Sam's questions

In the past I've been able to open "Active Directory Users and Computers" to manage the users and computers on our Windows Server 2008 R2 box. We just recently made some changes to our Group Policy to log authentication sucess/failure and enabled the Windows Firewall (I'm assuming the Firewall may be the culprit).

Now when I try to open "Active Directory Users and Computers" I get the following error:

When I run dcdiag.exe it passes all of the tests except for System Log. For that one it throws all kinds of errors about Group Policy Settings. For example:

An error event occurred. EventID: 0x00000406 Time Generated:

12/23/2014 09:44:58

Event String: The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.

I'm at a loss and am not sure what to do or to look for next.

EDIT:

I turned off the Firewall in the Group Policy and rebooted the machine. I can now access the Active Directory Users and Computers. So now I'm left wondering which ports/rules I need to enable for a Domain Controller and Active Directory? When I looked at the firewall before it already had a bunch of Active Directory and DNS rules in place with allowed traffic.

We have a Cisco RV-042 Small Business router and our PCI scans flagged it as being vulnerable to CVE-2014-0224 (CCS Injection/Man-in-the-Middle). It appears to be another OpenSSL vulnerability.

We have the latest firmware (Apr 2014) installed, but can't wait around forever for Cisco to fix. So I have a few questions:

1) There is an option to disable SSL on the router. Does anyone know what the effects of this are? Does this only impact the web admin, or would VPN also be impacted?

2) Cisco seems to have fallen over a cliff on support of their products. What alternatives have you had success with that provide regular firmware updates (especially for PCI/Security related issues) and good support for their products?

We just put our first Hyper-V based web solution online about a month ago (Diagram below). We're having intermittent communication issues between Virtual Machines during periods of elevated traffic, for example, during Bing/Google/Baidu/McAfee Secure/etc crawls. The issue lasts a couple minutes and it is not a full blown outage; some requests work perfectly fine while others result in errors. I've looked in the system logs on the VMs and host system but there's nothing indicating failure (other than some ASP.net ODBC errors on the Web VM because it can't reach the database host).

Our old setup with a single 8-year old Windows Server 2k3 web and database server handled all the traffic without a problem, but was limiting our new development abilities. It only had 4GB of RAM and an old 2GHz dual-core processor. Our new server has 32GB of RAM and a quad-core 3.4GHz Xeon. The hardware blows the old stuff out of the water when everything is working. Pages load faster, queries run faster, etc.

The only things I can think of are that traffic is essentially doubled-up on the adapter because the DB and Web are on seperate VMs but share the same Virtual Network, or, there may be a problem with the way our Hyper-V network is configured.

There is a single shared Virtual Switch set up as External. We use a hardware firewall to block ports to the outside world. I've included screenshots of the Network Adapters and current Virtual Switch setup.

I'm not sure which properties should be enabled/disabled on the Host and VMs. The machine has 2 nics, but everything is currently set up on one port. It's been recommended to use one port for admin and the other for the virtual switch, which I'm sure would increase performance when we log into the boxes, but I'm not sure that fixes the current issue.

Can anyone provide guidance on what the Nic properties should be on the host and VMs, or guide me to tweaks to boost network performance?

I want to re-order the cypher suites on our new Windows Server 2012 box to help mitigate the BEAST vulnerability for our clients. I went to Local Group Policy => Computer Configuration => Administrative Templates => Network => SSL Configuration Settings, opened SSL Cypher Suite Order, enabled it, and copied the values from the SSL Cypher Suites textbox.

I pasted them into notepad, re-ordered them, then copied+pasted them back into the SSL Cypher Suites textbox. However, the box isn't long enough to hold them all, despite the fact that the length didn't change. I would have to drop the last 3 cyphers (SSL_CK_DES_192_EDE3_CBC_WITH_MD5,TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_NULL_SHA) in order for it to fit.

Should I just drop them? Other ideas?

I set up a Windows Server 2012 virtual machine exactly the way we want it. I shut down the instance, made a copy of the .vhdx virtual drive, then spun up a new VM and attached the copy of the drive.

I started up the new VM and everything worked properly. Then I proceeded to run SysPrep on the new VM so it wouldn't clash with the original and I could run them both at the same time.

After running Sysprep I had to enter a CD-Key when I powered up the instance (expected behavior) and had to create an account for the new VM.

SQL Server Express was still installed and I was able to connect. However, whenever I try to expand a database I get an error message The database [DbName] is not accessible. (Object Explorer)

I also noticed that the SQL users I had created are now gone.

Does anyone know why this happened or how to recover?

Our old Small Business Server 2003 (acting as our domain controller) was on the fritz, so we replaced it with a new Windows Server 2008 box and set the server up as our new domain controller. In hindsight, it may have been a mistake, but we set up the new server as a replacement and tried to keep as much the same as possible, including the DOMAIN name. The problem was, that even though the domain name was the same, the guest computers somehow still realized it was not the exact same domain. We had to unjoin and rejoin the domain and port over everyone's documents and settings.

This morning, when I attempted to connect to my local SQL Server Instance, it was saying that my login failed. When I tried to use the SQL Management Studio, it throws the error "Package 'Microsoft SQL Management Studio Package' failed to load" on startup, then exits without giving me a chance to change the login. I am using Mixed Authentication and have an administrative account as a backup.

Ideas? If there is a more appropriate stack, please let me know where to put it.

On our old Windows 2003 SBS, the guy that set up the network created a login script that fired to map some drives and add a network printer. I would like to do away with that script and just use the GPO.

We're configuring a new Windows 2008 R2 server. I was able to set up a couple of mapped drives using GPO. I would like to automatically map user specific drives.

An example:

Login Username = skimmel
Mapped Drive Template = \\SERVER\users\%username%
Final Mapped Drive = \\SERVER\users\skimmel

Is there a way to do this without setting up the drive every time a new user is created?

Is there such thing as an Antivirus appliance that would sit at the top of your network and identify/block threats? I'm just thinking that it would be nice, if all the traffic is being scanned by the antivirus software on individual computers anyway, to just have an appliance instead of rolling out software and virus definitions to every computer on the network.

Best practices seem to state that you should separate the domain controller/active directory stuff from any other business functions. However, Microsoft's latest server release Windows Small Business Server 2011 Essentials seems to run counter to that wisdom.

In looking at the licensing FAQ, it allows one instance on a physical server, or one instance in a virtual environment.

Seems to me they are encouraging SMB's to throw their domain controller, intranet, and file shares all into one instance.

What are you guys that are using Small Business Server doing?

We currently have a SBS 2003 server that is on its way out. Our shop is small (< 10 PCs), and our needs are not that great. I've been looking at Small Business Server 2011 Essentials and trying to figure out if it will work for us. These are out basic needs:

• Domain Controller/Active Directory
• File and Printer Sharing
• IIS for Intranet
• Ability to create VPN connection

Our Intranet App uses MySQL, so SQL Server is not required. We have hosted email so Exchange is unimportant. We have no need for SharePoint.

Would SBS 2011 Essentials fit the bill for this? Or am I looking at the Standard version?