Ian Murphy's questions

I recently had a problem which I've never seen occur before. One evening around 2030 one of the DC's changed its clock back an hour. This server syncs to two addresses in pool.ntp.org. Nobody was present when this occured and the event logs clearly show time-service syncing against a public ip.

I can only assume that we hit a server which was incorrecly configured because, after the chaos the following morning caused by the building management systems having the wrong time, I simply resynced the ntp server and it immediately corrected its clock.

I normally have ntp configured to use two different ntp servers so I assume that the client only connects to the first one which responds and just assumes that it will supply the correct time.

so, my question:

Is there any way to configure the windows time service so that it will only correct its clock after consulting two different ntp servers and they both coincide as to the correct time? I'm running Win2019

Edit: I hadn't known it was possible to do historical querying on ntp results(thanks Paul Gear). Querying for the two IP's I had configured s shows the cause of my problem:

1623189765,"2021-06-08 22:02:45",-0.003809235,1,13.2,,,0,
1623188607,"2021-06-08 21:43:27",6.1543e-05,1,12.8,6,"Newark, NJ, US",0,
1623188607,"2021-06-08 21:43:27",6.1543e-05,1,12.8,,,0,
1623187438,"2021-06-08 21:23:58",0.011513196,1,12.4,6,"Newark, NJ, US",0,

The middle line there indicates a huge variation from the server I was using.

I'm experimenting with setting up an azure site-to-site vpn. I had a test server already set up and working in a subscription. The server had internet access but no vpn link.

I ran through the options to create a site to site vpn and it came up without any great problems. the on-prem firewall says its connected. I followed one of the online examples where I used 10.10.0.0/16 and created two subnets 10.10.1.0/24 and 10.10.2.0/24

My problem is that my server doesn't seem to be in any way linked to this new virtual network I've created. I've tried rebooting it just in case but it comes back up with an ip in the 100. range which azure gives out to new machines. I expected it to have an address in the 10.10. range, or maybe a second interface.

What I have is a VM + Virtual network under the same subscription. Both work independently.

I've spent hours digging through blogs and docs and can't find anything which helps. If I try to create a new test vm under this subscription, when I get to the "Choose A Region/Affinity group/Virtual Network" I can choose the virtual network I created, but I can't work out any way to modify the existing vm.

Can anyone suggest what I may be missing?

I'm experimenting with my first setup of MS virtual desktop virtualization and have hit a problem I can't get over. I switched over from using the gui to powershell to try and identify the issue. It occurs when I try and create the Desktop collection from the template.

What I have is:

• 1 hyper-v on win 2012 R2 (HyperVServer)
• 1 win 2012 Std server (RDServer) which will have/has each of the other roles involved.
• DCs are our normal DC's in the office here.
• 1 vm with win7sp1pro, patched and updated the integration tools and then sysprepped
• The servers are in spanish

NOTE: I have noticed mention of installing win7 enterprise, which I hope is not a requirement for this to work as I only have pro licenses to experiment with. I can't find this mentioned as being a requirement...

From the RDServer I execute the following:

new-RDVirtualDesktopCollection -CollectionName myVDIPool -PooledManaged 
-Virtual DesktopTemplateName VDIBaseWin7 
-VirtualDesktopTemplateHostServer hypervserver.mydom.com 
-VirtualDesktopAllocation @{"hypervserver.mydom.com"=1} 
-StorageType localstorage 
-ConnectionBroker RDServer.mydom.com 
-VirtualDesktopNamePrefix msVDI

which responds (in spanish - I'll translate below) with

Confirmar
No se concedió acceso a la unidad organizativa CN=Computers,DC=mydom,DC=com. ¿Desea pasarlo por alto y continuar?
[S] Sí  [N] No  [U] Suspender  [?] Ayuda (el valor predeterminado es "S"): s
No se pudieron obtener detalles del escritorio virtual para VDIBaseWin7 del servidor HyperVSrv.mydom.com.
    + CategoryInfo          : InvalidResult: (:) [], WorkflowTerminatedException
    + FullyQualifiedErrorId : JobStateFailed
    + PSComputerName        : localhost

new-RDVirtualDesktopCollection : No se pudo crear la colección de escritorios virtuales. Error:
En línea: 1 Carácter: 1
+ new-RDVirtualDesktopCollection -CollectionName VDIPool -PooledManaged  -Virtu ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,New-RDVirtualDesktopCollection

It asks to grant access to the computers.mydom.com ou - ok, no problem. But it then fails with "No se pudieron obtener detalles del escritorio virtual para VDIBaseWin7 del servidor HyperVSrv.mydom.com" which translates as:

Unable to obtain details for the virtual desktop for VDIBaseWin7 on server hypervsrv

or

Cannot obtain details for the virtual desktop for VDIBaseWin7 on server hypervsrv

obviously the command is trying to do something remotely with hyperv, but I cannot work out what.

Does anyone have any idea what this command may be attempting to do when it fails? If I had an idea of what it was trying to do I could work out what was wrong, but this doesn't give much info.... 'cannot obtain details' isn't the most helpful of errors.

edit: I've tried trawling through the powershell code in C:\Windows\System32\WindowsPowerShell\v1.0\Modules\RemoteDesktop and other places looking for the source to the function to try and work out what its doing, but no luck, can't find it anywhere.

I have an odd problem on one of the MS Exchange 2010 systems I manage. A single mailbox is causing rapid database growth. This is a problem we saw once before on the same system, only this time its a different mailbox.

We saw this a year or so back with a mailbox where, whatever database it was placed in, the database would grow rapidly (GBs/day). I discovered this by isolating the mailbox by itself. Get-MailboxDatabase -Status would indicate that the database did not have any free space, but its containing mailbox would only occupy, say, 2Gb of a 20GB database. If I moved the mailbox to a new database we would start again at 2GB and it would commence growing almost immediately. Sometimes growth would be slow, sometimes 10Gb overnight.

The user was not doing anything unusual and did not have a high volume of email.

We finally cured the problem by, rather drastically, exporting everything to a pst, deleting the mailbox, removing the profile in outlook, deleting the account on his phone and recreating everything. We had previously tried just recreating his outlook profile.

Now the problem has occurred again, only this time on a different mailbox. Since this has occurred twice I'd like to try and get to the bottom of the issue.

Can anyone suggest anything I can do to diagnose this or possible causes? What I've found by googling is rather vague and noone seems to be able to point to a cause.

I recently noticed at a clients that their Dell laptops appear to have SMART disabled in bios by default. I noticed this while swapping out a disk on a desktop which had failed without any warning.. wonder why we didn't get anything. :-)

Anyone know how to script bios changes on Dell machines? Is it even possible?
This particular client has loads of laptops and maybe 50-75% of the company will be out of the office on any given day - making updating this difficult and expensive - unless I can script it.

The dell site mentions an openmanage package which they offer/sell, but that looks like overkill for such a simple need.

We have a sonicwall tz series FW with two internet service providers connected.

One of the providers has a wireless service which works a bit like an ethernet switch in that we have an ip with a /24 subnet and the gateway is .1. All other clients on the same subnet (say 195.222.99.0) have the same .1 gateway - this is important, read on.

Some of our clients are also on the same subnet.

Our config:

• X0 : Lan
• X1 : 89.90.91.92
• X2 : 195.222.99.252/24 (GW 195.222.99.1)

X1 and X2 are not connected, other than both being connected to the public Internet.

Client config:

• X1 : 195.222.99.123/24 (GW 195.222.99.1)

What fails, what works:

• Traffic 195.222.99.123 (client) <-> 89.90.91.92 (X1) : Spoof alert
• Traffic 195.222.99.123 (client) <-> 195.222.99.252 (X1) : OK - no spoof alert

I have several clients with IPs in the 195.222.99.0 range and all provoke identical alerts.

This is the alert I see on the FW:

Alert   Intrusion Prevention    IP spoof dropped 195.222.99.252, 21475, X1  89.90.91.92, 80, X1 MAC address: 00:12:ef:41:75:88

Anti-spoofing is switched off on my FW (network->mac-ip-anti-spoofing -> config for each interface) for all ports

I can provoke the alerts by telneting to a port on X1 from the clients.

You can't argue with the logic - this is suspicious traffic. X1 is receiving traffic with a source IP which corresponds to X2s subnet.

Anyone know how can I tell the FW that packets with a src subnet of 195.222.99.0 can legitimately appear on X1?

I know whats going wrong, I've seen the same thing before, but with higher end FWs you can avoid this with a few extra rules. I can't see how to do this here. And before you ask why we're using this service provider - they give us 3ms (yep 3ms, thats not an error) delay between routers.

Y'know they way windows print queues will occasionally stop working with a print job at the head of the queue which just won't print and which you can't delete? Anyone know whats going on when this happens?

I've been seeing this since the NT4 days and it still happens on 2008. I'm talking about standard IP connected laser printers - nothing fancy. I support a lot of servers and loads of workstations and see this happen a few times a year.

The user will call saying they can't print. When you examine the print queue, which in my case will generally be a server based queue shared out to the workstations, you find a print job which you cannot cancel. You also can't pause it, reinitialize it, nothing.

Stopping the spooler is the usual trick and works sometimes. However I occasionally see cases which even this doesn't cure and which a reboot is the only solution. Pause the queue, reboot, when it comes back up the job can then be deleted. Once gone the printer happily goes back to its normal state. No action is ever necessary on the printer.

I regard having to reboot as last resort and don't like it. What on earth can be going on when stopping the process (spooler) and restarting it doesn't clear a problem?

Its not linked to any manufacturer either. I've seen this on HPs, lexmark, canon, ricoh, on lasers, on plotters.... can't say I ever saw this on dot matrix.

Anyone got any ideas as to what may be going on.

Ian

Maybe someone can shed some light on a bit of Powershell weirdness I've come across and can't explain.

This PS script returns a list of exchange databases, their sizes and the number of mailboxes in each one:

Get-MailboxDatabase | Select Server, StorageGroupName, Name, @{Name="Size (GB)";Expression={$objitem = (Get-MailboxDatabase $_.Identity); $path = "`\`\" + $objitem.server + "`\" + $objItem.EdbFilePath.DriveName.Remove(1).ToString() + "$"+ $objItem.EdbFilePath.PathName.Remove(0,2); $size = ((Get-ChildItem $path).length)/1048576KB; [math]::round($size, 2)}}, @{Name="Size (MB)";Expression={$objitem = (Get-MailboxDatabase $_.Identity); $path = "`\`\" + $objitem.server + "`\" + $objItem.EdbFilePath.DriveName.Remove(1).ToString() + "$"+ $objItem.EdbFilePath.PathName.Remove(0,2); $size = ((Get-ChildItem $path).length)/1024KB; [math]::round($size, 2)}}, @{Name="No. Of Mbx";expression={(Get-Mailbox -Database $_.Identity | Measure-Object).Count}} | Format-table –AutoSize

If I add a simple 'sort name' before the 'format-table' my resulting table contains blanks where the database sizes and number of mailboxes should appear (not zeros, blank empty space).... but only in some rows, not all rows. Some rows contain numbers!

If I put the '|sort name| ' after the initial 'get-mailboxdatabase' it works fine.

Whats even weirder is if I do the following:

1. Execute the above command
2. Add the sort before format-table
3. Execute the new command
4. Execute the initial command again

What I see is different amounts in each of the three cases - all of which are incorrect. Yet 1 and 3 are the same command and the only difference with 2 is a sort. 1 and 3 should, at a minimum, return the same results. I get blanks where I should have MBs

If I add the sort after the get-mailboxdatabase, it always returns identical results (as it should).

Can anyone suggest an explanation as to what may be going on?

If its of any help in reading the expression, I've reformatted it here to make it a bit more readable:

Get-MailboxDatabase | Select Server, StorageGroupName, Name, 
    @{Name="Size (GB)";Expression={
        $objitem = (Get-MailboxDatabase $_.Identity); $path = "`\`\" 
        + $objitem.server + "`\" 
        + $objItem.EdbFilePath.DriveName.Remove(1).ToString() + "$"
        + $objItem.EdbFilePath.PathName.Remove(0,2); 
    $size = ((Get-ChildItem $path).length)/1048576KB; [math]::round($size, 2)
    }}, 

    @{Name="Size (MB)";Expression={
        $objitem = (Get-MailboxDatabase $_.Identity); 
        $path = "`\`\" 
        + $objitem.server + "`\" 
        + $objItem.EdbFilePath.DriveName.Remove(1).ToString() + "$"
        + $objItem.EdbFilePath.PathName.Remove(0,2); 
    $size = ((Get-ChildItem $path).length)/1024KB; [math]::round($size, 2)
    }}, 

    @{Name="No. Of Mbx";expression={
        (Get-Mailbox -Database $_.Identity | Measure-Object).Count
    }} 
| Format-table –AutoSize

I'm trying to set up a script to generate SSL certificates for use with IIS. I'm trying to get certificates signed by a an self signed CA cert to work. I'm 99% there but something is sill wrong. This is for use with MSExchange SSL certs. I want to have long life self signed certificates and to have a root cert which I can install on devices like smartphones which will allow me to trust other certs I have signed with it, like SSL certs.

This is what I'm doing:

/// create a private root cert
openssl genrsa -des3 -out work\Private-CA.key 2048 

openssl req -new -x509 -days 3650 
    -key work\Private-CA.key
    -out work\Public-CA.CRT

/// Create an SSL cert request
openssl genrsa -des3 -out work\Certificate-Request.key 2048 

openssl req -new 
    -key work\Certificate-Request.key
    -out work\SigningRequest.csr

/// Sign the request with the root cert
openssl x509 -req -days 3650 -extensions v3_req 
    -in work\SigningRequest.csr
    -CA work\Public-CA.CRT
    -CAkey work\Private-CA.key
    -CAcreateserial 
    -out work\SSL-Cert-signed-by-Public-CA.CRT

The first 4 commands seem to be fine. The final command is generating a certificate which has the attributes I want.

I import the Public-CA.CRT into the machine Store as a trusted root certificate. I then use exchanges import-exchangecertifiate cmdlet to try and import SSL-Cert-signed-by-Public-CA.CRT. This fails with a message saying that the certificate is not trusted.

It would appear it is not being signed. If I import the ssl cert into to machine personal store, it also indicates that it doesn't have a certification route.

Can anyone with a better knowledge of this see what I'm missing?

As an aside: Is there any way, from the command line, of asking openssl if Certificate X has been signed by Certificate Y? This should work but doesn't:

openssl verify  -cafile Public-CA.CRT SSL-Cert-signed-by-Public-CA.CRT
usage: verify [-verbose] [-CApath path] [-CAfile file] [-purpose purpose] [-crl_check] [-engine e] cert1 cert2 ...
recognized usages:
       sslclient       SSL client
       sslserver       SSL server
       nssslserver     Netscape SSL server
       smimesign       S/MIME signing
       smimeencrypt    S/MIME encryption
       crlsign         CRL signing
       any             Any Purpose
       ocsphelper      OCSP helper

adding -purpose doesn't make matters any better.

I have a server with Win2008R2 and a synology NAS. On the Nas there are 6 iSCSI partitions which are mounted on the windows server. The windows server is virtualized under Hyper-V.

After rebooting the client machine, two of the 6 partitions do not remount and I have to manually remount them... every time.

Each one has a similar configuration and has been configured with CHAP authentication. All 6 appear in the favourites list.

Event log shows no errors regarding iSCSI. The other 4 partitions mount without problems.

Any suggestions for further debugging?

EDIT: After speaking with synology they suggested disabling chap authentication and enabling something called masking, which is basically a filter to block which nodes can connec to each LUN. This made a huge difference to the problem. It still occurs every now and again after power outages or similar, but after reboots I can be pretty much certain that the luns will remount. I guess its an issue between the windows iscsi initiator and the target in authentication negotiation.

This morning we had an odd problem on a server running hyper-v. It was the second time we've seen the exact same problem int he last 6 months and I am a bit mystified as to the cause.

The physical host and the virtual machines cease having access to the network and the physical console of the host displays a black screen. Unfortunately I wasn't me who investigated but a user each time, so I can't confirm anything else. In each case the only solution was to power-cycle the server.

Up until here its just a driver problem. The box is up to date with the 8.70 support pack from HP.

After rebooting no network interfaces are available (the list shows up empty). In device manager the 4 interfaces show up with a little yellow triangle and the event viewer contains the following event

HP NC382i: Network controller failed to exchange interface with the bus driver.

Which makes no sense to me. Disabling and reenabling the devices had no effect.

The solution each time has been to uninstall the driver and let windows redetect them. After redetection you then have to reassociate the 'new' interfaces with the hyper-v networking config.

Its a win2008 R2Enterprise box running Hyper-v and 3 client machines. They've been installed and running for over a year now. Installed from scratch, not migrated.

The box is an HP DL385 G6. It has Broadcom NICs which are rebadged by HP to appear as NC382i controllers. The nic driver I have loaded is the hp one v6.2.9.0. The latest drivers appear to be 6.2.16.0 - so not particularly different.

Anyone seen anything similar or know what may be going on? I may schedule an upgrade to the NIC drivers but I don't think a minor update is likely to have much of an effect given the behaviour of the server.

I should also add that the host server was still logging events right up until it was rebooted - no anomalous events other than an odd duplicate netbios name which had been going on since the night before. No recent reboots, nor installations in the last couple of months. No new apps - this is a hyper-v server after all.

Update: I just realised that I hadn't updated this posting. I opened an incident with HP and we went over the drivers and firmware. Everything checked out ok so they suggested that we remove and reload the drivers and reflash the network card firmware. If the problem repeats itself they've said they will swap out the motherboard.

That was a couple of weeks ago and its been stable so far. This problem is very intermittent, so only time will tell. Have to give it a couple of months.

Anyone know if theres a way to exclude certain redirected printer queues from being created under windows 2008.

It seems to be all or nothing and I would like to be able to just exclude certain printers which show up all over the place and which just are never going to be used on this server.

for example "PDF Creator" "XPS*" The printer which is on the local subnet and which already exists on the terminal server

With one or two users this isn't a problem, but once you have 50+ the number of queues multiplies.

Ian

I'm using DFS to access varios shares on a server using a domain namespace - like \mydomain.local\docs. The DFS shares are not replicated. The shares are located on a DC

After rebooting the host the shares become unavailable from the client machines until they too reboot or restart the dfs client service.

I've seen a similar problem when we had windows 2003 and win xp but the problem seems to be exacerbated with our current setup which is Win2008 and Win7.

The problem is a client one and not a server problem - I think. If I reboot the server and then boot or reboot a workstation it will have immediate access to the share. Any client machine which had previously been connected but which has not yet rebooted is unable to access either a previously mapped drive nor the unc for the dfs share, nor access the underlying unc (so they can't access X:, \dfsspace.local\xdrive nor \server\xdrive)

The error varies but it can be the old 'the system can't find the specified route' or it can also be an error which states that the driver is no longer valid. Trying to access from either explorer or from command line produces the same result - so its not an explorer problem.

If you just leave the pc, then the access to the shares will start working after half an hour or so, though not always. Yesterday I was upgrading a NAS and rebooted the server to update it while waiting on Nas copies to complete. This morning my own Win7 still could not access the shares some 12 hours later. Other users who had come in this morning and booted had no problems. A quick reboot fixed the problem with mine but this doesn't make any sense.

It appears like some sort of a dfs cache problem but I'm not sure and it makes little sense.

On machines with offline files enabled the problem is generally worse, they will see the drives as being available but empty. After some time the shares will suddenly show their correct contents.

I've tried trawling the ms docs, technet, google and haven't found anything very relevant - so this is either something so obvious and dumb that I'm just missing it or we have an extremely esoteric problem... I suspect the former.

Can anyone shed any light on my woes?

Ian

I'm migrating from exchange 2007 to exchange 2010 and have a problem. Everything has migrated over ok but I cannot remove the public mailbox db from the 2007 server. I want to uninstall exchange before decomissioning this box but have hit a block wall.

This is a domain where we've has exchange for around 10 years, so there's likely some junk in there related to the old instalations.

This is a spanish language server, so some of the text is in spanish.

The source of the problem appears to be old offline address books which cannot be removed. The two appear below and refer to 'first administrative group' and 'Primer grupo administrativo' - which means the same in english and spanish... presumably created by different installers at one time or another... we've had lots of different exchange servers in this network.

When I try to remove the database it says that it contains replicas. There is nothing remaining on this box of any use:

get-publicfolder \ -recurse | select name, replicas

returns a list showing everything in the new public folder db except for IPM_SUBTREE

get-publicfolder \NON_IPM_SUBTREE -recurse | select name, replicas

returns a list showing everything in the new public folder db except for NON_IPM_SUBTREE and "EX:/o=IntegraXP/ou=first administrative group"

so I think I can safely say that the "EX:/o=IntegraXP/ou=first administrative group" public folder is the cause of my problems.

This what happens when I try to remove the public folder. It says to make sure I've correctly specified the identity of the folder.

    [PS] C:\>get-publicfolder \NON_IPM_SUBTREE -recurse | where {$_.name -eq "EX:/o=Integ
raXP/ou=first administrative group"}

Name                                                              Parent Path
----                                                              -----------
EX:/o=IntegraXP/ou=first administrative group                     \NON_IPM_SUBTREE\OFFLINE ADDRESS BOOK

    [PS] C:\>get-publicfolder \NON_IPM_SUBTREE -recurse | where {$_.name -eq "EX:/o=Integ
raXP/ou=first administrative group"} | remove-publicfolder

Confirmar
¿Está seguro de que desea realizar esta acción?
Quitando la carpeta pública "\NON_IPM_SUBTREE\OFFLINE ADDRESS BOOK\EX:/o=IntegraXP/ou=first administrative group".
[S] Sí  [O] Sí a todo  [N] No  [T] No a todo  [U] Suspender  [?] Ayuda (el valor predeterminado es "S"): s
Remove-PublicFolder : No se puede eliminar el objeto '\NON_IPM_SUBTREE\OFFLINE ADDRESS BOOK\EX:/o=IntegraXP/ou=first administrative
 group'. Asegúrese de que ha especificado la identidad correcta y de que cuenta con los permisos correctos para eliminarlo.
En línea: 1 Carácter: 135
+ get-publicfolder \NON_IPM_SUBTREE -recurse | where {$_.name -eq "EX:/o=IntegraXP/ou=first administrative group"} | remove-publicf
older <<<<
    + CategoryInfo          : NotSpecified: (0:Int32) [Remove-PublicFolder], MapiPartialCompletionException
    + FullyQualifiedErrorId : 3B3918E6,Microsoft.Exchange.Management.MapiTasks.RemovePublicFolder

Any suggestions. Everything is already on my new server, so I'm open to drastic solutions.

Thanks

Ian Murphy

I have a client who has OpenVPN installed on a windows server. I didn't install it and the person who did is no longer available. The server runs a special App and the client machines talk to it - and it alone, no routing to other machines.

I have a problem where some internal subnets can access the OpenVpn server and some cannot.

The setup:

• Openvpn uses 10.8.0.0 - the default setup.
• The server is on 192.168.2.10
• Internal subnets 192.168.1.0 and 192.168.40.0 are connected by routers.

Pc's which are on 192.168.2.0 and 192.168.1.0 can access the server running openvpn without problems (remember, they're internal and they don't connect via openVPN).

PC's which are on the 192.168.40.0 subnet CANNOT ACCESS (they're internal and also don't connect via openVPN).

If I shut down OpenVPN on the server I can access the server from 192.168.40.0

So, my problem is that OpenVPN is rejecting connections from 192.168.40.0 to 192.168.2.10 but I can't see why.

Adding routes in the OpenVPN config doesn't see to make ay difference ... and I didn't expect it to.

What really mystifies me is why 192.168.1.0 works... but there is no mention of it in the OpenVpn config file.

Edit: routing table when openvpn is open:

          0.0.0.0          0.0.0.0      192.168.2.1     192.168.2.10     10
         10.8.0.0    255.255.255.0         10.8.0.1         10.8.0.1     30
         10.8.0.1  255.255.255.255        127.0.0.1        127.0.0.1     30
   10.255.255.255  255.255.255.255         10.8.0.1         10.8.0.1     30
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
      192.168.2.0    255.255.255.0     192.168.2.10     192.168.2.10     10
     192.168.2.10  255.255.255.255        127.0.0.1        127.0.0.1     10
    192.168.2.255  255.255.255.255     192.168.2.10     192.168.2.10     10
        224.0.0.0        240.0.0.0         10.8.0.1         10.8.0.1     30
        224.0.0.0        240.0.0.0     192.168.2.10     192.168.2.10     10
  255.255.255.255  255.255.255.255         10.8.0.1         10.8.0.1      1
  255.255.255.255  255.255.255.255     192.168.2.10     192.168.2.10      1

the lan ip is 192.168.2.10 and the openvpn interface ip is 10.8.0.1

Anyone got any suggestions?

I'm trying to assign some rights in Exchange 2010 using powershell... nothing special

[PS] C:>add-mailboxpermission -user "j.doe" -accessrights extendedright -extendedrights ms-exch-store-admin, recieve-as, send-as -identity "mydom\administrator"

or, alternately,

[PS] c:>add-adpermission -user "mydom\XManager" -accessrights ExtendedRight -extendedrights ms-Exch-Store-Admin, Receive-As, Send-As -identity "mydom\administrator"

but in both cases the commands never complete. They never produce errors either, they just hang. Ctrl-c will terminate them but it takes an age.

Anyone know a way of diagnosing this?

I have a Windows 2008 R2 server with Terminal server role installed. I'm seeing a problem with an ordinary user who is member of local printer operators group on the server.

If the user opens a cmd window using ‘run as administrator’ they can run printmanager.msc without needing to enter their password again. In printmanager they can change the ownership of redirected (easy print) printers without problems.

If, from the same cmd window, they use subinacl to try and change the onwership of the queue to themselves they get access denied:

>subinacl.exe /printer "_#MyPrinter (2 redirected)" /setowner="MyDom\MyUsr"
Elapsed Time: 00 00:00:00
Done:        1, Modified        0, Failed        1, Syntax errors        0
Last Done  : _#MyPrinter (2 redirected)
Last Failed: _#MyPrinter (2 redirected) - OpenPrinter Error : 5 Access denied

so, same context, same action but one works and one doesn't. Any ideas for this odd behaviour?

I'm using subinacl x86 on an x64 server as I can't find anything more up to date. I've tried with icacls and others but couldn't get them to do anything with printers.

EDIT: added after Gregs comments regarding setacl below

If I log into the TS server as Testusr and open Admin Tools > Printer Admin (as administrator) and then type mydomain\testusr and the testusr's password, then I can change the ownership of the printer queue and set testusr as the owner.

However if I open cmd as administrator and, again, type mydomain\testusr and the users password when I try to change the ownership of my redirected printer I get the following:

C:\>setacl -on "Bullzip PDF Printer (12 redireccionado)" -ot prn -actn setowner -ownr n:mydom\testusr

WARNING: Privilege 'Back up files and directories' could not be enabled. SetACL's powers are restricted.
WARNING: Privilege 'Restore files and directories' could not be enabled. SetACL's powers are restricted.
INFORMATION: Processing ACL of: <Bullzip PDF Printer (12 redireccionado)>
ERROR: Enabling the privilege SeTakeOwnershipPrivilege failed with: No todos los privilegios o grupos a los que se hace referencia son asignados al llamador.
 [meaning not all referenced privs or groups are assigned to the caller]

SetACL finished with error(s):
SetACL error message: A privilege could not be enabled

maybe I'm getting something wrong but if the built in windows tool can do it with just membership of the 'print operators' group then setacl should be able to as well, no?

However setacl seems to depend on other privileges, which in reality are not required to do this.

Got an odd problem which has me stumped.

We're trying to add a windows 2008 R2 server to an existing forest. What we have is something like this:

• mydomain.com
• Paris.mydomain.com
• Newyork.mydomain.com

which are all running win 2003 R2.

I want to add another domain, like madrid.mydomain.com, but using win 2008 R2. The DVD is spanish language but we've mui'd the install so it appears in english for the moment.

I've adprepped (forest and domain) the dc's on the root mydomain.com using the adprep which comes on the 2008 R2 dvd. (this is a dvd - I've seen a lot of references to using adprep from the second cd - there's only one)

The first oddity I saw was that Adprep doesn't display any initial text when executed on the existing win2003r2 DC for mydomain.com. If you press 'c', it proceeds to apply the AD modifications. I'd guess this has something to do with adprep being an mui spanish version copied across to an english language server... but odd never the less.

It applied the changes as is usual and using ldap I can see that the AD version is 47 - correct for 2008 R2.

However when I attempt to join the domain it still says I have to execute forestprep.

If I execute adprep/domainprep it does nothing - really nothing, it opens and closes and I get command prompt back. When I execute Adprep /forestprep it displays about 3 lines of dots each time I execute it, but no text messages.

Nothing changes in the ldap object version

SO.... in the absence of any other ideas, I tried using a copy of win2003 R2 temporarily as my DC for madrid. No problems it comes up and I now have a subdomain but using a temp server.

I get the same behaviour with this new win2003DC as I did with the other mydomain.com one:

• adprep doesn't display text when you type 'adprep /?'
• adprep /domainprep doesn't result in any messages
• adprep /forestprep displays about 3 lines of dots each time I execute it but no messages.

Servers have been rebooted - no effect. Functional level of AD is 2003. DNS is ok with all the usual structures for AD. netdiag, dcdiag, dnslint all return normal results.

Right now I'm lost for ideas. Any suggestions?

Ian

Anyone know a way of force dismounting an iSCSI volume from windows 2008? I need to redimension the iSCSI volume, but the applicance says it can only do this when its not in use, so I need to dismount it from windows. However I can't seem to find a way to do this.

I could just bring down the server and do it that way. However, now that I've hit the problem I'd like to find a solution. What would someone do on a big production server?

The volume doesn't have anything using it. Its shared using the standard admin share (like Z$) and a basic share. Noone is using it except for the windows Server process. However this should not prevent removal of the volume from the system, after all you an eject a DVD when it is shared.

Anyone any idea how to do this?

Ian

In the firewall advanced security manager/Inbound rules/rule property/scope tab you have two sections to specify local ip addresses and remote ip addresses.

What makes an address qualify as a local or remote address and what difference does it make?

This question is pretty obvious with a normal setup, but now that I'm setting up a remote virtualized server I'm not quite sure.

What I've got is a physical host with two interfaces. The physical host uses interface 1 with a public IP. The virtualized machine is connected interface 2 with a public ip. I have a virtual subnet between the two - 192.168.123.0

When editing the firewall rule, if I place 192.168.123.0/24 in the local ip address area or remote ip address area what does windows do differently? Does it do anything differently?

The reason I ask this is that I'm having problems getting the domain communication working between the two with the firewall active. I have plenty of experience with firewalls so I know what I want to do, but the logic of what is going on here escapes me and these rules are tedious to have to edit one by one.

EDIT: Whats the difference between these two rules:

• Let traffic from local subnet 192.168.1.0/24 access the SMB ports
• Let traffic from remote subnet 192.168.1.0/24 access the SMB ports

where I have a lan port with an ip of 192.168.1.1 I think theres no difference

Ian