Brian Knoblauch's questions

I've got a VM stuck at "Getting Devices Ready" today. It's a DataCenter 2012R2 clone that I'm setting up for test purposes via the VMWare Clone operation. Not something I do a lot of, but have done a couple times now and normally it works. This time however, it won't boot...

I've heard of issues with the PNP Monitor and seen recommendations on booting into safe mode to disable that service. However, I can't seem to get into safe mode either. It appears that holding shift during boot is the only option on this version, and it does not seem to work (or I can't get from the start VM option over to the console tab fast enough).

Other ways to get into safe mode? If I do get in, is disabling PNP Monitor my best first choice?

I have one particular AD user, nothing really special about them that I'm aware of, that I'm unable to delete. The error is the "You do not have sufficient privileges to delete..." with the CN data which oddly has something about iPad App and ExchangeActiveSyncDevices in it and then "...or this object is protected from accidental deletion."

The accidental deletion protection option is off. I can't delete it from an account escalated to administrator nor from a full administrator login. This is not the only person with an iPad that has synced to our Exchange server. Is that a real clue or is it a misleading error? What else could be blocking deletion?

I've got several users that were doing "send as" operations from Outlook on-prem. Upon moving them to the cloud, some still can, but others suddenly cannot.

More interestingly, the "send as" list for the account they use did not match the people actually using it. There are people not in the list that were (and still could send as) while there are people in the list that can't send as!

I corrected the list with Add-ADPermission Group -ExtendedRights Send-As -user User entered at the on-prem server. No change whatsoever. I verified it did synch to the cloud fine. I then tried adding myself as I've never sent as before. My account propagated fine, but I also cannot do "send as" on that account.

A great many of the things I've looked at online suggestion address book problems and talk about how it will work in web but not thick client. In our case it also does not work in web and the address book fixes do not help.

I've also seen some scripts that suggest that "FullAccess" rights are required rather than just Send-As, but those scripts all fail with syntax errors as apparently "FullAccess" / Trustee commands do not work on my version of Exchange/Powershell?

Just migrated some accounts from an on-prem Exchange server to O365. Some of those accounts need IMAP access. IMAP access is turned on for those individual mailboxes in the cloud Exchange control panel, but it's not working. Pointing the client at the outlook.office365.com server for IMAP just comes back with bad account/password on the e-mail client. Is there some other setting on O365 that needs to be turned on for IMAP to work? Username should just be the e-mail address, correct?

I just found out the other day that even non-admin users are able to reboot/shutdown our Windows Server 2012 R2 terminal server. All they have to do is click the windows flag in the lower left, then click the power button and all the regular power options are available to them!

How do I go about restricting that permission?

I'm logged into the vSphere Client and I want to add a specific person from our domain to the Global Permissions list. I set the user prompt to domain and then I search for the name in the search box. However, this user does not show up. Our other users do show up though (even a couple calendar objects show up!). This user has been with us for over a year, so I don't know why he wouldn't have replicated by now. Is there some way to force a username in even when it doesn't find it naturally? Or, is there a way to make it update the list?

I have a Windows 10 VM on a VMWare ESXi (6.0.0, 4600944) server that occasionally will suddenly just "power off". I can be logged in and using it and the connection just breaks suddenly. Other VMs on the same server do not have this issue. No obvious timing or load issues.

The Windows event log is all normal events, then the gap while it's off, followed by the power up events.

The VMWare log simply states "powered off" with no description of how or why.

Not sure where to go on diagnosing this given how the event logs are so unhelpful. Ideas for debugging it?

edit

It's now impacting a total of 3 VMs on 3 different VMWare hosts. 2 of the VMs are Windows Server OS based terminal servers. Hardware is different on all 3 hosts. The only thing in common that I'm seeing at the moment is that they all do a lot of traffic over remote desktop service.

I'm trying to setup FreeBSD 10 with an account that can SFTP, but not SSH.

I've got my sftponly group and my specific account is a member of that group. My sshd_config contains:

Match Group sftponly
ChrootDirectory /home/account
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

The /home/account is mode 755 with root:sftponly ownership. In this configuration I can login, list the directory, and "get" files but cannot upload files (write permission denied). If I change the account directory to 775 to give the sftponly group write permissions, then the login is blocked. What's the appropriate setup for allowing read AND write SFTP operations with SSH blocked?

It's a long story, but one of my VMs ended up not being backed up through Veeam, but we DO have the raw nvram, vm*, and log files. It appears that I need to load it onto our ESXi server's datastore. However, I've not been able to find a way with vSphere. The thick client is available, but I don't see an option for loading onto the datastore. The thin client website version won't load, throwing errors about Adobe Flash failing to load. Is there a way to do something like SFTP? Some other method?

I've got a Windows 2012 server that is multi-homed (for some specific monitoring purposes, definitely not ideal, but it is what it is). Only one interface has a gateway setup (as that's the one that should be used for traffic that needs to be routed). It has no problem selecting the appropriate interface for "directly connected" (same subnet) communications. However, when traffic is destined for an address that requires routing it doesn't always choose the interface that has the gateway. Obviously this is a bad thing as that traffic will never get anywhere. My expectation would be that Windows would not attempt to source non-local subnet traffic on an interface without a gateway, however, this server is proving me wrong... Is there a way to force the one particular interface with the gateway to be the preferred (except for directly connected traffic as those subnets are directly attached for a reason)?

edit

I have tried playing with the metrics on the interfaces and the gateway. No success, does not seem to influence which interface is actually chosen.

I've got a user "Bob" with an interesting problem. He needs to send to the distribution group "group", but has a problem with the e-mails just vanishing. From the client (SMTP-AUTH w/TLS on the MSA port) standpoint, it's successful. Bob authenticates and the Exchange server accepts the e-mails. However, the Exchange server then fails to deliver them (tracing the message shows a "FAIL" in the "ROUTING", have not been able to get anything more detailed than that so far). Seems simple enough, but it gets more interesting when testing variations:

• Bob can send to any individual user on Exchange just fine through SMTP-AUTH.
• Bob can send to the group fine through the Exchange webmail interface.
• Bob can send to several other groups fine through SMTP-AUTH.
• Any new groups I add (for testing), Bob cannot send to through SMTP-AUTH, failing silently just as above (but works fine through webmail).
• If I swap my credentials into the program in place of Bob's, it sends fine to the group.
• If I create a new user (for testing) and use those credentials, it fails to send to the group with an authentication error returned to the client, but sends to individuals fine!

I'm kind of at a loss here, it's such a specific set of circumstances that I can't even think of a mechanism in the server that could cause it. Sounds permissions related somehow, but why would one submission form succeed when another fails for only these very specific cases?

I just installed a fresh openSuSE 13.2 VM onto ESXi 6. I did the VMware-install.pl process and it completes successfully, reporting as installed. However, both our monitoring software (What's Up Gold) and VSphere itself report that VMWare-Tools is not installed.

I've rebooted, uninstalled, reinstalled, rebooted some more, etc. Seems like perhaps I'm missing some secret setup trick, but I've installed this version of openSuSE, with VMWare-Tools, on previous versions of ESXi with no problems. Other openSuSE VMs installed previously have survived the ESXi 5.5 to 6 upgrade intact (no VMWare Tools issues there). Is there a change required for fresh openSuSE VMs in ESXi 6.0?

We just updated our VMWare servers over the weekend and have noted that all of our FreeBSD 9.2 guests are having networking issues. Specifically, ipv4 no longer functions (they can't even see equipment on the same subnet). IPv6 does still function though. We've had similar problems in the past and flipping the VMWare interface to another VLAN, then back has fixed it before, but not this time. We've also had interface names change during VMWare upgrades, but that's not the problem this time either. Google came up empty. Thinking this may be a brand new issue with the combination of that VMWare version and FreeBSD 9.2 (our FreeBSD 10.0 VMs are working fine). Anyone find a workaround yet that we could use to get these VMs IPv4 connectivity again?

I'm hung up on a "Error: The tool was unable to install Application Server Role, Web Server (IIS) Role." error (as shown in the install log).

So far, I've run across a couple supposed fixes (they don't work for me). Microsoft's site lists a KB that needs to be installed (and also some PowerShell to run). Other sites have a policy modification to get updates from MS directly (bypassing WSUS). Unfortunately, none of these seem to make any difference. What else should I try?

In order to make compliance with our PCI-DSS requirements, I was required to disable TLS 1.0 (apparently it has a flaw that was corrected in TLS 1.1 and higher). However, after doing so, remote desktop fails to connect to that server. Is there a way to connect to remote desktop servers without TLS? Perhaps configure remote desktop for a newer version of TLS?

I'm using a pair of SunRay 2 thin-clients in a dual-head configuration (via SRSS, with Xinerama). On the secondary display, the mouse cursor will sometimes decide to jump to the upper left corner of the screen while I'm moving it (very rarely it will jump to other locations). While not moving, it stays in place just fine. However, while in motion it will do that "warp somewhere else" type action. Does not happen when the cursor is on the primary screen. I'm able to replicate the problem on another Solaris server, with SunRay 1g thin-clients at another location too!

We've got a curious problem with one of our Solaris (10, U8) servers. If we have our extra storage array mounted via NFS, the Solaris user logins are exceptionally slow. Unmount the storage device and user logins get real fast again. Anyone ever encounter anything like this before?

I've got other Solaris 10 servers elsewhere with storage arrays mounted the same way that don't have the issue. Those other ones actually are attached to even slower pieces of equipment and should be worse, all else being equal.

I really don't understand why an NFS mount that shouldn't be involved in the login process at all is causing the slowdown.

Trying to install CollabNet Subversion Client on Solaris x64, but I'm hung up with:

## Verifying signature for signer <Alexander Thomas(AT)>
pkgadd: ERROR: Signature verification failed while verifying certificate <subject=Alexander Thomas(AT), issuer=Alexander Thomas(AT)>:<self signed
certificate>.

Any way to just bypass the certificate check? None of the options listed in the man page seemed appropriate.

I've found information on how to keep squid from caching domains/IP addresses, however, that's not quite what I want. I'd like to prevent it from caching .jnlp and .jar files.

The core problem being that when I push updates out to our server, our users that are behind a squid proxy may not get the updated version for several days (apparently it takes that long for squid to figure out that the files have changed). Perhaps I've missed an even easier solution?

I've got a computer spewing messages from RUNDLL about errors loading "c:\windows\ajavuviy.dll". Seems to happen mostly when idle and can generate probably 40-50 error windows pretty quick.

Google came up completely empty on this. Thinking it's probably malware related, but am unsure. Anyone run across it before?