain controllers just to be safe.
6) Start the Remote Desktop Services
7) Test RDP login to server

WORKED FINE.

Trying to restore folders and files from Tape backup using Netbackup

2012-04-17T12:30:00.004+10:00

Trying to restore folders and files from Tape backup using Netbackup causes the file server to hang or crash when the restore folders contain Enterprise Vault placeholder files.

Every time we try to do a restore of a folder that contains Enterprise vault Placeholder files, the file server was crashing.

Came across this link.

http://www.symantec.com/business/support/index?page=content&id=TECH62001

File server running the File System Archiving (FSA) Agent for Enterprise Vault 2007 can hang during NetBackup Restore operations.

Problem

File server running the File System Archiving (FSA) Agent for Enterprise Vault 2007 can hang during NetBackup Restore operations.

Solution

Legacy placeholders (7.0 SP1, 7.0 and 6.0 SP4 and earlier) for files smaller than 4kb can cause system hangs due to an issue with the Master File Table in NTFS.

Workaround:
This issue can be worked around by unloading the evfilter driver with the fltmc command during the restore operation. (See Related Documents article 293389)

This issue can be avoided by recalling all placeholders created with older versions of Enterprise Vault (7.0 SP1, 7.0 and 6.0 SP4 and earlier), then allowing Enterprise Vault to re-archive and create new placeholders. Additionally, such small files can be excluded from being archived at all with a policy rule based on file size.

Symantec is planning on enhancing the evupdateplaceholder.exe tool to rectify legacy placeholders in the next major release for Enterprise Vault 2007.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

THE FIX is.. NOTE: this will make archived files inaccessible during the restore.

http://www.symantec.com/business/support/index?page=content&id=TECH54993

How to use FLTMC.exe to load and unload the evfilter mini-filter driver for Enterprise Vault (EV) for File System Archiving (FSA)

Problem

How to use FLTMC.exe to load and unload the evfilter mini-filter driver for Enterprise Vault (EV) for File System Archiving (FSA).

Solution

The FLTMC.exe command is run from a cmd prompt on the Windows file server. The syntax is as follows:

To unload the EvFilter driver:

Fltmc unload EvFilter

To load the EvFilter driver:

Fltmc load EvFilter

To view all instances of loaded drivers:

Fltmc instances

To attach the driver to a specific volume:

Fltmc attach EvFilter C:

To detach the driver from a specific volume:

Fltmc detach EvFilter C:

NOTE: The EV services on the file server should be restarted after unloading and reloading the filter driver.
For troubleshooting purposes the results can be saved to a text file. The syntax would be the same as above but adding > [File name and path]
ie: Fltmc instances > C:\FilterInstance.log

ONS Failed to Start. ONS.exe keeps crashing, Oracle ONS not starting in Windows

2012-03-13T17:21:00.003+11:00

Oracle node error. When trying to add a node to Oracle RAC

CRS-0215 / ONS Failed to Start. Pingwait Exited With Exit Status 2

Extract from Oracle KB Article

Applies to:

Oracle Server - Enterprise Edition - Version: 10.1.0.2 to 11.1.0.7 - Release: 10.1 to 11.1 Information in this document applies to any platform.

Symptoms

Problem can occur during an installation of CRS or while adding a new node.

* ONS fails to startup on one or both the nodes during a new install.

* When adding nodes, the ONS on the new node fails to start.

srvctl start nodeapps -n node2

CRS-0215: Could not start resource 'ora.node2.ons'.

$RDBMS_HOME/opmn/logs/ons.log does not have any updates.

Cause

The problem is that the remote port for ONS is used or not available.

Solution

Set up debugging :

srvctl stop nodeapps -n node2

crsctl debug log res 'ora.node2.ons:5'

srvctl start nodeapps -n nodename

- $ORA_CRS_HOME/log//racg/ora.node2.ons

2008-12-05 13:13:11.296: [RACG][3184] [3144][3184][ora.node2.ons]: ons failed to start. pingwait exited with exit status 2

Test:

ons.config :

localport=6150

useocr=on

allowgroup=true

usesharedinstall=true

onsctl ping on node 2 :

onsctl ping

Number of onsconfiguration retrieved, numcfg = 2

onscfg[0]

{node = node1, port = 6251}

Adding remote host node1:6251

onscfg[1]

{node = node2, port = 6251}

Adding remote host node2:6251

ons is NOT running . . .

onsctl start on node2 :

onsctl start

Number of onsconfiguration retrieved, numcfg = 2

onscfg[0]

{node = node1, port = 6251}

Adding remote host node1:6251

onscfg[1]

{node = node2, port = 6251}

Adding remote host node2:6251

Number of onsconfiguration retrieved, numcfg = 2

onscfg[0]

{node = dbserver01, port = 6251}

Adding remote host node1:6251

onscfg[1]

{node = dbserver02, port = 6251}

Adding remote host node2:6251

ons failed to start. pingwait exited with exit status 2

OCRDUMP

[DATABASE.ONS_HOSTS.node1]

ORATEXT : node1

SECURITY : {USER_PERMISSION : PROCR_ALL_ACCESS, GROUP_PERMISSION : PROCR_READ,

OTHER_PERMISSION : PROCR_READ, USER_NAME : administrator, GROUP_NAME : }

[DATABASE.ONS_HOSTS.node1.PORT]

ORATEXT : 6251

SECURITY : {USER_PERMISSION : PROCR_ALL_ACCESS, GROUP_PERMISSION : PROCR_READ,

OTHER_PERMISSION : PROCR_READ, USER_NAME : administrator, GROUP_NAME : }

[DATABASE.ONS_HOSTS.node2]

ORATEXT : node2

SECURITY : {USER_PERMISSION : PROCR_ALL_ACCESS, GROUP_PERMISSION : PROCR_READ,

OTHER_PERMISSION : PROCR_READ, USER_NAME : administrator, GROUP_NAME : }

[DATABASE.ONS_HOSTS.node2.PORT]

ORATEXT : 6251

SECURITY : {USER_PERMISSION : PROCR_ALL_ACCESS, GROUP_PERMISSION : PROCR_READ,

OTHER_PERMISSION : PROCR_READ, USER_NAME : administrator

Note: Remote port is registered in the ocrdump. You do not need to have the RemortPort in the ons.conf file.

Solution :

The key issue is that the remote port that we see in the ocrdump is used/unavailable

Ran netstat and found that the node did not have a free port 6251.

Reconfigured ons to use a different free port. In this case we used 2200

srvctl stop nodeapps -n node2

racgons remove_config node2:6251

racgons add_config node2:2200

The two nodes can be configured with different ports. However in this case we made the same modification to both the nodes.

ocrdump will now reflect the new PORT.

- srvctl start nodeapps -n node2 and it started successfully.

Variation of this problem :

The problem can manifest when adding a node on windows and perhaps on other platforms as well.

From our documentation :

Oracle? Database Release Notes

11g Release 1 (11.1) for Microsoft Windows

Part Number B32005-06

4 Installation, Configuration, and Upgrade Issues

4.7 Incorrect Port Number Registered for the New Node

When you run the crssetup.add.bat batch file to add another node, incorrect

port number is registered for the new node.

Workaround: Complete the following procedure to resolve this issue:

After running the crssetup.add.bat batch file, ignore the error messages

similar to the following error message:

Starting ONS application resource on (*) nodes1:CRS-0215: Could not start

resource 'ora.*.ons'

Use the following command to stop the nodeapps service on all the newly added

nodes:

srvctl stop nodeapps -n node

Use the following command to delete the existing ONS port number registration:

racgons remove_config node:4948

Use the following command to add an ONS port number:

racgons add_config node:remote_port

Use the following command to start the nodeapps service on all the newly added

nodes:

srcvtl start nodeapps -n node

*********************SOLUTION FOR WINDOWS ********************

The issue in windows in my case wasnt the port being used. The issue was due to the fact that the port being configured with the hostname was in the wrong case.

Get the hostname via Command prompt windows and 'Hostname'. In my case the hostname we were trying to get ONS to run was node003 and it kept failing.

Looking up the hostname showed the hostname as NODE003 instead. So doing the below with the correct CASE resolved the issue.

D:\oracle\product\11.1.0\crs\BIN>srvctl stop nodeapps -n node003

D:\oracle\product\11.1.0\crs\BIN>racgons remove_config node003:2300

racgons: Existing key value on node003 = 2300.

racgons: node003:2300 removed from OCR.

D:\oracle\product\11.1.0\crs\BIN>racgons add_config NODE003:6251

D:\oracle\product\11.1.0\crs\BIN>srvctl start nodeapps -n NODE003

D:\oracle\product\11.1.0\crs\BIN>srvctl status nodeapps -n node003 VIP is running on node: node003 GSD is running on node: node003 Listener is running on node: node003 ONS daemon is running on node: node003

Wrong Time/Date on files showing up on Citrix sessions ICA and local computer

2012-02-09T18:37:00.000+11:00

Files created on a server via RDP show different time stamp when checked via ICA.

Time zone policy settings issue.

You need this http://support.citrix.com/article/CTX127926
and

• Disable - Windows Components

/Terminal Services/Client/Server data redirection/Allow Time Zone in a GPO
• Copy Hotfix tzuser.dll to C:\Program Files\Citrix\System32
• Created a Citrix Police to Enable "Do not estimate local time for legacy clients" and Enable "Do not use Clients local time"

http://forums.citrix.com/message.jspa?messageID=1362140

Enabled SA account on SQL Express when access is denied

2012-02-07T17:48:00.000+11:00

I was unable to enable SA account or enabled Mixed mode authentication. Keep getting access denied errors when trying to do so using a local admin account on the box. Win 7 pro. SQL Express 2008

The steps below helped.

First Attemp:
(NOTE: This didnt work, the mode did change to Mixed but still access denied on SQL to enable SA or add another sysadmin account)

Force SQL server to support mixed-mode authentication.
1. Run REGEDIT
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQLServer
NOTE: This key may vary slightly based on the installed version and instance name.
3. Set "LoginMode" to 2.
4. Restart SQL Server.
(Source: http://support.microsoft.com/kb/285097 )

Second Attempt:
(note: Magic, worked fine.)
Force SQL server to let you in temporarily
1. Go to services.
2. Stop SQL Server.
3. Grab the SQL server command-line (right click the service - properties). Mine is:
"C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS
4. Open an administrative command prompt.
5. Run the command-line from step 3, but add -m -c for single-user maintenance mode command-line.
6. Open another administrative command prompt.
7. Run "sqlcmd -S localhost\SQLEXPRESS" from that same directory (replace with your server and instance name)
8. Now you can do all the stuff everyone told you to do that didn't work. For example, to create a hero user with administrative accss:

CREATE LOGIN TheBoss WITH PASSWORD='123', DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english], CHECK_EXPIRATION=OFF, CHECK_POLICY=OFF
EXEC sys.sp_addsrvrolemember 'theBoss','sysadmin'
GO

9. QUIT and close the command-prompt
10. Go to the SQL Server command-line window and hit ctrl+C. It will prompt "Do you wish to shutdown SQL Server (Y/N)?" and enter Y.
11. Close the command-prompt
(Source: http://msdn.microsoft.com/en-us/library/dd207004.aspx )

III. Finally, login using your hero:
1. Restart the SQL Server service
2. Login using SQL Server authentication as the user "theBoss" with password "123"
Yewheww...

thanks to MobyDisk on http://social.msdn.microsoft.com/Forums/en-US/sqlsecurity/thread/60b888bf-30dc-4eaf-bea8-5fd55181f8e5

Group Policy Work with Citrix Published Applications - HOW TO

2012-01-20T14:01:00.000+11:00

I came across an issue, whereby I needed to publish an app, which was basically launching an Intranet URL within IE from the Citrix servers for External citrix users.

The issue i was facing was that the trusted sites list from within IE specified USER GPO would not get applied.
Hence, users would not be able to access the intranet url.

After searching on the issue, it turns out to be a Microsoft Feature/Citrix Feature.

This link provides the solution and explanation:

https://www.conetrix.com/Blog/post/How-to-Make-Group-Policy-Work-with-Citrix-Published-Applications.aspx

Below is the extract from that post:

When a user with an empty roaming profile (new user) has their profile created as the result of running a published application, the user portion of the registry hive (ntuser.dat) is not created in its entirety. The users' hive can be loaded and a number of noticeable differences exist between it and the default user registry hive. If the user profile is created by logging on locally (console), via RDP to the same machine, or via Citrix published desktop on the same machine, the profile that is created is complete. I was unable to find any noticeable differences between the default user registry hive and that of the newly created roaming user profile when the profile was created in this way. Additionally, once an incomplete profile had been created via published application session, the profile could NOT be "fixed" by logging on via RDP or published desktop. Once the registry hive was created in an incomplete fashion, it seemed to be affected from then on. So why are we talking profiles...I thought this was about group policy? Well, it is...I'm getting there.
We found that users running published applications did not have group policy correctly applied. We were trying to set policies on Internet Explorer using Internet Control Panel settings in the user portion of the GPO. Specifically, IE security zone settings such as trusted and intranet sites would not apply. We also noticed that each security zone seemed to be locked. In the Security tab of the Internet Options dialog box, all the icons were the same....blue IE symbol with a lock next to it. The "Sites" button and the "Custom Level" button were also grayed out. So, here is the where the profile problem merges with the group policy problem. I found that by manually exporting certain keys from the default user profile registry hive under \Software\Microsoft\Windows\CurrentVersion\Internet Settings\ and importing them into in a incomplete user registry hive, I could fix the problem. That is, once the keys existed in the user registry hive that pertained to the settings I was trying to set via group policy, the policy was applied correctly...no issues. Makes sense right....if the group policy is setting registry keys in order to apply certain policies, it’s not going to work if the keys don't exist in the first place.
So things have come full circle. Group policy isn't working because the user profile is messed up. So why is the user profile not getting created correctly? Well, this is actually a Microsoft problem --> http://support.microsoft.com/kb/899270. And the script they provide doesn’t work…we tried it. Actually, there is more to the problem than that, but here is a summary of the information that we gathered. By design, Citrix published applications, remote applications in Windows 2008, and the "start this application on connection" functionality of RDP (mstsc.exe) running against Windows 2003 servers implement limited logon functionality so that the session footprint is smaller than a normal desktop session. Part of the "limited functionality" is that the user session does not start explorer.exe. So, any application that depends wholly or in part on explorer.exe could have issues. Some of the important pieces of functionality that explorer.exe implements are the following:

The run registry entry
The RunOne registry entry
Startup applications

If you have ever noticed the small gray box that is displayed the first time you log on as a new user, you have seen the effects of explorer.exe running at session logon. It goes by fast, but it says something like "applying internet explorer customizations", "setting up windows media player..."...stuff like that. That little box is normally initiated by explorer.exe. It is called runonce.exe. What we found was that if we initiated runonce.exe in a logon script, the user was created correctly when running published application; thus, group policy was applied correctly as well. Testing also showed that this process could also fix a previously created broken user registry hive (ntuser.dat). All we had to do is add the following to our logon.bat file
start /MIN %windir%\system32\runonce.exe /AlternateShellStartup
Citrix has documented this problem in a support article (http://support.citrix.com/article/CTX104374) and they refer back to the previous MS KB listed above. Numerous forums threads exist on this issue and we were unable to find a resolution elsewhere that did not include scripting registry imports to the user profile at logon. This workaround seems to be a more flexible and reliable.

Eventually, for me. i had to create a GPO with user loopback processing - merge, setup IE trusted list, and run the cmd in bat file at logon. apply the gpo to the citrix servers ou and filter it via Global groups.

Cheers

Rahul

Replicate Security Group membership from One Domain to Another.

2011-09-28T14:44:00.000+10:00

Using powershell, and making lot of string customisations to get the output as desired....
Not the best of scripting.. but does the job i want it to do, with a bit scratchy error reporting...

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# connection variables for all AD

$SourceAD = Connect-QADService -Service SourceAD_DC.local -ca sourcedomain\admin -cp (convertTo-SecureString password123 -ASPlainText -force)
$DestAD = Connect-QADService -Service DestAD_DC.local -ca Destdomain\admin -cp (convertTo-SecureString password123 -ASPlainText -force)

#Gets group names from file C:\temp\GroupCopySource\GroupsA.txt (Source Domain1 Groups),
#which then gets all members in the group, string manipulation is done to get only username and groupname
#so that we can use them in Domain2 AD for comparing and adding group members

#

Get-Content C:\temp\GroupCopySource\GroupsA.txt | ForEach-Object -Process {$member=get-qadgroupmember $_ -connection $sourceAD | Select-Object -expandProperty SamAccountName;
$new = $_.split("\");
$groupname=$new[1];
$groupfinal = "GSG-sourcedomain-$groupname";
$member > C:\temp\GroupCopyTask\$groupfinal.txt;
ForEach ($b in $member) {trap [Exception] { Add-Content c:\temp\GroupCopyJob\errors.txt $error" groupname = "$groupfinal"`n"; $error.clear(); Continue} Add-QADGroupMember -identity $groupfinal -member ("destdomain\$b") -connection $DestAD;
Add-content C:\temp\GroupCopyDest\$groupfinal"_copyresult.txt" $b}} > C:\Temp\GroupCopyJob\scriptoutput.txt

#clear all variables before being used.

Clear-Variable member
Clear-Variable groupfinal
Clear-Variable groupname
Clear-Variable new

Windows domain controller without Windows...

2011-06-19T21:42:00.001+10:00

Sounds good...
have to try it...

http://www.vmware.com/appliances/directory/393283

Ubuntu(windows) domain controller...

Resizing Disks used in a MSCS in VMWare

2011-06-09T09:29:00.000+10:00

To take a backup of the VMDK:

Stop the cluster nodes.

Rename the VMDK that needs to be expanded with the command:

vmkfstools -E

Clone the VMDK to a thin volume using the original name with the command:

vmkfstools -I -d thin

Grow the clone with the command:

vmkfstools -X

Inflate the cloned VMDK with the command:

vmkfstools -j

Start the cluster.

Remove the old VMDK from the datastore.

------------

backup the vmdk

1. vmkfstools –E servervm.vmdk servervm_old.vmdk (this renames the vmdk)

2. vmkfstools –i servervm_old.vmdk servervm.vmdk –d thin (clones the renamed vmdk to original name in thin format)

3 vmkfstools –X 200G servervm.vmdk (expand the available size to 200 GB)

4. vmkfstools –j servervm.vmdk (inflates the vmdk in eargerzeroedthick format)

Conclusion: I think its just another way to redo the metadata on the VMDK files so it reads the new resized disk properly...

Exchange 2010 - hub Transport not accepting SMTP connections, ForeFront client security enabled

2011-06-08T11:32:00.000+10:00

Need to make sure proper exclusions are in place such as the transport service in exch2010

http://technet.microsoft.com/en-us/library/bb332342.aspx

SCAN option not available at Right Click with Symantec Endpoint Protection

2011-05-17T11:11:00.001+10:00

Found out that,

the Right Click - SCAN option is not available when logged in via RDP session on SEP clients.

May be you already knew that, i didnt...

Also, if there is a centralized exception to the folder you are trying to scan manually,
IT WILL STILL NOT SCAN the folder if it is part of the exceptions.

Cheers

Reset password while unlocking SQL

2011-05-10T17:48:00.000+10:00

If you uncheck the enforce password policy then on the General screen then click ok then go back and recheck the enforce password policy after clicking ok the first time then the account will be unlocked w/o changing the password.

How to map a network drive to be used by a service

2011-04-27T12:25:00.000+10:00

For this hack you will need SysinternalsSuite by Mark Russianovich: http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx
Step one: Open an elevated cmd.exe prompt (Run as administrator)
Step two: Elevate again to root using PSExec.exe: Navigate to the folder containing SysinternalsSuite and execute the following command "psexec -s cmd.exe" you are now inside of a prompt that is "nt authority\system" and you can prove this by typing "whoami"
Step Three: Create the persistent mapped drive as the SYSTEM account with the following command "net use z: \servername\sharedfolder /persistent:yes"
It's that easy!
WARNING: You can only remove this mapping the same way you created it, from the SYSTEM account. If you need to remove it, follow steps 1 and 2 but change the command on step 3 to: "net use z: /delete"
NOTE: The newly created mapped drive will now appear for ALL users of this system but they will see it displayed as "Disconnected Network Drive (Z:)". Do not let the name fool you. It may claim to be disconnected but it will work for everyone. That's how you can tell this hack is not supported by Microsoft.

UPDATE

Hi all,

Thanks for the feedback.

I have finally had a chance to try and find a workaround to get the mapping done when the computer restarts. I have done limited testing, but so far this seems to have worked.

Follow this article to create a service with whatever name u like

http://support.microsoft.com/kb/137890

I suggest creating something like

C:\Program Files\Resource Kit\Instsrv.exe MapDriveAsSystem C:\Program Files\Resource Kit\Srvany.exe

Then do the regedit as described in the article.

There is a bit more to it then just running the psexec command.

You HAVE TO MAKE SURE THE SERVICE RUNS under a USER account and NOT LOCAL SYSTEM

Then its upto you to set the service startup requirement. The service stays in started state although the psexec has completed its task. So if you were to manually delete the mapping the service would show as started regardless. To improvise on that. may be you could create a bat file with the psexec command to map as system and then a SC command to stop the same service.

Shouldnt matter though, as we are only doing this service creation to handle the mapping on a computer reboot.

Hope it helps.

Cheers

Rahul

ICA Connections Hangs or Stops at 'Connection Established, Negotiating Capabilities'

2011-03-28T12:12:00.001+11:00

ICA Connections Hangs or Stops at 'Connection Established, Negotiating Capabilities'

Document ID: CTX123816 / Created On: Jan 11, 2010 / Updated On: Jan 11, 2010

LINK is here

View products this document applies to

Symptoms

ICA connections hang or stop at "Connection established. Negotiating capabilities” specific to client workstation or domain user . Also connecting to a specific server always hang at “Connection Established, Negotiating Capabilities”.

My machine + his\her credentials = success
Another machine + his\her credentials = success
His\Her home machine + his\her credentials = failure
His\Her home machine + test ID = failure

Cause

Usually this is caused by an inaccessible license server.

Server results in not getting a correct license, probably the license server detects that several servers are using the same license and blocks it, especially if servers are cloned.

Resolution

Caution! This procedure requires you to edit the registry. Using Registry Editor incorrectly can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Back up the registry before you edit it.

1. On client workstations with this issue, change the permissions on the registry key HKLM\SOFTWARE\Microsoft\MSLicensing. Give the Users Group Full Control or specific domain user account.

If you delete the key, Terminal Services recreates it when it acquires a license. However, the permissions on this key are set to read-only by default. Only administrators have full control rights. This means that only an administrator can request a Terminal Services license for this server. Once it is acquired, every user can use it.

2. Delete (rename or export key to be safe) the HKLM\Software\Microsoft\MSLicensing\HardwareID and HKLM\Software\Microsoft\MSLicensing\Store keys

More Information

Other solutions:

For Windows 2000 Professional systems: delete the License000x key to resolve the issue.

On each of your Citrix Presentation servers open the registry editor and navigate to
"HKEY Local Machine/System/Current ControlSet/Services/TermService/Parameters".

Delete the following keys (after making a backup):
Certificate
X509 Certificate
X509 Certificate ID
Reboot your server and verify that the issue is gone.

Rahul's corner

SCCM reporting, SQL 2014, AG setup

Setup and Enable Certificate Authentication on ADFS 3

Scope:

Things done:

Things that were wrong or went wrong:

Disclaimer:

System Center 2016 - SCOM - Operations Manager Installation issues, SQL 2014 cannot create database

Oracle RAC installation on Windows 2008 R2 - User equivalence and Remote Registry Gotcha

"DHCP...." followed by "PXE-E53: No boot filename received"

Setting up ADFS Farm with ADFS proxy and F5 Load balancer....

How to enable or disable hyperlink warning messages in 2007 Office programs and in Office 2010 programs particularly for PDF do documents that open up in Internet Explorer.

Troubleshooting information gathering:

SOLUTION:

Prishu at Daycare... with friends

Find service pack levels for Windows using powershell

Time settings on Windows machines and Domain Controllers

RDP issue rdpcorekmts.dll Application error Event id 1000, Windows Server 2008 R2

Trying to restore folders and files from Tape backup using Netbackup

File server running the File System Archiving (FSA) Agent for Enterprise Vault 2007 can hang during NetBackup Restore operations.

Problem

Solution

How to use FLTMC.exe to load and unload the evfilter mini-filter driver for Enterprise Vault (EV) for File System Archiving (FSA)

Problem

Solution

ONS Failed to Start. ONS.exe keeps crashing, Oracle ONS not starting in Windows

Wrong Time/Date on files showing up on Citrix sessions ICA and local computer

Enabled SA account on SQL Express when access is denied

Group Policy Work with Citrix Published Applications - HOW TO

Replicate Security Group membership from One Domain to Another.

Windows domain controller without Windows...

Resizing Disks used in a MSCS in VMWare

Exchange 2010 - hub Transport not accepting SMTP connections, ForeFront client security enabled

SCAN option not available at Right Click with Symantec Endpoint Protection

Reset password while unlocking SQL

How to map a network drive to be used by a service

ICA Connections Hangs or Stops at 'Connection Established, Negotiating Capabilities'

ICA Connections Hangs or Stops at 'Connection Established, Negotiating Capabilities'

This document applies to: