eric.s's questions

I'm tasked with upgrading out system from Lync 2010 to Lync 2013. To do this requires co-existence.

I have our 2013 environment up and running. Test users on the 2013 system can talk/IM/see presence of users on the 2010 system and vice versa. Users are able to share the desktop and programs between systems. The Edge servers are working.

I have found that the meet URL is not working if initiated by a user on the 2013 system.

A meeting will open up. It will show the 2013 and 2010 user in the meeting but IMs only show on the user computer and desktop sharing fails, but does not give me an error only a warning that leads to the links below.

I have found info about the warning messages that are showing up in the local logs but am very gun shy about forcibly removing my Conferencing info on our production servers (http://blog.rassie.dk/2013/03/lync-multiparty-im-and-voice-fails/ and here).

Are there any solutions I can test that are not as drastic?

We've recently been working with the documentation here to set up some access policies for a new DHCP server.

I've been able to successfully import 600+ records with the Set-DhcpServerv4Policy -Name -ScopeID command.

This seems to have wiped out the 2 records that were already in there, which leads to where I am running into issue.

I am trying to search the list that is now there to see if those MACs were included using Get-DhcpServerv4Policy -Name "Allow Private" -ScopeId 192.168.16.0 but all I get is an condensed response of the MAC's.

Name : Allow Private Description : Allow access to Private Wireless Network Enabled : False ScopeId : 192.168.16.0 ProcessingOrder : 2 Condition : OR VendorClass : UserClass : MacAddress : {EQ, 00-06-5b-22-xx-xx, 00-08-ca-e7-xx-xx, 00-0e-35-de-e5-xx...}e

I've added the -fl switch and get the same results.

Windows Server 2008 R2 had an export feature but I don't see it here in Windows Server 2012.

If the MAC's aren't in the list I need to add them - and am hoping not to keep the list I have and just add them to it - but if I have to do that I will, unless there is an update command that I am missing.

Thanks for any thoughts.

I've been asked to move an http tomcat install to https.

We've ordered and installed the cert and have followed the directions given by the application developer that are not working - so went and found other directions, ending up with the following for our connector port configuration:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
           maxThreads="150" scheme="https" secure="true"
           clientAuth="false" 
           keystoreFile="KeyStoreFileThatIsInSameDirectoryAsServer.xml" 
           keystorePass="*********"
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           sslProtocol="TLS" />

Now, http and https just spin on us.

I am not familiar with Tomcat, but the logs I am finding are not showing connections or issues when I am testing.

We don't want to disable http until we get https working for the application.

When I used the following I could use http, but https was just ignored completly.

           keystoreFile="%SINGULARITY_HOME%\lib\tomcat\conf\Keystore" 

Any pointers on where to look for the proper logs or glaring misteps in my connector port info?

We are looking to use a webdav server to publish some internal file shares and would like to use the established security on these shares for publishing. The environment is Win 2012/iis8

I've read and tried to follow directions for IIS7 and 7.5 but get 500 errors and web config errors.

I think it has to do with the authentication or authoring rules, as I can set a domain admin for the credentials or the user if I am testing with a user folder and it will go through - but that's not what we are looking to do. That seems to leave it wide open.

I am not an IIS guy and my searches for info on IIS8 are not giving me the results I need. Any direction that may help is greatly appreciated.

We currently have one WLAN that only domain users can connect to. We will be adding a guest WLAN and would like all non-domain machines to use this, even if a user has a domain account.

We have set up NPS and can log in against it, but we can not restrict the connection option to be a domain computer AND a domain account. As a network policy it states that it moves along through each policy until it finds one that it accepts or runs out.

For connection request policies Domain Computers is not an option. This is where I thought I may be able to stop it.

Has anyone been able to successfully restrict this without manually adding MACs to the WLAN Controller?

We have a Windows workgroup sitting behind an ASA 5505. All clients receive their IP assignment from the ASA.

VPN is set up and we can connect to the local LAN and connect to the machines by IP, but not by their hostnames.

Inside all machines can connect through hostnames and we would like to do the same when the users are connected through the VPN.

Is this possible with machines just being in a workgroup, dns set up inside and outside coming from Google and no domain set on the ASA?

We're using a 5505 where the primary connection is a DHCP IP (outside) from the provider and we have a backup ISP with a static IP (outsideBackup).

Can we create an SLA Monitor on the outside interface, even though there is no set gateway (say to check Google DNS or another very up ip address)?

Without a specific route command for the primary I am concerned this plan of action will not work for us.

What we have found is that the backup/failover we set in the ASDM seems to only take effect if the interface goes down, not the actual connection.

We have found the most excellent program that that will allow our OSX machines to print through our Windows Print servers. (ksmbprint from http://deploystudio.com/)

The program allows for smb printing with to the servers through kerberos authentication - taking away the need to constantly put in the AD username and password for each print job and for us not to have to set up specific printers on the 300 or so machines that will be printing using lpadmin.

The issue is that the kerberos ticket lasts for 10 hours. 10 hour 1 second and the print job goes to the ether - looks like it goes through, but goes to nowhere.

In testing I can go to Keychain Access -> Ticket Viewer then renew the ticket, after entering my AD password. This is fine for the tester, but not for the user.

I've found a script that checks and when a user has less than 30 minutes left on their ticket it will ask them to re-authenticate. Set this up as a launch agent and it works - until asking the user to re-authenticate. This part doesn't happen when running as an agent.

Looking for a way to re-authorize the ticket with as little user intervention as possible. If I can get the launch agent to work as it does when just run, I'm okay with that for first run, but would really like a way to quietly re-authenticate the kerberos ticket.

Spoke with the Domain Admins and they don't suggest upping the ticket time and after discussion we realized that no matter what time we set it to expire there is going to be someone whose ticket is going to expire, so we better find a better solution.

Edit: I've gotten the launch agent to work, but am still looking for a way to do this sans user intervention. The thought of asking users to just trust us when this random box appears and type in their domain password is on the list of things we shouldn't be asking users to do.