MrVimes's questions

I have a new server (Windows Server 2019) which I am trying to add to an old NLB cluster (It was set up on servers which previously did not consist of any servers newer than Windows Server 2003)

In NLB Manager on an existing member of the cluster I can load the cluster. If I try to add the new machine it tries for a while and then gives three log entries, one for each NIC of the new machine...

Could not read configuration of interface "{long guid}": error 0x8004100a

(one for each Network Card)

I have tried approaching this from the new server - I can load the cluster, and I can add this server to the cluster, but once I do, NLB Manager becomes unable to load the config from the other hosts. Specifically the last time I tried it I got host is misconfigured error for one of the other hosts (This is a host has been in the cluster without issue for years).

If I remove the new host from the cluster, and refresh the cluster, it loads the other hosts without issue.

I have quadruple-checked the network settings in the new server and can't find any conflicts.

None of the servers are domain joined, but that has never been an issue before (as long as either they all have identical username\password, or the username\password of a local account is specified when adding to NLB)

I have of course tried googling these errors without much luck.

Edit : I have now tried manually 'joining' the cluster by manually entering the cluster's IP addresses as extra IPs in the new server, then click the checkbox for 'Network Load Balancing' in the network properties screen. This seems to work, but if I open NLB Manager on one of the other servers it shows this host as unreachable, and I cannot ping it.

As soon as I reverse those manual changes I can then ping the server fine from one of the other servers.

It seems that attempting to join a cluster renders the server un-detectable by the other servers.

I have replaced an end-of-life server in a hosting center, with a new one running Windows Server 2019. The old and new servers were/are multi-homed. I have simply reused the network cables and assigned the same IP settings on the new server as were on the old (Windows Server 2003)

I cannot connect to one of the NICs and it shows 'Unidentified network' (and 'no network access' in the status screen)

If I add in the default gateway for that server it begins to work, but I get a warning from the OS

Warning - Multiple default gateways are intended to provide redundancy to a single network (such as an intranet or the Internet). They will not function properly when the gateways are on two separate, disjoint networks (such as one on your intranet and one on the Internet). Do you want to save this configuration?

(The other NIC is configured on a different vlan, has its own default gateway, and works fine)

The old server (and other 2003 server due to be replaced) worked fine without a default gateway entered. Is there something extra required in Windows Server 2019 to make this work?

We have a temporary situation where there is a remote office in the US connected via a vpn to servers in the UK (domain controllers, file servers, etc)

To try to improve things in the remote office I recently set up one of their computers as a local file server. To make it seem more appropriate I gave the computer a second DNS name so that instead of reaching it by \\computername they can reach it by \\localfileservername (the actual names are changed for this SF question)

This worked fine for a while. But now, when I try to access \\localfileservername I get "There are currently no logon servers available to service this logon request" but if I access it via \\computername it works fine.

Oddly I also get the error when I access it via \\ipaddress

Also to improve things in this temporary arrangement I have a number of servers set up in the hosts files of the machines at the remote office, and I added the name of this impromptu file server to the hosts file after I set it up (as well as in the DNS server).

So my question is, is having two names for the computer causing this problem? And is there anything I can do or check to improve this situation or get rid of this error.

Incidentally I'm finding this error occurring generally more frequently, in situations where the domain controllers are reachable.

I've tried following guides found on google for what to do when WSUS content folder gets too big, but I am still stuck with a massive WSUS content folder (141gb)

The last thing I tried was the reset method (stop service, delete all files, start service, run wsus reset command) but the day after, the wsus content folder grew back to its previous size.

I've got what I can determine to be the minimal classifications, and only one language, and I've got it set to only download updates that are approved.

(Also it's not showing Windows 10 in the classifications but that's a separate question)

Any ideas what I can do?, other than accept my fate and grow the drive it lives in?

I am thinking about setting the "Do not store update files locally; computers install from Microsoft Update" but that will mean increased internet usage.

Edit: Furthermore, I found the largest files, figured out they were for SQL Server 2012. Unchecked SQL Server 2012 from classifications, then ran the server cleanup wizard. It freed up 0 MB!

I have pointed an external website to a new IP address.

When I query the domain from an non-networked computer or device it picks up the change.

I've run dnscmd /clearcache on both DCs several times now and they keep getting the old IP.

There is nothing overriding the external IP on the DNS servers (no zones with the same domain name as the one I'm trying to update.

If I query the same external dns server that my DCs use for forwarding, for the url on a non-networked device I get the new IP. So the external DNS server has picked up the change.. but my DCs seem to be stuck with the old ip even after clearing the cache.

Edit: On further investigation (nslookup thedomain. externaldnsserver) the external DNS server is still serving the old ip address to my DC... but it serves the new IP address to other devices. I guess the problem (if it is a problem and not 'design') is on their DNS server.

Edit 2: The external DNS server in question is now returning the new ip. I will leave this question undeleted in case there is any value in it being left... unless anyone disagrees?

I have a GPO that is directly under the domain in the tree in group policy manager. Meaning it applies to all OUs in the domain. (This wasn't my doing)

The "Interactive logon: Message text for users attempting to log on" policy contains a security message in this GPO.

I want to be able to turn this message off for one or two servers, so that I can auto-log them in (the message interferes with this)

Is there a way I can override this policy for specific computers without reorganising the entire domain OU tree?

Most policies have an 'enabled' or 'disabled' option making it possible to override an 'enabled' with a more specific 'disabled' applied directly to an OU, but in this case that doesn't seem to be a possibility.

I need to allow standard domain users to be able to access the Resource Monitor on Windows 7 without adding them into the administrators group on any local machines. Is there a domain GPO setting to allow this?

Currently if they try to access it they are prompted for administrative credentials.

I have searched within GPME and I cannot find a setting myself.

Edit I think I may not be able to do this. Resource monitor also allows processes to be stopped and started, hence the need to require elevation to start it.

I have a Windows 2008R2 server that is a member of a domain. The other day I found that its time was different from the domain controller by seven seconds. I ran the following command...

w32tm /config /syncfromflags:domhier /update

net stop w32time

net start w32time

I then rebooted the server just to be sure. The time on the server was 'correct' in no time. But a day or two later the server has drifted again by 3 seconds.

All other member servers on this domain are fine (time is in sync to well within a second)

I've checked the settings in regedit and the 'Type' key shows 'NT4DS' which I believe is correct for a server synced from the domain. All other registry entries under that folder match a working server.

I believe all the correct ports are open between the server and the domain. The server has no other domain related problems.

The server is virtual (VMware). The virtual machine is not set to sync time with the host. Most of the other servers (that don't have this problem) are also virtual, on the same host pair.

Any ideas? Or any further areas I can check to verify the config?

Edit: New information. I just ran w32tm /query /status and got this...

Leap Indicator: 3(last minute has 61 seconds)

Stratum: 0 (unspecified)

Precision: -6 (15.625ms per tick)

Root Delay: 0.0000000s

Root Dispersion: 0.0000000s

ReferenceId: 0x00000000 (unspecified)

Last Successful Sync Time: unspecified

Source: Free-running System Clock

Poll Interval: 10 (1024s)

On a different server the 'Source' paramater lists a domain controller. So there is definitely a 'good' reason for this server to have the problem. I will investigate this myself but providing it here for the benifit of those following this question.

Edit to provide screenshot of time synchronization task history...

I wanted to ask what the proper procedure for installing an SSL certificate onto two servers running IIS6 that are in an NLB load balancing configuration.

Yesterday I installed the certificates according to what I believed to be the correct procedure. Shortly after this I was getting cert errors on my iphone (but nowhere else - chrome, IE, firefox were all fine)

Since then the site's SSL is not generating errors on my iphone either (Safari, chrome) but I don't feel confident that I've done this properly...

• In IIS 6 request the certificate using the update option.

• Use the resulting CSR to get the certificates (from godaddy)

Root Cert....

• Using the acquired certificates, complete the pending request in IIS6.

• Still in IIS6 export the cert.

• On the other server - Import the cert into the 'Personal Certificates' store in the certificates snap in in MMC.

• In IIS6 (still other server) choose the 'change certificate' option, and choose the newly imported certificate.

Intermediate cert...

• Import the intermediate cert into the "Intermediate Certification Authority"

• Here's where I'm unsure if I've done the right thing - I didn't export the imported intermediate certificate and then import it on the other server. Rather - I simply imported the same file again. I did this because I seem to remember learning in the past that the export-import did not need to be done for the Intermediate certificate. (Also, to this day I still don't fully understand what the purpose/point of the Intermediate certificate is. I believe it is provided to support very old browsers?)

So my question is - Have I done this right? Is this the valid procedure for updating SSL on load balanced servers running IIS6?

Edit: Upon further investigation (with the help of - https://www.ssllabs.com/ssltest/) I have discovered that the Intermediate certs weren't present on the first server (I could have swore I installed them but obviously I didn't) I have now installed them and my site passes the "Additional certificates" test for each server.

I know how to demote a domain controller (done it before) but I need to do it for two physical old DCs on a much more 'important' and strictly controlled domain than that which I previously did it for. My question is what additional checks should I run to make sure nothing will break after I demote the domain controllers.

The domain in question is mostly virtualized (including the two new DCs). One of the new DCs has had the FSMO roles for a while now, without any issues, and it is the authorititive time server for the domain. When I run dcdiag it fails only one test (NCSecDesc). The failure of this particular test is acceptable because we will never have RODCs on this domain. All of the member servers have their DNS settings pointing at the new DCs.

As a pre-demotion experiment - can I switch these DCs off for a while to see that the domain continues to function without them? Would this not cause replication issues or other issues?

I apologise for asking what seems like an easilly googlable question but I've tried, and even Microsoft's own article on W32tm doesn't seem to mention it.

I have recently been configuring time sync for a new DC on an existing domain (to replace an old DC holding the FSMO roles and set as the reliable time source)

On one member server I saw a Root Dispersion of about 4 seconds when running w32tm /query /status which concerns me slightly, so I want to find out what it means.

This is going to seem like a silly question, but many many years ago I somehow got it into my head, perhaps from reading an article or speaking to people 'in the know' that a computer should not be run with 'odd' amounts of ram, such as 3, 5, 7 etc... Is there any truth in this whatsoever?

I have a vmware environment with many servers in it. I want to go through and alter the amounts of ram to reduce the overall ram usage and in many cases I want to give a server 3gb of ram as opposed to 4 or 2.

I have inherited an AD environment that contains hundreds of long-dead computer accounts. I want to start clearing them out. If I use the dsquery computer -inactive command it seems to ignore these computers and only return computers that have been active in recent months/weeks but not active in the given time period.

For example, if I run dsquery computer -inactive 4 I get one computer. If I run dsquery computer -inactive 3 I get about five. If I run dsquery computer -inactive 1 I get a large list. None of these lists show the very old computer accounts.

Am I misunderstanding what this command is supposed to do?

I recently installed Windows Server 2003 on a virtual machine and then added the IIS role.

(The reason for using an old OS is to make some old software work - Crystal Reports web server component)

I have not yet added any pages/apps to the website (except one very simple test html page with 'hello' paragraph tag in it before the re-installation of iis), but no matter what I try I get 'Service Unavailable' when browsing localhost or when browsing the site from outside the server.

I have tried the steps listed here - http://support.microsoft.com/?id=918041

I have tried the steps listed here - http://support.microsoft.com/kb/842493 (even though the machine is not a domain controller)

I have tried gradually giving more and more 'freedom' to the wwwroot folders to the various user/system accounts involved. No matter what I try - 'Service Unavailable'

Each time I try the site, the event viewer shows a series of warnings - "A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was 'xxxx'. The process exit code was '0xffffffff' each with a different process id, and then "Application pool 'DefaultAppPool' is being automatically disabled due to a series of failures in the process(es) serving that application pool.

I also tried removing the IIS role, then re-adding it (but this time - without the APS.net component)

The server is fully updated.

Any ideas?

I have googled how to list locked out accounts and found two methods so far, both of which don't work...

Saved query - (&(&(&(objectCategory=Person)(objectClass=User)(lockoutTime>=1))))

Lists a number of accounts, many of which are not locked out. If I unlock one that I happen to know is locked out, it still gets returned by the query.

Powershell command - Search-ADAccount -LockedOut

Does nothing.

So either - Am I doing something wrong? Or - Is there a method that actually works?

I have been moving user profiles from one server to another. For the question we'll call them 'oldserver' and 'newserver' and the user is 'jbloggs'

While the user is logged out...

Copy the entire profile of jbloggs (\\oldserver\users\jbloggs) to the new server using robocopy.

When that is complete, rename the old folder to 'moved_jbloggs'

Then go into active directory and change the 'Profile path' to \\\newserver\users\jbloggs\profile and 'Home folder' 'Connect U:' to \\newserver\users\jbloggs

I have also changed the group policy 'redirect my documents' setting from \\oldserver\users to \\newserver\users

But when jbloggs logs in, a new folder is created in oldserver! \\oldserver\users\jbloggs\jbloggs's documents

Does anyone know what could cause the user folder to be re-created on the old server? Is there a further step that needs to be taken?

I need to retire a file server soon.

I was wondering if there is a correct way to transfer department shares and user profile folders to the new server in a way that retains all folder and subfolder permissions settings?

And secondly are there any 'best practices' to follow when doing this?

Possible Duplicate:
Can you help me with my software licensing issue?

We are looking to set up a virtualization environment. As I assume is standard this will include more than one physical server to run the virtual machines. As I also think is standard (I could be wrong, please correct me if I'm wrong) the servers will be in a master/failover type arrangement. Meaning the virtual machines will run on one, and if the server should fail the virtual machines are switched to the other.

My question is, do I need to purchase two data center licences for Windows Server (probably 2008 r2) to run this arrangement?

I ran the WSUS cleanup wizard in the WSUS MMC snap-in but this made no difference. I think the files are associated with System Center Essentials because they are in a folder called "data\SCE2007\WsusContent"

I've looked for a similar cleanup wizard in System Center Essentials but can't find one. Is there a way to clear these files out that doesn't cause issues for SCE or anything else?

FYI I've got both SCE and standalone WSUS settings already set to minimize the amount of updates downloaded from Microsoft to only those that are needed.

I am sure this is simple, but I did have a look and couldn't find anything. The property page of the particular task that updates the AV dat (or whatever) on client PCs doesn't contain any options to change the schedule.

I 'inherited' the setup from previous IT Managers, and the schedule is 9am and 9pm. Some of our users like to switch their PCs off when they leave, and so their PC is never on for any of the two update times. I therefore want to either - Change the overall schedule, Or - Alter it for the PCs in question.

Anyone know where I find this setting in Epolicy Orchestrator?