glasnt's questions

I'm looking at trying to virtualize a few dedicated Windows 2008/2008R2 boxes, and am having issues finding a software solution that will support live migration.

I know that Norton Ghost 2.5.2 now runs in 2008/R2, but it doesn't support backing up that kind of environment.

Are there any production-ready solutions that will allow me to migrate dedicated hardware to a virtual environment (KVM) with as much uptime (live backup, migration) as possible? I know of a few offline solutions, but they are not an acceptable alternative.

I've got a new server that I want to use to replace an existing (older generation hardware) server, both of which are hosting Windows 2008 DC + Exchange 2007.

Both machines are currently running side by side, with all the mailboxes moved to the new server, and the MX records moved to the new as well.

In order to remove the old server from Exchange functionality and completely remove it from the DC, I need to uninstall exchange and run DCPromo.

In which order should I do this to ensure that all the functionality and roles are working on the new server, and the old server can be effectively shutdown without issue?

Do I:

• promote the new machine to DC controller via dcpromo, then
• remove exchange from the old machine, then
• remove the old machine from the domain via dcpromo

Or should these steps be performed in a different order?

I've attempted disabling services on the old machine, and unchecking the Global Catalog box from the old server in AD Sites and Services, but this caused issues where OWA could not find a Global Catalog (may have been related to services on the new machine being disabled by one of the above changes, or something unrelated)

I am doing a migration of mailboxes from one Exchange 2007 server to another server(new hardware, different server name, both on the same domain).

What steps do I need to take to ensure that no users access the mailbox stores during the migration process?

• Disable port 25?
• Disable OWA?

I will be using the move-mailbox exchange console functionality.

I'm experiencing some issues with a legacy Windows Server 2003 Std SP2 machine.

Behaviour: Windows Updates are being automatically applied, but failing to finish, due to one or multiple updates not completing in time, and causing the system to fail to reboot by itself.

I can see that in the WindowsUpdate.log:

 [Update] took too long (more than 16 hours) and was stopped

Then a series of:

WARNING: SUS Client is rebooting system.
AU invoking RebootSystem (OnRebootRetry)

Every 10 seconds until human intervention.

This is an issue, because the system partially shuts down (monitoring systems shutdown, TS sometimes dies) so the machine hobbles until someone kicks it over manually.

Is there a way to prevent/mitigate this kind of behaviour? I've found that this has happened in the May and July updates for the Windows Malicious Software Tool. Is this a known issue? Would I be better off manually updating the machine to remove the update for the WMST, in order to ensure correct rebooting and continued functionality?

In addition, is it possible to change the 16 hour window to something more manageable? Such as 1 hour?

Currently I have a setup with a virtual FTP site in IIS 7.5 that requires the following authentication details for the anonymous account:

Host: ftp.mydomain.com
User: ftp.mydomain.com|anonymous
Pass: <none>

I have multiple FTP accounts setup on this same server. I know that this means I need to specify the domain in the username to let IIS know what I need site to authenticate against, but is it possible to make the username only be anonymous? Would I have to create a user by that name in the windows users and groups area to be and specifically link it there?

I have a onstartup task that I want to automatically run, regardless of if someone is logged in or not.

I've set it up as Run whether user is logged in or not, Do not store password1, and Run with highest privileges, which I assume would work, using the below code:

schtasks /create /tn "My OnStartup Task"  /TR "powershell blah.ps1" /sc ONSTART /f /NP /RL HIGHEST

After enabling task scheduler history, I'm getting errors like:

Event ID: 104: Task Scheduler failed to log on "<Task Author>" . Failure occurred in "LsaLogonUser" . User Action: Ensure the credentials for the task are correctly specified. Additional Data: Error Value: 2147943711.

Event ID: 311: Task Scheduler failed to start Task Engine ""  process due to an error occurring in "LUAIsElevatedToken" . Command="taskeng.exe" . Additional Data: Error Value: 2147943711.

Event ID: 101: Task Scheduler failed to start "\My OnStartup Task" task for user "<Machine>\<Task Author>". Additional Data: Error Value: 2147943711.

I've specifically set not to store the password, yet the errors are saying it's trying to use the password. I recall reading somewhere that not the storing the password checkbox also counts for "do not run interactively", or something. Could someone point me into the right direction here?

Using the IIS namespace, one can query the IIS Apppool settings, using:

$pools = get-wmiobject -namespace "root/microsoftiisv2" -query 'select * from IIsApplicationPoolSetting'

However, this only returns information about the existing application pools.

How can one query the current application pool defaults, the same that are retrieved from Application Pools > Set Application Pool Defaults. These values are different from the Default Application Pool (DefaultAppPool)

I know there are a number of suites out there that allow Windows machines on a Domain, or in Active Directory to be remotely administrated (windows updates, program installs, maintenance, etc); but does there exist a package that does this for non-AD/Domain setups?

The kind of things I'm looking for:

• manage windows updates, + automatic applying
• custom package pushing (custom scripts, etc)
• general maintenance, visibily of health
• works for 2003/2008/2008R2
• works without Active Directory or being part of a Domain

I'm trying to debug some monitoring code that uses SNMP, and have come across an issue.

If I run snmpwalk -v 1 -c $COMMUNITY $SERVER hrSystemDate.0 on a Windows 2003/2008/2008R2 machine, I get an output like

HOST-RESOURCES-MIB::hrSystemDate.0 = STRING: 2012-2-16,16:30:21.1

But the same check on a Linux machine (debian) yields.

HOST-RESOURCES-MIB::hrSystemDate.0 = STRING: 2012-2-16,16:31:23.0,+11:0

The Windows version lacks a timezone.

Is this a known/documented limitation on Microsoft's part? And/or is there another way to get the timezone out by itself?

I've got a server running with dual quadcore processors (2 x Intel Xeon L5609), with Windows Server 2008 R2 Standard edition running on top.

The Windows Server Editions Comparison Guide shows that Standard edition can use "X64 Sockets : 4" only. From other documentation, this refers to the amount of logical processors, multiplied by 64 (256). Not exactly sure what this means..

I'm also seeing 8 cores in Task Manager, but I'm unsure if that's physical cores or hyperthreaded duplication.

Can Windows Server 2008 R2 Standard handle only 4 physical cores? Or is the restriction to do with Hyper-V/Virtual machines (which I've seen a lot of google noise about)

Edit: According to a random technet post "Windows Server 2008 Standard Edition can support up to four physical processors, regardless of the number of cores on each processor". I assume that R2 should be the same, but is there any official documentation to back this up?

I want to be able to save an object to file, and then have another script pick up that object again and be able to use it.

I run

Export-Clixml -InputObject $object -Encoding UTF8 -Path $file

to save the object to file, but if I run

$object = Import-Clixml $file

I can't manipulate the object as I did before.

Sample code to describe my problem:

#script 1
$objecttofromFile = new-object -com "Microsoft.Update.UpdateColl"
foreach ($herp in $derp) {
    # do stuff, then 
    $null = $objecttofromFile.Add($herp)
}
######## stop, save to file #########
#save shiny UpdateColl object to file
Export-Clixml -InputObject $objecttofromFile -Encoding UTF8 -Path $file

then..

#script 2
$objecttofromFile = Import-Clixml $file
###### start again ######
#assuming object is now a microsoft.update.updatecoll object
$downloader = (new-object -com "Microsoft.Update.Session").CreateUpdateDownloader()
$downloader.Updates = $objecttofromFile #WRONG

Error I'm getting is Exception setting "Updates": "Type mismatch. (Exception from HRESULT: 0x80020005 (DISP_E_TYPEMISMATCH))", but I'd assume that exporting and importing the object from file could keep the object type as it was.

If I take the code above and throw it into 1 file, removing the stuff between the hashlines, the code renders. But if I save and restore between scripts, it fails.

Am I missing something silly?

I know that if you go through the pending updates, there's a flag (rebootrequired, or similar) that will tell you if a reboot is mandatory, not required, or may be required. It seems that in the metadata of a lot of updates, this is tagged as "maybe, not sure", so there's not a sure fire way to know if an update will cause a reboot.

Given the Microsoft.Update.Session API, is there a way to check through the update content to see if the code itself will change the registry setting HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired to make windows knows it needs to reboot?

I'm assuming that, even though the metadata is "maybe", there's something in each update that forces this registry flag to to "Ping! I need to reboot!"

Either that, or is there a more reliable way to work out how check which updates require rebooting?

I want to be able to create a powershell script that will tell me, for all RDP sessions currently active on a machine, who the user is, and what their clientname (machine name) is.

I can use a combination of win32_loggedonnuser and win32_logonsession to get the username information, but I can't find the client name in these objects (enumerations?).

PS C:\> $logons = gwmi win32_loggedonuser; $lstring = ""; foreach($l in $logons) { $lstring +=$l;} $lstring -match "cephalopod";
False
PS C:\> $sessions = gwmi win32_logonsession; $sstring = ""; foreach($s in $sessions) { $sstring +=$s;} $sstring -match "cephalopod";
False

(cephalopod is my machine name, the machine that's logged into the server box)

.

I can see that HKCU:\Volatile Environment does have the client name, and the temp key has the user name within it, but I can't establish from the keys alone if the session is currently active.

Am I missing an API call that will get me all this information in one place?

Basic requirement: grep out the Task Manager > Users listing for user and client name, where status is active.

Using RDP, you get a max number of sessions (2). If you try and connect to a session, given the right group policy settings, you get the "Reconnection" screen:

Windows Logon
Select a session to reconnect to

You already have active remote desktop connections on this company

-> Session loggin on for X days and Y hours
Disconnected for Z minutes

 -> Session loggin on for X days and Y hours
Disconnected for Z minutes

Is there a way to change the information about the sessions displayed on this window? I'd like to be able to show the source IP/Computer that the sessions are under.

I have a Windows Server 2008 R2 machine which has been having intermitted networking issues.

After 29 days, 14-ish hours uptime, I find it's not responding to RDP commands again, yet I can access it via terminal (iDRAC)

Wireshark didn't recognise any interface devices, yet I could ping out to network, but by all intents and purposes, the machine was dead to the world.

Then I checked the major network interface.

The Received bytes counter is literally overflowing the properties panel.

Is this possibly also meaning that the received bytes internally overflowed, causing network issues?

Is there a datatype limit to this value before windows, being the Enterprise(TM) Software(R) it is, falls over? The number I'm seeing here, assuming that it starts with 4,975.. and there are no more numbers in front, is larger than 2^42. Is this a hard limit?

edit: network connectivity is fine after restarting the server. Historically, it hasn't lasted 5 weeks without a reboot over the recent months.

edit: the newer sibling server, which does less traffic, is showing 12 significant figures of traffic, with 8 days uptime. I'd hazard a guess that the first visible digit in the Received Bytes listing (13 visible significant figures) is not the first significant digit in this value.

editedit: my network usage graphs is showing around 2^45 bytes transfer (once converted from megabits), so there's definitely an extra digit before the 4 that we can't see. My estimate from network usage is somewhere in the vicinity of 52 trillion bytes (52,000,000,000,000) over 29 days.

Is there an API or programmatic calling system for Roxio Retrospect?

Because of the naming conventions within the system, trying to search for "scripting" or anything of the like refers to the context of creating backup scripts through the GUI, not programatic scripting.

I have a recently migrated virtual machine (from VMware to KVM) that refuses to internally acknowledge that it is serving and receiving network traffic.

The Networking tab on Task Manager AND Performance Monitor - Networking both show 0 network utilization, but the Local Area Connection interface shows a steady stream of data coming in and out (Sent/Received count grows in real time)

It's as if the system recognises packets, but not bytes, being transfered by the network. It's an issue because our monitoring systems using SNMP uses the byte count to show network connectivity, and thus it assumes the machine isn't active.

By all other accounts it works, as it's currently serving websites. Guessing it might be an issue with changes in devices from the migration, but we have removed all the old network adapters from Vmware to no avail.

Is there any way to trick the system into display data? The machine has been restarted since bring migrated.

I want to get a security model implemented, but I'm not sure what terminology IIS/SSL uses in order to do that. Nor do I know how to make it happen in IIS7.5

The process I want to have

• Administrator users (multiple) of a website create a personal certificate (.p12/.pfx/something)
• Server operator installs one side of this certificate to IIS (for each admin)
• Administrator imports the other side of certificate to their browser
• Administrator then authenticates to their administration area of the website, using the SSL as a passport to be able to get anywhere near the admin login area

How would I go about implementing the model above? I pretty much require step by step with the certificate generation and IIS configuration. I'm unsure if I require some sort of windows based authentication on top of the website authentication and some sort of mapping of the certificates back to the windows user.

I'm guessing I'll need dedicated Windows Users for each administrator, with sync'd certificates. Note this is Win2k8 R2 + IIS 7.5, not exchange or domain driven stuff, just a plain server without all the AD crap.

I have multiple IIS7 websites hanging off 1 IP, using different ports.

All three sites use Z.A.B.C:XX, where XX is {100, 200, 300} *

There's no web.config settings not making :300 not work, the bindings are set ok. I can even change the ports so 200 becomes 300, but the original 300 still doesn't work. They are all shown by IP, so it's not DNS. There's no SSL setting differences between them. I can't see anything in metabase.xml that would make one behave differently to another.

Are there any other settings in IIS7 that I might not be finding, that would fix the issue?

* not the real values.

Update:

The website being hosted, no matter the port, always returns 500 errors. This has been working in the last few days, tempted to try rolling back the website from backups, see if it's anything to do with that. Because I'm sure as heck that it's nothing in the IIS setting side.

Since the site has been deleted, the IIS > Web Sites listing to get the identifier doesn't work (since it's not there)

Is there another way to get the identifier?

I have a multitude of LogFiles in system32, all listed by W3SVC ID, but none contain any identifying information about the website it's logging, so I have to go by ID.