Cold cup of coffee

Exchange 2010–Default mailbox settings (user provisioning)

2012-01-05T11:52:00.001+01:00

A customer needed to have specific mailbox feature settings on all of there mailboxes. The customer needed the following settings on all mailboxes:

Disable IMAP and POP
Enable OWA and ECP
Disable OutlookAnywhere
Allow Connected mode in Exchange
Enable ActiveSync

This is easy to do on all provisioned (already created) mailboxes with a PSH script:

get-mailbox * -resultsize unlimited | set-casmailbox -ImapEnabled:$false -POPEnabled:$false -OWAEnabled:$true
-MAPIBlockOutlookRpcHttp:$true -MAPIBlockOutlookNonCachedMode:$false -ActiveSyncEnabled:$true

The customer also stated that all new mailboxes should have these settings upon creation. The solution is to use the Scripting Agent Cmdlets in Exchange 2010. This is what I did to solve the customer case:

Created the ScriptingAgentConfig.xml (this must be on all Exchange servers) in the C:\Program Files\Microsoft\Exchange Server\V14\Bin\CmdletExtensionAgents
Enabling the “Scripting Agent”
Enable-CmdletExttensionAgent “Scripting Agent”

Below is my syntax of my “ScriptingAgentConfig.xml” file:

<?xml version="1.0" encoding="utf-8" ?>
<Configuration version="1.0">
<Feature Name="MailboxProvisioning" Cmdlets="New-Mailbox">
<ApiCall Name="OnComplete">
      If($succeeded) {
        $Name= $provisioningHandler.UserSpecifiedParameters["Name"]
        set-casmailbox -identity $Name -ImapEnabled:$false
        set-casmailbox -identity $Name -POPEnabled:$false
        set-casmailbox -identity $Name -OWAEnabled:$true
        set-casmailbox -identity $Name -MAPIBlockOutlookRpcHttp:$true
        set-casmailbox -identity $Name -MAPIBlockOutlookNonCachedMode:$false
        set-casmailbox -identity $Name -ActiveSyncEnabled:$true

      }
</ApiCall>
</Feature>
</Configuration>

Links

Cmdlet Extension Agent
http://technet.microsoft.com/en-us/library/dd335054.aspx
Understanding the Scripting Agent
http://technet.microsoft.com/en-us/library/dd297951.aspx

0x0000009D on Win7 with VMWare Workstation and starting a host

2011-12-29T19:44:00.001+01:00

I got a BSOD (Blue Screen of Death) on my Windows 7 x64 bit laptop when starting VMWare hosts with a 0x0000009D STOP message.

After doing some investigations some forums gave me hints to try “verifier /reset” whichs resets “Driver Verifier” settings (link).

Install SRS 2000 Client Print ActiveX controll in managed environment

2011-11-28T23:09:00.001+01:00

Today I needed to create a script for installing SRS 2000 Client Printing ActiveX components for a customer. They have been running a WinXP platform but are now migrating to Win7 x64 platform. Due to an old legacy application with SQL 2000 Reporting Services they needed to install SRS 2000 Printing ActiveX controll for IE9 32 bit browser (which the customer is using as a default browser).

To be able to install the application with SCCM I did the following:

Extracted the files from RSClientPrint.cab from the SRS server
Normally located in c:\Program Files\Microsoft SQL Server\MSSQL\Reporting Services\ReportServer\bin
Copied the files to the workstation on the following path
%windir%\SysWOS64\srs_rpe
Registered the DLL file using 32 bit regsvr32.exe

The script that I used in SCCM:

@echo off
REM Create folder
md "%windir%\Syswow64\srs_rpe"
REM Copy files
xcopy "%~dp0Reporting" "%windir%\Syswow64\srs_rpe" /e /c /q /r /h /y
REM Register DLL file
%windir%\SysWOW64\regsvr32.exe /s %windir%\Syswow64\srs_rpe\RSClientPrint.dll
REM Exit script
Exit

Windows 2008 R2 Standard > Enterprise in-place upgrade

2011-11-22T22:35:00.001+01:00

Today I needed to upgrade a Windows 2008 R2 Standard OS (with a valid MAK key) to Enterprise. The reason was to utilize more RAM (>32 GB) on the server.
This is how I complete the upgrade:

Did a backup of the server
dism /online /set-edition:ServerEnterprise /ProductKey:489J6-VHDMP-X63PK-3K798-CPX3Y
(this is a KMS key from Microsoft, LINK) from Jamie’s blog
Got message “The operation completed successfully”
Reboot server
Logon to the server
Enter a valid MAK key
Reboot server
Now I had an error that RDP wasn’t working (and Remote Desktop disappeared from Remote tab)
slmgr /rearm (To remove the current license)
Got message back that the command completed successfully and that I needed to restart
Reboot server
slmgr /ipk VALID-MAK-KEY
Got message back that the key installed successfully
slmgr /ato
Got message back that the product was activated successfully
Reboot server

The server then was upgraded to Enterprise OS with working RDP. I did this on a server with 4 SQL instances without any additional errors.

When will the OS be device centric and applications device/time/setting centric aware ?

2011-11-03T10:43:00.002+01:00

I work with all kinds of technology from desktops/laptops, mobile phones, tablets and servers. I work with different operating systems but mainly the following;

Microsoft Windows (desktops, laptops, netbooks and a few slides)
Google Andriod OS (phones, tablets and netbooks)
Apple iOS (iPhone and iPad) and MacOS (desktop)

What all users wants is a good experience for doing the things they are doing at the moment with the device; for example creating a presentation, posting to a social network, taking a photo, editing a document, watching a movie or sending a message to a friend. They want to do these things as easy as possible but in a secure and intuitive way with no delays at the place they are currently at using personal and customized settings. Today it's nearly impossible to have a holistic user experience due to different challenges:

Applications are different on the platforms
Bandwidth limitations
Delay when doing many things simultaneously
Platforms/applications are lacking privacy and/or security
Battery capacity
Limited off-line support (no Internet or corporate connection)

Users of the future
Today all young people are used to Internet (and these people are coming to their professional work life).They are used to find services (often free of charge) to do the things they want and are also multitasking in a way we over 40 don't. To be able to serve these new users (and the current) we need technology in the Enterprise's that are very customization-able and devices that can multitask in a good way (i.e. run processes in the background). In near future we will have users used to touch everywhere (from slides, pads, screens, TV, media centers, meny at your local restaurant) that will create a need for intuitive user interfaces (UI design). This will also create a need for users to easily move/fetch data from devices and also to integrate data between devices (mobile payment to restaurant for example).

Operating systems of the future

I think (and dream) about a solution to this if the OS can be more device wide (i.e. same OS on different hardware and form factors; phone, tablet and computer), customization-able (multi user, work the way the user wants, access to the user data, bandwidth aware - offline cache if needed), context aware (work or at home, time of day, where are the user located) and privacy managable, secure and with "unlimited" power (i.e. a device that charges on the move and wireless).

It will also be important that these OS's will run the software/services that the users wants and will use in a good way and at the same time be secure, intuitive, quick/responsive and work off-line but also integrate with the cloud (both public and private ones).

Will any of the major OS vendors be able to deliver this dream and if so - how ?

Apple
Is the leading player on the slides marked (iPad) and have revolutionized the smart phone (iPhone). They also have a full desktop OS with off-line functionality. What Apple is missing is a Enterprise deployment method for iOS for applications (i.e. "private applications"). They are also separating the iOS and MacOS - I think they need to try to have applications to run on both platforms. Maybe some feature to "run MacOS applications on iOS" (remote desktop feature) or similiar. Apple have good looking devices (that are costly) with nice hardware but some users require more choices in form factors.
Google
Do have a very good momentum with Andriod and will also have a desktop OS (ChromeOS). Are very dependent on cloud technology and aren't embracing off-line capabilities that are important in a Enterprise market. I think that Google needs to create better off-line support for their services. They have a good application delivery model and Enterprises can have own repositories of application distributions (which is very good). Needs better Enterprise applications to be able to compete with Apple and Microsoft. Google is very good at integrating the services they create but in some cases terminates good products which creates problems for people using them.
RIM
Are loosing market share fast and do not have a a full range of devices. Can only win the slides/phone marked and will probably vanish from the market in a couple of years if they cannot stop the iOS/Android momentum. I think RIM must create services on the web (HTML5 support) to better serve users and maybe also create a flat rate service (one price for all users) to be able to compete with the others.
Microsoft
Are late with a good slide (will not exist until 2012 with Windows 8) but have a full range of services for all platforms. I think they are doing it right when trying to have one set of installation that will install Windows 8 in different flavors (slide, computer, server, xbox, portable player) and maybe also do a WinPhone8. This will give the possibilities to run the same applications on all devices - and due to a local file system it will have good off-line capabilities. Microsoft are responding to the Enterprise's needs with a application repository (WinPhone and System Center portfolio). At a negative side Microsoft is responding late to the new need of devices and I hope they will respond quicker to the future needs.

Management of my fleet of technology

If the future will have a device/user centric approach to technology there will be a need for good management tools, identity management, security layers and a platform for a central repository of audting and operations monitoring. This creates a need for integration of backend system's that all major vendors are working with (and will benefit everyone).

Final thoughts

I think that the future will be dominated by new/young users that will demand fantastic technology software/services on multiple devices with a holistic user inteface. I think that it will be a need for new services, software and innovative integrations that will force all vendors and niche companies to do creative solutions in the future. The biggest companies (Google, Apple and Microsoft) will compete in both Enterprise and consumer marked and that "private useage" (i.e. when using technology outside working context) will drive the innovation!

Restrict Control Panel icons in Windows 7

2011-10-20T11:44:00.000+02:00

Today I created a policy for showing only allowed icons in the Control Panel for a customer on a Windows 7 desktop platform.

To be able to hide the icons I used the following policy:
User configuration > Policies > Administrative Templates > Control Panel > Show only specified Control Panel items
For what name to use in the GPO setting use the table below:

Name in GPO (Win7)	Name in GPO (WinXP)	Control Panel Name (XP name)
Action Center		Action Center
Administrative Tools		Administrative Tools
AutoPlay		AutoPlay
Backup and Restore		Backup and Restore
BitLocker Drive Encryption		BitLocker Drive Encryption
Color Management		Color Management
Credential Manager		Credential Manager
Date and Time	timedate.cpl	Date and Time
Default Programs		Default Programs
Desktop Gadgets		Desktop Gadgets
Device Manager		Device Manager
Devices and Printers	printers and faxes	Devices and Printers (Printers and Faxes)
Display	desk.cpl	Display
Ease of Access Center	access.cpl	Ease of Access Center (Accessibility Options)
Folder Options	folder options	Folder Options
Fonts	fonts	Fonts
Getting Started		Getting Started
HomeGroup		HomeGroup
Indexing Options	srchadmin.dll	Indexing Options
Internet Options	inetcpl.cpl	Internet Options
Keyboard	main.cpl	Keyboard
Location and Other Sensors		Location and Other Sensors
Mouse	main.cpl	Mouse
Network and Sharing Center	ncpa.cpl	Network and Sharing Center (Network connections)
Notification Area Icons		Notification Area Icons
Performance Information and Tools		Performance Information and Tools
Personalization		Personalization
Phone and Modem	telephon.cpl	Phone and Modem
Power Options	powercfg.cpl	Power Options
Programs and Features	appwiz.cpl	Programs and Features (Add or Remove Programs)
Recovery		Recovery
Region and Language	intl.cpl	Region and Language
RemoteApp and Desktop Connections		RemoteApp and Desktop Connections
Sound	mmsys.cpl	Sound
Speech Recognition	control speech	Speech Recognition
Sync Center		Sync Center
System	sysdm.cpl	System
Taskbar and Start Menu	taskbar and start menu	Taskbar and Start Menu
Troubleshooting		Troubleshooting
User Accounts	nusrmgr.cpl	User Accounts
Windows CardSpace	infocardcpl.cpl	Windows CardSpace
Windows Defender		Windows Defender
Windows Firewall	firewall.cpl	Windows Firewall
Windows Update	wuaucpl.cpl	Windows Update (Automatic Updates)
mlcfg32.cpl	mlcfg32.cpl	Mail icon
smsrap.cpl	smsrap.cpl	"Run Advertised Programs (32-bit)" for System Center
smspdm.cpl	smspdm.cpl	"Program Download Monitor (32-bit)" for System Center
smscfgrc.cpl	smscfgrc.cpl	"Configuration Manager (32-bit)" for System Center
flashplayercplapp.cpl	flashplayercplapp.cpl	"Flash Player (32-bit)" for Adobe Flash Player

Additional links

IPv6 Auto-Config EUI-64 converter

2011-10-19T12:46:00.001+02:00

IF you need to know the auto-configured address for a NIC before enabling IPv6 in a network the following webpage can help you; http://73837.net/

Simply put in your advertised /64 prefix (or any IPv6 address - it will only take the first 64 bits) and the host MAC address, and you'll get the auto-configured address. This was built according to the RFC3513 and correctly inverts the seventh bit of the EUI-64 address. The eighth bit, for group/host indication, is not modified.

Generate reports for all your GPO’s

2011-10-15T07:59:00.001+02:00

I had a customer needed a print out of all GPO’s in their domain. To do this you can do the following routines below.

Windows 2003

The following information describes the Group Policy Management Console (GPMC) scripting samples. You can find the samples in the %programfiles%\Gpmc\Scripts directory after you install the GPMC. You can execute the scripts at the command prompt. The scripts send output to the Command Prompt window. Run the scripts using the CScript.exe application.

Link to other sample scripts: GPO script samples

Link to GPMC console for Windows 2003: GPMC download

Generate Reports for all GPOs (Windows 2003/2008)

The GetReportsForAllGPOs.wsf sample generates two files for each GPO in the domain. The first file is an XML file that contains information such as details, links, security filtering, WMI filtering, delegation, computer, and user configurations for the GPO. The second file is an HTML representation of the GPO data. Use the ReportLocation parameter to specify the location in which you want to generate the files. Use the Domainswitch to specify the domain that you want to run the report against.

Usage: GetReportsForAllGPOs.wsf <ReportLocation> [/Domain:<DNSDomainName>]

Example: GetReportsForAllGPOs.wsf c:\reports

Generate GPO Reports for all GPO’s (Windows 2008 R2)

In Windows 2008 R2 you can user PowerShell for doing the same task.

Usage: Get-GPOReport -All -ReportType {<Xml> | <Html>} [-Domain <string>] [-Path <string>] [-Server <string>] [<CommonParameters>]

Example: Get-GPOReport –All -ReportType HTML -Path C:\GPOReports\GPOReport1.html

Link: http://technet.microsoft.com/en-us/library/ee461057.aspx

Migrate SIDHistory for Domain Admins and Domain Users cross forest

2011-09-19T10:41:00.001+02:00

Today I needed to migrate Domain Admins and Domain Users SID to SIDHistory from an old forest to a new built. To be able to to this you need the "Windows 2003 SP2 Support Tools" (link). In my situation I needed to run the utils on a Windows 2008 R2 (x64) OS - so the following guide needs to be followed:

Create a trust between your forests
Get the PDC Emulators for both forests
Extract sidhist.vbs and clonepr.dll from the CAB files
Logon to the PDC Emulator in the target forest (where SIDHistory is to be migrated to)

Edit the HOSTS file with IP and hostname för the PDC Emulator in the source domain
192.10.10.10 SOURCEPDC
Register the clonepr.dll using the 32-bit regsvr32.dll
c:\windows\syswow64\regsvr32.exe clonepr.dll

Create a script.cmd file with your commands
c:\windows\syswow64\cscript.exe sidhist.vbs "/srcsam:domain users" "/dstsam:domain users" /srcdom:NetBIOS_Source_Domain /dstdom:NetBIOS_Target_Domain /srcdc:NetBIOS_Source_PDC /dstdc:NetBIOS_Target_PDC
Run your script

Your output should be something like:

Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.
Connected
Success

Setup a new PC for a friend

2011-09-09T09:28:00.003+02:00

I have setup a laptop for a friend who is mainly using the PC at school (university), social web and music/movies. So this is what I recommend for installation:

Windows 7 (x64)
Install Microsoft Security Essentials
Setup automatic patching of the computer (every day)
Adobe Reader
Microsoft Office 2010
WinRAR
Configure Power settings to be more optimal than default settings
Install an online backup software (crashplan.com is a good choice)
Install Java
Install web integrated applications (Flash, Adobe Air, Silverligt)
Install PDF Creator (PDF Creator homepage)
Install software for phone management (if needed)

Migrate users to a new AD forest (or domain)

2011-09-08T07:08:00.000+02:00

I often work with projects that must migrate users from one Active Directory forest to another. There can be many reasons for doing this; migration projects, creating test forests/domains or moving users due to compliance or security demands.

Some of these project customers often have requirements for moving all attributes and in some cases even SID (security identifier), passwords and/or groups and their members. In some cases even email addresses, aliases and security permissions for Exchange are required to be migrated (but that will be another post in the future).

There are many tools that can be used for migrating users but Microsoft ADMT version 3.2 is a useful tool (specifically for users and groups). Below is a short step by step guide to migrate users and groups cross forest.

Establish network infrastructure between domainsNetwork traffic must be routable between the domain controllers (preferably all DC's but at least the PDC Emulators in every domain).
Establish DNS infrastructure between domainsI usually setup conditional forwarding on all DNS servers to be able to do name lookups cross forest.
Create one way forest trust between domainsSetup a one-way forest trust from target.com to source.com (i.e. target.com is trusted by source.com). This way you can have the migration tools in the target.com forest.
Install ADMT version 3.1 on TargetDC1.target.comADMT requires a SQL database for storage. If you have a SQL deployed into the domain I recommend you to use that otherwise you can install SQL Express instance to host the data.
Setup migration accounts

Create "acct_migrators" in target.com domain (Global Security Group)
Add your migration account into the "Domain Admins" group in target.com
Add "acct_migrators" from target.com into "Administrators" in source.com

SID History (optional)If you require SID History you must do som additional tasks to be able to migrate source SID to target SIDHistory. This is especially useful if you also migrate services and/or files and preserve ACL's on the objects, services or servers.

Enable TCP/IP support on PDC emulator
This step isn't needed if you are using Windows 2003 servers or newer.

HKLM\System\CurrentControlSet\Control\LSA

Modify the "TcpipClientSupport" (REG_DWORD) and set it to "1"

Restart the DC hosting the PDC role

Enable auditing in target.com and source.com domains
Edit "Default Domain Controllers policy" with the following settings;

Computer Configuration > Polices > Windows Settings > Local Policies > Audit Policy

Audit Account Management: Success & Failure
Audit Directory Service Access: Success

Create a NETBIOSDOMAINNAME$$$ group in source.com/Users container
This goups is a special group used during SID migration by ADMT

Password Export Server (PES) service (optional)
If you need to migrate password with the user object this is possible with PES.

Create PES encryption key on TargetDC1.domain.com
admt key /option:create /sourcedomain:NETBIOSDOMAINNAME /keyfile:C:\Secure\Mig.key /keypassword:*
Install PES server on SourceDC1.source.com
Use a service account from target.com (NETBIOS\AccountName) and you will also need the encryption key file (and key file password) during the installation. The service is installed with "manual" as service startup (never change this)
Restart the DC with PES service

Migration

I recommend to migrate the groups in the following order:

Global groups
Users
Domain local and Universal groups

During migration of passwords remember to start the PES service on the SourceDC1.target.com server and always stop the server after the password migration to prevent attacking surface on the service.

Links

Move log files for a Exchange 2010 DAG database

2011-08-17T14:47:00.001+02:00

To move DAG enabled mailbox stores in Exchange 2010 to a new LOG disk you have a few different options. If you require a small amount of downtime then I recommend you to create a new mailbox database with the correct paths, then enable DAG replication and then move user mailboxes to the created database.

If you only need to move the log files (and also can break DAG replication) then the following procedure can be used:

Remove all DAG replication copies (except the active database)

Mark the database
Right click the database copy and choose “Remove”
Remove EDB and LOG files from the servers where you removed replication

Move the database

Right click the mailbox database and choose “Move Database Path…”
The database will be dismounted when moving the logfiles (causing downtime for users in the database). The database will be dismounted for the time it takes to copy all current log files into the new location specified.

Add DAG replication for moved database

Mark the database
Right click and choose “Add Mailbox Database Copy…”

Can’t allocate disks to SQL cluster

2011-08-16T07:40:00.001+02:00

I have been working on a failed SQL cluster setup today and decided to reinstall all SQL clusters on the two node cluster. All uninstallation went OK but when I was about to create my new clusters I could’t allocate any disks. All disks came up with:

The disk resource 'Cluster Disk 1 (SQL Data Disk A)' is already in use by resource 'Analysis Services A'. To use a disk in a new SQL Server failover cluster instance, the disk must not have any dependencies that reference it.

The SQL uninstallation must have failed to clean up (or delete) the correct resources.

My solution was the following:

Open a CMD prompt (run as administrator)
cluster res
This showed me all resources on my cluster and I noted which one’s that I should delete
cluster res “resource name” /delete
Deletes the resources (I deleted all disk and services resources that I had uninstalled)
Re-added all disk using “Failover Cluster Manager” (cluadmin.msc)

After this I could allocate the disks when setting up the cluster again from SQL Installation > New SQL Server failover cluster installation.

Get SSO on F5 Firepass with OTP

2011-06-18T23:52:00.001+02:00

Some customers use F5 Firepass appliance box for getting remote access to internal resources. One of the good features it have is to wrap a RDP/Citrix session inside a browser (requires a plug-in) and can also take the logon information to do a SSO (Single Sign On) to the backend system.

Some customers are not using ID/PWD as credentials to system but are using two factor authentication logons (two pieces is something you have and something you know). We are using both RSA SecurID and a OTP password generator from Mideye.

One problem we got with the OTP was that SSO stopped working with “wrong username and password”. This was caused by the F5’s variables saving the OTP password instead of the domain password.

Example with SSO not working

Logon to the portal using domain\userid and P@ssword
Getting the OTP on SMS (123456)
Open a Citrix/RDP session (Firepass sends domain\userid and 123456)
Getting error message “wrong username and password”

But F5 Firepass has saved the correct password to another variable that can be set to be used for SSO when logged on to the F5 session.

Change the SSO password to the domain user password entered

Logon to the F5 Firepass admin interface (web)
Users > Groups > Master Groups
Open the correct Master Group
Go to the “SSO” tab
Change/add %username% as the Username:
Change/add %primarypassword% as the Password:
Click Update

Then SSO will work even if two factor authentication is used on the F5 Firepass solution.

Viewing registry as a user on Terminal Server when security polices prevent access to RegEdit and Reg command ?

2011-06-08T11:01:00.003+02:00

Today I needed to view the registry as a normal user on a Remote Desktop server (XenApp). There was GPO's in place to prevent access to both Regedit.exe and REG.exe so I needed an alternate way of accessing the registry (and overriding the security).
I found the following utility on the web to be able to access registry as the normal user (an other solution could be to create a GPO; allowing Regedit access and scope it to my test user).
Link to software:
http://aezay.site11.com/aezay/regcmd/index.html

Disclaimer
I have no knowledge about the application or vendor so use the software on your own risk.

Scheduled backup on a SQL Express 2005

2011-06-02T00:03:00.023+02:00

I needed to create scheduled backups of a SQL Express 2005 instance for an application. TO be able to do this you can use the sqlcmd.exe utility that are installed with SQL Express.

To create a scheduled backup you need to do the following:

Create (and insert) a new stored procedure into SQL Express
Create a batch file
Create a scheduled task for running the batch file

Create the stored procedure

Copy the code below into notepad and save the file as C:\DB.sql:


USE [master]
GO
/****** Object:  StoredProcedure [dbo].[sp_BackupDatabases] ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
-- =============================================
-- Author: Microsoft
-- Create date: 2010-02-06
-- Description: Backup Databases for SQLExpress
-- Parameter1: databaseName
-- Parameter2: backupType F=full, D=differential, L=log
-- Parameter3: backup file location
-- =============================================
CREATE PROCEDURE [dbo].[sp_BackupDatabases]
         @databaseName sysname = null,
         @backupType CHAR(1),
         @backupLocation nvarchar(200)
AS
    SET NOCOUNT ON;
         DECLARE @DBs TABLE
         (
               ID int IDENTITY PRIMARY KEY,
               DBNAME nvarchar(500)
         )
          -- Pick out only databases which are online in case ALL databases are chosen to be backed up
          -- If specific database is chosen to be backed up only pick that out from @DBs
         INSERT INTO @DBs (DBNAME)
         SELECT Name FROM master.sys.databases
         where state=0
         AND name=@DatabaseName
         OR @DatabaseName IS NULL
         ORDER BY Name
         -- Filter out databases which do not need to backed up
         IF @backupType='F'
               BEGIN
               DELETE @DBs where DBNAME IN ('tempdb','Northwind','pubs','AdventureWorks')
               END
         ELSE IF @backupType='D'
               BEGIN
               DELETE @DBs where DBNAME IN ('tempdb','Northwind','pubs','master','AdventureWorks')
               END
         ELSE IF @backupType='L'
               BEGIN
               DELETE @DBs where DBNAME IN ('tempdb','Northwind','pubs','master','AdventureWorks')
               END
         ELSE
               BEGIN
               RETURN
               END
         -- Declare variables
         DECLARE @BackupName varchar(100)
         DECLARE @BackupFile varchar(100)
         DECLARE @DBNAME varchar(300)
         DECLARE @sqlCommand NVARCHAR(1000)
         DECLARE @dateTime NVARCHAR(20)
         DECLARE @Loop int                
         -- Loop through the databases one by one
         SELECT @Loop = min(ID) FROM @DBs
   WHILE @Loop IS NOT NULL
   BEGIN
-- Database Names have to be in [dbname] formate since some have - or _ in their name
   SET @DBNAME = '['+(SELECT DBNAME FROM @DBs WHERE ID = @Loop)+']'
-- Set the current date and time n yyyyhhmmss format
   SET @dateTime = REPLACE(CONVERT(VARCHAR, GETDATE(),101),'/','') + '_' +  REPLACE(CONVERT(VARCHAR, GETDATE(),108),':','')
-- Create backup filename in path\filename.extension format for full,diff and log backups
   IF @backupType = 'F'
         SET @BackupFile = @backupLocation+REPLACE(REPLACE(@DBNAME, '[',''),']','')+ '_FULL_'+ @dateTime+ '.BAK'
   ELSE IF @backupType = 'D'
         SET @BackupFile = @backupLocation+REPLACE(REPLACE(@DBNAME, '[',''),']','')+ '_DIFF_'+ @dateTime+ '.BAK'
   ELSE IF @backupType = 'L'
         SET @BackupFile = @backupLocation+REPLACE(REPLACE(@DBNAME, '[',''),']','')+ '_LOG_'+ @dateTime+ '.TRN'
-- Provide the backup a name for storing in the media
   IF @backupType = 'F'
         SET @BackupName = REPLACE(REPLACE(@DBNAME,'[',''),']','') +' full backup for '+ @dateTime
   IF @backupType = 'D'
         SET @BackupName = REPLACE(REPLACE(@DBNAME,'[',''),']','') +' differential backup for '+ @dateTime
   IF @backupType = 'L'
         SET @BackupName = REPLACE(REPLACE(@DBNAME,'[',''),']','') +' log backup for '+ @dateTime
-- Generate the dynamic SQL command to be executed
    IF @backupType = 'F'
               BEGIN
            SET @sqlCommand = 'BACKUP DATABASE ' +@DBNAME+  ' TO DISK = '''+@BackupFile+ ''' WITH INIT, NAME= ''' +@BackupName+''', NOSKIP, NOFORMAT'
               END
    IF @backupType = 'D'
               BEGIN
            SET @sqlCommand = 'BACKUP DATABASE ' +@DBNAME+  ' TO DISK = '''+@BackupFile+ ''' WITH DIFFERENTIAL, INIT, NAME= ''' +@BackupName+''', NOSKIP, NOFORMAT'      
               END
    IF @backupType = 'L'
               BEGIN
            SET @sqlCommand = 'BACKUP LOG ' +@DBNAME+  ' TO DISK = '''+@BackupFile+ ''' WITH INIT, NAME= ''' +@BackupName+''', NOSKIP, NOFORMAT'      
               END
-- Execute the generated SQL command
    EXEC(@sqlCommand)
-- Goto the next database
SELECT @Loop = min(ID) FROM @DBs where ID>@Loop
END

Open an administrative command prompt
Run the following command: sqlcmd –S .\SQLInstanceName –i C:\DB.sql

Create the batch file

Open notepad

Enter the following:

REM sqlbackup.bat
sqlcmd -S .\SQLInstanceName -E -Q "EXEC sp_BackupDatabases @backupLocation='D:\SQLBackup\', @backupType='F'"

Save the file to disk (for example C:\Full-DB-backup.cmd)

Create a scheduled task

Open Scheduled task manager
Create a new task (run it as the user that installed SQL Express)
Point to the batch file created earlier (C:\Full-DB-backup.cmd)
Set to run as needed (hourly, daily, weekly)

If you get an error message “The following error was reported: A specified logon session does not exist. It may already have been terminated” when running the scheduled task you need to modify the following security setting to allow storing passwords (gpedit.msc or with a GPO):

Computer > [Policies] > Windows Settings > Security Settings > Local Policies > Security Options > Network access: Network access: Do not allow storage of credentials or .NET Passports for network authentication

Links

How to schedule and automate backups of SQL Server databases in SQL Server Express Editions [Microsoft]
Automating Database maintenance in SQL 2005 Express Edition [SQLdbatips.com]
Task Scheduler – A Specified Logon Session Does Not Exist

Listen/bind IIS 7 or 7.5 to a specific IP on a server with multiple IP’s

2011-05-23T09:38:00.001+02:00

In some cases you want multiple webserver software co-exist on the same server (for example IIS, Apache, Tomcat, etc).

On Windows all IP’s will be bound to IIS to be used preventing other web software to be bound to port 80.

In order to solve this the IIS needs to be bound to a specific IP address(es).

How to:

Start an administrative cmd prompt (run as administrator)
netst http add iplisten ipaddress=10.0.0.10

Checks

Verify the http iplisten with netsh http sho iplisten

Verify your change by doing a netstat -an (and check that 10.0.0.1:80 is in the list). If you still have a 0.0.0.0:80 in the list you must do a IISreset on the server to release the binding.

Links

Move XOBNI index to other location

2011-03-24T10:06:00.001+01:00

I use a indexing software for Outlook called XOBNI (inbox backward) which I recommend to everyone. One thing that I do not like with the software is that there isn’t a setting for choosing where it places the index data.

The location for indexing is:
%userprofile%\AppData\Local\xobni

To be able to move the Xobni index to another location (or any other folder) do the following:

Stop all applications writing to the folder structure (i.e. close Outlook)
Copy the folder %userprofile%\AppData\Local\xobni to your new location (for example D:\Index\Xobni)
Delete the "%userprofile%\AppData\Local\xobni” folder
Start a cmd-prompt using runas administrator
Run the following command in the cmd-prompt:
cd /d %userprofile%\AppData\Local\
Run the following command in the cmd-prompt (point to the correct location you moved your files to:
mklink /d xobni d:\index\xobni

Links

Two good OneNote tips

2011-03-16T22:55:00.002+01:00

I frequently use Microsoft OneNote for note taking and different kind of logs/work done. Usually OneNote serves as my “work in progress” that later is converted to documents, reports and other stuff.

I have collected a few good things to know in OneNote that I use myself very often.

Side by side

To have to pages side by side do the following:

Start OneNote
View-tab > “New Windows”
Place the OneNote windows as you need them

Disable links when pasting from web pages

One thing that I don’t like is the links when pasting from webpages. This is configurable in OneNote:

Start OneNote
File tab > Options > Advanced
Uncheck “Include like to source when pasting from the Web”

Internet Explorer 9 is RTM-ed

2011-03-16T06:00:00.001+01:00

Internet Explorer 9 is now available for download [Link]. The installation says:

Get the most from the web. Internet Explorer 9 offers a fast, clean, and more trusted web browsing experience.”

Supported OS

Internet Explorer 9 is supported on Windows Vista and Windows 7. For the server OS Windows 2008 and Windows 2008 R2 is supported. Both 32 and 64 bit is supported on the OS’s.

Links

IE9 review (PCMag.com) [link]
Microsoft.com > IE9 > Features [link]

Disable KMS server DNS record publishing

2010-12-23T08:30:00.001+01:00

If you need to disable KMS servicing (i.e. a server that tries to publish _VLMCS._tcp.domain.com records for a domain then do the following:

Start an administrative cmd-prompt
slmgr.vbs –cdsn
net stop slsvc && net start slsvc

To verify that the server isn’t trying to publish the DNS record for KMS server run the following command “slmgr.vbs -dlv”.

DNS publishing is enabled
DNS publishing is disabled

CNAME on Windows 2008 R2 server (print server)

2010-12-23T08:19:00.002+01:00

In some cases you want to reference a single server using a CNAME (i.e. DNS alias that points to another record). You can use this technique to provide friendly names for the users to remember for the services, for example PrinterServer instead of NetPrnNoOsl01 (Net Printer Norway Oslo 01).

In other to reference a server with CNAME on Windows 2008 R2 you need to do the following:

Create a correct CNAME in you DNS

Add registry entries on the server (3 entries)

Reboot the server (so the changes are implemented)

CName in DNS

To create a CNAME in DNS use the dnsmgmt.msc to create the alias in the correct zone.

Registry entries

Path: HKLM\SYSTEM\CurrentControlSet\Control\Print Key: DnsOnWire Type: REG_DWORD Value: 1

Path: HKLM\system\currentcontrolset\services\lanmanserver\parameters Key: DisableStrictNameChecking Type: REG_DWORD Value: 1

Path: HKLM\system\currentcontrolset\services\lanmanserver\parameters Key: OptionalNames Type: REG_MULTI_SZ Value: CNAME (only NETBIOS name)

Register SPN’s

You use the setspn.exe utility to add, list or remove SPN’s from users and/or computers. You need to create the SPN’s so authentication will work correctly.

Create HOST/CNAME and HOST/CNAME.domain.suffix on the computerobject hosting the alias name.

setspn.exe –a host/CNAME computerobject

Example

In this example I'’m creating an PrintServer CNAME for NetPrnNoOsl01 in contoso.com.

CNAME PrintServer points to NetPrnNoOsl01.contoso.com.

Add registry entries as specified

Add SPN’s setspn.exe –a host/PrintServer NetPrnNoOsl01 setspn.exe –a host/PrintServer.contoso.com NetPrnNoOsl01

Windows 2008 and missing default gateway after reboot

2010-09-22T09:31:00.002+02:00

I have had some Windows 2008 servers that are missing the default gateway after a reboot. If I set the gateway after startup (using ILO or a virtual console) the server runs fine but if someone does a reboot the server then it disappears again.

A solution used are the following:

Logon to the server (using ILO or virtual console)
NIC settings (and write down all settings)
Open a CMD prompt with elevated permissions (“Run as Administrator”)
Run the command:
netsh int ip reset
Reboot the server
Logon again
Set the correct NIC settings
Reboot the server

Links

http://support.microsoft.com/kb/299357

Allow user access via RDP to desktop on a XenApp 6.0 server

2010-05-05T11:54:00.001+02:00

I haven’t worked with Citrix/XenApp for a while but today I needed to do some testings on a new server. While doing the testing I needed to logon with a user account to the RDP connection to the server (i.e. not ICA-protocol).

I was faced with the following error message when trying to logon with a test-account (non domain admin) to RDP desktop (server connection):

The desktop you are trying to open is currently unavailable. Contact you administrator to confirm that the correct settings are in place for your client connection.

To resolve the issue a Citrix XenApp policy must exist for the user with the following settings:

Desktop launches: Allowed

If you need to launch a application with the RDP client (i.e. Programs tab) then I was faced with the following error:

The initial application you are trying to open is currently unavailable. Contact your administrator to confirm the correct settings are in place for your client connection.

To resolve the issue another policy needed editing:

Launching of non-published programs during client connection: Enabled

You edit the Citrix policies according to this:

Start –> Citrix –> Management Consoles –> Citrix Delivery Services Console
Citrix Resources –> XenApp -> [Farm] –> Policies

Win7 and *.chm file not showing content

2010-04-28T19:58:00.007+02:00

Old help files (*.chm) is sometimes not showing on Win7 computers. They are showing with "Navigation to the webpage was canceled" as picture below:

To be able to view the content of the *.chm file you need to do the following:

Have the file locally (i.e. not on a network drive of WebDAV area)
Unblock the file (file properties > Unblock)

Unblock files with cmd-line
It's possible to unblock files with the cmd-line utility Streams from Sysinternals; Streams.exe -d Filename.chm

Debug a Windows 7 minidump

2010-03-06T08:48:00.002+01:00

On my new x64 Windows 7 computer I'm having problems with shutdowning the computer. During shutdown the computer hangs for approx. 10 minutes and then blue screens. Today I decieded to have a look at the minidumps that are automatically created by the OS.

Install debugging tools

Download the debug tools from here: Windows Driver Kit v 7.1.0
Unpack the ISO or burn it to a CD (I do unpack it with WinRAR)
Go to \Debuggers and install the correct version for your OS (in my case the setup_amd64.exe)

Debug a minidump

Create a symbols folder (I created D:\temp\symbols)
Start WinDBG.exe
File -> Symbol File Path...
Enter "srv*d:\temp\symbols*http://msdl.microsoft.com/download/symbols" (change the bold to your directory)
File -> Open Crash Dump...
Wait for the WinDBG to take input and enter the following command
"!analyze -show"
"!analyze -v"
Look at the output to find the cause of the dump

Move the offline files repository in Windows 7

2010-02-20T12:21:00.003+01:00

I use offline files for having some file shares available when I'm on the road. I needed to move the %systemroot%\csc (the default place for offline files) to my D:\-drive on my new computer (HP EliteBook 8530w).

I did the CSC move before setting up any offline files replication:

Setup a folder to store the Offline Files cache
Start regedit (with elevated permissions)
Navigate to HKLM\System\CurrentControlSet\Services\CSC
Add Parameters subkey if it doesn't exist
On my Windows7 Enterprise the subkey already existed
Add a new value
Type: REG_SZ (string value)
Name: CacheLocation
Value: \??\<PATH>
Example \??\d:\Data\OfflineCache
Reboot the computer

Link to KB article for moving CSC cache: KB942960

Install Telnet Client on Windows 7 from cmd line

2010-02-16T14:14:00.002+01:00

I often use the telnet command to verify ports on webservers, smtp gateways and RPC traffic. Telnet isn't installed by default on a Windows 7 workstation so I need a way of quickly install it (and on secure systems also remove it).

Install

Open an elevated cmd prompt
Enter "start /w pkgmgr /iu:telnetclient"

Uninstall

Open an elevated cmd prompt
Enter "start /w pkgmgr /uu:telnetclient"

Exchange 2007 - OWA attachment size limit

2010-02-01T12:08:00.003+01:00

When using large attachments (larger than 30 MB) with OWA in Exchange 2007 you will get an 404 Error message during upload. This is due to IIS preventing large streams of data (which potentially leads to a denial of service possibility).

If you need to enable larger attachment sizes then you can do the following:

Logon to your CAS-servers
Browse to the OWA directory
Default: C:\Program Files\Microsoft\Exchange Server\ClientAccess\Owa
Take a backup of the current web.config file
Edit web.config
Need to edit the existing (the size is in kilobytes) - 60 MB = 60*1024 = 61440 kB
Start a command prompt (elevated)
Browse to your iis directory
Default: C:\Windows\System32\inetsrv
Run the following command: appcmd set config "Default Web Site/Owa" -section:requestFiltering -requestLimits.maxAllowedContentLength:xxxxxx (where the size is in bytes) - 60 MB = 60*1024*1024 = 62914560 bytes
Command prompt: IISReset

Default sizes - web.config

OWA: 30 MB attachment limits (30000 in web.config)
C:\Program Files\Microsoft\Exchange Server\ClientAccess\Owa\web.config
EAS: 10 MB attachment limits (10240 in web.config)
C:\Program Files\Microsoft\Exchange Server\ClientAccess\Sync\web.config
EWS: 13 MB attachment limits (13280 in web.config)
C:\Program Files\Microsoft\Exchange Server\ClientAccess\exchweb\ews\web.config

Links

Set/view permissions on a Windows service

2009-11-19T21:16:00.001+01:00

A Microsoft resource kit tool (subinacl.exe) exists to set/view permissions for different parts of the Windows Server system. You can use subinacl.exe to handle the following objects;

Files
Services
Registry keys
Shares
IIS/metabase
Printers

To view permissions on a windows service run the following command;

subinacl.exe /service <servicename>

To grant full permissions for a user run the following command;

subinacl.exe /service <servicename> /grant=computer\user=F
or
subinacl.exe /service <servicename> /grant=domain\user=F

The different permissions you can set for a service are;

F = Full Control
R = Read
W = Write
X = eXecute
L = Read control
Q = Query Service Config,
S = Query Service Status
E = View Dependent Services,
C = Service Change Config,
T = Start Service
O = Stop Service
P = Pause service
I = Interrogate Service
U = Service User-Defined Control Commands

How to RDP with 256 colors on Win7

2009-09-19T21:46:00.001+02:00

Sometimes I work on limited bandwidth (with mobile phone) and are doing remote management on servers using RDP (remote desktop). With Win7 it isn’t possible to choose 256 color depth in the RDP client any longer (15 bit is lowest possible value).

A simple workaround is to do the following;

Open remote desktop client (mstsc.exe)
Do your normal adjustments for low bandwidth
Save the RDP-file
Open the RDP-file in Notepad
Change the line “session bpp:i:15” to “session bpp:i:8”
Empty the server name in “full address:s:”
Double click the file to use the RDP session

My recommendation for low bandwidth scenarios (RDP-file);

Display: 640*480
Color Depth: 256 colors (see above how to set this)
Audio settings: Do not play / do not record
Local devices and resources: None used in remote session (use smartcard if these are needed for authentication)
Experiance: Modem (56 Kbps)
Reconnect: Yes
Server Authentication: As needed in your environment
Connect from Anywhere: Based on your environment

Values for session bpp:i:depth (bpp=bits-per-pixel)

4 (16 colors)
8 (256 colors)
15 (32’768 colors)
16 (65’536 colors)
24 (16’777’216 colors)
32 (4.2 billion colors)

Outlook 2010 - allow attachments

2009-09-03T07:17:00.004+02:00

I use Outlook 2010 (Technical Preview) but it blocks attachments by default. Using the registry key Level1Remove the attachments can be available;

Placement: HKCU\Software\Microsoft\Office\14.0\Outlook\Security
Notice that Office 2010 is level 14.0 in the registry.
KeyName: Level1Remove
KeyType: REG_SZ (String value)
Data: .ade;.adp;.app;.asp;.bas;.bat;.cer;.chm;.cmd;.com;.cpl;.crt;.csh;.exe;.fxp;.gadget;.hlp;.hta;.inf;.ins;.isp;.its;.js;.jse;.ksh;.lnk;.mad;.maf;.mag;.mam;.maq;.mar;.mas;.mat;.mau;.mav;.maw;.mda;.mdb;.mde;.mdt;.mdw;.mdz;.msc;.msi;.msp;.mst;.ops;.pcd;.pif;.prf;.prg;.pst;.reg;.scf;.scr;.sct;.shb;.shs;.tmp;.url;.vb;.vbe;.vbs;.vsmacros;.vss;.vst;.vsw;.ws;.wsc;.wsf;.wsh;.xnk

This will allow the user in Outlook to be able to access most attachments (save to disk). If you recieve attachments from unknown persons then do not open the attachments. As always take backup of the registry before doing changes.

You need to restart Outlook.exe to pickup the new registry key.

ICS on Windows Mobile 6.1 with Win7

2009-09-01T08:10:00.003+02:00

I have a Windows Mobile 6.1 device that I connect to my Windows 7 computer to use Internet Connection Sharing (ICS). This way I can be connected when I'm doing consulting at customers sites that doesn't allow me to use my computer on their network (or if they do not have any wireless guest access).

After my upgrade from Win7RC to Win7RMT the feature haven't worked and today I decided to get it up and running.

I know that most drivers are in the the Win7RTM so is should be some kind of drive issue. I did the following to get the ICS to work against the Win7 computer:

Uninstalled all old WMDC drivers and updates using add/remove programs
Rebooted my Win7
Plugged in my Windows Mobile 6.1 device (choose ICS when prompted)
Open Device manager (devmgmt.msc)
Removed my "Remote NDIS based Internet Sharing Device" driver (uninstall)
Removed my "Unknown mass storage device" driver (uninstall)
Removed an other "Unknown device" that was only present when the phone was plugged in
Re-plugged the Windows Mobile 6.1 device and all "Win7RTM" drivers where used to setup ICS

RSAT tools (Windows 7)

2009-08-28T20:25:00.004+02:00

For having all the administration tools on your Windows 7 workstation the RSAT (Remote Server Administrator Tools for Windows 7) must be installed.

Download the package: Link
Remove previous versions of RSAT
Install the MSU file
Run the installation wizard
Start -> Control Panel -> Programs (or appwiz.cpl)
Click "Turn Windows features on of off"
Expand Remote Server Administration Tools
Click/select the tools you need and click OK
The tools are installed
Available in the Start Button -> All Programs -> Administrative Tools

Now you have installed the RSAT tools

Multiple Exchange accounts in Office 2010

2009-08-26T12:26:00.003+02:00

I use a couple of different email servers for my different accounts on Exchange server (both private and work email). I have always been missing the feature to have multiple Exchange accounts in Outlook (without having to use multiple Outlook profiles).

This limitation is now gone with Outlook 2010 as it's possible to use multiple Exchange accounts in the same profile.

My Mail profile:

When sending emails (choosing From account):

Microsoft File Transfer Manager (FTM) installation

2009-08-18T15:43:00.001+02:00

Many of Microsoft’s files are downloaded by their tool FTM to be able to suspend and resume downloads. This to help IT Pro’s to easier download lagre files (for example ISO-images).

In some environments it’s easier to install the components to Internet Explorer via a MSI file. The latest file for installation can be found here:

File Transfer Manager (FTM) download

Find out the version of FTM on your computer

Start –> Run
%SystemRoot%\Downloaded Program Files\TransferMgr.exe
Click the FTM icon (top left icon) and choose About

Install TELNET-client in Windows 2008 server from command line

2009-08-12T14:50:00.003+02:00

I do often use the telnet.exe command during troubleshooting. This feature is disabled by default on Windows 2008 servers. To install the telnet.exe use the following command in a elevated command prompt:

ServerManagerCMD -i Telnet-client

Now you will have the binaries installed.

Upgrade Win7 RC (Ultimate) to Win7 Enterprise

2009-08-10T16:54:00.004+02:00

Today I decided to move from my Windows7 RC (Ultimate version) to the Enterprise version. To be able to do this you need to do the following:

Download the Enterprise Win7 CD
Unpack the Enterprise Win7 CD to disk
Open the file "\sources\cversion.ini"
Change MinClient value to 7000.0
Save the file
Open regedit
Browse to the following location;
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Change the key "EditionID" to "Enterprise"
Change the key "ProductName" to "Windows 7 Enterprise"
Start the installation of Windows 7 with "\setup.exe"

Picture of cversion.ini with changed MinClient value

Picture of registry with changed values

Change KMS to MAK key on Windows 2008 server

2009-08-06T21:47:00.002+02:00

If you ever need to change a Windows 2008 to MAK key then do the following (requires reboot and a valid MAK key):

Start an elevated CMD prompt
slmgr /rearm
NOTE: the rearm command can only be done 3 times on an Win2008 server
Reboot the server
On next logon enter the valid MAK key (and activate)
If activation doesn’t work logoff/login and run the slmgr /ato (from a cmd prompt)

To verify your license run slmgr /dli or slmgr /dlv in a cmd prompt

slmgr /dli (licence information)

slmgr /dlv (detailed license information)

Connect WEBDAV to MOSS 2007 on a server

2009-07-01T13:18:00.001+02:00

A customer needed to copy documents from a MOSS 2007 server (all document libraries) to a file share. Using ROBOCOPY (Robust File Copy) from Microsoft and a WEBDAV this task is rather easy.

Robocopy

Robocopy is part of Windows 2003 server Microsoft resource kit (reskit) that you can download from this page. It’s important that robocopy.doc is read and that you get familiar with all parameters and options.

WebDAV on a server

If you try to map a UNC path [net use * \\servername\path] towards MOSS on a server you will get the following error message:

System error 67 has occurred.

The network name cannot be found.

You need to enable WebClient on the server to be able to access WebDAV on a server. How to do this:

Start –> Run –> Services.msc
Find WebClient in the list
Double click WebClient
Change Startup type to Automatic
Click Apply button
Click Start button (the service starts)

This enables WebClient and you can now map a WebDAV folder using net use command.

Error “The workstation driver is not installed.”

In some cases you will get an error “The workstation driver is not installed”. This seems to be related to the following device driver “WebDav Client Redirector”. You need to run the following commands to fix this error message:

net stop webclient
net stop mrxdav
net start mrxdav
net start webclient

Happy WebDAV-ing from servers.

VMWare vSphere 4 on Windows 7 RC

2009-06-24T10:12:00.006+02:00

Yesterday I needed to logon to our VMWare vShpere 4 console using my Windows 7 RC. After upgrading the client to the newest version and entering id/password a error box came up;

Error parsing the server “[server/ip]” “clients.xml” file. Login will continue, contact your system administrator.

And after that the following;

The type initializer for ‘VirtualInfrastructure.Utils.HttpWebRequestProxy’ threw an exception.

So I couldn’t get into VMWare management console. After some googling and testing there is a solution for the problem.

Download this file (contains a .config file and a system.dll from .Net 3.5 SP1)
Create a folder LIB in %programfiles%\VMWare\Infrastructure\Virtual Infrastructure Client\Launcher
Copy the system.dll file into the LIB folder
Create a system variable DEVPATH that points to %programfiles%\VMWare\Infrastructure\Virtual Infrastructure Client\Launcher\LIB
Replace the VpxClient.exe.config in the %programfiles%\VMWare\Infrastructure\Virtual Infrastructure Client\Launcher with the new file

Now will the vSphere 4.0 work correctly.

Upgrade Windows 7 Beta to RC version

2009-06-06T12:35:00.002+02:00

Today I needed to upgrade my Windows 7 Beta (expires 1 July 2009). After trying to “fool” the setup to believe the Windows 7 Beta to be a Vista (using registry keys) I found some tips regarding a check using cversion.ini in the installation package.

Basically there is a minimum Win7 version to allow upgrade to the Windows 7 RC (7077) but the Beta is build 7000. The trick is simply to change the minimum version to a lower value.

Download the ISO file for Windows 7 RC
Unpack the ISO file to a directory using for example MagicISO
Go to the <Win7RC>\Sources directory
Open the cversion.ini file in Notepad
Edit the line “MinClient=7077.0” to “MinClient=7000.0”
Save the file

Run <Win7RC>\Setup.exe to upgrade your Windows 7 Beta to the RC version. I have sucessfully done this on my computer that now have the following upgrade path (WinXP > WinVista > Vista SP1 > Win7 Beta > Win7RC).

Note! This upgrade path isn’t officially supported by Microsoft and can cause all kinds of problems so I recommend you only to do this test computers (so you don’t have any critical data on the computer if it crasches).

Windows 7 - the missing Quick Launch toolbar

2009-01-18T14:55:00.006+01:00

I recently upgraded to Windows 7 to have a first look and feel of the new OS. One of the first things that I really missed was my Quick Launch taskbar for easy access to a lot of my applications. After some investigations I found how to enable it in two steps.
Enable the taskbar

Start -> Run -> Enter "gpedit.msc" and click OK
Navigate to the following branch
User configuration > Administrative Templates > Start Menu and Taskbar
Find the setting "Show QuickLaunch on Taskbar" and double click on it
Change the setting to "Enabled" and click OK
Close the Local Group Policy Editor

Configure the taskbar/quick launch

Right click the taskbar > toolbars > New Toolbar...
Navigate to %userprofile%\AppData\Roaming\Microsoft\Internet Explorer\
Mark the "Quick Launch" folder and choose the Select Folder button

The Quick Launch should now be available on the taskbar and you can rearrange the taskbar. I have made the following changes:

Removed "Show text"
Removed "Show Title"
View > Small Icons

Screenshot with Quick Launch toolbar enabled in Windows 7

Upgrade Windows Vista Enterprise to Windows 7 Beta (Ultimate)

2009-01-18T12:18:00.002+01:00

Upgrading Windows Vista Enterprise (SP1) isn’t a valid upgrade path. An information/error message will be displayed that it isn’t possible to upgrade to Windows 7 Beta.

To work around the issue do the following:
I do not know if it can cause any problems but so far I don’t have any issues after doing the upgrade from Vista Enterprise to Windows 7 Beta.

Restart your computer
Start regedit.exe
Never use the register editor (regedit.exe) if you do not know what you are doing. Worst case will prevent your computer from working after a reboot.
Navigate to the following branch
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Change the EditionID to “Business”
Change the ProductName to “Windows Vista ™ Business”
Run the setup.exe from the Windows 7 DVD (or a local folder)

After upgrading to Windows 7 I recommend you to install the following updates:

RSAT (Remote Server Administration Tools) for Windows 7
RSAT download link on Microsoft.com
MP3 and Windows Media Player update
http://support.microsoft.com/default.aspx/kb/961367

IE 7 tabs missing in managed enviroment with Turn on Classic Shell setting Enabled

2009-01-13T09:28:00.003+01:00

I have investigated an issue when IE 7 tabs not working after upgrading from IE6. All options was configurable in Internet Options but the customer had a managed environment with GPO’s. Some settings was configuring IE (User Configuration > Administrative Templates > Windows Components > Internet Explorer) but removing these didn’t solve the issue.

When I denied applying GPO’s from the main “user settings” GPO the tabs worked within IE so it was clear that a setting within that GPO prevented the IE 7 tabs.

After some investigations I found that the setting for Turn on Classic Shell removes IE7 tabs.

Turn on Classic Shell
User Configuration > Administrative Templates > Windows Components > Windows Explorer

If “Turn on Classic Shell” is set to Enabled then IE7 tabs will not work.

The setting with GPO configures the following registry key:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell (REG_DWORD)

0 = Disabled (i.e. no classic shell
1 = Enabled (i.e. classic shell active)

Explanation of GPO setting (from ADM file):

This setting allows you to remove the Active Desktop and Web view features. If you enable this setting, it will disable the Active Desktop and Web view. Also, users cannot configure their system to open items by single-clicking (such as in Mouse in Control Panel). As a result, the user interface looks and operates like the interface for Windows NT 4.0, and users cannot restore the new features.
Note: This setting takes precedence over the "Enable Active Desktop" setting. If both policies are enabled, Active Desktop is disabled.
Also, see the "Disable Active Desktop" setting in User Configuration\Administrative Templates\Desktop\Active Desktop and the "Remove the Folder Options menu item from the Tools menu" setting in User Configuration\Administrative Templates\Windows Components\Windows Explorer.

I haven’t found any explanaition on the web explaining why IE7 tabs aren’t available when using “Turn on Classic Shell. I have sent an email to Microsoft and hopefully they will provide me with an answer and if they do I will update this post.

Update (14 January)
Today I recieved a mail from Microsoft (IE Team) regarding the issues above with at link to a blogpost. This describes the issue but do not explain why IE7 uses the setting, the mail came from Eric Lawrence who also posted information in the comments of this post.

Link to the blogpost describing the issue. (see down in the post on the ClassicShell registry key)

No roaming profile ?

2008-12-15T22:14:00.000+01:00

Today I troubleshooted a roaming profile error, i.e. the profile wasn't copied back to the share on the server. No errors (or popups) came during logon/logoff and the user account had full access to the share.

After some investigations I noticed that the user account was member of the "Domain Guests" build in group. Apparently this group membership makes the roaming profile to be temporary (and never saved to the share). Due to the lack of error messages (or information messages) this was hard to find out of.

I have searched the Internet for some good information about "Domain Guests" but didn't find much useful information:

Using Default Group Accounts
http://technet.microsoft.com/en-us/library/bb726982.aspx
Profiles for Members of Guests Group Are Deleted
http://support.microsoft.com/kb/165398

Extremely slow logon to ICA/RDP showing "Checking your credentials..."

2008-09-07T19:26:00.001+02:00

Together with two of my collegues I recently worked on a Citrix problem with extremely slow logon. When trying to logon with ICA the server showed "Checking your credentials..." for a very long time (maybe 15 minutes) and RDP just gave me a blue background approximately the same time (after entering a valid ID/PWD).

After cheching verious things like:

NETLOGON service (both on Citrix server and domain controllers in the same site)
KDC service (on the DC's)
Bindings on the NIC (Citrix server)
IMA service (on the Citrix server)
Time (i.e. no time skew difference on the server, for Kerberos to work)
ICA connection/protocoll settings
A load of other possible things

My collegue (Jostein Støen)found the issue to be a DC (Windows 2008 server) that had cleaned a file with a virus and required a restart to fix all errors. After the restart all worked well again. The slow logon was caused by the server session timing out to the first DC and after the timeout the logon succeeded as normal.

Need to test a SMTP server ?

2008-09-04T14:50:00.002+02:00

During my work with Exchange, antispam solutions and relaying email I need a tool for sending e-mail directly to a server. I can use telnet for this purpose but many servers require strict RFC-compliance which is hard to do by typing manually.

I have found a good software to test SMTP servers from White Peak Software ($11.95) that fills my usage. With SMTP diagnostics you can:

Author the test email
SSL support
Specify to/from addresses
Specify SMTP server
Add attachments (for checking attachment compliance)
Authentication support
Batch and schedule support

Links

ISA server "Domain Controllers" computer set read only ?

2008-08-28T08:39:00.003+02:00

If you for some reason move an ISA server from one domain to another (labb environment) without uninstall/install the ISA software you can experiance that the "Domain Controllers" computer set is read only and populated with the wrong set of servers. This prevents the ISA server to apply GPOs from the current domain if it's not "allowed" to contact DC's to download security polices and other GPO settings.

After investigating the issue on a ISA 2006 Standard server I found the following solution:

Start Regedit
Go to the following regkey:
HKLM\IsaStg_Eff1\Arrays\{GUID}\RuleElements\ComputerSets\{AA7BB30B-D410-4A75-8657-E87F4F7CDF7}
Changes the msFPCPredefined key from 1 to 0
Restarted ISA server console
Now the Domain Controllers computer set was editable

After other investigations this settings seems to be in registry or in Active directory (in some cases in ADAM) for ISA server.

ISA 2006 Std: Registry (see above)
ISA 2006 Ent: Active Directory
ISA 2004 Std: ADAM on Configration storage server
ISA 2040 Std: Registry (HKLM\Software\Microsoft\Fpc\Storage\Array-Root\Arrays\{GUID}\RuleElements\ComputerSets\{DC_GUID}

Links

Forum post with information
http://forums.isaserver.org/m_2002014363/mpage_1/key_/tm.htm
Blog with information
http://blogs.isaserver.org/shinder/2006/07/09/how-do-i-edit-the-domain-controllers-computer-set/

SQL 2008 released (RTM)

2008-08-06T23:35:00.000+02:00

Just a quick note that SQL 2008 is now released (RTM).

SQL 2008
SQL Server 2008 delivers on Microsoft’s Data Platform vision by helping your organization manage any data, any place, any time. It enables you to store data from structured, semi-structured, and unstructured documents, such as images and music, directly within the database. SQL Server 2008 delivers a rich set of integrated services that enable you to do more with your data such as query, search, synchronize, report, and analyze. Your data can be stored and accessed in your largest servers within the data center all the way down to desktops and mobile devices, enabling you to have control over your data no matter where it is stored.

Restore Exchange 2003 public folder to alternate hardware

2008-07-22T10:43:00.002+02:00

In some cases you need to recover old public folder data from Exchange while maintaning full production to all users. Public Folder stores isn't supported with recovery storage groups (RSG) within Exchange 2003 so an alternative is to use a separate hardware.

Below is a simplified todo list

Create a new server (physical or virtual) with appropriate disk space for the public folder
Promote the new server to a Domain Controller in a new forest and domain (use DNS on the same server)
Run Exchange 2003 forestprep
Run Exchange 2003 domainprep
Retrieve Exchange names from the running Exchange forest

Exchange organization name
Administrative group name (for the public folder store)
Storage group name
Public folder store name

Install Exchange 2003 on the new server

Specify the identical organization name

Patch the Exchange server to identical patch level
Change the Exchange organization to "native" level
Change name on the Administrative group
Change name on the Storage group for the Public Folder store
Change the name on the public folder store
Restart the Exchange server (to refresh Information store cache)
Dismount the PF store
Check "This database can be overwritten by a restore" on the Public Folder store
Restore the public folder database

Redirection is used within most backup products
Use the correct backupfile locally on the restore server if using NTBackup

Mount the database
Extract the data needed with a utility

Outlook can be used
PFDAVAdmin can be used

Links

Add Storage controller to RIS image

2008-06-13T11:14:00.002+02:00

Today I was going to prepare a RIS deployment to handle new hardware (and a new storage controller). The present RIS setup ended with an error message "No harddrive found" due to drivers missing.

To solve the issue I integrated the correct files to the RIS CD installation and added the correct entries to txtsetup.sif:

Downloaded the correct drivers
Copied the correct driver files to the ...\i386 catalog (on the RIS server)

*.sys files
*.cat files
*.inf files

Edited txtsetup.sif

[SourceDisksFiles] section
[HardwareIdsDatabase] section
[SCSI.Load] section (if storage device, i.e. SATA controller)
[SCSI] section (if storage device)

I also added the correct drivers to ...\$OEM$\$1\Drivers\Nic (depending on driver)
Edited ...\i386\templated\ristndrd.sif [Unattended] section

OemPreinstall = yes
OemPnpDriversPath = "\Drivers\Nic;\Driver\xxx"
DriverSigningPolicy = Ignore

Restarted RIS/WDS services

PNF files are created in the ...\i386 catalog

PXE-booted a client to install an CD install with the new drivers that I had attached to the image.

Deploy MS .Net framework 3.5 with Group policies (GPO)

2008-05-14T19:32:00.002+02:00

Today I was faced with the challenge to deploy Microsoft .Net Framework 3.5 with GPO (software installation). The application itself have many dependencies/requirements to have a successfull installation:

MS XML Parser 6
RGB Rasterizer
.NET FW 2.0 SP1
.NET FW 3.0 SP1

Create a AIP (Administrative Installation point)

I found a blog (Project84) that had created a batch script for creating the required administrative installation point. The script worked for me when I edited some parameters in the script:

Row 2: Changed WORKFOLDER
Row 14: Changed to correct path to dotnetfx35.exe

After this I got the folders to be able to deploy software to x86 systems.

MST files (Micsoft

For installation to work with GPO's I created some MST-files for the deployment to set the property VSEXTUI=1 to the .Net Framework installers (2.0 SP1, 3.0 SP1 and 3.5).

GPO-deployment

To deploy all software I created 4 GPO's in the correct OU and assigned the software to computers in the following order:

RGB Rasterizer (no MST needed)
.NET FW 2.0 SP1 (with MST)
.NET FW 3.0 SP1 (with MST)
.NET FW 3.5 (with MST)

Silent installation

If you need to do a silent installation of the .NET 3.5 then you can download the redistributable package and run it with the following command:

dotnetfx35.exe /q /norestart

Some useful links

RunAs in Vista SP1

2008-03-14T08:56:00.002+01:00

If you use RunAs (starting applications with different credentials) then you have probably noticed that this option is missing in Vista SP1. To start applications with the RunAs you need to use the cmd-line based command:

%windir%\system32\runas.exe /user:domain\user "<Path>\Application.exe"

If you are used to the Windows XP feature with right clicking an application and choose runas then you can get an addon to Vista to have this functionallity. The application (ShellRunas) is developed by Mark Russinovich and is found here: Link

ShellRunas works on Windows XP, 2003 server, Vista and 2008 server and you need to register the functionallity with running the command:

shellrunas /reg

Where did the /console switch go ?

2008-03-12T12:37:00.004+01:00

If you use Remote Desktop Protocol (RDP) to remotely manage servers you are probably used to the /console switch (to access the console session on the server). This means that you have 3 sessions on a Windows 2003 server (2 sessions + console session).

If you have upgraded to RDP 6.1 (comes with Vista SP1 and Windows 2008 server) the /console switch doesn't connect to the console session. To be able to attach to the console session you need to use a new switch /admin to successfully connect and use the console session.

It is possible to a post to install the RDP 6.1 on other computers, but requires some work (link).

RDP 6.1
mstsc connection file /v:server:port /admin /f /w:width /h:height /public /span /edit "connection file" /migrate

<connection file>	Specifies the name of and .rdp file for the connection
/v:server:port	Specifies the remote computer to which you want to connect (and port)
/admin	Connects you to the session for administering a server
/f	Starts in full-screen mode
/w:width	Specifies width
/h:height	Specifies height
/public	Runs RDP in public mode When the TS client is running in public mode it does not persist to disk or the registry any private user data (e.g. username, domain, password, etc.) on the machine which it is running, nor does it make use of any saved private data that may exist (e.g. trusted sites list, persistent bitmap cache, username, etc). In essence, the client operates as if there is no registry or secondary storage present for private data. However, the client still honors GP settings.
/span	Matches the remote desktop width and height with the local virtual desktop, spanning across multiple monitors if necessary. To span across monitors, the monitors must all have same height and be aligned vertically
/edit	Opens the specified .rdp file for editing
/migrate	Migrates legacy connection files that where created with Client Connection Manager to new .rdp connection files

RyanVM integrator and Deployment4 error (looping indefinetly)

2008-02-27T11:44:00.001+01:00

I have recently been working with Microsoft Deployment4 to create a lite touch deployment for a customer. When using the RyanVM integrator I h run into a problem with the text mode setup "looping" indefinitely.

The problem lies with setupldr.bin and setupldr.ex_ not being copied to the root folder after first text mode setup.

To fix the error I swapped the setupldr.bin and setupldr.ex_ in the i386 directory for the network installation files with the ones provided on the Windows XP SP2 cdrom.

Links

Vista SP1 out on MSDN and TechNet+

2008-02-17T09:06:00.001+01:00

If you have a MSDN or TechNet+ subcription then you can download and install Windows Vista SP1. The installation process is simple (run the correct .exe for you Vista language and binaries) and it will install and reboot. During the first reboot it will install in 3 stages (sometimes with reboots) and when finished it will present the standard logon screen.

I haven't had any problems installing the update (have done it on 3 PC's) and have noticed that wireless networking and some file operations (copying) is working better after the patch.

Find the MSDN download here (you must logon to MSDN):
Link to file on MSDN

Windows Installer startup error 14007

2008-01-09T18:28:00.001+01:00

Today I have troubleshooted a system (Windows XP SP2) with a Windows Installer error. The error reported both in Event logs (System log) is

The Windows Installer service terminated with the following error:
The requested lookup key was not found in any active activation context.

When manually (with services.msc) trying to start the service the following error comes up:

Could not start the Windows Installer service on <computername>.
Error 14007: The requested lookup key was not found in any active activation context.

The problem seems to relate to Windows Installer not correctly registered on the computer. Running the following commands solved the issue:

%systemroot%\system32\msiexec.exe /unregserver
%systemroot%\system32\msiexec.exe /regserver

How to license a Exchange 2007 EDGE server

2007-12-28T12:36:00.001+01:00

If you deploy and configure an Exchange 2007 environment with a EDGE server without registering license keys before creating the subscription you can have problems licensing the EDGE server. There will be a warning message when starting the Exchange Management Console on any of the HUB/CAS/Mailbox servers that the EDGE server is unlicensed.

If you run Get-ExchangeServer select name,productid,*trial* you will get a similar output:

Name:	<ServerName>
ProductID:
IsExchange2007TrialEdition:	True
IsExpiredExchange2007TrialEdition:	False
RemainingTrialPeriod	26.22:52:33.0692266

To solve this issue you need to recreate the EDGE subscrition between the EDGE and HUB server:

Logon to the EDGE server
1. Start Exchange Management Shell
2. New-EdgeSubscription -FileName <Filename.xml>
Copy the XML file to the HUB server
Logon to the HUB server
1. Start Exchange Management Console (EMC)
2. Go to Organization Configuration > Hub Transport
3. Right click and choose "New Edge Subscription..."
4. Follow the wizard
5. Start Exchange Managment Shell (EMS)
6. Start-EdgeSynchronization
  Verify that "Result: Success" appears
Delete the XML-files that you created

Now the EDGE server should be licensed when starting the EMC.

Hardware scan from command line (devcon.exe)

2007-12-28T09:52:00.001+01:00

In some cases you might need to do a hardware scan from command line (batch file). Microsoft have created a tool to be able to do this that are available from their download site (link).

DevCon can also be used as an alternative to Device Manager. Using DevCon, you can enable, disable, restart, update, remove, and query individual devices or groups of devices. DevCon also provides information that is relevant to the driver developer and is not available in Device Manager.
DevCon can be used with Microsoft Windows 2000, Windows XP, and Windows Server 2003.

Usage (devcon.exe rescan)
devcon.exe [-r] [-m:\\machine] <command> [<arg>...]
-r if specified will reboot machine after command is complete, if needed.
rescan; Scan for new hardware

Setup NLB cluster on cloned server on VMWare plattform

2007-12-28T09:42:00.001+01:00

I have had problems setting up a cloned server on VMWare with NLB (Network Load Balancing) on Windows 2003 (SP2). The error when trying to add the second host to the NLB cluster is: No interfaces are available for installing a new cluster

The reason for this is that every NIC creates a GUID in registry (HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworksCards). To be able to set up NLB correctly every NIC needs a uniqe GUID (the settings for NLB are stored in HKLM\System\CurrentControlSet\Services\WLBS).

Solution when cloning servers
Remove the NIC from Device Manager (devmgmt.msc) and do a hardware rescan to add the same NIC with a new GUID.

Unicast/multicast on VMWare
VMWare supports both unicast and multicast but it's easier to implement multicast (this is dependent of how ARP addresses are updated). More information is found in KB1556 in the VMWare knowledge base.

Change color in CRM 3.0

2007-11-16T09:55:00.000+01:00

Some times customers deploy multiple installations of Microsoft CRM 3.0 in their Active Directory. One for production use and the other for a development/staging plattform (for testing new functionallity and code deployments).

If users access both deployments they can have trouble to know which CRM system they are on and in worst case starts to work on the development/staging servers.

To prevent this you can change the background color of the CRM system to a color you like (yellow, orange, red).

This change makes you CRM 3.0 unsupported by Microsoft but if you keep a copy of the original file it's easy to swap back to a supported configuration.

In some cases you need to reapply the change after an upgrade/repair/hotfix.

Step by step guide to change background color

Logon to the CRM server
Browse to <CRM IIS root> (normally c:\inetpub\wwwroot)
Browse to _common\styles
Copy the global.css to a backup directory
Open global.css
Do a IISreset

In Global.css you need to edit the body.stage tag:

body.stage
{
background-color: #acc0e9;
padding: 10px;
}

Change the color to what you like with color codes. I normally recommend the following codes:

#ffC4AC = OrangePink color
#22B14C = Green color
yellow = Yellow color (remeber to remove the #)

Google search tips

2007-11-04T19:23:00.000+01:00

I use Google (http://www.google.com) as my primary search engine when searching information on the internet. Below is some of the technices that I use to make good searches:

filetype:PDF
To filter the result to just show links with the specific filetype. Google handles many filetypes including PDF, Microsoft Office, Lotus 1-2-3 and others.

site:blogger.com
To display indexed content for a specific site use the site function. You can even specify a subfolder using this (site:microsoft.com/exchange).

"phrase to search for"
To search for a phrase put the text with quotation marks.

~synonym
To search for synonyms use the ~ before the search word.

Define:ITIL
To find an explanation to a word definition the define function can be used.

Mail attribute not updating when using ESM

2007-10-08T17:39:00.000+02:00

When using the ESM (Exchange Management Console) on Exchange 2007 to manage email addresses without a E-Mail address policy (i.e. custom addresses) the mail attribute of the user isn't updated (as seen on the General tab in ADUC).

To update the mail attribute of the user you must start ADUC (Active Directory Users and Computers) and modify the attribute to be equal to the primary SMTP address. If you don't do this you can have errors (EventID: 9327/OAL Generator) with the Offline Address Book (OAB) generation and users will be missing in the GAL/AL for Outlook users in cached mode.

You will also get information about which recipients missing in the Application log of the server building OAB's if you have Medium or higher diagnostic level on the OAL generator.

Set diagnostic level on OAL generator

Set-EventLogLevel -Identity "MSExchangeSA\OAL Generator" -Level Medium

After running a new update of the OAB you will find information like this in the Application log:

Event Type: ErrorEvent

Source: MSExchangeSAEvent

Category: OAL Generator

Event ID: 9325

Description:OALGen will skip user entry 'username' in address list '\Global Address List' because the SMTP address '' is invalid. - Default Offline Address Book

Summary

Use E-mail policies as much as possible when creating e-mail addresses for the users. If this isn't possible then you must remember to manually enter the mail attribute field in ADUC for the user until Microsoft releases a patch for this error.

Event 9344 - OAL Generator (error)

2007-10-04T11:01:00.000+02:00

During the last week I have troubleshooted Offline Address Book (OAB) generation on a Exchange 2007 deployment. The OABs didn't generate any files on the mailbox server (in the C:\Program Files\Microsoft\Exchange Server\ExchangeOAB directory).

The application log gave the following information:
Source: MSExchangeSA
Category: OAL Generator
Event ID: 9344
Description: OALGen could not find the address list with the Active Directory object GUID of '/guid=08EF907625C16F47833B53E2AA26BE08' in the list of available address lists. Please check the offline address list configuration object. - Administrators OAB

After checking the GUID for the Address List that Administrators OAB was built from with a VBScript (see below for script) I thought this had something todo with permissions on the Address List container inside Active Directory. I checked the permissions on the following containers:

CN=All Address Lists,CN=Address Lists Container,CN=,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=com
CN=All Global Address Lists,CN=Address Lists Container,CN=,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=com
CN=Offline Address Lists,CN=Address Lists Container,CN=,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=com

After looking at the permissions I notices that Network Service didn't had permissions to any of the address lists in the different containers. After adding Network Service with default permissions the Offline Address Lists generated successfully:

List Contents
Read All Properties
Read Permissions

See Exchange 2007 Server Setup Permissions Reference for details about permissions modified during setup.

Please also note that Network Service in the default configuration inherits the permissions from CN=,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=com and are not explicit set on the Address List containers. The Exchange organization that I investigated was set up to be a hosting provider and that was the reason for breaking inheritance.

VBscript for checking GUID of an address list
Dim obArgs
Dim cArgs
Dim Path
Set obArgs = WScript.Arguments
cArgs = obArgs.Count
If cArgs <> 1 Then
WScript.Echo "Usage: cscript scripname Addresslist"
WScript.Echo "Written by Rikard Strand, Net Works AS, 2007"
wscript.quit
End If
'Modify the path below to match the Active Directory and Exchange
organizationPath = "LDAP://CN=" & obArgs.Item(0) & ",CN=All Address Lists,CN=Address Lists Container,CN=ExchangeOrgName,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=example,dc=com"
wscript.echo "------------------"
wscript.echo "Running query on:"
wscript.echo Path
wscript.echo "------------------"
Set objUser = GetObject(path)
arrbytGuid = objUser.object
GuidstrHexGuid = OctetToHexStr(arrbytGuid)
Wscript.Echo "User Guid in hex string format: " & strHexGuid
strGuid = HexGuidToGuidStr(strHexGuid)
Wscript.Echo "User Guid in display format: " & strGuid
Function OctetToHexStr(arrbytOctet)
' Function to convert OctetString (byte array) to Hex string.
' From http://www.rlmueller.net/
Dim k
OctetToHexStr = ""
For k = 1 To Lenb(arrbytOctet)
OctetToHexStr = OctetToHexStr _
& Right("0" & Hex(Ascb(Midb(arrbytOctet, k, 1))), 2)
NextEnd
Function
Function HexGuidToGuidStr(strGuid)
' Function to convert Hex Guid to display form.
' From http://www.rlmueller.net/
Dim k
HexGuidToGuidStr = ""
For k = 1 To 4
HexGuidToGuidStr = HexGuidToGuidStr & Mid(strGuid, 9 - 2*k, 2)
Next
HexGuidToGuidStr = HexGuidToGuidStr & "-"
For k = 1 To 2
HexGuidToGuidStr = HexGuidToGuidStr & Mid(strGuid, 13 - 2*k, 2)
Next
HexGuidToGuidStr = HexGuidToGuidStr & "-"
For k = 1 To 2
HexGuidToGuidStr = HexGuidToGuidStr & Mid(strGuid, 17 - 2*k, 2)
Next
HexGuidToGuidStr = HexGuidToGuidStr & "-" & Mid(strGuid, 17, 4)
HexGuidToGuidStr = HexGuidToGuidStr & "-" & Mid(strGuid, 21)
End Function

Enable remote errors in SQL 2005 Reporting services

2007-09-07T07:33:00.000+02:00

Today I had to troubleshoot reports on a SQL 2005 Reporting services installation. All reports ran fine under a administrator account but when users tried to use the reports they where presented with the following error message:
An error has occurred during report processing. Cannot create a connection to data source 'AdventureWorks'. For more information about this error navigate to the report server on the local server machine, or enable remote errors.

As I needed to see the actual error message I needed to enable remote errors (or running the reports locally on the reportserver as the user). To do this I created a script for enabling the remote errors and saved it as Enable-SRS-Remote-Errors.rss:
Public Sub Main()
Dim P As New [Property]()
P.Name = "EnableRemoteErrors"
P.Value = True
Dim Properties(0) As [Property]
Properties(0) = P
Try
rs.SetSystemProperties(Properties)
Console.WriteLine("Remote errors enabled.")
Catch SE As SoapException
Console.WriteLine(SE.Detail.OuterXml)
End Try
End Sub

I copied the file to the SQL reporting server and ran the following command (from the \90\Tools\binn directory):
rs -i Enable-SRS-Remote-Errors.rss -s http://reportserver/ReportServer

The script writes back:
Remote errors enabled.

How to enable debug logging for Terminal Services Licensing

2005-08-03T07:20:00.000+02:00

1. Change the Terminal Services Licensing service settings in Control Panel. Click to select the Allow service to interact with desktop check box on the Log On tab.

2. Start Registry Editor on the server that is running Terminal Services Licensing, locate and then click the following key:

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/TermServLicensing/Parameters

3. Create a DWORD value named Console. Set the value to 1.

4. Create a DWORD value named Log Level. Set the DWORD value as needed according to the following matrix:

Set the value to FFFFFFFF for full debug information.

Debug level : Bit 0 to 13 (total of 14 debug levels)

Severity code : Bit 30 and 31

#define DBG_SUCCESS 0x00

#define DBG_INFORMATION 0x01

#define DBG_WARNING 0x10

#define DBG_ERROR 0x11

Facility code : Bit 14 - 29

#define DBG_FACILITY_JETBLUE 0x00001

#define DBG_FACILITY_RPC 0x00002

#define DBG_FACILITY_KEYPACK 0x00004

#define DBG_FACILITY_LICENSED 0x00008

#define DBG_FACILITY_KEYPACKDESC 0x00010

#define DBG_FACILITY_ALLOCATELICENSE 0x00020

#define DBG_FACILITY_INIT 0x00040

#define DBG_FACILITY_LOCK 0x00080

#define DBG_FACILITY_HANDLEPOOL 0x00100

#define DBG_FACILITY_RETURN 0x00200

#define DBG_FACILITY_UPGRADE 0x00400

#define DBG_FACILITY_POLICY 0x00800

#define DBG_FACILITY_WORKMGR 0x01000

#define DBG_FACILITY_WKSTORAGE 0x02000

#define DBG_FACILITY_SRVLIST 0x04000

#define DBG_FACILITY_JOB 0x08000

All levels:

#define DBG_ALL_LEVEL 0x000003FF

Debug level:

#define DBGLEVEL_FUNCTION_ERROR 0x0001

#define DBGLEVEL_FUNCTION_TRACE 0x0001

#define DBGLEVEL_FUNCTION_DETAILSIMPLE 0x0002

#define DBGLEVEL_FUNCTION_DETAILFULL 0x0004

#define DBGLEVEL_FUNCTION_ALL DBG_ALL_LEVEL

5. Stop the Terminal Services Licensing service and restart it. A console window opens on the console of the server that is running Terminal Services Licensing.

NOTE: This does not work in a Terminal Services session. You have to work on the console or in Windows 2003 (mstsc /v:host /console).

----

How to enable debug logging for Terminal Services Licensing

How to set X500 proxy addresses for Exchange Server 2003 recipients and for Exchange 2000 Server recipients

2005-05-30T09:45:00.000+02:00

How to set X500 proxy addresses for Exchange Server 2003 recipients and for Exchange 2000 Server recipients
View products that this article applies to.
Article ID : 313324
Last Review : April 25, 2005
Revision : 2.1
This article was previously published under Q313324
On this page
SUMMARY
MORE INFORMATION
APPLIES TO

SUMMARY
This article describes how to set X500 proxy addresses for Microsoft Exchange Server 2003 recipients and for Microsoft Exchange 2000 Server recipients.
Back to the top

MORE INFORMATION
To ensure the delivery of e-mail messages to a recipient that may not typically receive these messages, (for example, Exchange Server 5.5 distinguished names [also known as DNs] or migrated contact distinguished names), you can add an X500 proxy address to the recipient. To do so, perform the following steps: 1. Start the Active Directory Users and Computers snap-in. To do so:

a. Click Start, and then point to Programs.
b. Point to Administrative Tools, and then click Active Directory Users and Computers.

2. Click the container that contains the user account or contact that you want.
3. Right-click the user or contact, and then click Properties.
4. Click the E-mail Addresses tab, and then click New.
5. Click Custom Address, and then click OK.
6. In the E-mail address box, type the X500 address for the recipient, for example type the following:
/o=ExampleAB/ou=Organizationalunit1/cn=Recipients/cn=Username
7. In the E-mail type box type X500.
8. Click OK, click OK, and then quit the Active Directory Users and Computers snap-in.
Use Microsoft Outlook to verify that the address resolves. For example, you can compose a new e-mail message, type the X500 address of the recipient in the To box, such as in the following example, click Tools, and then click Check Names:
/o=ExampleAB/ou=Organizationalunit1/cn=Recipients/cn=Username
Try to send the e-mail message, and then verify the e-mail message delivery to the recipient by using the new e-mail address.

An X500 address can be added to a mailbox, because old e-mail messages in a migrated mailbox contain these addresses. Therefore, if this address is not present in the new system, all of the replies to these old e-mail messages receive a non-delivery report (NDR).

--

Orginal artikel
How to set X500 proxy addresses for Exchange Server 2003 recipients and for Exchange 2000 Server recipients

Glen's Exchange Dev Blog: Adding a public folder contact search option to OWA in Exchange 2003

2005-05-28T00:00:00.000+02:00

Adding a public folder contact search option to OWA in Exchange 2003
One of the new features (among others) in Exchange 2003 OWA is the ability for the user to now search their own contacts folder when using the address book find in OWA 2003. One other location that can be used to store contacts especially if you want to share contacts among users is in a contacts folder in a public folder tree. So I was asked to look at making this available to search in OWA like the contacts folders.

This brings up the first question of how can I customize OWA I went digging though some old whitepapers and found this one about customizing OWA 2000 which is mostly still relevant to Exchange 2003. The low down from this whitepaper is the core HTML used to render OWA is stored in the wmtemplates.dll file which means that you can’t really mess with it. There are some other warnings in this whitepaper about any changes made to the .js, htc or xml files used by OWA are unsupported. But further on they give you an example of modifying one of the script files used by OWA to change the NAV bar. Siegfried Webber also has a sample on his blog that shows how to add a button to the NAV bar in OWA 2003.

What I learnt from these two sources was that although you can’t modify the OWA core code directly the scripts that contain all the page events that OWA loads can be modified and the document object can be used to insert your own custom code back into what gets rendered to the client.

So the first thing I had to do is work out which script was being used when you click the address book in OWA. This is where Ethereal (or some other packet capture program) is invaluable. Doing a capture I could see that file dlg_gal.js which is in the exchweb/version/controls directory was being used for events on this page and also I found that the ID for the drop down box I wanted to modify was selFindIn.

The next important thing was to come up with a function I could add to the script that would insert another option into this dropdown box. The document object was used to create a HTML Option tag, give it a value of 2 and then create a text node which contains the text that will be displayed in the box. The rest of the function ties the HTML together and then appends it into selFindIn tag block. The function looks like

// -------------------------------------------------------------------------------------------------------------
function addoptionitem()
{
var newoptionvalue = document.createElement("OPTION");
newoptionvalue.value = "2";
var oTextNode = document.createTextNode("Public Folder Contacts");
newoptionvalue.appendChild(oTextNode);
var objselfindin = g_winDocAll.item("selFindIn");
objselfindin.appendChild(newoptionvalue);
}
// -------------------------------------------------------------------------------------------------------------
To ensure this function will run a modification is also needed to the window.onload() event function defined in the script. Basically all that is involved was putting some code after the current last line in the function that would run my custom function in the onload event.

window.document.body.attachEvent("onkeydown", event_window_onkeydown);addMessage("", false);event_FindIn_change();g_winDocAll['DN'].focus();
// ------------------------------------------------------------------------------------------------------------------
addoptionitem();}
// ------------------------------------------------------------------------------------------------------------------

Once this is done I had a piece of functioning code that would add an extra item into the drop drown “find name in” box. The only thing missing is that it won’t do anything because there is nothing defined if the option value is 2 when the find button is pressed. Currently what happens when you select contacts and click find is that it does a WebDAV search of the contacts folder using the parameters entered. The only thing that needs to be changes in the current code to make this search a public contacts folder was the actually folder that is being searched. So I decided to go with reusing the functions that are already there for the contacts search and just modifying them so it would check and change that location it’s searching against if the option value is 2. To do this required editing another 2 existing functions. The first function that need to be modified was the event_button_find() this is the code that is run when someone presses the find button in the Web dialogue. All that I needed to modify was one if statement which currently said if the selFindIn value is 1 run this code so I changed it to if SelFindIn is 1 or 2 run this code. The following change was made

// ------------------------------------------------------------------------------------------------------------------
else if (selFindIn.value == 1 || selFindIn.value == 2)
// ------------------------------------------------------------------------------------------------------------------

Once this change was made this means that if Contacts or Public folder Contacts is selected it will run the same function. The next function in line is the queryGetContactsData() this function builds the webdav query of the contacts folder. Within this function I’ve added a if statement so if the selFindIn.value is 1 it runs the normal code it would usually run but if its two it will run one line different which changes the location it will perform the query from the contacts folder to the public folder contacts folder. There is a variable already defined that holds that URL of the public folder tree for the user so as long as there is a replica of your public contacts folder on this server all you need to do is append the name of the contacts folder you want to use. I defined a variable called g_sPublicContactsFolder to hold this information

// ------------------------------------------------------------------------------------------------------------------
if (selFindIn.value == 2){
var g_sPublicContactsFolder;
g_sPublicContactsFolder = g_sPublic + "PubContacts";
var oReq = new requestFactory(g_sPublicContactsFolder, "SEARCH", null,event_getData);}
else {
var oReq = new requestFactory(g_sContactsFolder, "SEARCH", null,event_getData);}
// ------------------------------------------------------------------------------------------------------------------

This part of the code you need to customize yourself in this example the contacts folder is called PubContacts and its just off the root of the public folder tree. g_sPublic holds the value of the Root public folder tree eg http://server/public/ so you just need to append the rest of the path.

That’s about it, but now you need to think about the problems of actually doing this. Firstly modifying this .js file isn’t supported. One reason for this is pretty obvious the files themselves are held in the /exchweb directory within a versions/controls directory. What version you have of these files is going to depend on what service pack you run and what hotfixes you have applied. For instance I currently have version 6.5.7232.34 of these files which came out of the KB 883543 hotfix. So if you don’t get where I’m going with this if you make changes to your files today apply a hotfix or the next SP your changes are going to get blown away. And because changes to these files don’t get documented when updates are released, you really need to start again and modify the new files sourced from the service pack/hotfix or risk OWA not working because of changes that have been made. Other problems you could have are that you need to have a replica of the public contact folder on the server that’s being uses for OWA. Also IE tends to cache this file so if you make an error modifying the script every time you make a change to the file you need to purge the file cache in IE (e.g. delete temporary internet files) so it will use the new version (It’s very easy to be fooled by this). You need to make sure you have got it right in a dev environment first and even then you may face problems with having the file cached by some clients.

I’ve put a downloadable copy of the 3 functions I modified and the 1 new function (you just need to add this at the bottom of the current script) here this is for illustration purposes only as I mentioned these files change regularly so if you do want to make changes you should make them yourself and understand what your doing. Also before you make any change, make sure you backup the existing dlg_gal.js file as this is your rollback plan.

---

Orginal article:

Glen's Exchange Dev Blog: Adding a public folder contact search option to OWA in Exchange 2003: "Adding a public folder contact search option to OWA in Exchange 2003
One of the new features (among others) in Exchange 2003 OWA is the ability for the user to now search their own contacts folder when using the address book find in OWA 2003. One other location that can be used to store contacts especially if you want to share contacts among users is in a contacts folder in a public folder tree. So I was asked to look at making this available to search in OWA like the contacts folders.

This brings up the first question of how can I customize OWA I went digging though some old whitepapers and found this one about customizing OWA 2000 which is mostly still relevant to Exchange 2003. The low down from this whitepaper is the core HTML used to render OWA is stored in the wmtemplates.dll file which means that you can�t really mess with it. There are some other warnings in this whitepaper about any changes made to the .js, htc or xml files used by OWA are unsupported. But further on they give you an example of modifying one of the script files used by OWA to change the NAV bar. Siegfried Webber also has a sample on his blog that shows how to add a button to the NAV bar in OWA 2003.

What I learnt from these two sources was that although you can�t modify the OWA core code directly the scripts that contain all the page events that OWA loads can be modified and the document object can be used to insert your own custom code back into what gets rendered to the client.

So the first thing I had to do is work out which script was being used when you click the address book in OWA. This is where Ethereal (or some other packet capture program) is invaluable. Doing a capture I could see that file dlg_gal.js which is in the exchweb/version/control"

Cisco - Adjusting IP MTU, TCP MSS, and PMTUD on Windows and Sun Systems

2005-05-27T23:00:00.000+02:00

Adjusting IP MTU, TCP MSS, and PMTUD on Windows and Sun Systems
Document ID: 13709

--------------------------------------------------------------------------------

Contents
Introduction
Before You Begin
Conventions
Prerequisites
Components Used
Problem Description and Possible Causes
TCP MSS Value
PMTUD Failure
Different LAN Media Types
"Dumbbell" Network Topology
Defective Links
How to Disable PMTUD and Configure a Smaller MTU/MSS on an End Node
Solaris 8 (and Previous Versions)
HP-UX 9.x, 10.x, and 11.x
IBM AIX Unix
Windows 95/98/ME
Windows NT 3.1/3.51
Windows NT 4.0
Windows 2000/XP
Related Information

--------------------------------------------------------------------------------

Introduction
This technical tip provides examples of configuring nodes to adjust the IP Maximum Transmission Unit (MTU), TCP Maximum Segment Size (MSS), and IP Path MTU Discovery (PMTUD) on Solaris 8 (and previous versions), HP-UX 9.x, 10.x, 11.x, Windows 95/98/ME, Windows NT 3.1/3.51, Windows NT 4.0, and Windows 2000/XP.

Before You Begin
Conventions
For more information on document conventions, see the Cisco Technical Tips Conventions.

Prerequisites
Due to network hardware malfunction, misconfiguration, or software defects, you might observe a condition where small TCP data transfers will work without problem, but large data transfers, ones with full-length packets, will hang and then time out. A workaround is to configure the sending nodes to do one or both of the following:

Disable PMTUD.

Reduce the maximum packet size by shrinking the TCP MSS and/or the IP MTU.

Components Used
This document is not restricted to specific software and hardware versions.

Problem Description and Possible Causes
Sometimes, over some IP paths, a TCP/IP node may send small amounts of data (typically less than 1500 bytes) with no difficulty, but transmission attempts with larger amounts of data hang, then time out. Often this is observed as a unidirectional problem: large data transfers succeed in one direction but fail in the other direction. This problem is likely caused by the TCP MSS value, PMTUD failure, different LAN media types, or defective links. These problems are described below:

TCP MSS Value
The TCP MSS value specifies the maximum amount of TCP data in a single IP datagram that the local system can accept (reassemble). The IP datagram may be fragmented into multiple packets when sent. Theoretically, this value could be as large as 65495, but such a large value is never used. Typically, an end system will use the "outgoing interface MTU" minus 40 as its reported MSS. For example, an Ethernet MSS value would be 1460 (1500 - 40 = 1460).

PMTUD Failure
PMTUD is an algorithm described in RFC 1191 and implemented in recent TCP/IP stacks. This algorithm attempts to discover the largest IP datagram that may be sent without fragmentation through an IP path and maximizes data transfer throughput.

PMTUD is implemented by having an IP sender set the "Don't Fragment" (DF) flag in the IP header. If an IP packet with this flag set reaches a router whose next-hop link has too small an MTU to send the packet without fragmentation, that router discards that packet and sends an ICMP "Fragmentation needed but DF set" error to the IP sender. When the IP sender receives this Internet Control Message Protocol (ICMP) message, it should learn to use a smaller IP MTU for packets sent to this destination, and subsequent packets should be able to get through.

Various problems can cause the PMTUD algorithm to fail, so that the IP sender will never learn the smaller path MTU but will continue unsuccessfully to retransmit the too-large packet, until the retransmissions time out. Some problems include the following:

The router with the too-small next hop path fails to generate the necessary ICMP error message.

Some router in the reverse path between the small-MTU router and the IP sender discards the ICMP error message before it can reach the IP sender.

Confusion in the IP sender's stack in which it ignores the received ICMP error message.

With the above problems, a workaround is to configure the IP sender to disable PMTUD. This causes the IP sender to send their datagrams with the DF flag clear. When the large packets reach the small-MTU router, that router fragments the packets into multiple smaller ones. The smaller, fragmented data reaches the destination where it is reassembled into the original large packet.

Different LAN Media Types
Two hosts on the same routed network, but on different LAN media types (Ethernet versus Token Ring and Fiber Distributed Data Interface (FDDI)) may act differently. The Ethernet attached systems may work correctly while the Token Ring and FDDI attached systems may fail. The reason for this failure is that the Ethernet system will report an MSS value of 1460 while the Token Ring and FDDI attached systems will report an MSS value around 4400. Since the remote server cannot exceed the reported MSS value from the other end, it may use smaller packets when communicating with the Ethernet attached system than it will when communicating with the Token Ring and FDDI attached system.

"Dumbbell" Network Topology
PMTUD problems are often seen in a "dumbbell" network topology (for example, a topology where the MTU of an interior link in the network path is less than that of the communicating hosts' interfaces). For example, if using an IP (generic routing encapsulation (GRE)) tunnel, the MTU of the tunnel interface will be less than that of the corresponding physical interface. If PMTUD fails due to ICMP filtering or host stack problems, then large packets will be unable to traverse the tunnel. (A workaround in Cisco IOS versions with CSCdk15279 integrated will be to increase the tunnel IP MTU to 1500B.)

Defective Links
Sometimes a router will have a link with a large (1500 byte) MTU, but the router is unable to deliver a datagram of that size over that link. That router will not return a "Fragmentation needed but DF set" ICMP error to the sender, because the link does not actually have a small MTU. However, large datagrams will be unable to pass through the link. Therefore, PMTUD will not help, and all large-packet transmission attempts through this link will fail.

Sometimes this is due to a lower layer problem with the link, such as a Frame Relay circuit with a too-small MTU and too little buffering, a malfunctioning channel service unit/data service unit (CSU/DSU) or repeater, an out-of-spec cable, or a software or firmware defect.

Listed below are related software defects.

CSCdj11304 ( registered customers only)

CSCdi75411 ( registered customers only)

CSCdj74245 ( registered customers only)

Another lower layer problem with the link is caused by using a substandard FDDI-to-Ethernet bridge that is incapable of performing IP-layer fragmentation. A workaround may be to configure a smaller MTU on the router interfaces attached to the problematic link. This may, however, not be an option, and may not be fully effective. You may want to configure a smaller MTU, 1500 for example, on the IP end nodes, as described in the next section.

How to Disable PMTUD and Configure a Smaller MTU/MSS on an End Node
The following examples set an IP MTU of 1500 or a TCP MSS of 1460 for Solaris 8 (and previous versions), HP-UX 9.x, 10.x, and 11.x, Windows 95/98/ME, Windows NT 3.1/3.51, Windows NT 4.0 and Windows 2000/XP. Setting an IP MTU value of 1500 and a TCP MSS value of 1460 generally produces the same effect because a TCP segment normally comes in 40 bytes of an IP/TCP header.

Note: If you change the interface MTU (router or end node) then all systems connected to the same broadcast domain (wire and hub) must run the same MTU. If two systems on the same broadcast domain do not use the same MTU value, they will have trouble communicating when packets (larger than the small MTU but smaller than the big MTU) are sent from the system with the larger MTU to the system with the smaller MTU.

Solaris 8 (and Previous Versions)
Disable PMTUD:

$ ndd -set /dev/ip ip_path_mtu_discovery 0

Set Maximum MSS to 1460:

$ ndd -set /dev/tcp tcp_mss_max 1460

Source: The TCP/IP Illustrated: The Protocols, Vol. 1, Appendix E, by W. Richard Stevens and Gary R. Wright.

HP-UX 9.x, 10.x, and 11.x
Disable PMTUD:

HP-UX 9.X does not support Path MTU discovery.

HP-UX 10.00, 10.01, 10.10, 10.20, and 10.30 support Path MTU discovery. It is on (1) by default for TCP, and off (0) by default for UDP. On/Off can be toggled with the nettune command.

# nettune -s tcp_pmtu 0

# nettune -s udp_pmtu 0

HP-UX 11 supports PMTU discovery and enables it by default. This is controlled through the ndd setting ip_pmtu_strategy command.

# ndd -h ip_pmtu_strategy 0

Set the Path MTU Discovery strategy: 0 disables Path MTU Discovery; 1 enables Strategy 1; 2 enables Strategy 2. For further information, use the ndd -h command on an HP-UX 11 system.

Source: Hewlett Packard

Set Maximum MSS to 1460:

HP-UX 10.x:

# lanadmin -M 1460
/usr/sbin/lanadmin [-a] [-A station_addr] [-m] [-M mtu_size] [-R] [-s] [-S speed] NetMgmtID
-M mtu_size

Set the new MTU size of the interface corresponding to NetMgmtID. The mtu_size value must be within the link specific range, and you must have superuser privileges.

Source: The man page for HP-UX on version 10.2

HP-UX 11.x:

# ndd -set /dev/tcp tcp_mss_max 1460

For further information, please see the man page for ndd on an HP-UX 11 system.

IBM AIX Unix
Disable PMTUD:

Path MTU Discovery was added to AIX 4.2.1, default = off. From AIX 4.3.3 default = on.

# no -o tcp_pmtu_discover=0

Source: IBM

Set Maximum MSS:

For AIX 4.2.1 or later, tcp_mssdflt is only used if path MTU discovery is not enabled or path MTU discovery fails to discover a path MTU. Default: 512 bytes; Range: 1 to 1448.

# no -o tcp_mssdflt=1440

Only one value can be set even if there are several adapters with different MTU sizes. This change is a systemwide change.

Source: IBM

Windows 95/98/ME
Note: Modifying Windows 95's TCP/IP parameters involves editing the registry, which should only be attempted by experienced system administrators because mistakes can render the system unbootable. After making these registry changes, reboot to apply the changes.

Disable PMTUD:

Add the following registry value to the key:

Hkey_Local_Machine\System\CurrentControlSet\Services\VxD\MSTCP

PMTUDiscovery = 0 or 1

Data Type: DWORD

The above specifies whether Microsoft TCP/IP will attempt to perform path MTU discovery as specified in RFC 1191 . A "1" enables discovery while a "0" disables it. The default is 1.

Note: In Windows 98, the data type is a string value.

Set Interface MTUs to 1500:

The entries in this section must be added to the following registry key, where "n" represents the particular TCP/IP-to-network adapter binding.

Hkey_Local_Machine\System\CurrentControlSet\Services\Class\netTrans\000n

MaxMTU = 16-bit integer

Data Type: String

The above specifies the maximum size datagram IP that can pass to a media driver. Subnetwork Access Protocol (SNAP) and source routing headers (if used on the media) are not included in this value. For example, on an Ethernet network, MaxMTU will default to 1500. The actual value used will be the minimum of the value specified with this parameter and the size reported by the media driver. The default is the size reported by the media driver.

Source: Knowledge Base article Q158474 at Microsoft

Windows NT 3.1/3.51
Note: Modifying Windows NT's TCP/IP parameters involves editing the registry, which should only be attempted by experienced system administrators because mistakes can render the system unbootable. After making these registry changes, reboot to apply the changes.

Disable PMTUD:

PMTU discovery is enabled by default, but can be controlled by adding the following value to the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpip\parameters\EnablePMTUDiscovery

PMTU Discovery: 0 or 1 (Default = 1)

Data Type: DWORD

A "1" enables discovery while a "0" disables it. When PMTU discovery is disabled, a MTU of 1500 bytes is used for all non-local destination IP addresses. The TCP MSS=1460.

Source: Knowledge Base article Q136970 at Microsoft

Set Interface MTUs to 1500:

These parameters for TCP/IP are specific to individual network adapter cards. These appear under the following Registry path, where "adapterID" refers to the Services subkey for the specific adapter card:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adapterID\Parameters\Tcpip

MTU: REG_DWORD (Number in octets)

Default: 0 (That is, use the value supplied by the adapter.)

The above specifies the MTU size of an interface. Each interface used by TCP/IP may have a different MTU value specified. The MTU is usually determined through negotiation with the lower driver, using that lower drivers value; however, that value may be overridden.

RouterMTU REG_DWORD Number in octets

Default: 0 (That is, use the value supplied by the lower interface.)

The above specifies the MTU size that should be used when the destination IP address is on a different subnet. Each interface used by TCP/IP may have a different RouterMTU value specified. In many implementations, the value of RouterMTU is set to 576 octets. This is the minimum size that must be supported by any IP node. Because newer routers can usually handle MTUs larger than 576 octets, the default value for this parameter is the same value as that used by MTU.

Source: Knowledge Base article Q102973 at Microsoft

Windows NT 4.0
Note: Modifying Windows NT's TCP/IP parameters involves editing the registry, which should only be attempted by experienced system administrators because mistakes can render the system unbootable. After making these registry changes, reboot to apply the changes.

Disable PMTUD:

PMTU discovery is enabled by default, but can be controlled by adding the following value to the registry:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\EnablePMTUDiscovery

PMTU Discovery: 0 or 1 (Default = 1)

Data Type: DWORD

A "1" enables discovery while a "0" disables it. When PMTU discovery is disabled, a MTU of 1500 bytes is used for all non-local destination IP addresses. The TCP MSS=1460.

Setting this parameter to 1 (True) causes TCP to attempt to discover the Maximum Transmission Unit (MTU or largest packet size) over the path to a remote host. By discovering the Path MTU and limiting TCP segments to this size, TCP can eliminate fragmentation at routers along the path that connect networks with different MTUs. Fragmentation adversely affects TCP throughput and network congestion.

Set Interface MTUs to 1500:

These parameters for TCP/IP are specific to individual network adapter cards. These appear under the following Registry path, where "adapterID" refers to the Services subkey for the specific adapter card:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\AdapterID\Tcpip\Parameters

MTU: Set it to equal the required MTU size in decimal (default 1500)

Data Type: DWORD

This parameter overrides the default MTU for a network interface. The MTU is the maximum packet size in bytes that the transport will transmit over the underlying network. The size includes the transport header. Note that an IP datagram may span multiple packets. Values larger than the default for the underlying network will result in the transport using the network default MTU. Values smaller than 68 will result in the transport using an MTU of 68.

Source: Knowledge Base article Q120642 at Microsoft

Windows 2000/XP
Note: Modifying Windows NT's TCP/IP parameters involves editing the registry, which should only be attempted by experienced system administrators because mistakes can render the system unbootable. After making these registry changes, reboot to apply the changes.

Disable PMTUD:

PMTU discovery is enabled by default, but can be controlled by adding the following value to the registry:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\EnablePMTUDiscovery

PMTU Discovery: 0 or 1 (Default = 1)

Data Type: DWORD

A "1" enables discovery while a "0" disables it. When PMTU discovery is disabled, a MTU of 1500 bytes is used for all non-local destination IP addresses. The TCP MSS=1460.

Setting this parameter to 1 (True) causes TCP to attempt to discover the Maximum Transmission Unit (MTU or largest packet size) over the path to a remote host. By discovering the Path MTU and limiting TCP segments to this size, TCP can eliminate fragmentation at routers along the path that connect networks with different MTUs. Fragmentation adversely affects TCP throughput and network congestion.

Set Interface MTUs to 1500:

These parameters for TCP/IP are specific to individual network adapter cards. These appear under the following Registry path, where "adapter ID" refers to the Services subkey for the specific adapter card:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\ Interfaces\[Adapter ID]

MTU: Set it to equal the required MTU size in decimal (default 1500)

Data Type: DWORD

This parameter overrides the default MTU for a network interface. The MTU is the maximum packet size in bytes that the transport will transmit over the underlying network. The size includes the transport header. Note that an IP datagram may span multiple packets. Values larger than the default for the underlying network will result in the transport using the network default MTU. Values smaller than 68 will result in the transport using an MTU of 68.

Source: Knowledge Base article Q314053 at Microsoft

----

Orginal artikel:
Cisco - Adjusting IP MTU, TCP MSS, and PMTUD on Windows and Sun Systems: "MSS"

TCP/IP and NBT configuration parameters for Windows XP

2005-05-27T22:59:00.000+02:00

TCP/IP and NBT configuration parameters for Windows XP
View products that this article applies to.
Article ID : 314053
Last Review : October 26, 2004
Revision : 1.0
This article was previously published under Q314053
Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry

For a Microsoft Windows 2000 version of this article, see 120642.
On this page
INTRODUCTION
MORE INFORMATION
Standard parameters that you can configure by using Registry Editor
Optional parameters that you can configure by using Registry Editor
Parameters that are configurable from the properties of a network connection
Non-configurable parameters
NBT
APPLIES TO

INTRODUCTION
This article defines all the registry parameters that are used to configure the protocol driver, Tcpip.sys. Tcpip.sys implements the standard TCP/IP network protocols.

The TCP/IP protocol suite implementation for Windows XP reads all its configuration data from the registry. This information is written to the registry by the Network tool in Control Panel as part of the Setup process. Some of this information is also supplied by the Dynamic Host Configuration Protocol (DHCP) Client service if the DHCP Client service is enabled.

The implementation of the protocol suite should perform correctly and efficiently in most environments by using only the configuration information that is gathered by DHCP and by the Network tool in Control Panel. Optimal default values for all other configurable aspects of the protocols have been encoded in the drivers.

There may be some unusual circumstances in customer installations where changes to certain default values are appropriate. To handle these cases, optional registry parameters can be created to modify the default behavior of some parts of the protocol drivers.

Caution The Windows XP TCP/IP implementation is largely self-tuning. Adjusting registry parameters without careful study may reduce your computer's performance.
Back to the top

MORE INFORMATION
Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To change these parameters, follow these steps: 1. Click Start, click Run, and then type regedit in the Open box.
2. Locate the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
3. Click Add Value on the Edit menu, type the value the value that you want, and then set the value type under Data Type.
4. Click OK.
5. Quit Registry Editor.
6. Restart the computer to make the change take effect.
all the TCP/IP parameters are registry values that are located under one of two different subkeys of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
Tcpip\Parameters
Tcpip\Parameters\Interfaces\ID for Adapter
NoteID for Adapter is the network adapter that TCP/IP is bound to. To determine the relationship between an Adapter ID and a network connection, view HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\\Connection. The Name value in these keys provides the friendly name for a network connection that is used in the Network Connections folder. Values under these keys are specific to each adapter. Parameters that have a DHCP configured value and a statically configured value may or may not exist. Their existence depends on whether the computer or the adapter is DHCP configured and whether static override values are specified. You must restart the computer for a change to take effect.
Standard parameters that you can configure by using Registry Editor
The following parameters are installed with default values by the Network tool in Control Panel during the installation of the TCP/IP components. You can use Registry Editor to modify them.

DatabasePath
Key: Tcpip\Parameters
Value Type: REG_EXPAND_SZ - Character string
Valid Range: A valid Windows NT file path
Default: %SystemRoot%\System32\Drivers\Etc
Description: This parameter specifies the path of the standard Internet database files (HOSTS, LMHOSTS, NETWORKS, PROTOCOLS). It is used by the Windows Sockets interface.
ForwardBroadcasts
Key: Tcpip\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0 or 1 (False or True)
Default: 0 (False)
Description: Forwarding of broadcasts is not supported. This parameter is ignored.
UseZeroBroadcast
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_DWORD - Boolean
Valid Range: 0 or 1 (False or True)
Default: 0 (False)
Description: If this parameter is set to 1 (True), the IP will use zeros-broadcasts (0.0.0.0) instead of ones-broadcasts (255.255.255.255). Most computers use ones-broadcasts, but some computers that are derived from BSD implementations use zeros-broadcasts. Computers that use different broadcasts do not interoperate well on the same network.
Optional parameters that you can configure by using Registry Editor
Generally, these parameters do not exist in the registry. You can create them to modify the default behavior of the TCP/IP protocol driver.

ArpAlwaysSourceRoute
Key: Tcpip\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0,1 (False or True)
Default: 0 (False)
Description: If you set this parameter to 1, TCP/IP transmits ARP queries with source routing enabled on Token Ring networks. By default, the stack transmits ARP queries without source routing first and retries with source routing enabled if no reply was received.
ArpUseEtherSNAP
Key: Tcpip\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0,1 (False or True)
Default: 0 (False)
Description: If you set this parameter to 1, TCP/IP transmits Ethernet packets using 802.3 SNAP encoding. By default, the stack transmits packets in DIX Ethernet format. It will always receive both formats.
DefaultTTL
Key: Tcpip\Parameters
Value Type: REG_DWORD - Number of
seconds/hops
Valid Range: 1-255
Default: 128 for Windows XP
Description: This parameter specifies the default Time To Live (TTL) value that is set in the header of outgoing IP packets. The TTL determines the maximum time that an IP packet can live in the network without reaching its destination. It is effectively a limit on the number of routers an IP packet can pass through before it is discarded.
EnableDeadGWDetect
Key: Tcpip\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0,1 (False, True)
Default: 1 (True)
Description: If you set this parameter to 1, TCP uses the Dead Gateway Detection feature. With this feature, TCP requests IP to change to a backup gateway if it retransmits a segment several times without receiving a response. Backup gateways may be defined in the Advanced section of the TCP/IP configuration dialog box in the Network Control Panel.
EnablePMTUBHDetect
Key: Tcpip\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0,1 (False, True)
Default: 0 (False)
Description: If you set this parameter to 1 (True), TCP tries to detect "Black Hole" routers while doing Path MTU Discovery. A "Black Hole" router does not return ICMP Destination Unreachable messages when it must fragment an IP datagram with the Don't Fragment bit set. TCP must receive these messages to perform Path MTU Discovery. With this feature enabled, TCP will try to send segments without the Don't Fragment bit set if several retransmissions of a segment are unacknowledged. If the segment is acknowledged, the MSS will be decreased and the Don't Fragment bit will be set in future packets on the connection. Enabling black hole detection increases the maximum number of retransmissions that are performed for a particular segment.
EnablePMTUDiscovery
Key: Tcpip\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0,1 (False, True)
Default: 1 (True)
Description: If you set this parameter to 1 (True), TCP tries to discover the Maximum Transmission Unit (MTU or largest packet size) over the path to a remote host. By discovering the Path MTU and limiting TCP segments to this size, TCP can eliminate fragmentation at routers along the path that connect networks with different MTUs. Fragmentation adversely affects TCP throughput and causes network congestion. If you set this parameter to 0, an MTU of 576 bytes is used for all connections that are not to computers on the local subnet.
ForwardBufferMemory
Key: Tcpip\Parameters
Value Type: REG_DWORD - Number of bytes
Valid Range: network MTU - some reasonable
value smaller than 0xFFFFFFFF
Default: 74240 (sufficient for fifty 1480-byte
packets, rounded to a multiple of 256)
Description: This parameter determines how much memory IP allocates to store packet data in the router packet queue. When this buffer space is filled, the router starts to discard packets at random from its queue. Packet queue data buffers are 256 bytes in length. Therefore, the value of this parameter must be a multiple of 256. Multiple buffers are chained together for larger packets. The IP header for a packet is stored separately. This parameter is ignored and no buffers are allocated if the IP router is not enabled.
IGMPLevel
Key: Tcpip\Parameters
Value Type: REG_DWORD - Number
Valid Range: 0,1,2
Default: 2
Description: This parameter determines how well the computer supports IP multicasting and participates in the Internet Group Management Protocol. At level 0, the computer provides no multicast support. At level 1, the computer can only send IP multicast packets. At level 2, the computer can send IP multicast packets and fully participate in IGMP to receive multicast packets.
KeepAliveInterval
Key: Tcpip\Parameters
Value Type: REG_DWORD - Time in milliseconds
Valid Range: 1 - 0xFFFFFFFF
Default: 1000 (one second)
Description: This parameter determines the interval that separates keepalive retransmissions until a response is received. After a response is received, KeepAliveTime again controls the delay until the next keepalive transmission. The connection is aborted after the number of retransmissions that are specified by TcpMaxDataRetransmissions are unanswered.
KeepAliveTime
Key: Tcpip\Parameters
Value Type: REG_DWORD - Time in milliseconds
Valid Range: 1 - 0xFFFFFFFF
Default: 7,200,000 (two hours)
Description: The parameter controls how frequently TCP tries to verify that an idle connection is still intact by sending a keepalive packet. If the remote computer is still reachable and functioning, the remote computer acknowledges the keepalive transmission. By default, keepalive packets are not sent. A program can turn on this feature on a connection.
MTU
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_DWORD Number
Valid Range: 68 - the MTU of the underlying network
Default: 0xFFFFFFFF
Description: This parameter overrides the default Maximum Transmission Unit (MTU) for a network interface. The MTU is the maximum packet size in bytes that the transport transmits over the underlying network. The size includes the transport header. An IP datagram can span multiple packets. Values larger than the default value for the underlying network cause the transport to use the network default MTU. Values smaller than 68 cause the transport to use an MTU of 68.
NumForwardPackets
Key: Tcpip\Parameters
Value Type: REG_DWORD Number
Valid Range: 1 - some reasonable value
smaller than 0xFFFFFFFF Default: 50
Description: This parameter determines the number of IP packet headers that are allocated for the router packet queue. When all headers are in use, the router begins to discard packets at random from the queue. This value should be at least as large as the ForwardBufferMemory value divided by the maximum IP data size of the networks that are connected to the router. This value must be no larger than the ForwardBufferMemory value divided by 256 because at least 256 bytes of forward buffer memory are used for each packet. The optimal number of forward packets for a particular ForwardBufferMemory size depends on the type of traffic that is carried on the network and will be somewhere between these two values. This parameter is ignored and no headers are allocated if the router is not enabled.
TcpMaxConnectRetransmissions
Key: Tcpip\Parameters
Value Type: REG_DWORD - Number
Valid Range: 0 - 0xFFFFFFFF
Default: 2
Description: This parameter determines the number of times that TCP retransmits a connect request (SYN) before aborting the attempt. The retransmission timeout is doubled with each successive retransmission in a particular connect attempt. The initial timeout value is three seconds.
Back to the top

TcpMaxDataRetransmissions
Key: Tcpip\Parameters
Value Type: REG_DWORD - Number
Valid Range: 0 - 0xFFFFFFFF
Default: 5
Description: This parameter controls the number of times that TCP retransmits an individual data segment (non-connect segment) before it aborts the connection. The retransmission timeout is doubled with each successive retransmission on a connection. It is reset when responses resume. The base timeout value is dynamically determined by the measured round-trip time on the connection.
TcpNumConnections
Key: Tcpip\Parameters
Value Type: REG_DWORD - Number
Valid Range: 0 - 0xfffffe
Default: 0xfffffe
Description: This parameter limits the maximum number of connections that TCP can have open at the same time.
TcpTimedWaitDelay
Key: Tcpip\Parameters
Value Type: REG_DWORD - Time in seconds
Valid Range: 30-300 (decimal)
Default: 0xF0 (240 decimal)
Description: This parameter determines the time that a connection stays in the TIME_WAIT state when it is closing. While a connection is in the TIME_WAIT state, the socket pair cannot be re-used. This is also known as the "2MSL" state. According to RFC, the value should be two times the maximum segment lifetime on the network. See RFC793 for more details.
Back to the top

TcpUseRFC1122UrgentPointer
Key: Tcpip\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0,1 (False, True)
Default: 0 (False)
Description: This parameter determines whether TCP uses the RFC 1122 specification for urgent data or the mode that is used by BSD-derived computers. The two mechanisms interpret the urgent pointer in the TCP header and the length of the urgent data differently. They are not interoperable. By default, Windows XP uses the BSD mode.
TcpWindowSize
Key: Tcpip\Parameters
Value Type: REG_DWORD - Number of bytes
Valid Range: 0 - 0xFFFF
Default: The smaller of 0xFFFF
OR
(The larger of four times the maximum TCP data size on the network
OR
8192 rounded up to an even multiple of the network TCP data size.)
The default is 8760 for Ethernet.
Description: This parameter determines the maximum TCP receive window size of the computer. The receive window specifies the number of bytes a sender can transmit without receiving an acknowledgment. Generally, larger receive windows improve performance over high (delay * bandwidth) networks. For highest efficiency, the receive window must be an even multiple of the TCP Maximum Segment Size (MSS).
Parameters that are configurable from the properties of a network connection
The following parameters are created and modified automatically by the connection properties interface through user-supplied information. You do not have to configure them directly in the registry.

DefaultGateway
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_MULTI_SZ - List of dotted decimal IP addresses
Valid Range: Any set of valid IP addresses
Default: None
Description: This parameter specifies the list of gateways to route packets that are not destined for a subnet that the computer is directly connected to and that do not have a more specific route. This parameter overrides the DhcpDefaultGateway parameter.
Domain
Key: Tcpip\Parameters
Value Type: REG_SZ - Character string
Valid Range: Any valid DNS domain name
Default: None
Description: This parameter specifies the DNS domain name of the computer. It is used by the Windows Sockets interface.
EnableDhcp
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_DWORD - Boolean
Valid Range: 0 or 1 (False or True)
Default: 0 (False)
Description: If this parameter is set to 1 (True), the DHCP client service tries to use DHCP to configure the first IP interface on the adapter.
Hostname
Key: Tcpip\Parameters
Value Type: REG_SZ - Character string
Valid Range: Any valid DNS hostname
Default: The computer name of the computer
Description: This parameter specifies the DNS hostname of the computer that will be returned by the hostname command.
IPAddress
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_MULTI_SZ - List of dotted- decimal IP addresses
Valid Range: Any set of valid IP addresses
Default: None
Description: This parameter specifies the IP addresses of the IP interfaces to be bound to the adapter. If the first address in the list is 0.0.0.0, the primary interface on the adapter will be configured from DHCP. A computer with more than one IP interface for an adapter is known as "logically multihomed." There must be a valid subnet mask value in the SubnetMask parameter for each IP address that is specified in this parameter.
IPEnableRouter
Key: Tcpip\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0 or 1 (False or True)
Default: 0 (False)
Description: Setting this parameter to 1 (True) causes the computer to route IP packets between the networks that it is connected to.
NameServer
Key: Tcpip\Parameters
Value Type: REG_SZ - A space delimited list of dotted decimal IP addresses
Valid Range: Any set of valid IP address
Default: None (Blank)
Description: This parameter specifies the DNS name servers to be queried by Windows Sockets to resolve names.
SearchList
Key: Tcpip\Parameters
Value Type: REG_SZ - Delimited list of DNS domain name suffixes
Valid Range: Any set of valid DNS domain name suffixes
Valid Range: Any set of valid DNS domain name suffixes
Default: None
Description: This parameter specifies a list of domain name suffixes to append to a name to be resolved by the DNS if resolution of the unadorned name fails. By default, the value of the Domain parameter is appended only. This parameter is used by the Windows Sockets interface.
SubnetMask
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_MULTI_SZ - List of dotted decimal IP addresses
Valid Range: Any set of valid IP addresses.
Default: None
Description: This parameter specifies the subnet masks to be used with the IP interfaces bound to the adapter. If the first mask in the list is 0.0.0.0, the primary interface on the adapter will be configured by DHCP. There must be a valid subnet mask value in this parameter for each IP address that is specified in the IPAddress parameter.
Non-configurable parameters
The following parameters are created and used internally by the TCP/IP components. They should never be modified by using Registry Editor. They are listed here for reference only.

DhcpDefaultGateway
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_MULTI_SZ - List of dotted decimal IP addresses
Valid Range: Any set of valid IP addresses
Default: None
Description: This parameter specifies the list of default gateways to route packets that are not destined for a subnet that the computer is directly connected to, and that do not have a more specific route. This parameter is written by the DHCP client service, if enabled. This parameter is overridden by a valid DefaultGateway parameter value.
DhcpIPAddress
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_SZ - Dotted decimal IP address
Valid Range: Any valid IP address
Default: None
Description: This parameter specifies the DHCP-configured IP address for the interface. If the IPAddress parameter contains a first value other than 0.0.0.0, that value will override this parameter.
DhcpNameServer
Key: Tcpip\Parameters
Value Type: REG_SZ - A space delimited list of dotted decimal IP addresses
Valid Range: Any set of valid IP address
Default: None
Description: This parameter specifies the DNS name servers to be queried by Windows Sockets to resolve names. It is written by the DHCP client service, if enabled. The NameServer parameter overrides this parameter.
DhcpServer
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_SZ - Dotted decimal IP address
Valid Range: Any valid IP address
Default: None
Description: This parameter specifies the IP address of the DHCP server that granted the lease on the IP address in the DhcpIPAddress parameter.
DhcpSubnetMask
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_SZ - Dotted decimal IP subnet mask
Valid Range: Any subnet mask that is valid for the configured IP address
Default: None
Description: This parameter specifies the DHCP-configured subnet mask for the address that is specified in the DhcpIPAddress parameter.
IPInterfaceContext
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_DWORD
Valid Range: 0 - 0xFFFFFFFF
Default: None
Description: This parameter is written by the TCP/IP driver for use by the DHCP client service.
Lease
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_DWORD - Time in seconds
Valid Range: 1 - 0xFFFFFFFF
Default: None
Description: This parameter is used by the DHCP client service to store the time (in seconds) that the lease on the IP address for this adapter is valid for.
LeaseObtainedTime
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_DWORD - Absolute time in seconds since midnight of 1/1/70
Valid Range: 1 - 0xFFFFFFFF
Default: None
Description: This parameter is used by the DHCP client service to store the time that the lease on the IP address for this adapter obtained.
LeaseTerminatesTime
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_DWORD - Absolute time in seconds since midnight of 1/1/70
Valid Range: 1 - 0xFFFFFFFF
Default: None
Description: This parameter is used by the DHCP client service to store the time that the lease on the IP address for this adapter expires.
LLInterface
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_SZ - NT device name
Valid Range: A valid NT device name
Default: Empty string (Blank)
Description: This parameter is used to direct IP to bind to a different link-layer protocol than the built-in ARP module. The value of the parameter is the name of the Windows NT-based device that IP should bind to. This parameter is used in conjunction with the RAS component, for example.
T1
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_DWORD - Absolute time in seconds since midnight of 1/1/70
Valid Range: 1 - 0xFFFFFFFF
Default: None
Description: This parameter is used by the DHCP client service to store the time that the service will first try to renew the lease on the IP address for the adapter. To renew the lease, he service contacts the server that granted the lease.
T2
Key: Tcpip\Parameters\Interfaces\ID for Adapter
Value Type: REG_DWORD - Absolute time in seconds since midnight of 1/1/70
Valid Range: 1 - 0xFFFFFFFF
Default: None
Description: This parameter is used by the DHCP client service to store the time that the service will try to renew the lease on the IP address for the adapter. To renew the lease, the service broadcasts a renewal request. Time T2 should be reached only if the service was not able to renew the lease with the original server.
NBT
all the NBT parameters are registry values that are located under one of two different subkeys of
HKEY_LOCAL_MACHINE\computer\CurrentControlSet\Services

Netbt\Parameters
Netbt\Parameters\Interfaces\Tcpip_ID for Adapter
where ID for Adapter represents the network adapter that NBT is bound to. The relationship between an Adapter ID and Network Connection can be determined by examining HKEY_LOCAL_MACHINE\computer\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\ID for Adapter\Connection. The Name value in these keys provides the name that is used for a network connection used in the Network Connections folder. Values under the latter keys are specific to each adapter. If the computer is configured through DHCP, a change in parameters takes effect if the command ipconfig /renew is issued in a command shell. Otherwise, you must restart the computer for a change in any of these parameters to take effect.
Standard Parameters Configurable from Registry Editor
The following parameters are installed with default values by the Network tool in Control Panel during the installation of the TCP/IP components. They may be modified by using Registry Editor (Regedit.exe).

BcastNameQueryCount
Key: Netbt\Parameters
Value Type: REG_DWORD - Count
Valid Range: 1 to 0xFFFF
Default: 3
Description: This value determines the number of times NetBT broadcasts a query for a particular name without receiving a response.
BcastQueryTimeout
Key: Netbt\Parameters
Value Type: REG_DWORD - Time in milliseconds
Valid Range: 100 to 0xFFFFFFFF
Default: 0x2ee ( 750 decimal)
Description: This value determines the time interval between successive broadcast name queries for the same name.
CacheTimeout
Key: Netbt\Parameters
Value Type: REG_DWORD - Time in milliseconds
Valid Range: 60000 to 0xFFFFFFFF
Default: 0x927c0 ( 600000 milliseconds = 10 minutes)
Description: This value determines the time interval that names are cached for in the remote name table.
NameServerPort
Key: Netbt\Parameters
Value Type: REG_DWORD - UDP port number
Valid Range: 0 - 0xFFFF
Default: 0x89
Description: This parameter determines the destination port number that NetBT sends packets to that are related to name service, such as name queries and name registrations to WINS. The Microsoft WINS listens on port 0x89. NetBIOS name servers from other vendors can listen on different ports.
NameSrvQueryCount
Key: Netbt\Parameters
Value Type: REG_DWORD - Count
Valid Range: 0 - 0xFFFF
Default: 3
Description: This value determines the number of times NetBT sends a query to a WINS server for a specified name without receiving a response.
NameSrvQueryTimeout
Key: Netbt\Parameters
Value Type: REG_DWORD - Time in milliseconds
Valid Range: 100 - 0xFFFFFFFF
Default: 1500 (1.5 seconds)
Description: This value determines the time interval between successive name queries to WINS for a particular name.
SessionKeepAlive
Key: Netbt\Parameters
Value Type: REG_DWORD - Time in milliseconds
Valid Range: 60,000 - 0xFFFFFFFF
Default: 3,600,000 (1 hour)
Description: This value determines the time interval between keepalive transmissions on a session. Setting the value to 0xFFFFFFF disables keepalives.
Size/Small/Medium/Large
Key: Netbt\Parameters
Value Type: REG_DWORD
Valid Range: 1, 2, 3 (Small, Medium, Large)
Default: 1 (Small)
Description: This value determines the size of the name tables that are used to store local and remote names. Generally, Small is adequate. If the computer is acting as a proxy name server, the value is automatically set to Large to increase the size of the name cache hash table. Hash table buckets are sized as follows: Large: 256 Medium: 128 Small: 16
Optional Parameters Configurable from Registry Editor
These parameters generally do not exist in the registry. They may be created to modify the default behavior of the NetBT protocol driver.

BroadcastAddress
Key: Netbt\Parameters
Value Type: REG_DWORD - Four byte, little- endian encoded IP address
Valid Range: 0 - 0xFFFFFFFF
Default: The ones-broadcast address for each network.
Description: This parameter can be used to force NetBT to use a specific address for all broadcast name-related packets. By default, NetBT uses the ones-broadcast address that is appropriate for each net (that is, for a network of 11.101.0.0 with a subnet mask of 255.255.0.0, the subnet broadcast address would be 11.101.255.255). This parameter would be set, for example, if the network uses the zeros-broadcast address (set by using the UseZeroBroadcast TCP/IP parameter). The appropriate subnet broadcast address would then be 11.101.0.0 in the earlier example. This parameter would then be set to 0x0b650000. This parameter is global and is used on all subnets that NetBT is bound to.
EnableProxyRegCheck
Key: Netbt\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0 or 1 (False or True)
Default: 0 (False)
Description: If this parameter is set to 1 (True), the proxy name server sends a negative response to a broadcast name registration if the name is already registered with WINS or is in the proxy's local name cache with a different IP address. The hazard of enabling this feature is that it prevents a computer from changing its IP address as long as WINS has a mapping for the name. Therefore, it is disabled by default.
InitialRefreshT.O.
Key: Netbt\Parameters
Value Type: REG_DWORD - Time in milliseconds
Valid Range: 960000 - 0xFFFFFFF
Default: 960000 (16 minutes)
Description: This parameter specifies the initial update timeout used by NBT during name registration. NBT tries to contact the WINS servers at 1/8th of this time interval when it is first registering names. When it receives a successful registration response, that response contains the new update interval to use.
LmhostsTimeout
Key: Netbt\Parameters
Value Type: REG_DWORD - Time in milliseconds
Valid Range: 1000 - 0xFFFFFFFF
Default: 6000 (6 seconds)
Description: This parameter specifies the timeout value for LMHOSTS and DNS name queries. The timer has a granularity of the timeout value. Therefore, the actual timeout might be as much as two times the value.
MaxDgramBuffering
Key: Netbt\Parameters
Value Type: REG_DWORD - Count of bytes
Valid Range: 0 - 0xFFFFFFFF
Default: 0x20000 (128 Kb)
Description: This parameter specifies the maximum memory that NetBT dynamically allocates for all outstanding datagram sends. After this limit is reached, additional sends will fail because the available resources are not sufficient resources.
NodeType
Key: Netbt\Parameters
Value Type: REG_DWORD - Number
Valid Range: 1,2,4,8 (B-node, P-node, M-node, H-node)
Default: 1 or 8 based on the WINS server configuration
Description: This parameter determines what methods NetBT uses to register and resolve names. A B-node computer uses broadcasts. A P-node computer uses only point- to-point name queries to a name server (WINS). An M-node computer broadcasts first, and then queries the name server. An H-node computer queries the name server first, and then broadcasts. Resolution through LMHOSTS or DNS follows these methods. If this key is present, it will override the DhcpNodeType key. If neither key is present, the computer uses B-node if there are no WINS servers configured for the network. The computer uses H-node if there is at least one WINS server configured.
RandomAdapter
Key: Netbt\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0 or 1 (False or True)
Default: 0 (False)
Description: This parameter applies to a multihomed host only. If it is set to 1 (True), NetBT will randomly select the IP address to put in a name query response from all its bound interfaces. Frequently, the response contains the address of the interface that the query arrived on. This feature would be used by a server with two interfaces on the same network for load balancing.
RefreshOpCode
Key: Netbt\Parameters
Value Type: REG_DWORD - Number
Valid Range: 8, 9
Default: 8
Description: This parameter forces NetBT to use a specific opcode in name update packets. The specification for the NetBT protocol is somewhat ambiguous in this area. Although the default of 8 that is used by Microsoft implementations appears to be the intended value, some other implementations, such as those by Ungermann-Bass, use the value 9. Two implementations must use the same opcode to interoperate.
SingleResponse
Key: Netbt\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0 or 1 (False or True)
Default: 0 (False)
Description: This parameter applies to a multihomed host only. If this parameter is set to 1 (True), NBT will only supply an IP address from one of its bound interfaces in name query responses. By default, the addresses of all bound interfaces are included.
WinsDownTimeout
Key: Netbt\Parameters
Value Type: REG_DWORD - Time in milliseconds
Valid Range: 1000 - 0xFFFFFFFF
Default: 15,000 ( 15 seconds)
Description: This parameter determines the time that NBT waits before again trying to use WINS after it does not contact any WINS server. With this feature, computers that are temporarily disconnected from the network can proceed through boot processing without waiting to time out each WINS name registration or query individually.
Parameters Configurable from the Connection Properties
The following parameters can be set through the Connection Properties from the Network Connections folder. You do not have to configure them directly.

EnableDns
Key: Netbt\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0 or 1 (False or True)
Default: 0 (False)
Description: If this value is set to 1 (True), NBT queries the DNS for names that cannot be resolved by WINS, broadcast, or the LMHOSTS file.
EnableLmhosts
Key: Netbt\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0 or 1 (False or True)
Default: 1 (True)
Description: If this value is set to 1 (True), NBT searches the LMHOSTS file, if it exists, for names that cannot be resolved by WINS or broadcast. By default, there is no LMHOSTS file database directory (specified by Tcpip\Parameters\DatabasePath). Therefore, NBT takes no action. This value is written by the Advanced TCP/IP configuration under the Network tool in Control Panel.
EnableProxy
Key: Netbt\Parameters
Value Type: REG_DWORD - Boolean
Valid Range: 0 or 1 (False or True)
Default: 0 (False)
Description: If this value is set to 1 (True), the computer acts as a proxy name server for the networks that NBT is bound to. A proxy name server answers broadcast queries for names that it has resolved through WINS. With a proxy name server, a network of B-node implementations can connect to servers on other subnets that are registered with WINS.
NameServer
Key: Netbt\Parameters\Interfaces\Tcpip_ID for Adapter
Value Type: REG_SZ - Dotted decimal IP address (for example,11.101.1.200)
Valid Range: Any valid IP address
Default: blank ( no address )
Description: This parameter specifies the IP address of the primary WINS server. If this parameter contains a valid value, it overrides the DHCP parameter of the same name.
NameServerBackup
Key: Netbt\Parameters\Interfaces\Tcpip_ID for Adapter
Value Type: REG_SZ - Dotted decimal IP address (for example, 11.101.1.200)
Valid Range: Any valid IP address.
Default: blank ( no address )
Description: This parameter specifies the IP address of the backup WINS server. If this parameter contains a valid value, it overrides the DHCP parameter of the same name.
ScopeId
Key: Netbt\Parameters
Value Type: REG_SZ - Character string
Valid Range: Any valid DNS domain name consisting of two dot-separated parts, or a "*".
Default: None
Description: This parameter specifies the NetBIOS name scope for the node. This value must not start with a period. If this parameter contains a valid value, it will override the DHCP parameter of the same name. A blank value (empty string) will be ignored. Setting this parameter to the value "*" indicates a null scope and will override the DHCP parameter.
Non-Configurable Parameters
The following parameters are created and used internally by the NetBT components. They should never be modified by using Registry Editor. They are listed here for reference only.

DhcpNameServer
Key: Netbt\Parameters\Interfaces\Tcpip_ID for Adapter
Value Type: REG_SZ - Dotted decimal IP address (for example, 11.101.1.200)
Valid Range: Any valid IP address
Default: None
Description: This parameter specifies the IP address of the primary WINS server. It is written by the DHCP client service, if enabled. A valid NameServer value will override this parameter.
DhcpNameServerBackup
Key: Netbt\Parameters\Interfaces\Tcpip_ID for Adapter
Value Type: REG_SZ - Dotted decimal IP address (for example, 11.101.1.200)
Valid Range: Any valid IP address
Default: None
Description: This parameter specifies the IP address of the backup WINS server. It is written by the DHCP client service, if enabled. A valid BackupNameServer value will override this parameter.
DhcpNodeType
Key: Netbt\Parameters
Value Type: REG_DWORD - Number
Valid Range: 1 - 8
Default: 1
Description: This parameter specifies the NBT node type. It is written by the DHCP client service, if enabled. A valid NodeType value will override this parameter. See the entry for NodeType for a complete description.
DhcpScopeId
Key: Netbt\Parameters
Value Type: REG_SZ - Character string
Valid Range: a dot-separated name string such as "microsoft.com"
Default: None
Description: This parameter specifies the NetBIOS name scope for the node. It is written by the DHCP client service, if enabled. This value must not start with a period. See the entry for ScopeId for more information.
NbProvider
Key: Netbt\Parameters
Value Type: REG_SZ - Character string
Valid Range: _tcp
Default: _tcp
Description: This parameter is used internally by the RPC component. The default value should not be changed.
TransportBindName
Key: Netbt\Parameters
Value Type: REG_SZ - Character string
Valid Range: N/A
Default: \Device\
Description: This parameter is used internally during product development. The default value should not be changed.

---

Orginal artikel:
TCP/IP and NBT configuration parameters for Windows XP

PXE options with RIS

2005-05-06T19:57:00.000+02:00

Rembo Technology

How to set size limits for messages in Exchange Server

2005-05-06T12:29:00.000+02:00

How to set size limits for messages in Exchange Server

Problem med MAC OS X

2005-05-06T08:39:00.000+02:00

Nedanstående är lösningar på problem med MAC OS X (10.3.9)

Login windows forever (user cannot logon)
1. Remove files
/Library/Preferences/com.apple.loginwindow.plist
/Library/Preferences/com.apple.windowserver.plist

2. Run "full automation" in OnyX to delete system caches
Download on: Titanium Software

3. Reboot

Disk mount problem (error "" when mounting .dmg-files)
1. Remove the following files:
/System/Library/Extensions.kextcache (file)
/System/Library/Extensions.mkext (file)
/System/Library/Caches/com.apple.kernelcaches (folder)

JoeWare - All Tools

2005-04-29T06:07:00.000+02:00

A good collection of different tools;
AccExp - Account expiration tool.
AdFind - Active Directory query tool.
AdMod - Active Directory modification tool.
ATSN - IP to Subnet/Site Information tool.
Auth - Authentication test tool.
ChangePW - Administrative password set utility.
ClientTest - GUI socket test tool.
CPAU - Create process as another user.
ELDLL - Event log resource DLL.
ELDLLEx - Event log resource DLL pair, see docs.
ExchMbx - Exchange Mailbox command line tool.
Expire - Bulk password expiration tool.
FindExpAcc - Finds expired accounts and accounts with expired passwords.
FindNBT - Scans networks for Windows machines.
FindPDC - Verifies PDC can be located and responds properly.
GCChk - GC verifier, lingering object checker.
GetUserInfo - User information display tool.
LG - Local group manipulation tool.
MemberOf - Display user's group memberships.
NetSess - Session enumeration tool.
OldCmp - Old User/Computer maintenance tool.
Quiet - Launches processes in background.
SecData - Display security info about users/computers.
SecTok - Enumerate groups in security token.
SeInteractiveLogonRight - Grant logon locally rights.
SidToName - Convert SIDs to user friendly names.
ShrFlgs - Configure share flags.
SNU - Network share connection tool, primarily for monitoring scripts.
SvcUtil - Service infomation display tool.
Unlock - AD Domain unlock Tool.
UserDump - Dumps basic user info for all users on machine/domain.
UserName - Display current userid in multiple formats.
W2KLockDesktop - Lock desktop.
WriteProt - Write Protect arbitrary disk volumes.

Webpage:
All Tools

Recommendations for troubleshooting an Exchange Server computer with antivirus software installed

2005-04-27T07:00:00.000+02:00

Vad som inte skall scannas av FILE BASED virus scanner på Exchange server... (OBS! IIS är exkluderat).

MORE INFORMATION
File-Based Antivirus Software
You can install file-based scanning antivirus software on an Exchange computer. However, never run scanning against the program and database files of an Exchange computer.

In addition, never run scanning against the Installable File System (IFS) drive (drive M) of an Exchange 2000 server. If you do so, you might receive false reports of a virus and you might damage Exchange 2000 databases when you attempt to disinfect the file.

In Exchange 2000, drive M is a convenient label for the Exchange IFS. The Exchange IFS enables you to view and use the Exchange information store as a file system.

NOTE: Drive M can use a letter other than M. This drive is generally referred to as drive M; however, if the letter M is already being used, this drive uses another drive letter. For additional information about issues that are caused by antivirus scanning of drive M, click the following article number to view the article in the Microsoft Knowledge Base:
299046 Calendar items disappear from user's folders
298551 Large number of transaction logs created
In some situations, you may experience additional issues with the Exchange IFS. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
305145 How to remove the IFS mapping for drive M in Exchange 2000 Server
If you need to run a file-based virus scanner on an Exchange computer, remove the Exchange-specific files and folders from the scheduled scans and real-time scanning. File-based scanning of Exchange 2000 executable files is supported.

IMPORTANT: Never run file-based scanning software against Exchange databases, logs, temporary files, the IIS system files, or the IFS drive (drive M). Configure antivirus software to avoid scanning the folders that contain these files.

You can run file-based antivirus software against the operating system of the Exchange computer and against Exchange program files (the Exchsrvr\Bin folder), but never run file-based antivirus software against files in the following folders: • Exchange databases and log files.
• Exchange .mta files (default location: \Exchsrvr\Mtadata).
• Exchange message tracking log files (default location: \Exchsrvr\Server_Name.log).
• Virtual server folders (default location: \Exchsrvr\Mailroot).
• Site Replication Service (SRS) files (default location: \Exchsrvr\Srsdata).
• Internet Information Service (IIS) system files (default location: \%SystemRoot%\System32\Inetsrv).
• Internet Mail Connector files (default location: \Exchsrvr\IMCData).
• The working folder that is used to store streaming temporary files that are used for message conversion. By default, this working folder is located at \Exchsrvr\MDBData.
• A temporary folder that is used in conjunction with offline maintenance utilities such as Eseutil.exe. By default, this folder is the location that you run the .exe files from, but you can configure this when you run the utility.
You can run file-based scanning against the following folders: • Exchsrvr\Address
• Exchsrvr\Bin
• Exchsrvr\Exchweb
• Exchsrvr\Res
• Exchsrvr\Schema
Temporarily disable file-based scanning software during operating system and Exchange upgrades; this includes upgrading to new versions of Exchange or the operating system, and applying any Exchange or operating system fixes or service packs.

When you upgrade an Exchange or operating system product, or apply a service pack or fix, it is standard procedure to stop and disable all of the third-party services, hardware vendor and operating system monitors, and any agents or Exchange monitors before you perform the update or upgrade. Also stop and disable any performance monitors, any Microsoft or third-party backup programs, and Microsoft Simple Network Management Protocol (SNMP). Then restart the Exchange computer before you apply the upgrade or fix. This procedure prevents files that the update process needs to access from being locked.

IMPORTANT: This procedure also includes stopping and disabling any antivirus programs (including file-based scanning antivirus software) before you upgrade any version of Exchange or the operating system and before you apply any Exchange or operating system service pack or fix.
Exchange Information Store Scanning Software
Microsoft provides application programming interfaces (APIs) that give other manufacturers the ability to write antivirus programs that scan the information store. If this type of software is running on your Exchange computer and you are experiencing issues, research the issues and follow normal troubleshooting procedures. If these procedures do not resolve the issue, temporarily disable or remove the antivirus software to determine whether it is contributing to the issue. If the antivirus software is not contributing to the issue, you can re-enable the antivirus software.

If the issue stops occurring after you disable or remove the antivirus software, contact the manufacturer of the antivirus software for the most recent update. If the most recent update of the software does not resolve the issue, continue working with the antivirus software manufacturer and Microsoft to pursue a resolution to the issue.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
241855 Information Store does not start with event ID 145
The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

Exclude the folder that contains the checkpoint (.chk) files from file-based scanners.

NOTE: Even if you move the Exchange databases and log files to new locations, and you exclude those folders, the .chk file may still be scanned. For additional information about what may occur if the .chk file is scanned, click the following article number to view the article in the Microsoft Knowledge Base:
253111 Event: Unable to write a shadowed header for file
176239 Database won't start; circular logging deleted log file too soon

Recommendations for troubleshooting an Exchange Server computer with antivirus software installed: "MORE INFORMATION
File-Based Antivirus Software
You can install file-based scanning antivirus software on an Exchange computer. However, never run scanning against the program and database files of an Exchange computer.

In addition, never run scanning against the Installable File System (IFS) drive (drive M) of an Exchange 2000 server. If you do so, you might receive false reports of a virus and you might damage Exchange 2000 databases when you attempt to disinfect the file.

In Exchange 2000, drive M is a convenient label for the Exchange IFS. The Exchange IFS enables you to view and use the Exchange information store as a file system.

NOTE: Drive M can use a letter other than M. This drive is generally referred to as drive M; however, if the letter M is already being used, this drive uses another drive letter. For additional information about issues that are caused by antivirus scanning of drive M, click the following article number to view the article in the Microsoft Knowledge Base:
299046 Calendar items disappear from user's folders
298551 Large number of transaction logs created
In some situations, you may experience additional issues with the Exchange IFS. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
305145 How to remove the IFS mapping for drive M in Exchange 2000 Server
If you need to run a file-based virus scanner on an Exchange computer, remove the Exchange-specific files and folders from the scheduled scans and real-time scanning. File-based scanning of Exchange 2000 executable files is supported.

IMPORTANT: Never run file-based scanning software against Exchange databases, logs, temporary"

Virus scanning recommendations on a Windows 2000 or on a Windows Server 2003 domain controller

2005-04-27T06:40:00.000+02:00

Vad som ett antivirus program inte ska scanna på en Windows 2000/2003 domain controller.

MORE INFORMATION
Because domain controllers provide a critical service to clients, the risk of disruption of their activities as a result of malicious code from a virus must be minimized. Antivirus software is the generally accepted way to mitigate the risk of virus infection. Install and configure antivirus software so that the risk to the domain controller is reduced as much as possible and so that performance is affected as little as possible. The following list contains recommendations to help you configure and install antivirus software on a Windows 2000 or on a Windows Server 2003 domain controller:

Warning Microsoft recommends that you apply the following specified configuration to a test configuration to make sure that in your specific environment it does not introduce unexpected factors or compromise the stability of the system. The risk from too much scanning is that files are inappropriately flagged as having been changed, resulting in excessive replication on the Active Directory directory service. If testing verifies that replication is not affected by the following recommendations, you can apply the antivirus software to the production environment.

Note Specific recommendations from antivirus software vendors may supersede the recommendations in the article.• Antivirus software must be installed on all domain controllers in the enterprise. Ideally, try to install such software on all other server and client systems that have to interact with the domain controllers. It is optimal to catch the virus at the earliest point, such as at the firewall or at the client system where the virus is first introduced. This prevents the virus from ever reaching the infrastructure systems that the clients depend on.
• Use a version of antivirus software that is designed to work with Active Directory domain controllers and that uses the correct Application Programming Interfaces (APIs) to access files on the server. Older versions of most vendor software inappropriately modify file metadata as it is scanned, causing the File Replication Service engine to recognize a file change and therefore schedule the file for replication. Newer versions prevent this problem. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
815263 Antivirus, backup, and disk optimization programs that are compatible with the File Replication service
• Do not use a domain controller to browse the Web or to perform any other activities that may introduce malicious code.
• Where possible, do not use the domain controller as a file sharing server. Virus scanning software must be run against all files in those shares, and this can put an unsatisfactory load on the processor and the memory resources of the server
• Do not place Active Directory or FRS database and log files on NTFS file system compressed volumes.
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
318116 Issues with Jet Databases on compressed drives
• Do not scan the following files and folders. These files are not at risk of infection, and if you include them, this may cause serious performance problems because of file locking. Where a specific set of files is identified by name, exclude only those files instead of the whole folder. Sometimes, the whole folder must be excluded. Do not exclude any of these based on the file-name extension; for example, do not exclude all files with a .dit extension). Microsoft has no control over other files that may use the same extension as those shown here.

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.• Active Directory and Active Directory-related files: • Main NTDS database files. The location of these files is specified in the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File
The default location is %windir%\ntds. Exclude the following files:
Ntds.dit
Ntds.pat
• Active Directory transaction log files. The location of these files is specified in the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files Path
The default location is %windir%\ntds. Exclude the following files:
EDB*.log (the wildcard character indicates that there may be several files)
Res1.log
Res2.log
Ntds.pat
• The NTDS Working folder that is specified in the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory
Exclude the following files:
Temp.edb
Edb.chk

• SYSVOL files: • The File Replication Service (FRS) Working folder that is specified in the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory
Exclude the following files:
FRS Working Dir\jet\sys\edb.chk
FRS Working Dir\jet\ntfrs.jdb
FRS Working Dir\jet\log\*.log
• The FRS Database Log files that are located in the following registry key:
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\NtFrs\Parameters\DB Log File Directory
The default location is %windir%\ntfrs. Exclude the following files:
FRS Working Dir\jet\log\*.log (if registry key is not set)
DB Log File Directory\log\*.log (if registry key is set)
• The Staging folder that is specified in the following registry key and all of the Staging folder's sub-folders:
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage

The current location of the Staging folder and all of its sub-folders is the file system reparse target of the replica set staging folders. Staging defaults to the following location:

%systemroot%\sysvol\staging areas

The current location of the SYSVOL\SYSVOL folder and all of its sub-folders is the file system reparse target of the replica set root. The SYSVOL\SYSVOL folder defaults to the following location:

%systemroot%\sysvol\sysvol
• The FRS Preinstall folder that is in the following location:
Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory
The Preinstall folder is always open when FRS is running.

In summary, the targeted and excluded list of folders for a SYSVOL tree that is placed in its default location would look similar to the following:
1. %systemroot%\sysvol Exclude
2. %systemroot%\sysvol\domain Scan
3. %systemroot%\sysvol\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory Exclude
4. %systemroot%\sysvol\domain\Policies Scan
5. %systemroot%\sysvol\domain\Scripts Scan
6. %systemroot%\sysvol\staging Exclude
7. %systemroot%\sysvol\staging areas Exclude
8. %systemroot%\sysvol\sysvol Exclude

If any one of these folder or files have been moved or placed in a different location, scan or exclude the equivalent element.
• DFS

The same resources that are excluded for a SYSVOL replica set must also be excluded when FRS is used to replicate shares that are mapped to the DFS root and link targets on Windows 2000 or Windows Server 2003-based member computers or domain controllers.

----------------------------------

Orignal link from Microsoft
Virus scanning recommendations on a Windows 2000 or on a Windows Server 2003 domain controller: "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory"

Remote Exploit

2005-04-22T13:07:00.000+02:00

About
The Auditor security collection is a Live-System based on KNOPPIX. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes. Independent of the hardware in use, the Auditor security collection offers a standardised working environment, so that the build-up of know-how and remote support is made easier. Even during the planning and development stages, our target was to achieve an excellent user-friendliness combined with an optimal toolset. Professional open-source programs offer you a complete toolset to analyse your safety, byte for byte. In order to become quickly proficient within the Auditor security collection, the menu structure is supported by recognised phases of a security check. (Foot-printing, analysis, scanning, wireless, brute-forcing, cracking). By this means, you instinctively find the right tool for the appropriate task. In addition to the approx. 300 tools, the Auditor security collection contains further background information regarding the standard configuration and passwords, as well as word lists from many different areas and languages with approx. 64 million entries. Current productivity tools such as web browser, editors and graphic tools allow you to create or edit texts and pictures for reports, directly within the Auditor security platform. Many tools were adapted, newly developed or converted from other system platforms, in order to make as many current auditing tools available as possible on one CD-ROM. Tools like Wellenreiter and Kismet were equipped with an automatic hardware identification, thus avoiding irritating and annoying configuration of the wireless cards.

News - Rexploit

Sätta upp OWA passord byte på SBS server

2005-03-08T08:16:00.000+01:00

Sätta upp OWA passord byte på SBS server

En enkel guide:
Step 1:

Click on the Options Button to see if Password change option is active.

Screen shot of OWA without Password Option (You should see password button under Contact Options)

Screen shot of OWA with Password Option (Look under Contact Options)

Step 2:

Create the IISADMPWD Virtual Directory
Start the IIS (MMC) snap-in, right-click the Web site in which you want to create the virtual directory, point to New, and then click Virtual Directory.
In the Virtual Directory Creation Wizard, click NEXT

Type IISADMPWD in the Alias box, and then click NEXT.

In the Directory box, type C:\WINDOWS\system32\inetsrv\iisadmpwd
and then click NEXT.
Note: Where C is the drive on which Windows is installed.

Click to select the following check boxes (if they are not already selected):

Read
Run scripts (such as ASP)
Click NEXT

Then click FINISH.

Step 2:

Right Click IISADMPWD, Properties
Click on Directory Security TAB
Under Authentication and access control click EDIT

Under Authentication Methods check Enable anonymous access
Under Authentication Methods check Integrated Windows authentication

Open a command prompt
Type CD C:\Inetpub\AdminScripts click ENTER
Type adsutil.vbs click ENTER

Click OK

Click YES

Click OK

Type cscript adsutil.vbs set w3svc/1/PasswordChangeFlags 0 ENTER

Type cd c:\inetpub\adminscripts ENTER

Step 3:

Secure Sockets Layer (SSL)

Right Click IISADMPWD, Properties

Click on Directory Security TAB
Under Secure communications click EDIT

Under Secure Communications check Require secure channel (SSL)
Under Secure Communications check Ignore client certificates
Click OK

Based on MS KB: http://support.microsoft.com/?id=327134

Right Click IISADMPWD, Properties

Click on Virtual Directory TAB

Check A directory located on this computer
Under Local Path:
Check Script source access
Check Read
Check Log visits
Check Index this resource
Under Application name: IISADMPWD
Under Execute permissions: Scripts only
Under Application pool: DefaultAppPool

Click on Directory Security TAB
Under IP address and domain name restrictions click Edit

Check Granted access
Click OK

Based on MS KB: http://support.microsoft.com/default.aspx?scid=kb;EN-US;315579

Based on MS KB: http://support.microsoft.com/default.aspx?scid=kb;en-us;306833

Step 4:

Edit Registry Key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeWEB\OWA

Open DisablePassword
Enter 0 Value data:
Click OK

Based on MS KB: http://support.microsoft.com/default.aspx?scid=kb;EN-US;297121

OWA_Password_Configuration - orginal article

How to grant "Send as" and "Send on behalf" permissions in Exchange 2000 Server

2004-12-22T07:57:00.000+01:00

Detta ser till att inte mottagaren kan se avsändarens address (t.ex. både user@company.com och support@company.com).

How to grant "Send as" and "Send on behalf" permissions in Exchange 2000 Server

Tool for Exchange Resource forest -- abridean: Automated User Management and Provisioning

2004-12-09T10:22:00.000+01:00

abridean: Automated User Management and Provisioning

You Cannot Generate an Offline Address List and an Event ID 9126 Error Message Is Logged

2004-11-21T08:14:00.000+01:00

You Cannot Generate an Offline Address List and an Event ID 9126 Error Message Is Logged

Kontrollera även att i Offline Address list att det inte är några ADDRESSLISTOR från Global Address lists (då får man samtliga entries i OAB).

Kontrollera också att det är rätt värde på msexchUseOAB på brukerobjektet som får fel OAB i cached outlook (2003).

Top Screenshot Tips

2004-09-27T14:47:00.000+02:00

Top Screenshot Tips: "Top Screenshot Tips
These screen-capture tips provide built-in and add-on solutions to just about anything you might wish to snap.
[Discuss (3) | Link to this hack]

Capturing good screenshots in Mac OS X requires some experimentation. If you simply want to capture the screen for reference later on, you can do it easily with the built-in screen-capture tool. However, if you are a professional writer or a student preparing that term paper and need great-looking screen shots, you have to spend a little more time exploring your options.
These screen capture tips provide built-in and add-on solutions to just about anything you might wish to snap.
Built-Ins
Mac OS X Jaguar comes with a built-in capability for capturing screenshots. To capture the entire screen, simply press command-Shift-3 and a PDF grab of your current view will appear on your desktop. Screenshots are numbered sequentially, such as Picture 1.pdf, Picture 2.pdf, and so on.
To capture a particular region of the screen, type command-Shift-4 and highlight � using click-and-drag � whatever portion of the screen you'd like.

Figure 1. Capturing a portion of the screen
An extension to region grabbing is snagging a picture of a particular window or dialog box. Press command-Shift-4, then the spacebar; any window you run your mouse over will be highlighted. Click to capture it. You can toggle back and forth between region and window modes by pressing the spacebar.
TIP
To change your mind and cancel screen capture, press the Escape (Esc) key on your keyboard.
While the built-in screen-capture tool is good enough for just about all purposes, it has a couple of drawbacks. It doesn't capture the mouse pointer in any of the screenshots � not even optionally. This is a bust for technical writers explaining the operation of menus,"

Start SQL Server in Single User Mode

2004-09-24T06:39:00.000+02:00

How to start a named instance of SQL Server in single-user mode (Command Prompt)

Stop the MS SQL service (services.msc)
Drop to CMD
Go to the MS SQL server BIN folder
Run "sqlservr.exe -c - m -s {instancename}"

How to start the default instance of SQL Server in single-user mode (Command Prompt)

Stop the MS SQL service (services.msc)
Drop to CMD
Go to the MS SQL server BIN folder
Run "sqlservr.exe -c -m"

Startup Options for MS SQL server
When you install Microsoft® SQL Server™, SQL Server Setup writes a set of default startup options in the Microsoft Windows® 2000 registry. You can use these startup options to specify an alternate master database file, master database log file, or error log file.

-dmaster_file_ path
The fully qualified path for the master database file (typically, C:\Program Files\Microsoft SQL Server\MSSQL\Data\Master.mdf). If you do not provide this option, the existing registry parameters are used.

-eerror_log_ path
The fully qualified path for the error log file (typically, C:\Program Files\Microsoft SQL Server\MSSQL\Log\Errorlog). If you do not provide this option, the existing registry parameters are used.

-lmaster_log_path
The fully qualified path for the master database log file (typically C:\Program Files\Microsoft SQL Server\MSSQL\Data\Mastlog.ldf).
You can override the default startup options temporarily and start an instance of SQL Server by using the following additional startup options.

-c
Shortens startup time by starting an instance of SQL Server independently of the Service Control Manager, so that SQL Server does not run as a Microsoft Windows NT® 4.0 or Windows 2000 service.

-f
Starts an instance of SQL Server with minimal configuration. Useful if the setting of a configuration value (for example, over-committing memory) has prevented the server from starting. Enables the sp_configure allow updates option. By default, allow updates is disabled.

-g
Specifies the amount of virtual address space (in megabytes) SQL Server will leave available for memory allocations within the SQL Server process, but outside the SQL Server memory pool. This is the area used by SQL Server for loading items such as extended procedure .dll files, the OLE DB providers referenced by distributed queries, and automation objects referenced in Transact-SQL statements. The default is 256 megabytes (MB).
Use of this option may help tune memory allocation, but only when physical memory exceeds 2 gigabytes (GB) for the SQL Server 2000 Personal Edition or SQL Server 2000 Standard Edition, or 3 GB for SQL Server 2000 Enterprise Edition. Configurations with less physical memory will not benefit from using this option. Use of this option may be appropriate in large memory configurations in which the memory usage requirements of SQL Server are atypical and the virtual address space of the SQL Server process is totally in use. Incorrect use of this option can lead to conditions under which an instance of SQL Server may not start or may encounter run-time errors.

Use the default for the -g parameter unless you see the following warning in the SQL Server error log:
WARNING: Clearing procedure cache to free contiguous memory
This message may indicate that SQL Server is trying to free parts of the SQL Server memory pool in order to find space for items such as extended stored procedure .dll files or automation objects. In this case, consider increasing the amount of memory reserved by the -g switch. Using a value lower than the default will increase the amount of memory available to the buffer pool and thread stacks; this may, in turn, provide some performance benefit to memory-intensive workloads in systems that do not use many extended stored procedures, distributed queries, or automation objects.

-m
Starts an instance of SQL Server in single-user mode. When you start an instance of SQL Server in single-user mode, only a single user can connect, and the CHECKPOINT process is not started. CHECKPOINT guarantees that completed transactions are regularly written from the disk cache to the database device. (Typically, this option is used if you experience problems with system databases that should be repaired.) Enables the sp_configure allow updates option. By default, allow updates is disabled.

-n
Does not use the Windows application log to record SQL Server events. If you start an instance of SQL Server with -n, it is recommended that you use the -e startup option too; otherwise, SQL Server events are not logged.

-s
Allows you to start a named instance of SQL Server 2000. Without the -s parameter set, the default instance will attempt to start. You must switch to the appropriate BINN directory for the instance at a command prompt before starting sqlservr.exe. For example, if Instance1 were to use \mssql$Instance1 for its binaries, the user must be in the \mssql$Instance1\binn directory to start sqlservr.exe-sinstance1.

/Ttrace#
Indicates that an instance of SQL Server should be started with a specified trace flag (trace#) in effect. Trace flags are used to start the server with nonstandard behavior.

-x
Disables the keeping of CPU time and cache-hit ratio statistics. Allows maximum performance.

Important
When specifying a trace flag with the /T option, use an uppercase "T" to pass the trace flag number. A lowercase "t" is accepted by SQL Server, but this sets other internal trace flags that are required only by SQL Server support engineers. (Parameters specified in the Control Panel startup window are not read.)

apachefriends.org - xampp

2004-09-21T07:01:00.000+02:00

Nice and quick solution for bringing up a test environment quickly. Keep up the good work.

apachefriends.org - xampp

Microsoft Exchange Server: Exchange Intelligent Message Filter

2004-07-27T08:46:00.001+02:00

Microsoft Exchange Server: Exchange Intelligent Message Filter

2004-07-27T08:46:00.000+02:00

Microsoft Exchange Server: Exchange Intelligent Message Filter

260724 - XADM: Public Folders Set up As Calendars Do Not Publish Free/Busy Information

2004-07-05T12:47:00.000+02:00

260724 - XADM: Public Folders Set up As Calendars Do Not Publish Free/Busy Information

Får access denied då man loggar av från OWA i Exchange 200x

2004-06-22T08:21:00.000+02:00

Detta kan komma av att det är fel rättigheter / autentisering i IIS på webservern (Frontend). Det måste vara samma inställningar på BIN / EXCHANGE / PUBLIC foldern i IIS, se länken nedan.

325906 - XCCC: Cannot Log off Exchange 2000 Front-End Server While You Are Using OWA: "Right-click the Exchweb\bin virtual directory for the Default Web site in the console tree, and then click Properties. "

Locating the WMI Control

2004-06-21T11:25:00.000+02:00

Här kan man se vad som ligger i WMI på en specifik maskin.

En annan intressant sak i förbindelse med problem med WMI på Exchange 2000 kan vara att initiera WMI på nytt med kommandot;
If you use the Exchange 2000 CD-ROM, run the following command, where cd-rom is the drive letter of the CD-ROM drive:
%systemroot%\system32\wbem\mofcomp.exe cd-rom:\setup\i386\exchange\exwmi.mof

If you use the Small Business Server 2000 CD-ROM, run the following command, where cd-rom is the drive letter of the CD-ROM drive:
%systemroot%\system32\wbem\mofcomp.exe cd-rom:\EXCHSRVR60\setup\i386\exchange\exwmi.mof

If you use the Exchange 2003 CD-ROM, run the following command, where cd-rom is the drive letter of the CD-ROM drive:
%systemroot%\system32\wbem\mofcomp.exe cd-rom:\setup\i386\exchange\exwmi.mof

Länkar:
Locating the WMI Control
288590 - Error "0x8004100e" and event ID 9097 occur when you run the System Attendant

Reinstall WMI

2004-06-21T06:53:00.000+02:00

WMI kan skapa problem med övervakning av servern. Nedan är två länkar som innehåller tips om hur man kan reinstallera WMI.

På Snakefoot's Windows Service details;
Note to repair/reinstall the WMI execute the following commands (Note it will reset the ICS and ICF configuration):
winmgmt /clearadap
winmgmt /kill
winmgmt /unregserver
winmgmt /regserver
winmgmt /resyncperf
net stop winmgmt
del %windir%\system32\Wbem\Repository\*.* /s
net start winmgmt
%windir%\system32\wbem\wbemtest.exe "

319101 - Error Message: Windows Management Instrumentation (WMI) Might Be Corrupted
Reinstalling WMI (Platform SDK: Windows Management Instrumentation)

187614 - Removing Terminal Server Licenses from an RDP Client

2004-06-04T13:22:00.000+02:00

Vart det blir placerat TS-CAL på en Windows klient.

187614 - Removing Terminal Server Licenses from an RDP Client

New blog is born

2004-05-14T14:38:00.000+02:00

This BLOG will contain information about what I do and need when working as a IT pro.