Smart IT for SMB

SCOM: Building Instance Groups from Groups of a Different Class

2011-04-05T07:00:00.021-04:00

When I first started working with Operations Manager, one of the items that I struggled with was how to make a group from another group targeting a different class such as all Non-System Drives hosted on Windows 2008 Servers. This can just as easily be used to help segment your management environment among multiple groups or departments managing different aspects of your environment.
You may have multiple web development groups in your organization and each may use similar systems, IIS and Tomcat for example, but they may each desire different overrides for the same components. Segmenting their views of the environment is relatively simple through simple computer groups, but overrides need to be targeted at the actual object class. This is especially true if you have a group that wants overrides targeted at some logical disks, but not all.

There are a number of articles out there that talk through how to use the SCOM containment constructs to your advantage (See References at end of the article), but none that I found specifically talked about how to use groups, either instance or computer, as a part of the formula. While on the surface it appears the same principles should work, my first few attempts were anything but successful.

The first thing that you discover is like I have already hinted at, not all groups are created equal. There are many different kinds of groups and each one has their own containment relationship. This is critically important as the group population rules need to refer to the proper relationship entity or the workflow errors out. Luckily for us, most of the management packs I have seen use either the Computer Groups or the Instance Group constructs provided by the base System Center Libraries. Computer Groups are defined in the Microsoft.SystemCenter.Library management pack and are groups that may only contain computers. Computer Groups have a Relationship named Microsoft.SystemCenter.ComputerGroupContainsComputer defined. Instance Groups are defined in the Microsoft.SystemCenter.InstanceGroup.Library management pack and are groups that may contain any combination of any class. Instance Groups have a relationship named Microsoft.SystemCenter.InstanceGroupContainsEntities defined.

Now I am sure that you are asking yourself, "How did he find that out?" I assure you that it was not through any sort of divine intervention, centuries old enlightenment techniques, or voodoo. (no animals were harmed in the writing of this article)

It is a simple thing to lookup for any group (or any other type of object for that matter). Simply have the management pack defining the object open in the Authoring Console (Even if it is a sealed management pack, you can still use the Author Console to view its configuration, you just can't change it). From the Service Model tab, find your Group in the Classes list. (Yes, groups are treated as classes just like every other logical representation construct in SCOM) To find out what kind of group construct that your group is defined from, simply look at the "InheritedFrom" column of the main view or look at the Base Class selection on the General Tab of the properties window. To discover the relationship defined for your group, simply navigate to the Relationships Tab of the properties window for your group and all will be revealed.

Now that we know the containment details for our group, we can use the same steps to uncover the containment relationships for essentially any other object in the system and use those relationships to build our Group Populator configuration XML.

Let say we want to create a group of all logical drives that are not named "C:" on machines contained in a group Named "Production Webservers" because our web team only wants to see alerts on Non-System Drives. (AKA they want you addressing all the system drive problems) In a management pack that you control, you simply create a new Instance Group of whatever name you want in the Classes section of the Service Model Tab of the Authoring Console. Then navigate to the discoveries section of the Health Model tab of the authoring console and create a new Custom Discovery object named whatever you like. (Good naming consistency does help when you have to revisit these later) For the target of the discovery, select the Group Class you created earlier. On the Classes Tab, make sure that the relationship for your group class is defined in the "Discovered relationships and their attributes" window. For an Instance class, this should be Microsoft.SystemCenter.InstanceGroupContainsEntities.

Now for the dreaded Configuration Tab. Be Strong, you can do this.

For a type, select GroupPopulator. This will bring up a configuration window for the GroupPopulator object type. Enter $MPElement$ for the RuleID. Enter $Target/Id$ for the GroupInstanceID. (See 2 fields out of the way and we haven't had to sweat yet)

Now for the Membership Rules. For this, I am going to show the full XML and then explain where/how it is derived from.
<MembershipRule>
<MonitoringClass>$MPElement[Name="MicrosoftWindowsLibrary6172210!Microsoft.Windows.LogicalDisk"]$</MonitoringClass> <RelationshipClass>$MPElement[Name="MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities"]$</RelationshipClass>
<Expression>
<And>
<Expression>
<Contained>
<MonitoringClass>$MPElement[Name="MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer"]$</MonitoringClass>
<Expression>
<Contained>
<MonitoringClass>$MPElement[Name="MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroup"]$</MonitoringClass>
<Expression>
<SimpleExpression>
<ValueExpression>
<Property>$MPElement[Name="SystemLibrary6172210!System.Entity"]/DisplayName$</Property>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Production Webservers</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Contained>
</Expression>
</Contained>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<Property>$MPElement[Name="SystemLibrary6172210!System.Entity"]/DisplayName$</Property>
</ValueExpression>
<Operator>DoesNotMatchWildcard</Operator>
<Pattern>^C:$</Pattern>
</RegExExpression>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<Property>$MPElement[Name="SystemLibrary6172210!System.Entity"]/DisplayName$</Property>
</ValueExpression>
<Operator>MatchesWildcard</Operator>
<Pattern>^_:$</Pattern>
</RegExExpression>
</Expression>
</And>
</Expression>
</MembershipRule>

Relax. Breathe slowly and deeply. Don't Panic, we are going to tackle this together. Let's take it from the top.

The membershiprules section of the XML configuration, needs to contain one or more membership rules, so we start off with (and end with) the tags (<MembershipRule></MembershipRule> denoting a MembershipRule. The next line containing the <MonitoringClass> tag denotes what type of objects we are placing in our group. In our case, we want Logical Disk objects. Logical Disk objects are Management Pack elements, so we need to denote that by the $MPElement[Name=""]$ portion of the line. We can see that Logical Disks are named Microsoft.Windows.LogicalDisk by looking at the class definitions of the Windows OS Management packs. So where did the "MicrosoftWindowsLibrary6172210!" portion of the line come from? It turns out that you can have different definitions of the same class from different management packs, so you need to tell the Group Populator which definition you are intending to use, which is done by "aliases".

The easiest way I have found to uncover the alias being used by your management pack is to simply open the raw management pack XML file with a text editor and retrieving the Alias from the references section of the file near the top. In my case, the Windows Library Reference looks like this:
<Reference Alias="MicrosoftWindowsLibrary6172210">
<ID>Microsoft.Windows.Library</ID>
<Version>6.1.7221.0</Version>
<PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
</Reference>

I now know that the alias for the Windows Library being used in my management pack is "MicrosoftWindowsLibrary6172210". This will vary from management pack to management pack on the same system, so get in the habit of looking it up. The only character in the line left undefined is the "!" character between the alias and the class definition and it is simply a delimiter to let the group populator know where the alias definition ends and the class name begins.

The line with the <RelationshipClass> tags simply defines which relationship definition we are using to define our group and is built using the info we learned earlier about our Group and is constructed in the same way as the <MonitoringClass> line.

We now need to restrict which logical disks end up in our group, which is done with <expression> tags using a sort of "backwards Reverse Polish Notation" of <operator> <operand> <operand> . Logical operators such as <AND>, <OR> and comparisons like <EQUAL>, <MatchesWildcard>, etc are fairly simple to understand and are explained in great detail elsewhere. The more interesting operators in this construct are the <Contained> and <Contains> operators. The contained and contains operators denote containment relationships either moving up or down the containment tree. Each rule is constructed of operands built in the same manner as we did the original <MonitoringClass> line.

Roughly translated, the membership rules defined in the XML above equate to:
All Logical Disks contained on Computers contained in a Group named "Production Webservers" with logical disk names that are 2 character names ending in a colon (_:$) and not named "C:"

The 2 character names portion of the rule needed to be included in my environment as it includes Windows Cluster servers and the logical disks used by the cluster appear as "GUID" strings on the passive node of the cluster.

Hopefully this example can help you to implement similar constructs in your environment and to better understand the Group Populator rules in general.

Good Reference Sites

http://systemcentercentral.com/BlogDetails/tabid/143/IndexID/67784/Default.aspx
http://technet.microsoft.com/en-us/library/ee957040.aspx
http://technet.microsoft.com/fr-fr/library/dd362550.aspx

Operations Manager: Cleaning Up Cluster Resources

2011-03-31T07:00:00.002-04:00

Fixing client issues or removing defunct clusters is one of the more frustrating tasks in Operations Manager. You try to uninstall the client on a Windows Cluster node and you are immediately met with a message that that the "Agent is managing other devices and cannot be uninstalled. Please resolve this issue via Agentless managed view in Administration".
If you are brave enough to keep fighting, you will find that you can remove the client from any "passive" nodes in the cluster. This is because all of these clients are truly agentless. The clients on any "active" node of the cluster will not uninstall through any means on the console.
This problem exists for the most part because the cluster itself physically does not. That is to say that the cluster itself, and its associated groups, is a virtual entity that exhibits most of the same properties as a computer resource without actually being a physical resource. It has a name, a domain, an IP address, one or more logical disks… You get the point. However, there is not a physical server to actually "house" the agent. These virtual resources need to be managed "remotely" through agentless monitoring and it is the active node of the cluster housing the physical resources that is responsible for monitoring those resources. It is this agentless monitoring that leads to the client maintenance problems.
There are a couple different approaches to correcting this problem; both are pretty drastic and not for the faint of heart. The first more common recommendation is a pretty ugly SQL query to purge the OperationsManager database of the cluster resources. These queries typically look something like this:
declare @nodeHS nvarchar(255)
Set @nodeHS=N'Microsoft.SystemCenter.HealthService:FQDN'
DECLARE Rel_Cursor CURSOR
FOR
(SELECT [RelationshipGenericView].[Id]
FROM dbo.RelationshipGenericView
WHERE ((RelationshipGenericView.[MonitoringRelationshipClassId] = dbo.fn_ManagedTypeId_MicrosoftSystemCenterHealthServiceShouldManageEntity())
AND
(((dbo.[RelationshipGenericView].[IsDeleted] = 0))))
AND
([RelationshipGenericView].[SourceMonitoringObjectId]
    IN
(select BaseManagedEntityId from BaseManagedEntity where FullName =@NodeHS)))
OPEN Rel_Cursor;
declare @relId uniqueidentifier
declare @discoSource uniqueidentifier
declare @now datetime
set @now =
GETUTCDATE()
FETCH
NEXT
FROM Rel_Cursor INTO @RelId;
WHILE
@@FETCH_STATUS
= 0
BEGIN
    SELECT @discoSource=DSTR.[DiscoverySourceId]
    FROM dbo.[DiscoverySourceToRelationship] DSTR
        inner
join dbo.[DiscoverySource] DS on DS.DiscoverySourceId = DSTR.DiscoverySourceId
        inner
join Discovery on Discovery.DiscoveryId = DS.DiscoveryRuleId
                   WHERE [DiscoveryName] =
'Microsoft.Windows.Cluster.Classes.Discovery'
                   AND [RelationshipId]=@relId
                   AND DSTR.[IsDeleted] = 0
    exec dbo.p_RemoveRelationshipFromDiscoverySourceScope
    @RelationshipId=@relId,
    @DiscoverySourceId=@discoSource,@TimeGenerated=@now
    FETCH
NEXT
FROM Rel_Cursor INTO @RelId;
END;
CLOSE Rel_Cursor;
DEALLOCATE Rel_Cursor;
Where FQDN is the fully qualified domain name of one of your physical cluster nodes.
This query would then need to be run once for each physical node in the cluster.
After that "emergency chainsaw surgery", the client will be able to be removed from the physical nodes in a "normal" way, repaired, or simply deleted and while this method does certainly work, it has all the subtlety of a 2000lb bomb.
There is another way that at least saves you from needing to go tromping through the production database and that is through judicious use of the "remove-disabledmonitoringobject" commandlet. The first step in this approach is to create a group housing the individual physical members of the cluster needing client maintenance/decommissioning. After the group is created, you simply need to create overrides for all of the cluster discovery methods disabling them for targets in your newly created group. After giving your management group sufficient time to fully replicate the new overrides throughout the hierarchy, one can simply launch the Ops Manager Powershell connected to your root management server and run the "remove-disabledmonitoringobject" commandlet. Once this commandlet completes, the cluster instance should be removed from your management group allowing you to then perform any necessary maintenance on the physical nodes' clients. While this is certainly more precise and less risky than direct SQL Queries in the production database, it is still far from ideal.
It should not be necessary to remove the entire cluster from the management group to perform simple client maintenance on any of the physical nodes. Given that clustering is one of the more common HA approaches and the assumption that if you want something to stay HA it needs to be proactively monitored, needing to resort to tactics like these should not be necessary. Hopefully MS finds a better approach in the future.

Advanced AD Inter-Site Replication

2011-03-29T07:00:00.001-04:00

Many of us have physical locations that are connected by high-speed connections, but we have elected to still represent these sites as separate AD Sites for other reasons: segmentation of authentication traffic, global catalog load balancing, DFS Root location, disaster recovery, etc. Unfortunately, now that the DCs are in separate AD sites, replication is relegated to the timed replication cycle rather than the change notification cycle used within the same site, or are they?

Before we discuss how to change one's Inter-Site links, let us review the 2 primary mechanisms used for replication within Active Directory: Timed Replication and Change Notification Replication.
The default replication mechanism for Intra-Site connections, DCs within the same AD Site, is Change Notification Replication. This is a mechanism where each Domain Controller communicates directly to the others in its site immediately notifying each other that they have changes. This allows for fast convergence of changes within a site, but takes a fair amount of communication to accomplish.
The default replication mechanism for Inter-Site connections, that is connections between DCs in different sites, is a timed replication cycle that can occurs at best four times per hour. This can lead to change convergence times on the order of 30 minutes in a typical mesh type replication configuration; and even longer if you have been forced to configure your replication in a tree fashion due to either DC/Site count or unruly WAN links. This mechanism is easy to configure, easy to maintain/explain, and reasonably efficient over slow WAN links. Unfortunately, it can also lead to unacceptable security lags and service delivery.
This is because changes need to replicate out from where they are made to all other sites. While the change is "in transit", one cannot guarantee which way AD will respond until the change has been replicated to all DCs. This transit time is called the convergence time. As one would expect, changes will go into effect pretty quickly in the original site due to the change notification replication. Changes to DCs in other sites however, will take significantly longer to reach other AD sites due to the default timed nature of replication across Inter-Site links. While many times this has no effect on overall service, there are times this can be unacceptable.
If your organization is like most others and you have a centralized service desk and/or AD management team, the real timing of changes may have a significant impact on the steps necessary and hence the overall service. For example, when you get that call from HR that an account needs to be disabled for disciplinary reasons and a technician makes the change to disable the account. If the technician is "forward thinking" and connects to the DC in the site where the end-user is located, the change is effective locally very quickly preventing access from workstations locally. However, we all live in a very connected world. If the user is in a site in a different site from their Exchange Mailbox server (not that uncommon today), the same user will still have access to their mailbox contents until the change reaches the domain controllers in the site with the Exchange Mailbox and CAS servers; potentially a major security issue.
With the cost effective availability of Ethernet speed links between locations today, there may be a business case to eliminate timed AD replication in significant portions of your environment. While this can be accomplished by simply spanning AD Sites across multiple physical locations, this may not have the desired results due to DFS root locators, GC access speeds, and a number of other issues. Ideally, one should be able to enable change notification replication on select AD Site connectors.
Luckily this is possible, if poorly communicated and documented. Change notification is possible on any IP Link. SMTP Links do not support Change Notification. To enable change notification on an IP site link

Launch ADSI Edit by running adsiedit.msc
In ADSI Edit, expand the Configuration Container icon and then expand CN=Configuration, DC= ForestRootDomainName and CN=Sites.
Expand the CN=Inter-Site Transports container, and then click CN=IP.
In the details pane, right-click the site link object whose options attribute you want to change, and then click Properties.
In the Select a property to view box, click options.
If the Value(s) box displays <not set>, in the Edit Attribute box, type 1 for the value (bit 0=1). See note below.
Click Set and then click OK.

Note: If the Value(s) box contains a value, you must derive the new value by using a Boolean BITWISE-OR calculation of the existing value and the value that enables the replication change you are making. Then convert that value to an integer. Therefore, if a value is set, convert the integer value to a binary value and OR that value with the value 0001. Then convert the results back to an integer and type the value in the Edit Attribute box.
For example, if the existing decimal value is 4, that value is equal to 0100 in the binary system. The value that enables change notification is 1, or 0001 in binary. The OR operation combines 0 OR 0 = 0, 0 OR 1 = 1, 1 OR 0 = 1, 1 OR 1 = 1. Therefore, the following OR calculation computes the binary value:
0100 (existing value)
0001 (value that enables change notification)
0101 (adds enable change notification to the existing setting) The binary value 0101 converts to the digital value 5. For information about binary calculations and converting binary values to digital values, see Windows 2000 Server Help.

Due to the increased communications needs of Change Notification replication, one should not simply enable change notification on all links. Latency and available bandwidth needs to be reviewed prior to making this type of change. As a general rule of thumb, I wouldn't consider doing this across any link with more than 50ms of latency, so intercontinental links are pretty much out of the question regardless of bandwidth. I have never seen any absolute recommendations about the minimum amount of bandwidth needed to support a change notification environment, but the rule of thumb has been 5Mbps total bandwidth AND 1Mbps average free bandwidth before even considering change notification replication. Even if your environment meets that minimum, be prepared to reverse the configuration should overall network performance be adversely affected.
Even with change notification, one still needs to be judicious about the proper assignment of server connections within the ntDS config of each server in Sites and Services; probably even more so. This is because the fewer servers that each server needs to notify, the faster each server will complete their replication cycle and the fewer system resources will be consumed. One can think of each server connection as a link in a chain. The longest chain needed (spanning tree depth) to get a change from point A to point B will drive the convergence time in your environment. The trick is keeping both connections per server and total communications chain length low for optimal replication performance.
Even if you are lucky enough to have a WAN that can support change notification from end-to-end, do not expect instant change convergence. In most production enterprise environments with an expected number of DCs and sites, the convergence time will still likely be on the order of a couple minutes. This is still a significant improvement over the 30-40 minutes one expects in a mesh type replication configuration with scheduled replication.
For a more in depth discussion of AD replication considerations, please see the following article from Microsoft.

Vacation Over

2011-03-28T07:00:00.001-04:00

Well my little vacation was far longer than originally planned.
Now that things have settled into a manageable routine, it is time to climb back on the "blogging" horse. Unfortunately, I know that I will not be able to maintain the daily publishing target that I was striving for before, so I am going to back off of that promise and aim for a more or less 2 time per week schedule with Tuesdays and Thursdays @ 7A Eastern being the targets for new content.
As always, should there be any specific desire for a topic, simply drop me a message or comment and we will see if we can't address that post-haste.
Thanks for your patience.

Dealing with WMI Issues – Part 3

2010-10-28T07:00:00.000-04:00

Over the last 2 days, we have addressed a couple of escalating methods in a process to repair the WMI subsystem on machines where it is not functioning properly. Today, we will cover, what is hopefully the last method needed, as it is a fairly drastic step: wiping the WBEM Repository.

The WBEM repository is the holding point for all of the compiled MOF and MTL files, so wiping it is about as close as one can come to "starting fresh" with WMI. To wipe the repository, simply stop the winmgmt service, rename the Repository folder (%WIN%\system32\WBEM\repository) to something new like Repository.old, then restart the winmgmt service. This will force the WMI subsystem to create a new repository and perform a repair at its next access.
With that complete, one can simply try to reinstall the SCCM Client on the affected machine. A good portion of the machines will then properly install. A small portion will still fail with WMI-related issues. In this case, simply repeat the WMIRepair process from the SCCM Client Center application, and try to reinstall the client.
If after wiping the repository and re-running the WMIRepair process the client still will not install, it is probably time to throw in the towel and reimage the machine.

Dealing with WMI Issues – Part 2

2010-10-27T07:00:00.000-04:00

Assuming that the WMIDiag script did not repair the WMI Subsystem sufficiently to allow for a successful client reinstall, the next step is to run a more "invasive" WMI Repair process. Luckily, it doesn't need to come with a lot of legwork on your part.

Enter the SCCM Client Center

If you haven't done so already, download the SCCM Client Center v2.0.2 from SourceForge. This tool gives you the ability to gain a great deal of info about the clients remotely including site assignment, recent advertisement and inventory activity, and the ability to trigger a number of actions on a healthy client. The Client Center also provides a number of actions that are invaluable when trying to repair clients. Unfortunately, the tool can be a bit "clunky" to use when addressing a significant number of machines and the uninstall action doesn't end up completing on a significant number of machines. However, the WMIRepair service that is included is a great follow-up to the Microsoft WMIDiag process as it goes a little bit further in trying to address the WMI subsystem. This service will also take a look at several of the key registry and DLL files, but will take it a big step beyond that. This WMIRepair process will also:

Reregister every DLL and EXE in the WMI folders
Force a full service reregistration
Recompile every MOF and MTL file in the repository

To perform the WMIRepair process, simply enter the name of the machine you wish to repair in the upper left corner and click Connect. Once connected, navigate to the Install/Repair tab and click the WMIRepair button. You can track the progress of the service by clicking the folder icon next to the WMI Repair button and navigating to the WMIRepair.log file.
Once the service completes and uninstalls itself, you can once again try to install the SCCM client again to see if you can get a successful installation.
Even this thorough revisiting of the WMI subsystem doesn't end up solving every WMI problem, it definitely addresses a significant number of issues. In tomorrow's article, we will cover what to do when this approach still doesn't solve the problem.

Dealing with WMI Issues – Part 1

2010-10-26T07:00:00.002-04:00

One of the most common issues with SCCM client implementations is WMI errors. Unfortunately, while WMI errors are a common cause of problems, there is not a "one-size-fits-all" method of fixing them. In practice, there are three real approaches to addressing the problems and they are best used in a particular order to give one the best chance at success, but that is getting ahead of the game. First, we need to know that we have a problem.

Identifying WMI problems

Identifying WMI problems at client installation is pretty straightforward. If you look in the CCMSetup.log file (%WINDIR%\system32\ccmsetup\setup.log), you will see one of a number of symptoms.

Errors registering WMI Namespaces
Errors compiling .MOF files
Most 1603 errors are related in some way to WMI issues

Identifying WMI problems post install gets a little harder. The most common way of finding these problems is looking at the Inventory log files. You normally will see a number of 800410XX errors in the inventory logs when WMI errors are creeping in

Phase 1 Repair

As mentioned earlier, there are 3 common approaches to addressing WMI errors: WMIDIAG, SCCM Client Console WMI Repair, and a Repository reset. In this first article, we will cover the WMIDIAG script.
WMIDIAG is a vbs script provided by Microsoft (Source at end of article) that addresses checking for common things that induce problems within the WMI subsystem. Some have said that you can run WMIDIAG with the SCCM client in place as long as it is shutdown, but I have found that if there are errors in the inventory files already you are usually better removing the client before getting started.
Removing the client is straightforward, simply run either ccmsetup /uninstall from the %WINDIR%\system32\ccmsetup folder or use the latest ccmclean utility by running ccmclean /client . Many times I will run the Client Wipe procedure used for duplicate GUIDs to make sure everything gets reset.
Once the client has been removed, one can start to address the WMI problems.
Simply copy the WMIDiag.vbs file local to the machine and run it. If you wish for it to run silently and simply record a log file of its activities, run it with the silent and logfilepath directives as shown below:
cscript wmidiag.vbs silent=true logfilepath=c:\temp

The script does a pretty good job of correcting permissions and registration based problems. Unfortunately, it is not a fast fix. On many machines, this process can take upwards of 5-10 minutes.
Once the WMIDiag script has completed, one can try to install the SCCM client again to see if you can get a successful installation. While this script doesn't end up being the stopping point for fixing many WMI problems, I have found it to do the most thorough job of checking to make sure that all of the fundamentals are in good working order. As a result, I usually start with this script.
Tomorrow, we will discuss the typical next step, the WMIRepair process from the SCCM Client Center from SourceForge.

WMIDIAG.VBS can be found at http://www.microsoft.com/downloads/en/details.aspx?familyid=D7BA3CD6-18D1-4D05-B11E-4C64192AE97D&displaylang=en

Repairing SCCM Clients with Duplicate GUIDs

2010-10-25T07:05:00.002-04:00

After a few weeks off to get some other projects under control, I am back. This week we will address repairing common problems within the SCCM client starting with machines with duplicate GUIDs.
There is no reason to be ashamed when these situations arise in your SCCM sites. These machines can arise for a number of reasons within an organization and no all of them are even due to problems within the SCCM system itself.
Some hardware vendors (Tangent Computers would be one example) are "shortcutting" their manufacturing processes and shipping machines without populating the SMBIOS GUID within their machine BIOS. Then when these machines are imaged, all of the machines end up with the same SCCM GUID as it is based off the SMBIOS GUID. For these machines, you need to not only address the SCCM Client, but also the underlying root cause which is the SMBIOS itself. (Tangent does have a downloadable DOS EXE to randomly generate an SMBIOS GUID on their machines) Another major cause of duplicate SCCM GUIDs is improper imaging techniques where the SCCM client was not fully removed from the "master" image prior to capture.
Luckily regardless of the reason why there is a duplicate GUID, the fix is straightforward and pretty easy. You simply need to remove the SCCM client and all of its history-storing pieces then re-install the client from scratch. The uninstall process can be broken into a number of discrete steps.

Removing the SCCM Client Certs with the ccmdelcert utility
Uninstalling the client software through ccmsetup /uninstall or the latest ccmclean /client
Deleting the %WINDIR%\SMSCFG.ini file
Deleting the %WINDIR%\system32\ccm folder
Deleting the HKLM\Software\Microsoft\CCMSetup key from the registry
Deleting the HKLM\Software\Microsoft\SMS key from the registry

Note: At the bottom of this posting is the contents of an SMS Installer script to accomplish these steps. Just put copies of the ccmclean.exe, ccmdelcert.exe and tranguid.exe from the SMS 2003 Toolkit in the C:\packages\DupGUID\files folder.
For those, like me, that love using the latest SCCM Client Center, unfortunately the uninstall process within that tool does not fully address these steps, so to address these machines remotely you will need to rely on copying the files to the machines and using something like PSEXEC to start them remotely.
Locating which machines need this process done is a straightforward process too. One simply needs to run the Computers that may share the same SMS Unique ID report from the SCCM Reporting Point. Make sure you run this process over all of the machines listed in the report including those appearing in the Name Column, not just the ones in the previous names column.

Note: As the client gets reinstalled on these machines, there will be an "obsolete" record created in the All Systems Collection. The clients will not drop off the Computers that may share the same SMS Unique ID report until this obsolete record is removed.

Script contents below:
Document Type: IPF
item: Global
Version=6.0
Title English=Duplicate SCCM GUID Repair
Flags=00000100
Languages=0 0 65 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
LanguagesList=English
Default Language=2
Copy Default=1
Japanese Font Size=9
Start Gradient=0 0 255
End Gradient=0 0 0
Windows Flags=00000100000000010010110000011000
Message Font=MS Sans Serif
Font Size=8
Disk Filename=SETUP
Patch Flags=0000000000000001
Patch Threshold=85
Patch Memory=4000
FTP Cluster Size=20
end
item: Check Disk Space
end
item: Set Variable
Variable=ROOT
Value=C:
end
item: Get Environment Variable
Variable=WINDIR
Environment=WINDIR
end
item: Install File
Source=C:\packages\DupGUID\files\*.*
Destination=%ROOT%\temp\dupguid
Flags=0000000000100010
end
item: Execute Program
Pathname=%ROOT%\temp\dupguid\ccmdelcert.exe
Default Directory=%ROOT%\temp\dupguid
Flags=00001010
end
item: Delete File
Pathname=%WINDIR%\SMSCFG.ini
end
item: Execute Program
Pathname=%ROOT%\temp\dupguid\ccmclean
Command Line=/client /q
Default Directory=%ROOT%\temp\dupguid
Flags=00001010
end
item: Insert Line into Text File
Pathname=%WINDIR%\system32\ccm\temp.txt
New Text=TEMP
Line Number=0
Flags=00010000
end
item: Delete File
Pathname=%WINDIR%\system32\ccm\temp.txt
Flags=00001100
end
item: Edit Registry
Total Keys=1
Key=SOFTWARE\Microsoft\CCMSetup
Root=130
end
item: Edit Registry
Total Keys=1
Key=SOFTWARE\Microsoft\SMS
Root=130
end

GPO Scripts – Creating your own ADMX/ADML files

2010-10-07T07:00:00.002-04:00

Unfortunately a full decade after the release of Active Directory and the introduction of its powerful Group Policy Engine, many, if not most, application vendors have not yet got with the program and produced template files for managing their applications via GPO. To get around this limitation, many administrators have gotten in the habit of "rolling their own" policy template files in order to be able to manage application settings quickly and easily. Unfortunately, doing so manually requires a lot of effort in order to get the file formatting correct.
Luckily the author or today's script from the Technet Script Center, Mariano S. Cosentino, has made our life much easier by being able to simply convert .REG registry files to appropriate ADMx/ADML files automatically. While not perfect, the script definitely takes most of the work out of the process. To do this the script makes a few assumptions:

the "name" of the value is also used as the caption for all displays.
all dwords values are assigned a numeric textbox for data entry
all other value types are treated as strings and assigned a textbox for data entry.

Known Limitations
@ or (Default)
The tools will not handle correctly the "@" or unnamed value name. This is the one that in the registry editor shows as (Default).
WORKAROUND: For now it's assigning the value to a "(Default)" value, but as you can see in the examples bellow, windows does not recognize this "(Default)" value as the real "(Default)" value.

Hex, Hex(0) ...
This is another example of things that I was not able to learn from the ADMX files that I have available.
We have several cases of registry files that assigning a value composed of several 2 char Hexadecimal values, but I have not find any ADMX file that applies this kind of settings to to policies.
WORKAROUND: For now, the script will make this hexadecimal values into a text.

HKU or HKEY_USERS
The ADMX definition allows you to set policies for Users (Current User, actually) and/or Computers, this does not include the HKU or the HKEY_USERS.
WORKAROUND: The script will treat any HKU policy as a HKCU (it will clean any named user defined as part of the HKU).

Usage:

CSCRIPT REG_2_ADMXL.vbs registry-file language [name]

registry-file is the name and path of the registry file to be converted.
language is the language and culture to be used, ie: en-US, sp-AR, etc.
name Display Name to show in the GPO. if omited "REG_2_ADMXL Generated Policy" will be used.
The output file will be named after the .REG file (if the input is myfile.REG, the output will be myfile.ADMX and myfile.ADML.
The ADMX output file will be saved in the same folder the input .REG file is located, while the ADML output file will be saved in a subfolder of the one the .REG file is located. The subfolder will be named after the language specified.
So, if the reg file is C:\myapp\myfile.reg and the lang is en-US, then the ADMX file will be as in C:\myAPP\myfile.ADMX and the ADML file will be saved as C:\myAPP\en-US\myfile.ADMX

' The goal of this tools is to read a .reg file and generate a .admx that would allow us to set those settings thru GPO

' +-----------------------------------------------------------------------------+
' | App.Name :    REG_2_ADMXL.vbs                             |
' | App.Description :     |
' | This tools reads a .reg file and generates a ADMX/ADML |
' | pair of files that would allow us to set those settings thru GPO |
' | This file accepts 3 parameters:                         |
' |     1) Reg File to convert                                |
' |                            2) Default Language (i.e.: en-US or sp-AR, po-BR) |
' |                            3) (optional) Display Name to show in the GPO                                                    |
' |                                                                                |
' | The output file will be named after the .REG file (if    |
' | the input is myfile.REG, the output will be myfile.ADMX and myfile.ADML)    |
' |     The ADMX output file will be saved in the same folder |
' | the input .REG file is located                                                |
' |     The ADML output file will be saved in a subfolder of |
' | the one the .REG file is located. The subfolder will be named after the     |
' |    Language specified.                                                            |
' |                        So, if the reg file is C:\myapp\myfile.reg and the lang |
' | is en-US, then the ADMX file will be as in C:\myAPP\myfile.ADMX and the |
' | ADML file will be saved as C:\myAPP\en-US\myfile.ADMX                        |
' |                                                                                |
' |                                                                                |
' |                                                                                |
' |     This file does a very simple assignment of input fields |
' |    If the data type is a dword a numeric textbox is used, otherwise a textbox |
' | will be used.                                 |
' |     In my experience, this is good enought for 90% of the    |
' | cases. And if you would like fancier stuff (like comboboxes, listboxes, |
' | date picker, etc.) you can still use this tool to generate the initial file |
' | and then add the stuff you need.                 |
' |                                                                                |
' |                                                                                |
' | Current Version:    1.02                                                    |
' |          By:    Mcosentino    (reg_2_ADMXL at marianok.com.ar)                    |
' |      Date:        Mar. 01 2010                                        |
' |                                                                                |
' +- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -+
' | 1.02 03/01/10    mcosentino    Fixed issue with HKCU/HKCC/HKCR/HKC not                |
' |                     being parsed correctly    |
' |                    Thanks to JimmyRolaff for reporting it    |
' |                                        |
' +-----------------------------------------------------------------------------+
' |                                                                                |
' | How to use it:                                                                 |
' |     cscript REG_2_ADMXL.vbs <Registry file> <Language> [<name>] |
' |        Sample:                                                                    |
' |     cscript REG_2_ADMXL.vbs c:\myapp\myfile.reg en-US "MY APP Policies" |
' |                                                                                |
' +-----------------------------------------------------------------------------+

Const ForReading = 1

dim sRegFileName
dim sLang
dim sRootDisplay
dim objFSO
set objFSO = createobject("Scripting.FileSystemObject")

' check that we have the necesary arguments, if not display instructions and end.

if wscript.Arguments.Count < 2 then
wscript.echo "Missing Parameters:" & vbcrlf & _
"Usage:" & vbcrlf & vbtab & _
"cscript " & WScript.ScriptName & " <Registry file> <Language> [<name>]" & vbcrlf & _
" Sample:" & vbcrlf & vbtab & _
"cscript " & WScript.ScriptName & " c:\myapp\myfile.reg en-US MY_APP_Policies"
    wscript.quit
else
sRegFileName=Wscript.Arguments.Item(0)
sLang=Wscript.Arguments.Item(1)
end if

' Let's check that the input file really exists

if not objFSO.FileExists(sRegFileName) then
wscript.echo "File not found. Unable to open " & sRegFileName & "."
    wscript.quit
end if

' OK, we have the necesary parameters, let's the games begin

' Let's check of they have specified a root node, otherwise I will use mine
if wscript.Arguments.Count >= 3 then
sRootDisplay=Wscript.Arguments.Item(2)
else
sRootDisplay="REG_2_ADMXL Generated Policy"
end if

' Define the Table that will hold the categories.
dim lCategories()
redim lCategories(4,0)
' First field is the name
' Second field is the data
' Third field is the GUID
' Fourth field is the GUID for the parent

    ' Set Node 0 with the data of the Root node.
    ' I must admit that is not really nice to be using node 0 this way, but it works.
     lCategories(4,0) = ""
     lCategories(1,0) = sRootDisplay
     lCategories(2,0) = sRootDisplay
     lCategories(3,0) = "MARIANOKS_XML_2_ADMXL"

' Define the table that will hold the value assignments (from now on "policies")
dim lPolicies()
redim lPolicies(8,0)
' First field is the caption
' Second field is the GUID
' Third field is the GUID for the parent
' Fourth field is the valueName
' Fifth field is the ValueType
' Sixth field is the ValueData
' Seventh field is the PATH
' Eight Field is the class (user Machine, both)

' Read and import the registry file.
ImportRegFile(sRegFileName)

'Create the Basic ADMX/ADML files
set ADMXDoc = CreateADMX
set ADMLDoc = CreateADML

'ListCategories
'ListPolicies

'Generate the XML
WriteCategories
WritePolicies

' Write the XML files to disk
SaveXML

' ------------------------------------------------------------------------------------------
' ALL FUNCTIONS START HERE
' ------------------------------------------------------------------------------------------

sub SaveXML()
    ' This function Saves the XML files in the correct locations and with the correct name

dim ADMXName, ADMLName, iLastBar
ADMXName = replace(lcase(sRegFileName),".reg",".ADMX")
ADMLName = replace(lcase(sRegFileName),".reg",".ADML")
iLastBar = InStrRev(ADMLName,"\")
if iLastBar=0 then
ADMLName = sLang & "\" & ADMLName
strFolder = sLang
elseif iLastBar=1 then
ADMLName = "\" & sLang & ADMLName
strFolder = "\" & sLang
else
strFolder = left(ADMLName,iLastBar) & sLang
ADMLName = left(ADMLName,iLastBar) & sLang & "\" & right(ADMLName,len(ADMLName) - iLastBar)
end if

ADMXDoc.save ADMXName
if not objFSO.FolderExists(strFolder) then
objFSO.CreateFolder(strFolder)
end if
ADMLDoc.save ADMLName
end sub

function CreateADMX ()

    ' This function creates the a template ADMX
    ' The ADMX file is the one that contains the policies, the ADML file(s) is the one that contains all the strings and tex, and is where all language/culture customization takes place.
    ' In other words, if you want to have the same policy file in a diferent language, you copy the ADML to another folder and trasnlate each string (preserving the rest of the file)
    ' All comments and settings are updated with the information from the .REG file
    ' Most of this values were obtained from reading existing ADMX files, I'm unsure of the need for some of them, so I'm including them to be safe

' Create the xml Document
Set xmlDoc = CreateObject("MSXML.DOMDocument")

' Create the root node for the document
Set objRoot = xmlDoc.createElement("policyDefinitions")
xmlDoc.appendChild objRoot

' Set the properties for the root node as required for the ADMX/L to work correctly
Set xmlAttribute = xmlDoc.createAttribute("revision")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("1.0"))
    objRoot.Attributes.setNamedItem(xmlAttribute)

Set xmlAttribute = xmlDoc.createAttribute("schemaVersion")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("1.0"))
     objRoot.Attributes.setNamedItem(xmlAttribute)

Set xmlAttribute = xmlDoc.createAttribute("xmlns:xsd")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("http://www.w3.org/2001/XMLSchema"))
     objRoot.Attributes.setNamedItem(xmlAttribute)

Set xmlAttribute = xmlDoc.createAttribute("xmlns:xsi")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("http://www.w3.org/2001/XMLSchema-instance"))
     objRoot.Attributes.setNamedItem(xmlAttribute)

    'Set xmlAttribute = xmlDoc.createAttribute("xmlns")
    ''Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("http://www.microsoft.com/GroupPolicy/PolicyDefinitions"))
    'Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"))
    'objRoot.Attributes.setNamedItem(xmlAttribute)

'Create the policynamspaces node for future use
Set objPolNS = xmlDoc.createElement("policyNamespaces")
objRoot.appendChild objPolNS

'Create the Target node (Looks like we need a unique one for each app, so I'll be using a GUID to ensure this)
Set tNode = xmlDoc.createElement("target")
objPolNS.appendChild tNode
' Set the properties for the target node
Set xmlAttribute = xmlDoc.createAttribute("prefix")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("Marianok")) ' I needed a unique Namespace, so I used mine (I deserve a little credit for my work, after all)
     tNode.Attributes.setNamedItem(xmlAttribute)


Set xmlAttribute = xmlDoc.createAttribute("namespace")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("MSC.Policies." & GenerateGUID ))
     tNode.Attributes.setNamedItem(xmlAttribute)

'Create the using node (defines this a a GPO)
Set tNode = xmlDoc.createElement("using")
objPolNS.appendChild tNode
' Set the properties for the target node
Set xmlAttribute = xmlDoc.createAttribute("prefix")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("windows"))
     tNode.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = xmlDoc.createAttribute("namespace")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("Microsoft.Policies.Windows"))
     tNode.Attributes.setNamedItem(xmlAttribute)

'Create the supersededAdm node (not sure i need this, but maybe some one will use it if they find it on the output file)
Set tNode = xmlDoc.createElement("supersededAdm")
objRoot.appendChild tNode
' Set the properties for the supersededAdm node
Set xmlAttribute = xmlDoc.createAttribute("fileName")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode(""))
     tNode.Attributes.setNamedItem(xmlAttribute)

'Create the resources node (not sure i need this)
Set tNode = xmlDoc.createElement("resources")
objRoot.appendChild tNode
' Set the properties for the target node
Set xmlAttribute = xmlDoc.createAttribute("minRequiredRevision")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("1.0"))
     tNode.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = xmlDoc.createAttribute("fallbackCulture")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode(sLang))
     tNode.Attributes.setNamedItem(xmlAttribute)

' ' Create the definitions node
' Set tNode = xmlDoc.createElement("definitions")
' objRoot.appendChild tNode

' Create the categories node, All categories will end up here
Set tNode = xmlDoc.createElement("categories")
objRoot.appendChild tNode

' Create the policies node, All Policies will end up here
Set tNode = xmlDoc.createElement("policies")
objRoot.appendChild tNode

'<?xml version="1.0" encoding="utf-8"?>

' Set objIntro = xmlDoc.createProcessingInstruction ("xml","version='1.0'")
' xmlDoc.insertBefore objIntro,xmlDoc.childNodes(0)

set CreateADMX = xmlDoc

end function

function CreateADML ()

    ' This function creates the a template ADML
    ' The ADMX file is the one that contains the policies, the ADML file(s) is the one that contains all the strings and tex, and is where all language/culture customization takes place.
    ' In other words, if you want to have the same policy file in a diferent language, you copy the ADML to another folder and trasnlate each string (preserving the rest of the file)
    ' All comments and settings are updated with the information from the .REG file
    ' Most of this values were obtained from reading existing ADMX/ADML files, I'm unsure of the need for some of them, so I'm including them to be safe

' Create the xml
Set xmlDoc = CreateObject("MSXML.DOMDocument")

' Create the root node
Set objRoot = xmlDoc.createElement("policyDefinitionResources")
xmlDoc.appendChild objRoot

' Set the properties for the root node
Set xmlAttribute = xmlDoc.createAttribute("revision")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("1.0"))
    objRoot.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = xmlDoc.createAttribute("schemaVersion")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("1.0"))
     objRoot.Attributes.setNamedItem(xmlAttribute)

Set xmlAttribute = xmlDoc.createAttribute("xmlns:xsd")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("http://www.w3.org/2001/XMLSchema"))
     objRoot.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = xmlDoc.createAttribute("xmlns:xsi")
Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("http://www.w3.org/2001/XMLSchema-instance"))
     objRoot.Attributes.setNamedItem(xmlAttribute)
' Set xmlAttribute = xmlDoc.createAttribute("xmlns")
' Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("http://www.microsoft.com/GroupPolicy/PolicyDefinitions"))
'' Set xmlText = xmlAttribute.appendChild(xmlDoc.createTextNode("http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"))
'     objRoot.Attributes.setNamedItem(xmlAttribute)

'Create the displayName node
Set objPolNS = xmlDoc.createElement("displayName")
objRoot.appendChild objPolNS
objPolNS.text="REG_2_ADMXL"

'Create the description node
Set objPolNS = xmlDoc.createElement("description")
objRoot.appendChild objPolNS
objPolNS.text="This policy file was generated by the REG_2_ADMXL tool" & vbcrlf & _
"Source File: " & sRegFileName & vbcrlf & vbcrlf & _
"This Freeware Tool can be downloaded from www.marianok.com.ar"

'Create the resources node
Set objPolNS = xmlDoc.createElement("resources")
objRoot.appendChild objPolNS

'Create the stringTable node. This will hold all strings for the language/culture
Set tNode = xmlDoc.createElement("stringTable")
objPolNS.appendChild tNode

'Create the presentationTable node. this will hold the diferent ways in with we want the data show (texbox, combobox, listbox, calendar picker, etc)
Set tNode = xmlDoc.createElement("presentationTable")
objPolNS.appendChild tNode

Set objIntro = xmlDoc.createProcessingInstruction ("xml","version='1.0'")
xmlDoc.insertBefore objIntro,xmlDoc.childNodes(0)

set CreateADML = xmlDoc

end function

Sub ImportRegFile(sRegFileName)

    ' this function will read the .REG file and parse it in order to store it's data in the internal tables

    dim strLine, sTempLine, sSubkey, sValueName, sValuetype, SValueData, iIndex ,sTestFile
    Set objTextFile = objFSO.OpenTextFile(sRegFileName , ForReading,, -2)

' if objTextFile.AtEndOfStream <> True then sTempLine = objtextFile.ReadLine
    Do While objTextFile.AtEndOfStream <> True
if (objTextFile.AtEndOfStream <> True) and (bSkip <> true) then sTempLine = objtextFile.ReadLine
bSkip = false

        strLine = sTempLine
        If left(strLine, 16) = "Windows Registry" or strLine = "" or left(strLine, 8) = "REGEDIT4" Then
            ' If it's a declaratory line, then skip
        else
            ' If this is a KEY, then create a new category
            If left(strLine, 1) = ";" Then
     ' If it's a comment line, then skip
            elseIf left(strLine, 1) = "[" Then
            ' If this is a KEY, then create a new category
                sSubkey = left(right(strLine, len(strLine)- 1), len(strLine)- 2)
                redim preserve lCategories(4,ubound(lCategories,2) +1)
lCategories(1,ubound(lCategories,2)) = GetName(sSubkey)
lCategories(2,ubound(lCategories,2)) = sSubkey
                lCategories(3,ubound(lCategories,2)) = GenerateGUID
lCategories(4,ubound(lCategories,2)) = GetParentGUID(sSubkey,lCategories(1,ubound(lCategories,2)))

            elseif left(strLine, 1) = """" or left(strLine, 1) = "@" Then

                'If the line starts with @, it's an asignation of the Default Value.
                ' I'm forcing the string to be the corresponding valuename
                if left(strLine, 1) = "@" Then
                strLine = """(Default)""" & right(strLine, len(strLine)- 1)
'                 strLine = """@""" & right(strLine, len(strLine)- 1)
end if
                'If the line starts with double quotes, it's an asignation of values, this will be converted into a pilicy for the ADMX/L files
                strLine = right(strLine, len(strLine)- 1)
                iIndex = instr(strLine,"""")
                if iIndex > 0 then
                    sValueName= left(strline,iIndex-1)
redim preserve lPolicies(8, ubound(lPolicies,2) +1)
                 Set TypeLib = CreateObject("Scriptlet.TypeLib")
lPolicies(1,ubound(lPolicies,2)) = sValueName
                 lPolicies(2,ubound(lPolicies,2)) = GenerateGUID
lPolicies(3,ubound(lPolicies,2)) = lCategories(3,ubound(lCategories,2))
lPolicies(4,ubound(lPolicies,2)) = sValueName

strLine=trim(strLine)
                iIndex2 = instr(strLine,"=")
                    strLine = right(strLine, len(strLine)- iIndex2)
strLine=trim(strLine)
if left(strLine,1) = " " then strLine=right(strLine, len(strLine)-1)
strLine=trim(strLine)
if left(strLine,1) = chr(9) then strLine=right(strLine, len(strLine)-1)
strLine=trim(strLine)
if left(strLine,1) = " " then strLine=right(strLine, len(strLine)-1)
strLine=trim(strLine)
if left(strLine,1) = chr(9) then strLine=right(strLine, len(strLine)-1)

                    ' Now, we need to determine if what we have on the right side of the = is an string or another kind of value.
                    if left(strline,1)="""" then
                        ' String value
                        sValuetype = "string"
                        SValueData = left(right(strLine, len(strLine)- 1), len(strLine)- 2)
                    else
                        ' non string
                        iIndex = instr(strLine,":")
                        if iIndex > 0 then
                            sValuetype = left(strline,iIndex-1)
                            SValueData = right(strLine, len(strLine)- iIndex)


if left(lcase(sValuetype),3) = "hex" then
bSkip = false
do
if right(SValueData,1)="\" then
SValueData = left(SValueData,len(SValueData)-1)
if (objTextFile.AtEndOfStream <> True) and (bSkip <> true) then
sTempLine = objtextFile.ReadLine
if left(sTempLine,1) = "@" or left(sTempLine,1) = "[" or left(sTempLine,1) = """" then
bSkip = true
exit do
else
SValueData = SValueData & sTempLine
end if
else
'bSkip = true
exit do
end if
else
'bSkip = true
exit do
end if
loop until bSkip
SValueData = replace (SValueData," ","")
end if
                        else
'                            sWriteLog "Invalid record (datatype w/o ':'): " & sTempLine
                        end if
                    end if
     lPolicies(5,ubound(lPolicies,2)) = sValuetype
     lPolicies(6,ubound(lPolicies,2)) = replace(SValueData,"\\","\")
sText=lCategories(2,ubound(lCategories,2))
                lPolicies(8,ubound(lPolicies,2)) = GetClass(sText)
                lPolicies(7,ubound(lPolicies,2)) = sText

                else
                    sWriteLog "Invalid record (Valuename w/o end quote): " & sTempLine
                end if
            else
                sWriteLog "Invalid record (or Valuename w/o quote): " & sTempLine
            end if
        end if
' if (objTextFile.AtEndOfStream <> True) and (bSkip <> true) then sTempLine = objtextFile.ReadLine
' bSkip = false
    Loop
    objtextFile.Close

end sub

sub sWriteLog (stexto)
wscript.echo stexto
end sub

sub ListCategories()

    ' This is a function for testing porpouses, it will just list all items stored on the Categories table
dim iCounter

for icounter = 1 to ubound(lCategories,2)
sWriteLog "Caption: [" & lCategories(1,iCounter) & "] " & vbcrlf & vbtab & "Path: [" & lCategories(2,iCounter) & "] " & vbcrlf & vbtab & " GUID: [" & lCategories(3,iCounter) & "] " & vbcrlf & vbtab & " ParentGuid: [" & lCategories(4,iCounter) & "]"
next
end sub

sub ListPolicies()

    ' This is a function for testing porpouses, it will just list all items stored on the Policies table

dim iCounter

for icounter = 1 to ubound(lPolicies,2)
sWriteLog "Caption: [" & lPolicies(1,iCounter) & "] " & vbcrlf & vbtab & " GUID: [" & lPolicies(2,iCounter) & "] " & vbcrlf & vbtab & " ParentGuid: [" & lPolicies(3,iCounter) & "] " & vbcrlf & vbtab & " Name: [" & lPolicies(3,iCounter) & "] " & vbcrlf & vbtab & " Type: [" & lPolicies(3,iCounter) & "] " & vbcrlf & vbtab & " Data: [" & lPolicies(6,iCounter) & "]"
next
end sub

sub WriteCategories()

    'This function converts the KEYS read from the .REG file into the corresponding categories for the GPOs

dim iCounter
set ADMXParentNode = ADMXDoc.selectSingleNode("policyDefinitions/categories")
set ADMLStringNode = ADMLDoc.selectSingleNode("policyDefinitionResources/resources/stringTable")
for icounter = 0 to ubound(lCategories,2)

' sWriteLog "Path: [" & lCategories(1,iCounter) & "] " & vbcrlf & vbtab & _
' " GUID: [" & lCategories(2,iCounter) & "] " & vbcrlf & vbtab & _
' " ParentGuid: [" & lCategories(3,iCounter) & "]"

' Create the category node on the ADMX file
Set objCategory = ADMXDoc.createElement("category")
ADMXParentNode.appendChild objCategory

' Set the properties for the category node
Set xmlAttribute = ADMXDoc.createAttribute("name")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode("CAT_" & lCategories(3,iCounter)))
     objCategory.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = ADMXDoc.createAttribute("displayName")
sTexto="$(string.CAT_" & lCategories(3,iCounter)
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode(sTexto & ")"))
     objCategory.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = ADMXDoc.createAttribute("explainText")
sTexto="$(string.CAT_" & lCategories(3,iCounter)
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode(sTexto & "_HELP)"))
     objCategory.Attributes.setNamedItem(xmlAttribute)

    ' Set the parent category (so AD knows how to build the Tree)
if lCategories(4,iCounter) <> "" then
Set objTemp = ADMXDoc.createElement("parentCategory")
objCategory.appendChild objTemp
Set xmlAttribute = ADMXDoc.createAttribute("ref")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode("CAT_" & lCategories(4,iCounter)))
objTemp.Attributes.setNamedItem(xmlAttribute)
end if

' Create the string node on the ADML file
Set objTemp = ADMLDoc.createElement("string")
ADMLStringNode.appendChild objTemp
Set xmlAttribute = ADMLDoc.createAttribute("id")
Set xmlText = xmlAttribute.appendChild(ADMLDoc.createTextNode("CAT_" & lCategories(3,iCounter)))
objTemp.Attributes.setNamedItem(xmlAttribute)
objTemp.text = lCategories(1,iCounter)
Set objTemp = ADMLDoc.createElement("string")
ADMLStringNode.appendChild objTemp
Set xmlAttribute = ADMLDoc.createAttribute("id")
Set xmlText = xmlAttribute.appendChild(ADMLDoc.createTextNode("CAT_" & lCategories(3,iCounter) & "_HELP"))
objTemp.Attributes.setNamedItem(xmlAttribute)
objTemp.text = "This Category configures the Values located under the [" & lCategories(2,iCounter) & "] Key." & vbcrlf & vbcrlf & _
"This policy file was generated by the REG_2_ADMXL tool" & vbcrlf & _
"This Freeware Tool can be downloaded from www.marianok.com.ar"

' <parentCategory ref="SAMPLE" />

next
end sub

sub WritePolicies()

dim iCounter
set ADMXParentNode = ADMXDoc.selectSingleNode("policyDefinitions/policies")
set ADMLStringNode = ADMLDoc.selectSingleNode("policyDefinitionResources/resources/stringTable")
set ADMLPresentationNode = ADMLDoc.selectSingleNode("policyDefinitionResources/resources/presentationTable")
for icounter = 1 to ubound(lPolicies,2)

' sWriteLog "Path: [" & lPolicies(1,iCounter) & "] " & vbcrlf & vbtab & _
' " GUID: [" & lPolicies(2,iCounter) & "] " & vbcrlf & vbtab & _
' " ParentGuid: [" & lPolicies(3,iCounter) & "]"

' Create the policy node On the ADMX File
Set objPolicy = ADMXDoc.createElement("policy")
ADMXParentNode.appendChild objPolicy

' Set the properties for the Policy node On the ADMX File
Set xmlAttribute = ADMXDoc.createAttribute("name")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode("POL_" & lPolicies(2,iCounter)))
     objPolicy.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = ADMXDoc.createAttribute("displayName")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode("$(string.POL_" & lPolicies(2,iCounter) & ")"))
     objPolicy.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = ADMXDoc.createAttribute("explainText")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode("$(string.POL_" & lPolicies(2,iCounter) & "_HELP)"))
     objPolicy.Attributes.setNamedItem(xmlAttribute)

' Set xmlAttribute = ADMXDoc.createAttribute("valueName")
' Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode(lPolicies(1,iCounter)))
'      objPolicy.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = ADMXDoc.createAttribute("key")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode(lPolicies(7,iCounter)))
     objPolicy.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = ADMXDoc.createAttribute("class")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode(lPolicies(8,iCounter)))
     objPolicy.Attributes.setNamedItem(xmlAttribute)

'presentation="$(presentation.Sample_Textbox)"

'explainText="$(string.Sample_Textbox_Help)"

' Create the string node On the ADML File
Set objTemp = ADMLDoc.createElement("string")
ADMLStringNode.appendChild objTemp
Set xmlAttribute = ADMLDoc.createAttribute("id")
Set xmlText = xmlAttribute.appendChild(ADMLDoc.createTextNode("POL_" & lPolicies(2,iCounter)))
objTemp.Attributes.setNamedItem(xmlAttribute)
objTemp.text = lPolicies(1,iCounter)
Set objTemp = ADMLDoc.createElement("string")
ADMLStringNode.appendChild objTemp
Set xmlAttribute = ADMLDoc.createAttribute("id")
Set xmlText = xmlAttribute.appendChild(ADMLDoc.createTextNode("POL_" & lPolicies(2,iCounter) & "_HELP"))
objTemp.Attributes.setNamedItem(xmlAttribute)
objTemp.text = "This Policy configures the Value [" & lPolicies(4,iCounter) & "] located under the [" & lPolicies(7,iCounter) & "] Key." & vbcrlf & vbcrlf & _
"In the .REG file, this setting was defined as [" & lPolicies(5,iCounter) & "] and had the value [" & lPolicies(6,iCounter) & "] assigned." & vbcrlf & vbcrlf & _
"This policy file was generated by the REG_2_ADMXL tool" & vbcrlf & _
"This Freeware Tool can be downloaded from www.marianok.com.ar"


' Parent category so AD knows under what node of the tree to show this policy
Set objTemp = ADMXDoc.createElement("parentCategory")
objPolicy.appendChild objTemp
Set xmlAttribute = ADMXDoc.createAttribute("ref")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode("CAT_" & lPolicies(3,iCounter)))
objTemp.Attributes.setNamedItem(xmlAttribute)

'This is another of those settings that I do not really know if i need, nor I know what are oll the posible values.
' I've found 2: "SUPPORTED_WindowsVista" and "SUPPORTED_ProductOnly". Because I do not really know what this last one means, I'll use the Vista one for everything.
' This goes on the ADMX file
Set objTemp = ADMXDoc.createElement("supportedOn")
objPolicy.appendChild objTemp
Set xmlAttribute = ADMXDoc.createAttribute("ref")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode("windows:SUPPORTED_WindowsVista"))
objTemp.Attributes.setNamedItem(xmlAttribute)

Set objElements = ADMXDoc.createElement("elements")
objPolicy.appendChild objElements

' <presentation id="POL_A10AF138_0BBF_4285_85DC_A68ACC333E63">
' Create the presentation node
' This goes on the ADML file
Set objpresentation = ADMLDoc.createElement("presentation")
ADMLPresentationNode.appendChild objpresentation
Set xmlAttribute = ADMLDoc.createAttribute("id")
Set xmlText = xmlAttribute.appendChild(ADMLDoc.createTextNode("POL_" & lPolicies(2,iCounter)))
objpresentation.Attributes.setNamedItem(xmlAttribute)
' Set the presentation for the presentation node
Set xmlAttribute = ADMXDoc.createAttribute("presentation")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode("$(presentation.POL_" & lPolicies(2,iCounter) & ")"))
     objPolicy.Attributes.setNamedItem(xmlAttribute)

' Here is the cheap and basic logic that determines what kind of interface the user will have in AD to enter the policy values.
' Currently, the logic is: If the data is a text gets a textbox, if the data is dword gets a numeric textbox. if the data is anything else, then becomes a text.
' I'm aware that this does not cover all posible cases, but it's a start and enought for my current needs.
' This goes on the ADMX file
if lcase(lPolicies(5,iCounter)) = "string" then
' <text id="Sample_TextboxPrompt" valueName="Example2textbox" />
Set objTemp = ADMXDoc.createElement("text")
objElements.appendChild objTemp
Set xmlAttribute = ADMXDoc.createAttribute("id")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode("TXT_" & lPolicies(2,iCounter)))
objTemp.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = ADMXDoc.createAttribute("valueName")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode(lPolicies(1,iCounter)))
     objTemp.Attributes.setNamedItem(xmlAttribute)

            ' The strings for the previous data must be saved as well
            ' This goes on the ADML file
         ' <TextBox refId="TXT_EA865626_37FD_48A5_8CFE_77702C6D648D">
         ' Create the string node
         Set objTextbox = ADMLDoc.createElement("textBox")
         objpresentation.appendChild objTextbox
    Set xmlAttribute = ADMLDoc.createAttribute("refId")
     Set xmlText = xmlAttribute.appendChild(ADMLDoc.createTextNode("TXT_" & lPolicies(2,iCounter)))
     objTextbox.Attributes.setNamedItem(xmlAttribute)

     ' <label>Country</label>
     Set objTemp = ADMLDoc.createElement("label")
    objTextbox.appendChild objTemp
     objTemp.text=lPolicies(1,iCounter)


     ' <defaultValue>US</defaultValue>
    Set objTemp = ADMLDoc.createElement("defaultValue")
     objTextbox.appendChild objTemp
     objTemp.text=lPolicies(6,iCounter)

elseif lcase(lPolicies(5,iCounter)) = "dword" then
' <decimal id="DXT_CECFD96A_F36B_4AB8_8B0F_57F8BAB84D08" key="SOFTWARE\INTERLINK\MSCLink\90\Config" valueName="User_Id" />
Set objTemp = ADMXDoc.createElement("decimal")
objElements.appendChild objTemp
Set xmlAttribute = ADMXDoc.createAttribute("id")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode("DXT_" & lPolicies(2,iCounter)))
objTemp.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = ADMXDoc.createAttribute("valueName")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode(lPolicies(1,iCounter)))
     objTemp.Attributes.setNamedItem(xmlAttribute)

' <decimalTextBox refId="DXT_CECFD96A_F36B_4AB8_8B0F_57F8BAB84D08">
' </decimalTextBox>
' Create the decimalTextBox node ' This goes on the ADML file
     Set objTextbox = ADMLDoc.createElement("decimalTextBox")
     objpresentation.appendChild objTextbox
    Set xmlAttribute = ADMLDoc.createAttribute("refId")
     Set xmlText = xmlAttribute.appendChild(ADMLDoc.createTextNode("DXT_" & lPolicies(2,iCounter)))
     objTextbox.Attributes.setNamedItem(xmlAttribute)

elseif left(lcase(lPolicies(5,iCounter)),3) = "hex" then
' This is a Hexadecimal Value ... I have not found a way to handle them so, for now, I will just handle them as string
Set objTemp = ADMXDoc.createElement("text")
objElements.appendChild objTemp
Set xmlAttribute = ADMXDoc.createAttribute("id")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode("HXT_" & lPolicies(2,iCounter)))
objTemp.Attributes.setNamedItem(xmlAttribute)
Set xmlAttribute = ADMXDoc.createAttribute("valueName")
Set xmlText = xmlAttribute.appendChild(ADMXDoc.createTextNode(lPolicies(1,iCounter)))
     objTemp.Attributes.setNamedItem(xmlAttribute)

' <decimalTextBox refId="DXT_CECFD96A_F36B_4AB8_8B0F_57F8BAB84D08">
' </decimalTextBox>
' Create the decimalTextBox node ' This goes on the ADML file
     Set objTextbox = ADMLDoc.createElement("TextBox")
     objpresentation.appendChild objTextbox
    Set xmlAttribute = ADMLDoc.createAttribute("refId")
     Set xmlText = xmlAttribute.appendChild(ADMLDoc.createTextNode("HXT_" & lPolicies(2,iCounter)))
     objTextbox.Attributes.setNamedItem(xmlAttribute)
else
wscript.echo "UNKNOWN DATATYPE: " & lPolicies(5,iCounter)
' Create the decimalTextBox node
Set objTemp = ADMXDoc.createElement("Text")
objElements.appendChild objTemp
Set objTextbox = ADMLDoc.createElement("Text")
objpresentation.appendChild objTextbox

end if

    ' If we had a Boolean data or something that get's turn ON/OFF we would use this, but I have not find a good way to determine that on the fly, so I just leave it here in case i ever do.
    ' Set objTemp = ADMXDoc.createElement("enabledValue")
    ' objPolicy.appendChild objTemp
    ' Set objTemp = ADMXDoc.createElement("disabledValue")
    ' objPolicy.appendChild objTemp


next
end sub

function GetClass(byref sKey)

dim iBar
    ' This function determines the scope ("CLASS" in the ADMX file) of the KEY.
    ' As allwyass, my logic is really basic: everything is BOTH, except for HKCU that get's assigned USER and HKLM that get's assigned Machine.
dim sTempClass
sTempClass = "Both"
if left(sKey,17)="HKEY_CURRENT_USER" then
sKey=right(sKey,len(sKey)-17-1)
sTempClass="User"
elseif left(sKey,4)="HKCU" then
sKey=right(sKey,len(sKey)-4-1)
sTempClass="User"
elseif left(sKey,18)="HKEY_LOCAL_MACHINE" then
sKey=right(sKey,len(sKey)-18-1)
sTempClass="Machine"
elseif left(sKey,4)="HKLM" then
sKey=right(sKey,len(sKey)-4-1)
sTempClass="Machine"
elseif left(sKey,17)="HKEY_CLASSES_ROOT" then
sKey= "SOFTWARE\Classes" & right(sKey,len(sKey)-17)
sTempClass="Both"
elseif left(sKey,4)="HKCR" then
sKey="SOFTWARE\Classes" & right(sKey,len(sKey)-4)
sTempClass="Both"
elseif left(sKey,19)="HKEY_CURRENT_CONFIG" then
sKey= "SYSTEM\CurrentControlSet\Hardware Profiles\Current" & right(sKey,len(sKey)-19)
sTempClass="Machine"
elseif left(sKey,4)="HKCC" then
sKey= "SYSTEM\CurrentControlSet\Hardware Profiles\Current" & right(sKey,len(sKey)-4)
sTempClass="Machine"
elseif left(sKey,10)="HKEY_USERS" then
sKey=right(sKey,len(sKey)-10-1)
iBar = instr(1,sKey,"\")
sKey=right(sKey,len(sKey)-iBar)
sTempClass="Both"
elseif left(sKey,3)="HKU" then
sKey=right(sKey,len(sKey)-3-1)
iBar = instr(1,sKey,"\")
sKey=right(sKey,len(sKey)-iBar)
sTempClass="Both"
end if
GetClass = sTempClass
end function

function GetName(sPath)
    ' This function retrieves the name of the current KEY based on the full PAth
iLast = InStrRev(sPath,"\")
sTemp="\\\\"
if iLast > 0 then
sTemp=right(sPath,len(sPath)-iLast)
end if
GetName=sTemp
end function

function GetParentGUID(sPath,sName)
    ' This function finds the Parent of the current registry KEY based on the PATH structure.
sFind = replace(sPath,"\" & sName,"")
sTemp="MARIANOKS_XML_2_ADMXL"
for icounter = 1 to ubound(lCategories,2)
if lcase(sFind) = lcase(lCategories(2,iCounter)) then
sTemp= lCategories(3,iCounter)
end if
next
GetParentGUID=sTemp
end function

function GenerateGUID()
    ' All settings in the GP must be unique, not only for this particular ADMX but for any other on the system.
    ' The best way to ensure that is to use GUIDs to name the objects.
    Set TypeLib = CreateObject("Scriptlet.TypeLib")
sTemp = TypeLib.GUID
sTemp = replace(sTemp,"{","")
sTemp = replace(sTemp,"}","")
sTemp = replace(sTemp,"-","_")
GenerateGUID = left(sTemp, len(sTemp)-2)

end function

GPO Scripts – Reporting on All GPOs in a Domain

2010-10-06T07:00:00.005-04:00

There are a significant number of times in an administrator's career when it is nice to be able to view all of the GPOs affecting a domain at a single glance. Some examples that quickly jump to mind are:

Starting a job with a new company
Consulting for a new customer
Discovery phase of a recent acquisition

Here is a Powershell script from the Technet Script Center that happens to be from an administrator of a customer that fills the bill on being able to produce an HTML report of all GPOs in a domain.
To use, simply replace your domain for the text "your.domain.here" in the script. Note: for this script to work you need the Group Policy Management Feature installed on your computer.Enjoy.

# Script By: Jonathan Knapp#
# Replacement for GPOTOOL.EXE (Windows Resource Kit Tool)
#
#

$results1 = Test-Path C:\GPOReports

# Create folder

if ($results = "False") {
New-Item C:\GPOReports -type directory -Force
}
else {
}

$results2 = Test-Path C:\GPOReports\GPOReportsGUID.html

# Create empty file

if ($results = "False") {
New-Item C:\GPOReports\GPOReportsGUID.html -type file -force
}
else {
}

Import-Module -Name grouppolicy

Get-GPOReport -All -Domain Your.domain.Here -Server DC01 -ReportType HTML -Path C:\GPOReports\GPOReportsAll.html

# now View in IE

Invoke-Item C:\GPOReports\GPOReportsAll.html

GPO Scripts – Comparing 2 GPOs

2010-10-05T07:00:00.001-04:00

Many times one needs to create very similar policies to address different OUs in a domain due to policy inheritance blocks etc. Then no matter how many times you cross check the settings between the 2 policies or how careful you are in typing in the values, one either forgets a key value or consumes so much time in doing the cross checks that it doesn't seem worth the effort. J
The following Powershell script from the Technet Script Center addresses that problem. The script requires 5 parameters to work.
-domain Your.domain.here
-server Which DC to use
-gponame GPO Name1, GPO Name 2
-folder Folder to contain output
-user or -computer (Whether you want to look at the user or computer portion of the GPO)
Note: for this script to work you need the Group Policy Management Feature installed on your computer. Enjoy.
# -----------------------------------------------------------------------------
# Compare-GPO.ps1
# ed wilson, msft, 7/13/2010
#
# HSG-07-15-2010
# -----------------------------------------------------------------------------
#requires -version 2.0
Param(
[string]$domain ="nwtraders.com",
[string]$server = "dc1.nwtraders.com",
[string]$gponame = "aTestOuGPO,AnotherTestOuGPO",
[string]$folder = "c:\fso",
[switch]$user,
[switch]$computer
)

Function Get-MyModule
{
Param([string]$name)
if(-not(Get-Module -name $name))
{
if(Get-Module -ListAvailable |
Where-Object { $_.name -eq $name })
{
Import-Module -Name $name
$true
} #end if module available then import
else { $false } #module not available
} # end if not module
else { $true } #module already loaded
} #end function get-MyModule

Function Get-GPOAsXML
{
Param(
[string[]]$gponame,
[string]$domain,
[string]$server,
[string]$folder
)
$gpoReports = $null
ForEach($gpo in $gpoName)
{
$path = Join-Path -Path $folder -ChildPath "$gpo.xml"
(Get-GPO -Name $gpo -Domain $domain -Server $server).`
GenerateReportToFile("xml",$path)
[array]$gpoReports + $path
}
Return $gpoReports
} #end get-gpoasxml

Function Compare-XMLGPO
{
Param([string[]]$gpoReports, $user, $computer)
[xml]$xml1 = Get-Content -Path $gpoReports[0]
[xml]$xml2 = Get-Content -Path $gpoReports[1]
$regpolicyComputerNodes1 = $xml1.gpo.Computer.extensiondata.extension.ChildNodes |
Select-Object name, state

$regpolicyComputerNodes2 = $xml2.gpo.Computer.extensiondata.extension.ChildNodes |
Select-Object name, state

$regpolicyUserNodes1 = $xml1.gpo.User.extensiondata.extension.ChildNodes |
Select-Object name, state
$regpolicyUserNodes2 = $xml2.gpo.User.extensiondata.extension.ChildNodes |
Select-Object name, state
if($computer)
{
Try {
"Comparing Computer GPO's $($gpoReports[0]) to $($gpoReports[1])`r`n"
Compare-Object -ReferenceObject $regpolicyComputerNodes1 `
-DifferenceObject $regpolicyComputerNodes2 -IncludeEqual `
-property name}
Catch [system.exception]
{
if($regPolicyComputerNodes1)
{
"Computer GPO $($gpoReports[0]) settings `r`f"
$regPolicyComputerNodes1
}
else { "Computer GPO $($gpoReports[0]) not set" }
if($regPolicyComputerNodes2)
{
"Computer GPO $($gpoReports[1]) settings `r`f"
$regPolicyComputerNodes2
}
else { "Computer GPO $($gpoReports[1]) not set"}
} #end catch
} #end if computer
if($user)
{
Try {
"Comparing User GPO's $($gpoReports[0]) to $($gpoReports[1])`r`n"
Compare-Object -ReferenceObject $regpolicyUserNodes1 `
-DifferenceObject $regpolicyUserNodes2 -SyncWindow 5 -IncludeEqual `
-property name}
Catch [system.exception]
{
if($regPolicyUserNodes1)
{
"User GPO $($gpoReports[0]) settings `r`f"
$regPolicyUserNodes1
}
else { "User GPO $($gpoReports[0]) not set" }
if($regPolicyUserNodes2)
{
"User GPO $($gpoReports[1]) settings `r`f"
$regPolicyUserNodes2
}
else { "User GPO $($gpoReports[1]) not set"}
}
} #end catch
} #end function compare-XMLGPO

# *** Entry Point to Script ***

if(-not ($user -or $computer))
{ "Please specify either -computer or -user when running script" ; exit}
If(-not (Get-MyModule -name "GroupPolicy")) { exit }

$gpoReports = Get-GpoAsXML -gponame $gponame.split(",") -server $server `
-domain $domain -folder $folder

Compare-XMLGPO -gpoReports $gpoReports -user $user -computer $computer

GPO Scripts – Finding a GPO given only the GUID

2010-10-04T07:00:00.005-04:00

Many times when you are chasing down a GPO problem, you only have the GPO GUID that is listed in the event log entry on the machine reporting the problem. If you are dealing with a domain of any size, finding the actual GPO that is causing the problem is a tedious process that requires a lot of patience when navigating through the directory tree looking for the actual policy link with the appropriate GUID.
The Powershell script below from the Technet Script Center addresses that problem and will produce an HTML report of the GPO in question given only its GUID. To use, simply replace your domain for the text "your.domain.here" in the script. Note: for this script to work you need the Group Policy Management Feature installed on your computer. Enjoy.

# Script By: Jonathan Knapp
#
# Script will search GPO's for GUID
#
#

$results1 = Test-Path C:\GPOReports

# Create folder

if ($results1 = "False") {
New-Item C:\GPOReports -type directory -Force
}
else {
}

$results2 = Test-Path C:\GPOReports\GPOReportsGUID.html

# Create empty file

if ($results = "False") {
New-Item C:\GPOReports\GPOReportsGUID.html -type file -force
}
else {
}

Import-Module -Name grouppolicy

$guidgpo = Read-Host "Enter the GUID of the GPO (Do Not Include Brackets {}"

Get-GPOReport -Domain Your.Domain.Here -Server DC01 -GUID $guidgpo -ReportType HTML -Path C:\GPOReports\GPOReportsGUID.html

# Now open in IE to View report

Invoke-Item C:\GPOReports\GPOReportsGUID.html

Windows 7 Optimization – Improving Performance Post Deployment

2010-10-01T07:00:00.001-04:00

All this week we have talked about methods for improving Windows 7's performance prior to deployment. While these items could be changed post deployment to address performance issues on a specific machine, today we will focus on a couple tools that are already on the workstation specifically focused on addressing performance issues on machines after they are in the hands of the end-user.

Performance Troubleshooting Wizard

The Performance Troubleshooting Wizard is a tool Microsoft provides that is intended to help find and fix performance related problems. The Performance troubleshooter checks issues that might slow down your computer's performance, such as how many users are currently logged on to the computer and whether multiple programs are running at the same time.
To launch the Performance Troubleshooting Wizard, simply select the Check for performance issues under the System and Security Heading in the Troubleshooting area of the Control Panel. You will be presented with a screen similar to the following:

Simply follow the prompts and answer the various questions it returns with, such as whether or not applications should be loaded at startup. The wizard will then reconfigure your system based upon the answers provided.

System Configuration Editor

The System Configuration Editor provides a simple means to control what applications and programs are launching at system startup. Many times there are applications launching at system startup that really do not need to be and these programs drain system resources away from the tasks that should be running. While this is a common means of launching for many types of malware, including the fake antivirus applications, many times there are "innocent" applications added to the system startup by the normal application installers in an effort to give you the appearance that an application launches faster. Several of the Office Applications, iTunes, QuickTime, and Acrobat are some of the many applications that use this "trick".
To launch the System Configuration Editor, simply run MSCONFIG at any command prompt. You will then see a screen similar to the following:

Simply Navigate over to the Startup Tab. All of the programs that are set to start from the Run Keys in the registry will be listed on this tab. If you find a program that is either suspicious or simply not needed, just uncheck the checkmark next to its entry. This will disable its launch at future logins.
Note: For those that are relatively new to the registry, all programs whose location begins with HKLM will launch for all users of the machine, while those whose location begins with HKCU will launch only for the current user.

Windows 7 Optimization – User Environment Tuning

2010-09-30T07:00:00.001-04:00

In an effort to optimize the Windows 7 environment, we have covered the removal of unnecessary network and system services. These on their own will make a significant difference in the overall performance of the system, but there are still other opportunities for improvement within the user environment itself. As was the case with the previous optimization techniques, there is not a "one size fits all" configuration, so there will be some discussion surrounding the impacts of the various items.

Disable System Restore

System Restore has not changed significantly in Windows 7 from its predecessors. The system restore area still provides a handy means for malware authors to address automated reinstallation of their code. Additionally, given the ease in which machines can be repaired through other means, the value provided by the system restore functionality doesn't typically justify its overhead.

Setting Visual Effects to Maximize Performance

Setting the Visual Effects to Maximize Performance under the system properties will minimize the amount of "flashy" transitions and visual effects presented to the user and hence will lower the amount of CPU and memory overhead needed to process these effects. This is another one of the unwinnable "form over function" arguments, so I would recommend against forcing these settings via any type of policy.

Modify MenuShowDelay

MenuShowDelay is a registry setting that controls the amount of time it takes for a menu in Windows 7 to pop, fade, or slide open when you hover the mouse pointer over it. By default, this setting is 400 ms. It is during this delay that the system is processing visual effects such as the fade effects. Lower values result in far less system resources being used to process these visual effects. I typically set this to 1ms. The path to this registry value is HKCU\Control Panel\Desktop\MenuShowDelay.
Note: This setting is located in the HKCU hive and as a result is profile specific, so it needs to be set for every user on the machine. This can be done by either using policies or by simply populating the value in the Default User profile.

Use the Basic Theme and Disable Aero

We have pretty much beat this horse to death over the last couple days. While the Aero system looks awesome, one needs to ask whether the windows transparency and other effects are really worth the CPU and memory costs.

Uninstall the Gadget Platform

I know this is another one of those items that can cause people to begin to reach for their torches and sharpen their pitchforks, because there are a number of gadgets that do have a valid business case to them. That being said, there are also a plethora of gadgets available that are simply time, resource, and/or bandwidth "wasters". Unfortunately in most organizations, leaving this component available becomes an implicit endorsement of all gadgets and an acknowledgement that you are willing to support them.
If your internal policies give you the freedom to support only those gadgets that have been "approved" then by all means feel free to leave this feature enabled.

Windows 7 Optimization – Remove Unnecessary System Services Part II

2010-09-29T07:00:00.000-04:00

As we discussed yesterday, the systems services area includes a significant number of items that are likely not being used and are just robbing CPU and memory resources from the user community. In today's article, we will cover the 2^nd half of these services that can likely be turned off and disabled in your environment with little or no effect on the user community.

Offline Files

Before you reach for the pitchforks and torches, I am well aware that this service can be unbelievably useful for the mobile worker. In fact, it is one of the tools that I rely on nearly every day. The key here though is that it is a tool for the mobile worker. In most environments, the mobile workforce is the minority; typically not more than 25%-40% of the overall user base. For the remainder of the workforce, this service has little, if any, value as they should have live access to the source materials nearly all the time. If you are using a scriptable image deployment system like the OSD component of SCCM, it is a simple matter to re-enable this service automatically as a part of your task sequences that address laptop computers. Even if you are not, it is a simple step to re-enable it as a part of the build process or in response to user inquiry.

Themes

Like the Desktop Window Manager Session Manager Service, this is another one of the "form over function" services within the OS. This service is responsible for providing user experience theme management. Together with the Desktop Window Manager Session Manager Service, the Themes service provides the heart of the "Aero Glass engine".
Don't get me wrong, the Windows 7 Aero looks awesome and can even be a plus. However, disabling the themes and Desktop Window Manager Session Manager Service to make it look like Windows 2000/XP could save you several hundred MB of RAM. In a 32-bit OS, several hundred MB of RAM is significant and could keep end-user workstations from paging when using more memory intensive applications and improving overall system responsiveness. On a 4GB machine, disabling these 2 services could result in an additional 10% of system RAM being available for end-user applications without paging. On a 2GB machine, the effects are even more significant.

Windows Media Player Network Sharing

This service shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play. If someone can come up with a business purpose for this service, I am all ears.

Windows Search

This is another one of the services that fills a very useful role for the mobile workforce, but not so much for the traditional desktop worker. Think about it; desktop search indexes files on the local workstation for faster searching. In most environments, users are strongly discouraged from storing files on their desktops in favor of using network shares for disaster recovery purposes.

Conclusion

There are likely other services that are providing questionable value for the resources they consume, but the nine services covered in the last 2 days should cover the vast majority of the "low hanging fruit". If you have others, feel free to add your two cents.

Windows 7 Optimization – Remove Unnecessary System Services Part I

2010-09-28T07:41:00.000-04:00

Just like the network services portion of the OS, the systems services area includes a significant number of items that are likely not being used and are just robbing CPU and memory resources from the user community. In today's article, we will cover the 1^st half of these services that can likely be turned off and disabled in your environment with little or no effect on the user community.

Application Experience

This service is essentially a database of 3rd party apps that Microsoft maintains to automatically apply proper settings to get well known programs with issues to run without user intervention (running in compatibility mode). If your environment doesn't include any apps that need to be run in compatibility mode, then this service is simply consuming resources and there is little risk to disabling it. If you have only one or two apps that need to run in compatibility mode, then you may still be able to disable it by manually specifying the compatibility mode parameters for those apps. If your environment houses more applications requiring compatibility mode than that, this service should probably be left running in your environment.

Desktop Windows Manager Session Manager

This service controls the Desktop Window Manager (DWM), which is responsible for Aero (transparent windows, etc). Without this service, you won't have the Aero effects. DWM consumes a fair amount of RAM which increases with each window you have open. While these visual effects are cool, are we really getting the value out of our machines by consuming our system resources this way and potentially forcing our "real" apps to be paging for memory?
Given some individual's propensity for choosing "form over function", I would strongly recommend against disabling this service by any sort of policy, either local or domain. It will simply lead to a confrontation down the road that isn't worth arguing over.

Diagnostic Policy Service

The Diagnostic Policy Service enables dynamic problem detection, troubleshooting and resolution for Windows components. If this service is stopped, diagnostics will no longer function. This is one of the services that I am always torn as to whether it should be left on or not. I usually disable it in the system image and then simply re-enable it on higher-end machines and on an as needed basis for lower-end machines.
I would recommend leaving this service enabled for all of the machines that are in your "QA" pool where you test system patches, etc. This service is usually quicker at finding problems on the system than we are.

Distributed Link Tracking Client

This service maintains links with NTFS files within your computer or across a domain. For example, you could make a file on "Computer A." You then create a "short cut" or "link" to that file on "Computer B." If you then move the file on Computer A to a different location, this service would tell Computer B to update its information to allow uninterrupted connectivity. Even though this is functionality sounds appealing, I have not found it terribly useful in a production environment. The user communities I have worked with simply don't maintain local shortcuts to all of their work files the way that this service expects them to. Additionally, there are usually only 3 reasons why a file or folder gets moved in the 1^st place and this really only "helps" the situation in one of the 3.

Situation leading to file/folder move	Results
Server Swap-out	In my testing, the only time this service was able to help was when the folder was a part of a DFS hierarchy. I have been unable to get this service to update shortcuts that move to a new server. (Which is kind of expected, when you think about it)
Misfiled Data	While the service does update the links in this situation, the individual who misfiled the data in the first place never hears that the file or folder was moved or why. This then leads to larger, non-technical problems in the future.
Accidental Folder Move	So who of us have not gotten the call that a whole folder structure has come up "missing"? Only to find (after some digging) that it has been dragged into an adjacent folder. In this situation, the updated shortcuts may actually shorten the discovery portion of this problem.

IP helper

This service provides tunnel connectivity using IPv6 transition technologies (IPv6toIPv4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer. Bottom line on this one is that unless you are running IPv6 in your environment, there is no need for this service.
That's it for today, we will pick it up tomorrow with more services that can likely be turned off to provide more resources to the user.

Windows 7 Optimization – Remove Unnecessary Network Services

2010-09-27T07:00:00.001-04:00

Roughly 1 year ago Microsoft released Windows 7 to the retail world and it has definitely been received as a significant improvement over its predecessor Vista. Many of the organizations that took a pass on Vista to stay with XP are starting to give Windows 7 a serious look for its use as their workstation OS platform going forward. As a result, we thought that we should take a look at ways to improve overall system performance within the Windows 7 environment.

Windows 7, like its predecessors, includes a number of features that are really intended on either setting you up for a future that has not yet arrived or are background processes meant to try and anticipate what you will need in the future to try to improve perceived performance. While these features are intended to improve the overall user experience, in many cases they simply end up consuming valuable CPU cycles or memory lowering overall performance. This occurs because these features must actively be used in order for them to contribute to your environment and many that are enabled by default simply are not used by many organizations.
One area that includes a number of examples is the network services that are installed by default. Included by default is support for the IPv6 protocol, Quality of Service for the workstation, and 2 topology services to help users find other systems on the network; none of which will likely perform any significant functionality in your environment. I am not saying these are not valuable services, but they need to be used in the proper context and environment in order to provide value to the organization. Let's take a look at them one by one, so one can make an informed decision as to whether these should be included in your default Windows 7 deployment image.

IPv6 Support

Enabled by default is the IPv6 protocol stack. Don't confuse this for standard TCP/IP, which has become the standard network protocol for most organizations, the Internet, etc. That protocol is formally known as IPv4, and it is enabled by default as well. IPv6 is intended as a long-term replacement for IPv4 due to its increased number of available addresses and other improvements. The point is, if you haven't specifically set your LAN/WAN environment up for IPv6, why enable it? Even if you had, there would then not be a need for IPv4. The two should only both need to be enabled on the same machine during a short transition period.
Bottom line if you are not using IPv6 today, disable it on the workstation image. Otherwise, you are forcing the machine to maintain a protocol stack it will not be using, which will force DHCP requests to take longer to resolve because the network layer needs to ask for both addresses forcing the system to wait for the IPv6 stack to timeout before resuming normal network operations.

QoS Packet Scheduler

Quality of Service and its little brother Class of Service, both fill a very important role in shaping network traffic in a finite bandwidth world. These are 2 very important technologies that help ensure that traffic on bandwidth capped lines such as those used in Wide Area Networks are used to their fullest by giving priority to applications that need real-time performance and lowering the priority of less business critical applications such as web surfing. That being said, is it really necessary to shape the traffic leaving a workstation?
Workstations are typically placed on high-speed gigabit subnets (or potentially 100Mbps in locations with older gear) with good connectivity to all other subnets on the LAN. Running the QoS scheduler forces the network subsystem to constantly check whether or not there is some other application running on the workstation that has a higher priority request for the network, lowering overall throughput and forcing a more memory and CPU intensive queue handler to be used.
Bottom line, if your network is congested to the point this technology would really make a difference, your time and money would probably be much better spent improving your local switch gear than managing the QoS policy for your workstations.

Link Layer Topology Services

The default network configuration also includes to network services: the Link-Layer Topology Discovery Mapper I/O Driver and the Link-Layer Topology Discovery Responder. These 2 services together are responsible for finding other systems on the network; the resources that they provide such as file and print shares or presence of a web server; and displying them on the network diagram view. In a lot of ways they are the next version of the computer browser service. In nearly every environment that I have ever been in, all of the resources that a user should have access to are provided by the login script or some other similar means. These services have no role or effect on a user's ability to find AD published printers or shares. As a result, these services then just end up adding network traffic to the environment that only helps users find things they shouldn't be looking for.

Conclusion

As I mentioned earlier, it is not that I don't think that these services are without merit and cannot be useful in the proper environment; I am only questioning whether or not they really should be enabled by default in your organizations base image. If you think I am missing the boat, please leave a comment explaining your point of view. It's not like I haven't been wrong before; just ask my wife… ;)

Diagnosing Queuing Problems – Part II

2010-09-25T07:00:00.003-04:00

Over the last 2 days we have been seriously polishing our "magnifying glasses" in effort to improve our mail delivery efficiency. Thursday, we covered the basics of the queue manipulation commands. Yesterday, we covered how to use those commands to address the most common mail queuing issues.
In this article we will cover the final four common queuing issues:

Messages rejected by destination
Cannot route one or more recipients of a message
Messages stuck in the submission queue
Messages show in the poison queue

Messages rejected by a remote machine

The last delivery error is either a per-message error received during a command like "mail from" or an aggregate of the recipient errors. The admin may see a recipient-specific error when looking at the message but would not know which recipient caused the problem. To get even more detailed information on a particular message run:
$m=get-message <MessageIdentity> -IncludeRecipientInfo
$m.Recipients | fl
This will also retrieve the recipients and will then display them in a detailed view (the message object will only print the email addresses). Each recipient has its own Status and LastError fields which can help identify what recipient caused the error and take an action (maybe the recipient wasn't found in AD or the mailbox is full, etc) In addition, the RetryCount property displays the number of times delivery has been attempted for that message.
When messages are rejected, NDRs are usually generated. If NDR messages start queuing up, there may be two problems: delivering to recipients and delivering the NDR to the sender. NDRs are easy to identify in the queue viewer: their FromAddress field is "<>" and the subject usually starts with "Undeliverable:" It is useful in this case to take a look at the NDRs themselves. To do so we can export the NDR messages and look at their body. To export a message it must be first suspended:
suspend-message <message identity>
export-message <message identity> -Path: <path to directory or file>
resume-message <message identity>

Cannot route one or more recipients of a message

When some recipients cannot be routed, the message with the subset of un-routable recipients will end up unreachable queue. The main question an admin must answer is "why did this message end up in the unreachable queue?" As in the previous cases, the LastError field will help diagnose the problem – all messages in the unreachable queue will have the LastError field populated. The value of this field is a concatenation of all the errors encountered when routing all recipients. There are errors like "A matching connector cannot be found to route the external recipient" or "The mailbox recipient does not have a MDB".
Of course, this doesn't help much until we realize what recipient caused what error. To do so, run the same sequence of commands as above by adding the IncludeRecipientInfo parameter to the get-message task to dump the recipients. All the recipients of the messages in this queue should have a last error string that describes the reason why they couldn't be routed.
In most case the actions needed to fix these issues follow from the error description. For example if the error on the message was "A matching connector cannot be found to route the external recipient" and the recipient is known to be valid, then it is likely that the send connectors are misconfigured (e.g. – missing address space, missing connector). After fixing the connectors, the unreachable queue will be automatically resubmitted too; this will result in those messages being drained and routed to the appropriate delivery queues.
To prevent automatic resubmission (e.g., when a few connectors need to be changed or added and we don't want the unreachable queue to be resubmitted after each configuration change because many messages may end up right back in the same queue) the queue can be suspended first, later resumed, and then resubmit can be performed manually:
suspend-queue Unreachable
… fix whatever is preventing the connector from connecting
resume-queue Unreachable
retry-queue Unreachable -Resubmit:$true

Messages stuck in the submission queue

The administrator will be alerted by MOM when the size of the Submission queue grows over the accepted limit. This can mean sometimes that we simply have a spike in incoming mail and the queue drains slower than the usual, but some other times we may see that no messages are going through the categorizer and into the delivery queues. This is usually an indication that something is wrong inside the categorizer component.
As usual, before attempting to investigate further, make sure the submission queue is not suspended (the status must be Ready).
get-queue Submission
One case when the above behavior happens is when the messages reach the categorizer but are being deferred and put back in the submission queue because of AD errors – the recipients cannot be resolved (this will only happen in the Hub role, as the Edge role doesn't have a resolver). The fix is to look at the messages in Retry
get-message –Filter:{Queue –eq 'Submission' –and Status –eq 'Retry'}
Note: there is no way to know exactly how long a message will be deferred for, but generally, 400-level errors in remote delivery will defer a message for the time span configured in the transport server property MessageRetryInterval (default is 1 minute). The messages in the submission queue are usually deferred for 30 minutes (non-configurable) if errors like AD connectivity failures. In addition a categorizer agent could defer a message for any duration. Unlike in the case for queues, there isn't a way for the admin to change or reset the retry time for messages.
If AD is unavailable, the last error on those messages will say something like "AD transient failure during resolve." The AD connectivity problem must then be investigated.
All message retries that are triggered by the categorizer have a reason associated with them. There are LastError messages indicating whether the message has been deferred by an agent ("Message deferred by categorizer agent."), that a failure happened during content conversion ("A storage transient failure has occurred during content conversion.") etc. These errors are not always giving an exact indication on what the problem is but they make a good starting point. For example, there won't be any indication in the last error field about which agent deferred the message and why, but if get-message returns too many messages in Retry with the same "deferred by agent" last error, it likely means that one of the categorizer agents has encountered a problem. The next steps may be trying to identify the agent by disabling all categorizer agents or rules, then enabling them one by one. Ultimately, debugging the agent or analyzing the tracing log of that agent, if available, may be needed.
Another case that we have encountered is when a categorizer agent is deadlocked and cannot finish processing a message. By default, the categorizer can only process 20 messages at once (in various stages of categorization). If all those 20 jobs are stuck, no more messages will be picked up from the submission queue for processing, and as a result, the submission queue will grow continuously until someone intervenes. To figure out which messages are just being processed by the categorizer run:
get-message –Filter: {Queue –eq 'Submission' and Status –eq 'Active'} | ft Identity
Active messages are those being currently in various stages of categorization (routing, resolving, content conversion). This query should return at most 20 results. Run the query a few times in a row. If the same messages are returned each time the query is run (you can see that by the fact that the identities are the same) then it is very likely that we have a stuck categorizer agent problem. The quick fix to restore mail flow is to disable the agents. The in-depth fix would be to attach a debugger and identify the call stack on all the stuck threads which will point to the "stuck" code.

Messages show in the poison queue

The poison queue does not show up when get-queue is run, unless there are messages in it. Hopefully, you have never even heard of the poison queue; let alone needed to check it. The poison queue is a special mail queue for holding severely impaired messages. This means that the server has crashed at least twice while processing those messages. This can have many causes: bugs in our code not knowing how to deal with certain kinds of input, bugs in agents, misconfigurations, etc. In general, if poison messages exist, they have uncovered a bug somewhere. It is important to realize that the messages in the poison queue are usually not invalid or malicious. They would only become malicious if attackers discover that they can crash/exploit Exchange servers in this way.
If you discover poison messages after a crash, you can get more information using the following commands:
First, take a look at the poison queue
get-queue Poison
or
get-queue <ServerName>\Poison
This will tell how many poison messages exist. Then the messages must be looked at individually and decisions must be made on a case-by-case basis.
get-message –Queue:Poison
All those messages are considered suspended. The admin now has a couple of options:

Resume the messages one by one and figure out if they still make the transport service crash resume-message <poison message identity>
Export the poison messages to files and have the content looked at by microsoft developers (the following command exports all poison messages in the temp directory) get-message –Queue:Poison | export-message –Path: "C:\temp"
Delete messages if they are indeed poison (and choose to send or not to send NDR) remove-message <poison message identity> -withNDR:$false

If the problem is suspected to be happening because of some agent, disable the agent and resume the poison messages.
Messages in the Poison queue never expire; they have to be either resumed or deleted by an admin.

Diagnosing Mail Queuing Problems – Part I

2010-09-24T07:00:00.002-04:00

With yesterday's posting covering the basics of the queue viewer commands (Playing Traffic Cop – Commands for Working with the Exchange Mail Queues), we now have a new set of tools to allow us to fulfill our role as the "Sherlock Holmes of NDRs". With that said, most mail flow interruption scenarios that can usually be classified in one the following categories:

Cannot connect to destination machine to deliver mail
Messages stuck in a delivery queue, but destination is working properly
Messages rejected by destination
Cannot route one or more recipients of a message
Messages stuck in the submission queue
Messages show in the poison queue
When faced with these situations, one needs to resolve the following two questions:

What caused this situation?
How can I fix it so that mail flow is restored again?

We will cover the first two common scenarios today and the remaining four in tomorrow's article.

Cannot connect to destination machine to deliver mail

This is far and away the most common problem. Some of the common causes may be:

Destination machine is down or there are network connectivity problems
Destination is being overwhelmed with traffic
No MX records can retrieved for the destination
Destination rejects connections because of certain limitations

One may be alerted to a possible mail delivery problem by a number of reasons: Users complaining of slow delivery times, a MOM/SCOM alert saying that the total number of messages in the transport queues on some server has exceeded the established threshold, etc. Since the information in these initial warnings is usually rather vague (for example, the counter used by MOM/SCOM only provides an aggregate message count for all delivery queues), the first step in the discovery process is to identify which queue seems to accumulate messages without delivering them.

To get to this information run the command: get-queue –SortOrder:-MessageCount
(Alternatively, one can launch the Queue Viewer from the Exchange Administrator Console and sort by Message Count)

Note: all commands that do not pass a full queue identity (prefixed with the server name) assume that the administrator is logged on the transport server. To run these tasks remotely add the "-Server:<server name>" parameter.

This will return all the queues on the server ordered descending by message count so the largest queue will come first in the results (change –MessageCount to +MessageCount to order ascending by the same field).

The first queue returned will likely be the queue that creates the problem (let's assume it's a delivery queue, that is, its DeliveryType member is not Submission or Unreachable). To figure out if this is the case let's get all the data about the queue with the largest number of messages. The "-Results:<desired result count>" argument can be passed to the task to limit the number of queues returned.
get-queue –SortOrder:-MessageCount –Results:1 | fl

The Status and LastError queue fields will help diagnose the problem. Usually, if the queue cannot establish a connection with the destination, its Status will be Retry and the LastError will be an error message in the form of an SMTP response. Healthy, active queues should be delivering messages, so the message count should be dropping with time or at least fluctuating up and down. (In the event it is increasing rapidly, check to make sure that you do not have a runaway mail merge, spambot, or other mass-mailing process gone awry using the get-message command as shown later in the article.)

Assuming one does not have a runaway mailer, make sure the queue status is not suspended. It is entirely possible that it may have been suspended by somebody else and left in this state accidentally. (If you work in an organization with more than one mail administrator, check to make sure that the queue is not intentionally in this state) A suspended queue will not even attempt to establish connections to attempt delivery. If the queue is suspended and shouldn't be, simply resume it by running the following command, which will automatically attempt to connect to the destination: resume-queue <QueueIdentity>

From the status and LastError fields, you may be able to determine whether the remote machine actively rejects connections (e.g. it has reached some maximum number of incoming connections) or a connection cannot be made because the remote IP address/port combination is not listening, or because the store driver cannot connect to a mailbox server. DNS lookup failures are also reflected in this field. What can be done to fix these problems? The LastError queue field should be descriptive enough to make it obvious that the problem lies with the server being diagnosed or the remote server or somewhere in between (MX records). The actions are different according to whether the destination belongs to the same org (AD site, routing group) or not (some remote domain on the internet)

If the destination is internal, besides the obvious checks that it is up and working it is also useful to check the routing information. If some send connectors are left enabled pointing to a smarthost that doesn't exist anymore or to an AD site which doesn't have any Hub servers, messages may be routed to a queue that acts like a dead-end. It is important that this scenario be detected early so that the messages don't stay in that queue forgotten until they expire. Note: In most cases, the NextHopDomain property of a queue is the name of either another SMTP server or of a mailbox machine. In these situations the destination can be promptly identified and actions can be taken. But In the case of the delivery to another AD site, the next hop domain is the name of the AD site and the actual machine our server is trying to connect to will be dynamically chosen by DNS.
The next step would be to bring the connectivity log and the protocol log or message tracking log in the picture and identify the IP of the bridgehead that responded with an error. In the case that the destination is rejecting connections because of certain limitations, a wealth of information is available in the protocol log, which offers the advantage of showing the history of our attempts to connect and deliver as opposed to the queue viewer which only exposes the current situation and the last error. This situation may also uncover other problems – if the destination machine that rejects messages is under your control, it may be useful to inspect the event log on destination which can give additional information about why the messages or connections were rejected – connection rate or message rate exceeded, etc.

Messages stuck in a delivery queue but destination seems OK

Sometimes after, trying to diagnose the state of a queue the admin realizes that the destination is ok, i.e. – it can be contacted via TCP/IP on port 25 (see Whose Fault is it Anyway), or if the queue is local delivery, the mailbox store is up and running. The queue status may be Ready or even Active, but the message count won't go down. In this situation we want to look more in depth at the messages. We could have a situation where the queue simply has a large backlog and the system is only slow. In this case you have to determine whether or not some messages are being delivered.
The first thing to do is call:
get-queue <QueueIdentity>

As in the previous situation described, first make sure first the queue status is not Suspended. Next, check if the queue status is Retry. After the "glitch retry" time (4 times at 15 second intervals) the queue will not attempt a connection for the next hour (local delivery queues however have a flat 5-minute retry time). The time of the next connection attempt is given by the NextRetryTime queue field. If the destination is known to have had a problem that was fixed in the meanwhile, run:retry-queue <QueueIdentity>
This will attempt to establish a connection immediately.

If the queue is Active and the message count fluctuates up and down then the queue is working as expected: messages are being delivered but they can also be rejected – in both cases they disappear from the queue. If the queue message count seems to be increasing constantly, it's time to take a look at the messages: get-message -Queue <QueueIdentity>
This will return all messages from the queue identified by <QueueIdentity>.

If there are too many messages this can be slow and spew too much information, so limiting the number of results may help. Here's how to get the first 10 results:
get-message –Queue <QueueIdentity> -Results:10

To diagnose the problem further we must check the status of the messages. However we must keep in mind that the order in which the messages are returned by get-message is not related to the order in which the messages are delivered.If the status of some messages is Active it means the queue is doing its job delivering messages. To get the active messages run the following command a few times and see if any results are returned:
get-message –Filter:{Queue –eq '<QueueIdentity>' –and Status –eq 'Active'}
(Run this a few times since messages in deliver may quickly disappear, so you may as well get no messages back sometimes.)

If many or all messages are Suspended, as in the case of the queues, no delivery will be attempted. Messages may have been suspended by somebody else and forgotten in this state.If the status of many messages is Retry (you can obtain them using a query filter like the one for Active messages) check their LastError. This should explain why they were put in Retry. Retry messages are usually accompanied by a SMTP error. This error is typically enough to diagnose the error.

Well, I have rambled on for long enough for one day; more to come tomorrow.

Playing Traffic Cop – Commands for Working with the Exchange Mail Queues

2010-09-23T07:00:00.001-04:00

So far this week, we have talked about how to react when Exchange has given up on a message and returned an NDR. Starting today and continuing the rest of the week, we will be discussing how to step in and be the traffic cop to help direct traffic around congestion, "road construction", and other obstacles before the dreaded NDR event happens. There are a number of tools available in the Exchange environment to help diagnose the problem and restore normal traffic flow. These tools include the queue viewer, protocol logging, connectivity logging, message tracking, etc. This article is going to focus on how to use the queue viewer commands to diagnose mail flow interruptions.

This article is the first in a 3 part series on working directly with the Exchange Mail Queues. In this first part, we will tackle the basic commands. In the second and third parts, we will look at common message delivery scenarios and how these commands can be used to solve the most common mail delivery problems.

Basic Concepts

Here are a few notions that should be understood before diving head first into your Exchange server's console session.

The queue viewer is referred to here as a set of distinct commands. These tasks are also available through the Exchange management UI, but the UI will not be our primary focus as it typically does not provide the same level of control and/or filtering capabilities.
A routing solution is a subset of the recipients of a message which are all routed to a single destination (or next hop). These solutions are built during routing and the recipients are partitioned into solutions based on their target domain (the address part after the "@" sign), the routing configuration (connectors, weights, AD sites) and other restrictions.
Destinations (next hops) are basically of two kinds: Exchange mailbox servers and any SMTP servers. Consequently, delivery queues are of two kinds: "local" – to a mailbox server (note: "local" doesn't have to mean the same machine) and "remote" – to an SMTP server. A distinction between the two categories will be made, when relevant. If not specified, it should be assumed that local and remote delivery queues share a common behavior.
In the following examples, all strings containing names delimited by "<" and ">" must be replaced with actual values (e.g.: <QueueIdentity>, <server name>)
This is not intended to be a primer on the exhaustive uses of these commands.

Queue Manipulation Commands

The queue viewer is a simple set of powershell commands which can be used to manipulate queues and messages on a server. The two main "status" commands one needs to master are the get-queue and get-message commands. The get-queue command returns information about existing transport queues and the get-message command provides info about the messages queued by the server. These objects have properties that can help us identify them, such as Identity and Subject for messages and Identity and NextHopDomain for queues. There are also other properties which can help diagnose the state of the object, such as Status, LastError and RetryCount.
There are also other "action" commands that will assist in your task by actually performing work on the various queues. The resume-queue command allows one to resume a suspended queue, while conversely suspend-queue allows for the suspending of a problem queue. The retry-queue command forces the queue to immediately attempt to deliver messages again rather than waiting for the next retry interval.
Lastly, there are "action" commands that will assist you by performing actions on individual messages within a queue rather than the entire queue. The suspend-message command allows one to suspend processing of an individual message within a queue, while allowing processing to continue for all other messages. The resume-message command allows one to resume the processing of a suspended message. The export-message command allows for the saving of an individual message to a file external from the mail queue, which can prove useful in addressing issues where mail content may be triggering problems such as prohibited attachment types, excessive size, etc. Lastly, there is the remove-message command which may be used to delete an individual message.

Common Command Examples

The table below illustrates some common uses of some of the various commands. Beginning tomorrow, we will put these together for more productive work.

Command	Usage	Description
Get-Queue	get-queue –SortOrder:-MessageCount	Return all of the active queues on the server in reverse order of message counts starting with the largest queue
	get-queue –SortOrder:-MessageCount –Results:1 \| fl	Get the full details of the longest queue
Get-message	get-message -Queue <QueueIdentity>	Get general message details from a specific queue
	get-message –Queue <QueueIdentity> -Results:10	Only return the top 10 messages from the specified queue
	get-message –Filter:{Queue –eq '<QueueIdentity>' –and Status –eq 'Suspended'}	Returns message details for suspended messages in the specified queue
Retry-Queue	retry-queue <QueueIdentity>	Force an immediate delivery attempt for the specified queue
Suspend-Queue	suspend-queue <QueueIdentity>	Suspend processing of the specified queue
Resume-Queue	resume-queue <QueueIdentity>	Resume processing of the specified queue

Deciphering TLS Issues within Exchange

2010-09-22T07:00:00.001-04:00

What do you do when you suspect that there is an encryption problem preventing mail delivery? Identifying these types of issues is usually pretty easy. You add the domain to your TLS exempted send connector's scope and the mail delivers; remove it and it fails. Unfortunately, getting the details as to why it fails is many times far more difficult than it should be.
Circumstantial evidence is often your friend in these situations. Think about it, if you are able to send messages via TLS to one organization and not to another, the chances are that you are not the organization with the problem.

Certificate Expired

An expired certificate on one side or the other is far and away the number one reason TLS suddenly stops working. Checking servers in your charge is relatively simple using the certificate manager MMC plug-in or the Get-Exchangecertificate powershell command. You should also see an Event ID 12016 at connector startup indicating the certificate has expired. (And a period of time where you were getting Events of ID 12018 telling you the certificate is about to expire) If you do end up renewing the certificates for your exchange transports, make sure to run the enable-exchangecertificate powershell command again to instruct exchange to begin using the new certificate as it will not do it automatically.
Finding and proving that a 3^rd party's servers have expired TLS certificates is a little trickier. If the 3^rd party domain lands in your "opportunistic TLS" connector, mail will still flow; it will simply be sent via normal SMTP without any encryption. If you look in the SMTP logs for messages to that domain, you will see an error similar to the following:

A secure connection to domain-secured domain 'example.com' on connector 'Default external mail' could not be established because the validation of the Transport Layer Security (TLS) certificate for Example.com failed with status 'Expired. Contact the administrator of ourclient.com to resolve the problem, or remove the domain from the domain-secured list.

If the 3^rd party domain lands in your "TLS required" connector, mail will not flow any longer and again you will see errors in the SMTP logs
Now if you are like most and the notion of digging through mounds and mounds of SMTP logs sends shivers up your spine, you can use OpenSSL to assist in the process (Windows binaries available here). Simply run openssl s_client -connect mail.example.com:25 -starttls smtp
Any irregularities in the client's certificate will be reported in the results.
Unfortunately, using the Windows binaries your client will fail the verification portion of the tests as it cannot look into the local certificate store to pull your certificate.

Wrong Certificate in Use

With Exchange's use of self-signed certificates for internal communications, it is a simple matter for an organization to inadvertently use the wrong certificate for its public TLS encryption. Checking your own servers is simply a matter of using the Get-Exchangecertificate powershell command to verify that the proper certificate is selected for use on your public send and receive connectors. Pay special attention to the thumbprints as many organizations have failed to run the enable-exchangecertificate powershell command again after renewing their TLS certificates resulting in the legacy certificate still being used even though a newer (and valid) certificate is available.
For checking 3^rd party servers, I know of no better tool than the method using the OpenSSL tool described above.

Getting Mail Delivered

If it is your servers with the issues, taking the steps above should help you correct any certificate issues quickly. (at least as quickly as your CA can provide) You obviously can't change the message security policy for your partners, but you can lessen the attention on your domain by simply changing the routing rules within your organization so that all domains leave your "No TLS" send connector and come in a receive connector that does not respond to TLS. This will help for all organizations except those that actively require TLS.
For situations where it is the 3^rd party server with the problem, simply move that domain to connectors that don't require TLS, assuming you don't have a policy prohibiting it, and notify their administrators.

Whose Fault is It Anyway?

2010-09-21T07:00:00.001-04:00

Unfortunately, even with the NDR codes to help and detailed SMTP logging turned on, there are a number of situations where it is still not obvious if the problem lies within your mail system or the destination domain's mail servers. That's where it helps to be able to be the mail server itself.

While to some extent that sounds crazy, it isn't actually that hard to pretend to be a mail server yourself because SMTP is a completely clear text protocol.
This should not be the first step in debugging an NDR. Other steps should be done first such as:

Looking at the NDR code to determine the likely cause
Verifying your mail servers are not on any black-lists (See below for instructions if you are not sure)
Reviewing the SMTP logs
Sending a small, unencrypted mail message

The basic process of simulating a SMTP session is laid out in MS KB153119, but it goes something like this:

Step 1: Lookup the mail server to use

At a command prompt, type NSLOOKUP. When nslookup returns with its prompt, type SET TYPE=MX. This will instruct NSLOOKUP to look for mail server records. At the prompt, type the domain name you wish to "send" the message to. This will be what appears after the "@" in the mail address (yahoo.com, gmail.com, etc) NSLOOKUP should return with a listing of all of the incoming mail servers for that domain and their preferences. In SMTP parlance, a lower preference number equates to a higher priority. i.e. messages should always be sent to the server with the lowest preference number that is available. In the example below, mail should be sent to the gmail-smtp-in.google.com host first.

Step 2: Connect to the host on port 25

At a command prompt, type telnet host 25, where host is the hostname determined in Step 1. Note: if using Windows 7 or Server 2008, there is not a telnet client installed by default, so you may need to substitute a different command such as Putty.

Step 3: Say HELLO

Upon successfully connecting, type EHLO domain, where domain is your domain name.

Step 4: Who is the mail message from

Upon accepting the domain name, one needs to explain who the message is from. This is done by typing the command MAIL FROM: address, where address is the from address. Note: some mail servers want the address enclosed in brackets. These servers usually give a clear text response indicating as such.

Step 5: Who is the message going to

Upon accepting the from address, one needs to explain who the message is going to. This is done by typing the command RCPT TO: address, where address is the to address. Note: some mail servers want the address enclosed in brackets. These servers usually give a clear text response indicating as such.
At this point if you haven't gotten any error responses from the remote server, the problem is likely within your own mail system. The only other explanation is there is something within the contents of the original messages that was blocking the message, which should have been flagged by sending the small, text only, test message. Ideally, you should have also put their mail domain in the connector properties of your TLS exempted send connector, so you can rule out mail encryption problems as well.
If you do get errors from the remote server (they should be very similar to those returned in the NDR messages), you don't have to just throw your arms up and say there is nothing you can do. Many organizations post a "Contact Us" form or phone number on their websites that can be used to explain the situation and help you get in contact with appropriate staff.

Note: To see if your mail server is on any of the common blacklists, simply navigate to mxtoolbox.com and use their Blacklist tool. Just enter the public IP address of your mail server, click on the Blacklist Check button, and in a few moments you will see whether that address is listed on any of roughly 100 public blacklists. If you find that your mail server address is blacklisted, don't panic. Simply browse to the main website of the blacklist your server is listed on and read for instructions on how to request to be removed. Many times, they will provide you with greater detail on why you were blacklisted in the first place, such as an open relay, unsolicited bulk email, etc. Simply correct that issue, request the delisting, and unfortunately wait. It often takes roughly 1 business day to get delisted.

What to do When the Postman Doesn’t Knock

2010-09-20T07:00:00.003-04:00

No matter how much we try, there will inevitably be messages that the system gives up on and are unable to be delivered. Luckily Microsoft Exchange, as our postman, does a pretty good job of giving us the clues as to why the message was not delivered.

Exchange does this in the form of a Non-Deliverable Report or NDR similar to the one below that is sent to the originator of the message.

All NDRs that originate within Exchange include a NDR code that is in X.X.X format, where X is in numeric format. The table below lists the Exchange 2007 NDR codes and their typical meaning.

NDR Code	Explanation of Enhanced Status Codes in Exchange 2007 NDRs
4.2.2	The recipient has exceeded their mailbox limit. It could also be that the delivery directory on the Virtual server has exceeded its limit.
4.3.1	Insufficient system resources. This normally means not enough disk space on the delivery server. Microsoft says this Exchange NDR may be reported as out-of-memory error.
4.3.2	A classic temporary problem. Most likely, the Administrator has frozen the queue.
4.4.1	Intermittent network connection. The server has not yet responded. Classic time-out problem. If it persists, you will also get a 5.4.x status code error.
4.4.2	The server started to deliver the message but then the connection was dropped. The sending server is configured to retry automatically.
4.4.6	Too many hops. Most likely, the message is looping.
4.4.7	Problem with a protocol timeout, for example a message header limit. Check receiving server connectors.
4.4.9	A DNS problem. Check your smart host setting on the SMTP connector. For example, check correct SMTP format. Also, use square brackets in the IP address [197.89.1.4] You can get this same NDR error if you have been deleting routing groups.
4.6.5	Multi-language situation. Your server does not have the correct language code page installed.
5.0.0	SMTP 500 reply code means an unrecognized address. You get this NDR when you make a typing mistake when you manually try to send email via telnet. The most likely cause is a routing error. One solution maybe to add an * in the address space. A separate cause for NDR 5.0.0 is a DNS problem.
5.1.0	Sender denied. Often seen with contacts. Verify the recipient address. Mismatched Network Card duplex setting.
5.1.1	Bad destination mailbox address. 5.1.1 is the most common Exchange 2007 NDR; there is a problem with the recipient address. Maybe the recipient does not exist. Possibly the user was moved to another server in Active Directory. Check mailbox delegation. Maybe an Outlook client replied to a message while offline. Check connector configuration.
5.1.2	SMTP; 550 Host unknown. An error is triggered when the host name can't be found. For example, when trying to send an email to user@nonexistantdomain.com.
5.1.3	Invalid recipient address. Another problem often seen with contacts or cached address entries. Address field maybe empty. Check the address information. Or there could be a syntax error.
5.1.4	Destination mailbox address ambiguous. Two objects have the same address, which confuses the Exchange 2007 Categorizer (Not to mention the mail administrator).
5.1.5	Destination mailbox address invalid.
5.1.6	Problem with homeMDB or msExchHomeServerName - check how many users are affected. Sometimes running RUS (Recipient Update Service) cures this problem. Mailbox may have moved.
5.1.7	Invalid address. Problem with senders mail attribute, check properties sheet in AD Users and Computers.
5.1.8	Something wrong with sender's address
5.2.1	Mailbox cannot be accessed. Perhaps the message is too large. Alternatively, the mailbox has been disabled, or is offline. Check the recipient's mailbox. Else it could be a permissions problem, particularly on a Public Folder. If so, try this PowerShell Command: get-PublicFolderClientPermission "\ProblemFolder"
5.2.2	Sadly, the recipient has exceeded their mailbox storage quota.
5.2.3	Recipient cannot receive messages this big. The server or connector limit exceeded. Try resending the message without the attachment.
5.2.4	Most likely, a distribution list or group is trying to send an email. Check where the expansion server is situated. The application event log may have an Event ID 6025 or 6026, which has more detailed information.
5.3.0	Problem with MTA, maybe someone has been editing the registry to disable the MTA / Store driver.
5.3.1	Mail system full. Disk full problem on the mailbox server?
5.3.2	System not accepting network messages. Look outside Exchange for a connectivity problem.
5.3.3	Remote server has insufficient disk space to hold email. Check SMTP log. This error often happens when the sending server is using an ESMTP BDAT command.
5.3.4	Message too big. Check the limits on both the sender and receiver side. There maybe a policy in operation.
5.3.5	System incorrectly configured. Multiple Virtual Servers are using the same IP address and port. See Microsoft TechNet article: 321721 Sharing SMTP. Email probably looping.
5.4.0	DNS Problem. Check the Smart host, or check your DNS. It means that there is no DNS server that can resolve this email address. Could be Virtual Server SMTP address.
5.4.1	No answer from host. Not Exchange's fault, check connections.
5.4.2	Bad connection.
5.4.3	Routing server failure. No available route.
5.4.4	Cannot find the next hop, check the Routing Group Connector. Perhaps you have Exchange servers in different Routing Groups, but no connector. Configuring an MX record may help.
5.4.6	Tricky looping problem, a contact has the same email address as an Active Directory user. One user is probably using an Alternate Recipient with the same email address as a contact. Check recipient policy.
5.4.7	Delivery time-out. Message is taking too long to be delivered.
5.4.8	Microsoft advises checking your recipient policy when receiving this error. SMTP address should be yourdom.com. NOT server.yourdom.com.
5.5.0	Underlying SMTP 500 error. Our server tried ehlo, the recipient's server did not understand and returned a 550 or 500 error. Set up SMTP logging. You will likely end up setting up a separate send connector to send mail to this domain to use HELO rather than EHLO formatted SMTP mail.
5.5.1	Invalid command. (Rare Exchange NDR)
5.5.2	Possibly the disk holding the operating system is full. Alternatively, it could be a syntax error if you are executing SMTP from telnet.
5.5.3	Too many recipients. More than 5,000 recipients. Check the Global Settings, Message Delivery properties. Try resending the same message to fewer recipients.
5.5.4	Invalid domain name. The true cause maybe an invalid character.
5.5.5	Wrong protocol version.
5.5.6	Invalid message content. This is a protocol error, thus you should get more information by looking in the application log.
5.6.0	Corrupt message content. Try sending without attachment.
5.6.1	Media not supported.
5.6.3	More than 250 attachments.
5.7.1	A very common Exchange 2007 NDR, the cause is a permissions problem. For some reason the sender is not allowed to email this account. Perhaps an anonymous user is trying to send mail to a distribution list. Alternatively, a user may have a manually created email address that does not match a System Policy. Check SMTP Virtual Server Access Tab. Try checking this box: Allow computers which successfully authenticate to relay. Check the outgoing SMTP logs. Check: Mailbox - <Mailboxname> - Properties - Mail Flow Settings - Message delivery restrictions. Try disabling Windows-Integrated-Security. Instead allow only standard authorization on the SMTP receiver on the Exchange 2007 server. Check Attachment filtering on the Edge server.
5.7.2	Distribution list cannot be expanded and so is unable to deliver its messages. May be a Global Catalog problem or a DL that has been deleted.
5.7.3	Not Authorized, security problem. It could be that the sender cannot send to the alternative address. On another tack, check external IP address of ISA server. Make sure it matches the SMTP publishing rule.
5.7.4	Extra security features not supported. Check delivery server settings
5.7.5	Cryptographic failure. Try a plain message without encryption.
5.7.6	Certificate problem, encryption level maybe too high.
5.7.7	Message integrity problem.

If your NDR code is not in X.X.X format, it did not originate within Exchange and likely originated with the client. This is especially true if it is either in hex format like 0x800CCC09 or a long numeric code that includes dashes.

File System Cleanup

2010-09-17T07:00:00.002-04:00

Let's face it both applications and people are terrible at cleaning up after themselves. As a result, cleaning up file systems has to be one of the most common requests I have had to help organizations through in my career and it's not always the servers needing the cleanup. Workstations often need the cleanup far more than the servers do. Organizations often target the network share locations for cleanup because that is where they see direct costs associated with this unnecessary collection of files in the form of additional backup media and premature system replacement costs. Workstations though also have file system cleanup needs as well.
We covered removing aged user profiles yesterday. There is also a need though to clean up the profiles and other folders that are still in use. Items such as old Temp Files and System Mini Dumps can easily consume an entire hard drive.
Luckily, a good start on addressing both the server and workstation cleanup tasks can be done in the same script. This is because both have similar needs. Both tasks need a way of reporting and/or deleting files that match a specified file name pattern. They also both need a way of reporting and/or deleting files over a certain age that match a specified name pattern. Today's included script can actually address one or both problems in a single pass through the file system.
This script, filecleanup.vbs, was put together from a bunch of different sources over the years to address the various cleanup requests I had received.
Using the script is simple assuming you have a good grasp of VBScript's regular expressions. See http://msdn.microsoft.com/en-us/library/ms974570.aspx for a quick refresher if you need help constructing regular expressions.
Since most file cleanup searches tend to be focused on the extension of the file in question, the one operator you will use continually is the $ operator as it means the expression needs to appear at the end. For example, the expression ".tmp$" will only match files with an extension of .tmp; it would not match "name.tmp.txt" The script does allow for multiple expressions to be provided in the same operation. Simply delimit the different strings with a semicolon (;). For example, ".tmp$;.err$;.log$" would match any file with a .tmp, .err, or .log extension.
Command line syntax:
Cscript filecleanup.vbs -FOLDER <folder> [-PATTERN <regexpr>] [-DATEPATTERN <regexpr> -NUMDAYS <n>] [-DELETE]
If you have file types that you want removed regardless of age, simply construct a regular expression that matches their name and include it in the –PATTERN argument to the script. For example, if you had a folder named c:\files that you wanted to remove every .dmp and .tmp file from, the command line would be:
Cscript filecleanup.vbs -FOLDER c:\files -PATTERN .dmp$;.tmp$ -delete
If you have file types that you want removed only after they reach a certain age, simply construct a regular expression that matches their name and include it in the –DATEPATTERN argument to the script along with the number of days old at which you wish to remove them. For example, if you wish to remove all .log and .err files from the c:\files folder after 3 days the command line would be:
Cscript filecleanup.vbs -FOLDER c:\files -DATEPATTERN .log$;.err$ -NUMDAYS 3 -delete
The two previous examples can even be combined into a single action. If that were the case the command line would be:
Cscript filecleanup.vbs -FOLDER c:\files -PATTERN .dmp$;.tmp$ -DATEPATTERN .log$;.err$ -NUMDAYS 3 -delete
If you simply want a list of files that meet the criteria, but don't want to delete them, simply leave off the –delete argument and the script will simply report the names and their location.
What the script does not do is cleanup empty folders.
As one can imagine, this script can still be used for a number of very useful things such as:

Cleaning up end user profiles of TMP files over a certain age
Cleaning up transient network locations such as scan destinations
Removing unwanted file types from network shares such as potentially .MP3, .WMA, WMV, etc.
Removing unwanted application log, dump, or detail files from systems

Script Contents below:
on error resume next
Sub Usage()
WScript.Echo UCase(WScript.ScriptName) &_
" - Reports/Deletes files based on name and age" & vbNewLine & vbNewLine &_
"Enumerates files starting at a specified folder and evaluates there name and age against" & vbNewLine &_
"provided patterns and either reports them or optionally deletes them." & vbNewLine & vbNewLine &_
WScript.ScriptName & " -FOLDER <folder> [-PATTERN <regexpr>] [-DATEPATTERN <regexpr> -NUMDAYS <n>] [-DELETE]" & vbNewLine &_
"-FOLDER <folder>        Start the search at the specified folder" & vbNewLine &_
    "-PATTERN <regexpr>        Semicolon delimited regular expressions denoting files that should be flagged regardless of age." & vbNewLine &_
    "-DATEPATTERN <regexpr>    Semicolon delimited regular expressions denoting files that should be flagged based on age." & vbNewLine &_
    "-NUMDAYS <n>            Number of days that should be used as the threshold for the date flagged files, default is 3650" & vbNewLine &_
    "-DELETE                Flagged files should be deleted as well as reported" & vbNewLine &_
"-?, -H             Displays this help" & vbNewLine & vbNewLine
WScript.Quit
End Sub

sPattern = ""
sTmPattern=""
iNumDays = 3650
boolDelete = false

While i < WScript.Arguments.Count
Select Case Replace(UCase(WScript.Arguments.Item(i)),"/","-")
Case "-FOLDER":
        i=i+1
        objStartFolder=WScript.Arguments.Item(i)
    Case "-PATTERN":
        i=i+1
        sPattern=WScript.Arguments.Item(i)
    Case "-DATEPATTERN":
        i=i+1
        sTmPattern=WScript.Arguments.Item(i)
    Case "-NUMDAYS":
        i=i+1
        iNumDays=clng(WScript.Arguments.Item(i))
    case "-DELETE":
        boolDelete = true
Case "-?":
usage()
Case else:
usage()
End Select
i = i + 1
wend

if len(objStartFolder) = 0 then
    wscript.echo "Starting Folder not specified."
    wscript.quit -1
end if

Set objFSO = CreateObject("Scripting.FileSystemObject")

Set objFolder = objFSO.GetFolder(objStartFolder)
if err.number <> 0 then
    wscript.echo "Starting Folder: " & objStartFolder & " is not accessible or does not exist."
    wscript.quit -1
end if
' Wscript.Echo objFolder.Path
Set colFiles = objFolder.Files
For Each objFile in colFiles
    boolMatch = false
    if NameMatch(objFile.Name, sPattern) then
        boolMatch = true
    end if
    if not boolMatch then
        if NameMatch(objFile.Name, sTmPattern) then
            DaysOldMod = Int(Now() - objFile.DateLastModified)
            DaysOldCreate = Int(Now() - objFile.DateCreated)
            if (DaysOldCreate > iNumDays) and (DaysOldMod > iNumDays) then
                boolMatch = true
            end if
        end if
    end if
    if boolMatch then
        Wscript.Echo objStartFolder & "\" & objFile.Name
        if boolDelete then
            objFSO.DeleteFile objStartFolder & "\" & objFile.Name, true
            if err.number <> 0 then
                wscript.echo "Unable to delete file: " & objStartFolder & "\" & objFile.Name
                err.clear
            end if
        end if
    end if
Next
' Wscript.Echo

ShowSubfolders objFSO.GetFolder(objStartFolder)

Sub ShowSubFolders(Folder)
For Each Subfolder in Folder.SubFolders
' Wscript.Echo Subfolder.Path
Set objFolder = objFSO.GetFolder(Subfolder.Path)
Set colFiles = objFolder.Files
For Each objFile in colFiles
        boolMatch = false
        if NameMatch(objFile.Name, sPattern) then
            boolMatch = true
        end if
        if not boolMatch then
            if NameMatch(objFile.Name, sTmPattern) then
                DaysOldMod = Int(Now() - objFile.DateLastModified)
                DaysOldCreate = Int(Now() - objFile.DateCreated)
                if (DaysOldCreate > iNumDays) and (DaysOldMod > iNumDays) then
                    boolMatch = true
                end if
            end if
        end if
        if boolMatch then
            Wscript.Echo Subfolder.Path & "\" & objFile.Name
            if boolDelete then
                objFSO.DeleteFile Subfolder.Path & "\" & objFile.Name, true
                if err.number <> 0 then
                    wscript.echo "Unable to delete file: " & Subfolder.Path & "\" & objFile.Name
                err.clear
            end if
            end if
        end if
Next
' Wscript.Echo
ShowSubFolders Subfolder
Next
End Sub

function NameMatch(sName, sPattern)
    NameMatch=false
    if len(sPattern) = 0 then
        exit function
    end if

    set re = new regexp
    re.ignorecase=true

    arrPattern = split(sPattern, ";")
    for each pattern in arrPattern
        re.pattern = pattern
        if re.test(sName) then
            NameMatch=true
            exit function
        end if
    next
end function

Smart IT for SMB

SCOM: Building Instance Groups from Groups of a Different Class

Good Reference Sites

Operations Manager: Cleaning Up Cluster Resources

Advanced AD Inter-Site Replication

Vacation Over

Other Common Problems Preventing SCCM Client Installation

Fixing Issues related to VAPPDeploy Registration

Fixing Issues Relating to Installer Error 1601

Fixing Issues Relating to Installer Error 1651

Resolving Issues related to "Another installation is running"

Conclusion

Dealing with WMI Issues – Part 3

Dealing with WMI Issues – Part 2

Enter the SCCM Client Center

Dealing with WMI Issues – Part 1

Identifying WMI problems

Phase 1 Repair

Repairing SCCM Clients with Duplicate GUIDs

GPO Scripts – Creating your own ADMX/ADML files

GPO Scripts – Reporting on All GPOs in a Domain

GPO Scripts – Comparing 2 GPOs

GPO Scripts – Finding a GPO given only the GUID

Windows 7 Optimization – Improving Performance Post Deployment

Performance Troubleshooting Wizard

System Configuration Editor

Windows 7 Optimization – User Environment Tuning

Disable System Restore

Setting Visual Effects to Maximize Performance

Modify MenuShowDelay

Use the Basic Theme and Disable Aero

Uninstall the Gadget Platform

Windows 7 Optimization – Remove Unnecessary System Services Part II

Offline Files

Themes

Windows Media Player Network Sharing

Windows Search

Conclusion

Windows 7 Optimization – Remove Unnecessary System Services Part I

Application Experience

Desktop Windows Manager Session Manager

Diagnostic Policy Service

Distributed Link Tracking Client

IP helper

Windows 7 Optimization – Remove Unnecessary Network Services

IPv6 Support

QoS Packet Scheduler

Link Layer Topology Services

Conclusion

Diagnosing Queuing Problems – Part II

Messages rejected by a remote machine

Cannot route one or more recipients of a message

Messages stuck in the submission queue

Messages show in the poison queue

Diagnosing Mail Queuing Problems – Part I

Cannot connect to destination machine to deliver mail

Messages stuck in a delivery queue but destination seems OK

Playing Traffic Cop – Commands for Working with the Exchange Mail Queues

Basic Concepts

Queue Manipulation Commands

Common Command Examples

Deciphering TLS Issues within Exchange

Certificate Expired

Wrong Certificate in Use

Getting Mail Delivered

Whose Fault is It Anyway?

Step 1: Lookup the mail server to use

Step 2: Connect to the host on port 25

Step 3: Say HELLO

Step 4: Who is the mail message from

Step 5: Who is the message going to

What to do When the Postman Doesn’t Knock

File System Cleanup