USD Matt's questions

I seem to have more and more issues with Microsoft pushing to try and force everything into their online service lately.

As of today I suddenly have two workstations that refuse to stay connected to Exchange. This is a local domain and a local Exchange server. Out of the blue they now pop up with a Microsoft online login window on start-up. If I close the window, the account status changes from being happily connected to Exchange to "Needs Password".

The login box is pre-populated with [email protected], and trying to click next just errors that "This account isn't on our system" (yeah, big surprise, it's a local domain, local exchange and nothing to do with Microsoft online).

What am I supposed to do about this? What is the correct way these days to let my users connect to their local exchange account without Outlook demanding they log into a non-existent Microsoft online account?

I have an Exchange 2019 server which is running fine but ideally I would like to run offline defrag on an archive database that is now way bigger than it needs to be after removing a mailbox which, due to an errant import, copied many times more data to the archive than actually existed in the mailbox.

Name                        DatabaseSize                    AvailableNewMailboxSpace
----                        ------------                    ------------------------
Archives                    50.13 GB (53,821,308,928 bytes) 49.8 GB (53,472,526,336 bytes)

Problem is, the databases are not accessible (Administrator gets a permissions error even trying to browse to them), and I'd rather not mess with permissions on Exchange folders unless I have no choice - or following Microsoft documented procedures.

What's the correct process these days to do any sort of recovery/maintenance directly on the database files when Exchange is by default set up to only allow access to itself? Is eseutil even supported anymore or do they not recommend touching the edb files at all?

I recently set up an internal Exchange 2019 server for a few users that we mainly use for testing. There are only 5 accounts on there, and in one case I imported the users entire existing email backup from PST file. This backup was around 10GB, although it didn't actually import fully as it hit the "TooManyLargeItems" error. I wasn't too fussed about this as I have a PST copy of each users mailbox as an offline archive.

A few days later I enabled the online archive for this user, using all defaults of >2 years on a standalone Archives database. After this I noticed that the Exchange drive was filling up quickly. Within a few days it had grown to 100GB of the 300GB I allocated it. Eventually I realised that it was the Archive database using excess space, and found that the archive for this user is just constantly growing. After a few days it was at 50GB -

Name                     FolderSize                      ItemsInFolder
----                     ----------                      -------------
Top of Information Store 0 B (0 bytes)                               0
Calendar                 124.1 MB (130,100,547 bytes)            10241
Deleted Items            29.06 KB (29,756 bytes)                     3
ExternalContacts         0 B (0 bytes)                               0
Files                    0 B (0 bytes)                               0
Inbox                    22.47 GB (24,125,848,037 bytes)        193193
Sent Items               27.09 GB (29,090,235,340 bytes)        224726
Sync Issues              0 B (0 bytes)                               0
Conflicts                379.5 MB (397,940,955 bytes)             5483
Recoverable Items        0 B (0 bytes)                               0
Calendar Logging         136.1 MB (142,698,692 bytes)            20681
Deletions                2.763 GB (2,967,210,171 bytes)          23899
Purges                   0 B (0 bytes)                               0
Versions                 0 B (0 bytes)                               0

Almost quarter of a million items in Sent and 200k in the Inbox.... This did not seem to stop and I have now been forced to simply disable the archive for this user.

Does anyone have any insight into how a mailbox that should only have <=10GB of email in it total can create a runaway archive like this, or what other methods I could use to understand why it happens?

I'm currently testing a new domain controller on Server 2019 Core. Bit late to this but it's my first time actually trying to achieve anything on Core so every single step is a hurdle. Just setting the IP address requires a google search...

At this point I have a domain controller set up, which wasn't too difficult, but I am now stuck at connecting to actually do anything with it.

My workstation is currently in our main company domain and I'd ideally like to avoid having to mess about creating trust relationships, etc, just to play with a system I may scrap and rebuild multiple times.

Server Manager just gets as far as "Online - Access Denied" when using the domain administrator account.

I could probably set up a windows 10 vm and log it onto the new domain as administrator, but is there no straight forward way I can get management access to this test machine otherwise?

I have inherited a VMWare installation that has an old version of the NetApp virtual storage console installed (it actually claims to be a "HTML5 technical preview, only for lab environment" when opening the overview).

This plugin doesn't appear to work and we've been told by the NetApp hardware support company that it's likely because of version incompatibilities (I assume VMWare/NetApp has been upgraded over the years and this plugin has at some point stopped working).

However, every now and then I get NetApp Create Backup tasks that start up before failing at 69% and sitting there doing nothing until we fully reset everything (As is the case with 90% of VMware tasks, you can't actually cancel it). It also creates a bunch of svmi snapshots that have to be cleared manually. We were told this is probably being initiated by software somewhere, but I'm starting to suspect this plugin as the documentation suggests it has a scheduled backup feature (https://library.netapp.com/ecmdocs/ECMP12412052/html/GUID-3524608B-3A8A-4127-8528-6D99A4E2206F.html).

Looking in VMWare documentation, I should apparently be able to go into Administration -> Client Plugins and disable the plugin. However, I don't get any options to do anything on this screen. Just a list (right clicking on any plugin also just brings up my standard browser menu)

The only other option I can find is using the java object browser on the vcenter server, but there are several netapp classes and I can see that ending in a broken vcenter server giving me scary errors about missing classes.

Does anyone have any further insight into how I can get this plugin disabled, or maybe just disable this backup job or confirm what's starting it.

I've managed to inherit a NetApp system and could do with some pointers for basic tasks. It looks like we may need to get a consultant in, but I don't see why checking these simple things should be this difficult...

First of all the system is running live NFS services for VMWare, but I can not get any info on the NFS configuration. I'm hoping this would at least give me some info on what volumes are doing what (as even they don't make sense, see below).

It shows 4 vservers, with 2 nodes -

                           Admin      Operational Root
Vserver     Type    Subtype    State      State       Volume     Aggregate
----------- ------- ---------- ---------- ----------- ---------- ----------
SAN2        admin   -          -          -           -          -
SAN2-01     node    -          -          -           -          -
SAN2-02     node    -          -          -           -          -
svm_nfs_sm
            data    default    running    running     svm_nfs_   san2_01_
                                                      sm_root    data

However, trying to list any nfs settings, with or without a vserver specified, just returns nothing

SAN2::> nfs show
This table is currently empty.

SAN2::> nfs show -vserver svm_nfs_sm
There are no entries matching your query.

Also regarding volumes, as briefly mentioned above, even they don't make much sense. I'm seeing 3 NFS mounts in VMware, reported as 3TB, 3TB & 1TB, but only 2 2.5TB volumes on the NetApp

svm_nfs_sm
          vmdatastore01_sm
                       san2_01_data
                                    online     DP       2.50TB    824.8GB   67%
svm_nfs_sm
          vmdatastore02_sm
                       san2_02_data
                                    online     DP       2.50TB     1.23TB   50%

I could do with some basic help to just try and inventory what is doing what, and where the data from VMWare is actually being stored...

Historically I've had a local user account for each email user and everything has been fine. Recently I've moved from Procmail to dovecot-lda, with Dovecot using its own user database.

Dovecot is quite happy to deliver mail, and let users collect it, without needing local user accounts. As such I've looked at trying to remove the local users and instead set dovecot to use a generic vmail user. TO test I've set the correct mail path for my test user in the Dovecot user database, but set the UID to be my vmail user and changed the ownership of the relevant mail folders to vmail.

This works fine for imap/pop connections, and manually running the dovecot-lda works fine. As far as I can see the entire delivery and collection process works fine as far as Dovecot is concerned.

However, If I try and deliver an email via Postfix, I get the following message:

status=bounced (unknown user: "test-user")

I thought this would be as simple as un-setting local_recipient_maps to stop Postfix trying to validate local users, but I just can't seem to get past this error. Is there some simple option I'm missing to make Postfix ignore the fact that a local user doesn't exist and just pass the message to dovecot?

Applicable Postfix config

mailbox_command = /usr/local/libexec/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT" -d "$USER"
local_recipient_maps =

virtual_alias_domains = $config_directory/local-host-names
virtual_alias_maps = hash:$config_directory/virtusertable

There's an entry in virtusertable for my test email address with test-user as the right hand side.

I have a server which is used purely for outbound email. I would like opendkim to sign every email going through, assuming it has a signing table entry. However, I can't seem to find any documentation for the correct MTA value I need, or any instructions on how to find it (I'm using Postfix).

Originally I had it set to the hostname, but I'm getting messages like the following in the log, which I find confusing as it shows no match, but lists matching values.

no MTA name match (host=my.full.hostname, MTA=my.full.hostname)

At the moment I have the MTA setting commented out, but it is currently only signing emails from authenticated users. I ideally need it to sign anything coming from an allowed relay source - without having to duplicate every single relay into the trusted/internal list.

I've been asked to look at a server for a customer as they are having trouble getting TLS 1.1 or 1.2 support to work. Their server integrates with a payment provider who will be requiring 1.2 soon.

According to Microsoft, this should be supported since they released update 4019276. https://support.microsoft.com/en-us/help/4019276/update-to-add-support-for-tls-1-1-and-tls-1-2-in-windows

However, Windows Update does not seem to list this update, and attempting to install manually just returns "The update does not apply to your system"

I'm at a loss as to why this update refuses to install.

Edit: Answering some questions from the first answer

• The update does not appear to be installed unless there's something broken causing it to not appear in Programs/Features
• The requirements for the update list only SP2 which is installed
• The customer is using IISCrypto to manage settings but this does not list 1.1 or 1.2 as an option.

I have a server running Windows Server 2016 Essentials. (Usually try and avoid the SBS type versions although I was hoping they hadn't hobbled things in 2016, ... but yes, they have)

This customers previous server backed up to a NAS using Symantec System Recovery, which we've always had good success with

On this system I'm trying to use the built in Windows Server Backup, which should be great right?

Unfortunately on Essentials it seems you can't backup to a network location. You can try and access Server Backup directly (rather than using the dashboard), but that wants matching accounts on both the system & NAS, and still complains about permissions issues. It also breaks the backup option in the dashboard.

I decided in the end it was easier to just follow the Essentials options and use a USB drive, however I'd rather not rely on that completely for the backup storage.

I would like to sync the backup files to the NAS, which I'm happy using RoboSync for. However, getting at the files seems to be a problem. I've already assigned a drive letter to the USB disk so I can see the backup folder - hoping that isn't already enough to upset the backup process.

It's still not possible to copy some of the data though, running RoboSync as an administrator with backup mode enabled.

It will access some of the files, and is currently copying the main image file (.vhdx) but is showing errors on other files like the following -

New File 18.7 g {faa21756-730f-11e7-be75-901b0ed00c98}{3808876b-c176-4e48-b7ae-04046e6cc752} 2017/07/28 09:23:43 ERROR 5 (0x00000005) Copying File F:\System Volume Information\{faa21756-730f-11e7-be75-901b0ed00c98}{3808876b-c176-4e48-b7ae-04046e6cc752} Access is denied.

Is there any way I can easily create a duplicate of the backup data without jumping through hoops? I've avoided changing permissions on the backup folders so far as I wouldn't be surprised if that breaks future backups.

Edit: Looking at this again, the only files that won't copy are in the System Volume Information folder, which is on the root of the USB drive. I don't think this is actually anything to do with the backup... Can anyone confirm that the WindowsImageBackup folder is all I should need to be able to recover the full machine in the future?

I'm using a combination of Postfix and Procmail to handle inbound email on one of my servers. Each user has a local account and I've been using the below /usr/local/etc/procmailrc successfully for years:

DEFAULT=$HOME/mail/
LOGFILE=/var/log/procmail

I've recently added a recipe to direct messages flagged as spam to a separate folder:

:0
* ^X-Spam-Flag: YES
$HOME/mail/.Junk/

However, it seems in some cases the messages going into this folder are owned by root instead of the correct user. I've never had this issue with the Inbox, and it also seems like it only affects certain users.

I managed to catch one of the Procmail processes in ps and it does seem to run as the correct user. (This user also has root owned mail in the Junk folder)

# ps axu | grep procmail
{correct-local-username}   7402   0.0  0.2  12140   1780 ??  Ss   11:37AM      0:00.01 /usr/local/bin/procmail -a

Does anyone have an idea why messages handled by the recipe would end up owned by root, while messages going to the default folder would get the correct owner?

Is there anything I can do (even if it's hacky such as calling chown from the Procmail recipe) to make sure the messages are always owned by the correct user?

In case it's of importance, Procmail is configured in Postix as follows:

mailbox_command = /usr/local/bin/procmail -a "$EXTENSION"