Docuemnts and Setttings>userid>local settings> application Data>microsoft>Dr watson file: drwtsn32.log and file: user.dmp might be large and using up valuable space.

Fix:

Dr watson is activated at time of an program crash, its safe to delete these two files if you don’t need the data or if they are just old.

Do a GUI reboot from RDP session, and RDP closes/no longer works but never reboots server because windows hung. (mostly found out by checking console)

Best way to try and prevent:

use shutdown command

“shutdown /r” may need /f option, also switches could be different depending on  your windows version.

Problem:

RDP Access Denied when logging in.

What is needed:

• Windows 2008 R2
• Remote Desktop Services role
• AD logins
• May also have failed to renew license events in the event log

Log Name: System
Source: Microsoft-Windows-TerminalServices-RemoteConnectionManager
Date: xxxxxxxx
Event ID: 1028
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: xxxxxx
Description:
The remote session could not be established from remote desktop client xxxxxx because its license could not be renewed.

How to check for bug: connect to server via RDP console mode (mstsc /admin) with same login if it works you are getting this bug.

Fix:

There is a known bug with Windows 2008R2 and the Terminal Services Role with Remote Desktop. Once installed if the following is not performed any user trying to log onto the server using AD credentials will not be allowed to logon.

The registry key affecting this behavior must be created and set. This change is only required on those servers hosting the Remote Desktop Role.

1.  Go to start menu, run , and type regedit and choose enter.
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
3. Create a DWORD value called (IgnoreRegUserConfigErrors) and assign the value 1 to this property.

No reboot required will work for any new RDP connections

Problem:

RDP has stopped working but your server still work just users can’t connect to modify applications

The most common fix is to reboot windows, because “Remote Desktop Services” aka TermService can’t be restarted at least thats the case on 2003 as the option is grayed out. This will also create an outage just for a remote control issue and thats not always desirable.

The fix: (remotely)

from command line

1. tasklist /s \\servername /svc /fi “imagename eq svchost.exe” (locate PID for TermService)
2. taskkill /s \\servername /pid xxxx (may need /f to force, UAC might give problems as well)
3. sc \\servername start TermService

The Fix: (local, using remote admin card/other remote control software/other remote command line)

From command line

1. tasklist /svc /fi “imagename eq svchost.exe” (locate PID for TermService)
2. taskkill /pid xxxx (may need /f to force, UAC might give problems as well)
3. sc \\servername start TermService

more helpful RDP troubleshooting

http://support.microsoft.com/kb/2477176

C:\ProgramData\Microsoft\Windows\WER is large possibly GB’s of data.

Reason:

The configuration of Windows Error reporting is configured wrong. Large amounts of data are stored in this location before the error’s are reported to microsoft. If the setting is not to send automatically then this folder is just going to grow.

Background:

Windows Error reporting is used to report errors to microsoft and then pooled and the largest offenders are repaired via patches etc. Also reports solutions if your problem has already been fixed.

Solution 1: (recommended)

1. change Windows Error reporting setting’s to auto send (found in server manager)
2. open control panel>problem reports and solutions
3. select all>right click> check for solution
4. the folder should be small after this

Solution 2: (if you are worried about security)

1. disable windows error reporting
2. open control panel>problem reports and solutions
3. select all>right click> delete
4. folder should be small

Problem: Domain account and local admin both in local administrators group, get an error when trying to access cluster with cluster administrator. An error occurred attempting to open cluster node ‘name’. access is denied. Error ID: 5 (00000005)

The possible Fix: check registry setting HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa and key LMCompatibilityLevel if that is set to 1 you might have this problem. Other things could effect cluster admin and give this error, this is one of them.

1. backup registry
2. run regedit
3. navagate to HKLM\System\CurrentControlSet\Control\Lsa
4. LMCompatibilityLevel
5. if set to 1 change to 2 (other options could work in your environment, also no reboot should be needed)
6. Cluster administrator should now work

Note: If you system is managed by an IT department and your not in IT please seek their help with the problem you are facing. Dont put your companies system at risk because you dont like they way its setup. ONLY DOES THESE STEPS IF YOU HAVE AUTHORIZATION TO DO SO.

Problem: What to do to upgrade/repair/fix setting on an install of Symantec Endpoint protection when the password is unknown/lost/forgotten.

Option 1: try default passwords

• symantec
• password
• admin
• norton
• 12345
• company name or stock symbol

Option 2: you could try sylinkdrop or SylinkReplacer to change the client from managed to unmanaged by replacing the sylink.xml to default, but you will most likely need the password as this step requires you to stop the service and will most likely be locked.

Option 3: Force the removal of the password.

1. take backup of registry
2. stop the SEP service, from services or command “start smc -stop”
3. boot in to safemode (if step one fails)
4. open regedit
5. HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC
6. delete key “SmcInstData” (this is where the password is keep, you cant delete if service is running)
7. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SepMasterService (only if step 1 failed, this will disable your SEP service)
8. Change Key “Start” to “3″
9. reboot to normal windows
10. uninstall/upgrade/repair your SEP or what ever else you needed to do. The password should be gone.

So if your here I’m guessing your running out of space on your C drive. And used a tool (windirstat) to scan your C drive and find out what folders are using all your space up. Well I’m also guessing that C:\Windows\winsxs and C:\Windows\Installer (this is basically the old $NTUninstall and $NtServicePackUninstall on XP/2003) are at the close to the top if not the top.

Well some back story on what the two folders do and what can you do to get some of you space back

Folder winsxs:

Well this folder is your “component store” for the “add and remove component” or “server roles” features of windows. They look up the required files from this folder and all other OS files hard link back to this folder. Every patch or SP will add a new copy of ever changed core file to this folder kinda like a version repository.

What to do with Winsxs:

1. Well first off DONT DELETE IT you might as well wipe your harddrive
2. Make your SP level Permanent, you can run VSP1CLN.EXE (Vista SP1)/COMPCLN (2008 SP2)/DISM (2008),  to make your service pack permanent and then will remove all files needed before that service pack (note: this exe might be named different on each OS version or SP release, look at item 4 under sources)
3. or you can compress the folder (right click>properties>advanced>compress contents to save disk space) Doing this will take a lot of time based on the size, and with any compression will slow down the input and output speed of the reads and writes to this location. And based on the function of this folder might slow your OS down as long as this folder is compressed.
4. nothing and expand your partition or backup and restore on a new larger disk

Sources:

1. http://blog.dampee.be/post/2011/12/04/Remove-Service-Pack-on-Windows-Server-2008-R2-(Compcln).aspx
2. https://blogs.technet.com/b/askcore/archive/2008/09/17/what-is-the-winsxs-directory-in-windows-2008-and-windows-vista-and-why-is-it-so-large.aspx?Redirected=true
3. http://answers.microsoft.com/en-us/windows/forum/windows_vista-files/to-use-or-not-to-use-compclnexe-that-is-the/cd93be4b-6e09-4419-b74e-0417f1273dc0
4. http://support.microsoft.com/kb/2592038

Folder installer:

This folder is used for some program uninstallers and patch uninstallers

1. I don’t recommend you delete this
2. It can be moved until needed. (don’t really recommend moving this off your computer, most like you will lose it) If you have a D drive you can move it over to that drive. You might want to zip/7zip it or use some other archive program to make it smaller
3. use msizap utility to remove orphaned files, this is a developer tool and is dangerous if you dont know what your doing.
4. Compress it (right click>properties>advanced>compress contents to save disk space) could slow down installing and uninstalling software
5. nothing and expand your partition or backup and restore on a new larger disk

Folder SoftwareDistribution (bouns topic #1)

This folder is used for Windowupdate and on older systems will keep failed patch installers in this folder. So if this folder has a few GB of data in it, you might want to do something about it

1. stop the windows update service, move it to a different drive, start windows update service. It will then recreate this folder
2. Compress it if you dont really want to mess with it

$NTUninstall and $NtServicePackUninstall (bouns topic #2)

The older version of the installer folder

1. Move and compress to a different drive incase you need them later. Or just compress it

Other system space saving you can try “Disk Cleanup” http://windows.microsoft.com/en-US/windows-vista/Delete-files-using-Disk-Cleanup

$hf_mig$ (bouns topic #3)

DO NOT DELETE

Used for window updates and migration “When a security update, critical update, update, update rollup, driver, or feature pack installs GDR version files, the hotfix files are also copied to the %windir%\$hf_mig$ folder. This supports migration to the appropriate files if you later install a hotfix or service pack that includes earlier versions of these files.”

1. you can compress the folder if its two large.

Well Microsoft removed disk cleanup from Windows 2008, this sucks if you need to do some clean up and want to delete all user profile recycle bins. So the only official way to get cleanmgr.exe back is to install desktop experience that will add a lot of junk you don’t need just for one tool in your server OS. But there is a much better solution that will just add cleanmgr.exe back so it can be used without doing any installations.

1. go to C:\Windows\winsxs\
2. use windows search and search for cleanmgr
3. cleanmgr.exe needs to be copied to %systemroot%\System32
4. cleanmgr.exe.mui needs to be copied to %systemroot%\System32\en-US
5. then just launch cleanmgr.exe from run or command prompt

additional information:

https://social.technet.microsoft.com/Forums/en-US/winserverManagement/thread/2af659cb-51b2-4ca6-ba56-0a507979fe7d/

http://technet.microsoft.com/en-us/library/ff630161(v=ws.10).aspx

Had to change the default regional settings on windows server 2003 so an application would show data correctly, it was installed as US regional settings but was used in EU. So come to find out that windows does not have a system-wide regional setting. At installation the default profile is set with what was picked at installation. And that default profile is used for all user accounts that get created so after an account is created it stores its own regional settings (currency, date, time, etc). Well come to find out that this is all stored in the registry and we have the option to do a login script, local GPO, domain level GPO, or just delete all the current user profiles. I went with local GPO as it was only for a few systems.

Waring: Make sure you backup your system before you do the steps below and if you don’t know what you’re doing in the registry you may not want to do this as it could destroy your system.

The fix:

1. Make a copy of registry as a backup
2. Make the change as the current user, to the regional settings you want (control panel>regional and language options) on advanced tab check apply all settings to current user and default profile (this will change it for your userid and all new ones)
3. Make a copy of new changes (export reg key HKEY_CURRENT_USER>Control Panel>International) Note: HKEY_USERS>.DEFAULT>Control Panel>International is the default user settings but you DON’T want to copy this one.
4. user a reg to .adm converter tool or create the .adm yourself (RegToADM from the nuts.exe package from http://yizhar.mvps.org/)
5. copy new adm file to C:\windows\inf
6. open gpedit.msc
7. add your new .adm file to the User Configuration>Administrative Templates (right click add/remove templates, then add and find your new .adm file)
8. change your filter options (have administrative templates highlighted and view>filtering, uncheck only show policy settings that can be fully managed. Otherwise you will not see your settings)
9. enable all your new settings (go to your newly created folder under User Configuration>Administrative Templates that the .adm file created, this will now update all current user profiles with the new settings after they login)
10. May need to reboot if its not working well with your applications

Helpful links if you need more help

http://support.microsoft.com/kb/924852
http://support.microsoft.com/?kbid=323639
http://www.windowsitpro.com/article/registry2/jsi-tip-0311-regional-settings-in-the-registry-
http://yizhar.mvps.org/
http://support.microsoft.com/kb/225087
https://www.youtube.com/watch?v=Up0Sd_R8KNM
https://groups.google.com/forum/?fromgroups#!topic/microsoft.public.win2000.group_policy/HbN-0gfR_MU
https://blogs.technet.com/b/askds/archive/2007/08/14/deploying-custom-registry-changes-through-group-policy.aspx?Redirected=true