NaOH's questions

I am configuring a new Cisco edge switch stack, and temporarily I am trunking this stack through another edge switch back to my core switch (no spare fiber pairs to use to trunk directly). This is how they're configured (lots of extraneous stuff removed):

**2960X Edge Stack**
  vtp mode transparent

  vlan 10 (old data subnet, 10.1.10.0/24)
  vlan 1000 (management subnet, 10.255.10.0/24)
  vlan 1080 (new data subnet, 10.1.80.0/24)

  int gi1/0/48 (trunk to 3560 edge switch)
    switchport mode trunk
    switchport trunk native vlan 1000
    switchport trunk allowed vlan 10,1000,1080
    spanning-tree portfast network
  
  int gi3/0/30 (edge port)
    switchport mode access
    switchport access vlan 1080
    spanning-tree portfast edge

  ip routing
  ip route 0.0.0.0 0.0.0.0 10.255.10.254

**3560 Edge Switch**
  vtp mode transparent

  vlan 10
  vlan 1000
  vlan 1080

  int gi0/3 (edge port)
    switchport mode access
    switchport access vlan 1080
    spanning-tree portfast

  int gi0/20 (trunk to 2960 edge stack)
    switchport mode trunk
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 1000
    switchport trunk allowed vlan 10,1000,1080
    spanning-tree portfast

  int gi0/49 (trunk to 9300 core switch)
    switchport mode trunk
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 1000
    switchport trunk allowed vlan 10,1000,1080
    spanning-tree portfast

  ip routing
  ip route 0.0.0.0 0.0.0.0 10.255.10.254

**9300 Core Switch**
  vtp mode transparent

  vlan 10
  vlan 100 (server subnet, 10.1.0.0/24)
  vlan 1000
  vlan 1080

  int te1/1/2 (trunk to 3560 edge switch)
    switchport mode trunk
    switchport trunk native vlan 1000
    switchport trunk allowed vlan 10,1000,1080
  
  int Vlan10
    ip address 10.1.10.254 255.255.255.0
    ip helper-address 10.1.0.1

  int Vlan100
    ip address 10.1.0.254 255.255.255.0

  int Vlan1000
    ip address 10.255.10.254 255.255.255.0

  int Vlan1080
    ip address 10.1.80.254 255.255.255.0
    ip helper-address 10.1.0.1

  ip routing

A device connected to an edge port on the 2960X in VLAN1080 (gi3/0/30 in this case) cannot get a DHCP address, and even with a statically-assigned address can't ping the gateway (10.1.80.254). If I put that port in VLAN10 instead, it will get a DHCP address and can ping everything as expected.

A device connected to an edge port on the 3560 in VLAN1080 will get a DHCP address in the correct scope (10.1.80.0/24) and can ping the gateway (10.1.80.254).

What seems to be happening is that the 3560 is maybe stripping the 802.1Q tags when traffic is traversing from the 2960X to the 9300, but I don't see any reason it should be doing that. Can anyone suggest what's happening here and how to fix it?

Between two server rooms on an office campus I have three pairs of fiber with an interconnect panel in the middle. Two of the three pairs were connected before I started here and are working. I cannot get a connection over the last pair for the life of me. I've tested all my patch cables and transceivers and I know they're all good, and I've had the fiber tested and it's good, so I have to assume maybe I've got an incompatibility somewhere?

The SFPs I'm using are 10Gbps/850nm multimode. The patch cables are OM1 2.0mm LC/ST. If I run from one switch to the other with an LC/LC or LC/ST - patch panel - LC/ST they get connected fine. Then if I try to run from one server room to the interconnect panel, no dice. I have tested both polarities to confirm that's not the issue. The cable that's running between that server room and interconnect panel is labeled 04/97 - FTB250MN which I believe refers to a 250um fiber diameter. Is that potentially the issue? I don't know but that might be singlemode fiber?

We are using a Nutanix cluster though this could just as easily apply to VMware. We use RDP sessions from a Windows 2012 server to thin clients running either Windows 8, 10, or HP ThinPro to provide HMIs in an industrial setting. Currently I have to schedule maintenance on our (infrequent) down days as my operators freak out if the RDP sessions drop even momentarily. We have noticed that migrating VMs often causes these sessions to drop.

Is there a way to configure either the thin clients or the server so that the connections could weather the perhaps several millisecond-long outage as the VM migration completes?

I'm using RADIUS for port security in my environment on publicly accessible ports (meeting rooms, etc.) We have HP Procurve switches and Aruba Clearpass is handling the authentication requests (with Active Directory DCs on the back end).

It's set up to default to a guest VLAN (which has no routing into our production VLAN, only out to the internet) and then switch to the production VLAN with a successful AD authentication.

In the meeting rooms we have fixed laptops and I'm having a problem currently that when the laptops have been logged out for longer than the "unauth" period (60 seconds currently), they get kicked back onto the guest VLAN. Then users whose credentials aren't currently cached on these laptops aren't able to hit the DC to log in on the laptop.

I'm not sure how to solve this exactly. I'm reticent to give one of the DCs an interface in the guest VLAN because I'm not sure about the security implications. What else could I do?

We're using Exchange 2010. We have a user who is receiving thousands of NDR messages from our Exchange server as a result of a spammer using his address to spam a ton of Yahoo and Hotmail addresses.

I've tried disabling NDR messages under Remote Domains, I've enabled RecipientValidation, no dice. How can I prevent Exchange from generating these emails?

Recently I have consolidated all our Dell Equallogic SANs into the same group; previously each SAN was in its own group. They are all populated with 15k RPM SAS drives in RAID 6 so I haven't bothered to tier the storage of the new consolidated group as they're basically all the same.

In the process of doing so, I have changed all our VMs to use VMDK storage instead of iSCSI because I believe the performance to be better.

I'm being told now that the disk I/O performance of our MS SQL 2005 server (our main SQL box, for now) has been consistently worse than prior to performing these operations, but I can't see how that could be... its disks (C - OS, D - MDFs, E - LDFs) are now spanned across way more read heads than they were previously, and my understanding is that VMDK storage is more performant than iSCSI.

So what gives? Here's a graph of the "total I/O wait time" from Solarwinds Database Performance Analyzer:

We have a 10Mbps (synchronous) connection with our ISP. Recently we have discovered that if a single user is watching Netflix, or if I run Windows Update on a PC, we will totally saturate that 10Mbps and the rest of the users in the company (~200 at this location) suffer very poor internet speed.

Our current firewalls are Fortigates but we're in the process of migrating to Watchguard. That being said, we haven't noticed this being an issue except for in the last few weeks, but we can't imagine what would have changed, and if we run the same sort of traffic through the Watchguard, the same issue crops up (we thought maybe the aging Fortigate was to blame).

Is this something that we should be talking to the ISP about? Is this something we should be controlling with our firewalls?

I've set up a mailbox like [email protected] that we would like people to be able to send emails to anonymously, creating a Transport Rule in Exchange 2010 as in this question: Is there a way to set up an Exchange mailbox to collect email "anonymously"?

This seems to work for external senders (when I send to this mailbox from my gmail account, the From field is appropriately stripped out) but this does not seem to work for internal senders... when I send to this mailbox from my Exchange email account, it still shows me as the sender.

Can anyone suggest how to correct this so it anonymises internal senders as well?

I have a few clients (notably only in the IS department) that aren't able to connect to Exchange 2010 with Outlook 2010 over our PPTP VPN connection, citing that Exchange is unavailable. This is true whether using an existing profile or attempting to create a new one. OWA functions fine and I can ping the mailserver by hostname, FQDN and IP address. There is a hosts file on all PCs and I have confirmed that they contain the exact same entries on the two PCs I'm testing this on.

It appears to be an issue with a few PCs as I have tested this with some other laptops and haven't had any issues.

I have double-checked the VPN configuration on my main PC (which, when connected to our guest wifi and VPNs in, will not connect to Exchange via Outlook) and on a test laptop (which will connect to Exchange in the same circumstances) but I'm not sure what other settings I should be looking at... Something in the way the Outlook client is configured?

I have a site with a DC I want to decommission, and a relatively new one (promo'd within the last two weeks). I'm having trouble demoting the old server, and in the process of trying to figure out why I'm running repadmin /replsum on a few of my DCs.

On most of them, I'm getting the error:

Experienced the following operational errors trying to retrieve replication information:

58 - c7908eb4-5ef4-46a7-b445-642b33ece726._msdcs.domain.com

I've looked around in DNS on the rest of my DCs looking for this listing, and I finally found it on my new DC mentioned above, and it refers to itself! So every other DC appears not to know about this DC, at least from a DNS perspective, but running repadmin /replsum on my new DC does not return any errors.

Why would this be happening, and what's the best way to correct it?

I have a domain separated into four sites. In one of my remote sites, I have promoted a new DC and will be decommissioning the existing DC in a few weeks. I didn't receive any errors when I did the dcpromo but I had to delay rebooting the server after the promotion for a few days.

After the reboot, it appears there are some serious problems on this new DC:

1. The directory service log is full of events 1864 (This directory server has not recently received replication information from a number of directory servers.), 2089 (This directory partition has not been backed up since at least the following number of days.), and 2093 (The remote server which is the owner of a FSMO role is not responding. This server has not replicated with the FSMO role owner recently.).

2. The system log contains many events 1006 (The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.) - info from the details tab is as follows:

   SupportInfo1 1
   SupportInfo2 5012 
   ProcessingMode 0 
   ProcessingTimeInMilliseconds 2184 
   ErrorCode 49 
   ErrorDescription Invalid Credentials 
   DCName
   

   As well as error 4 (The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server kelethdc01$. The target name used was E3514235-4B06-11D1-AB04-00C04FC2DCD2/2ee10a9d-dcf0-4940-b2e5-25044f90869c/[email protected]. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (DOMAIN.COM) is different from the client domain (DOMAIN.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.), and error 5782 (Dynamic registration or deregistration of one or more DNS records failed with the following error: TCP/IP network protocol not installed.).

Can anyone suggest what might have happened here, and how to correct?

I have been asked to generate a list of the security groups (so specifically not the distribution groups) that a list of approximately 50 users belong to.

I have a list of users, users.txt that contains each username on a new line. I want to generate a membership.txt that contains the username and a list of the security groups that user is a member of, separated by commas.

The Powershell script I have written so far is as follows:

$users = Get-Content C:\users.txt

ForEach ($User in $users) {
  $getmembership = Get-ADUser $User -Properties MemberOf | Select -ExpandProperty memberof
  $User + ',' + $getmembership | Out-File -Append c:\membership.txt
}

This almost works, but for two problems:

1. It is generating a list of all groups, not just security groups. How can I tell it to only include security groups and not distribution groups?
2. The groups are being appended in the format OU=Security Groups,OU=City,DC=domain,DC=com CN=Senior Leaders, but the only information I actually want is Senior Leaders. How can I cut out all the extra information?

I have a file server running on Windows Server 2008 R2 in our domain that houses files created by an application and then moved to a folder available as a share to some users here.

Users who use this share will receive an email when new files have been moved to this folder (by the application that moves them). Some users are reporting that when they browse to that folder that either it is empty or that there are no new files. I can go and look and see the new files but on their system even after a reboot they do not appear. It is only affecting a few users, all running Windows 7 Professional.

Initially I thought it might be some sort of caching or offline files problem but I've verified that offline files is disabled on these users' PCs. Permissions are also good and these users are local admins on their PCs.

Can anyone suggest why else this might be happening?

EDIT: A screenshot showing my system on the left and a user's system on the right, showing the discrepancy.

http://imgur.com/E7Elsh6

I have a user that is trying to assign delegates but receives the following error message when they try to access Delegate information in Outlook 2010:

The delegates page is not available. Cannot access Outlook folder.

I've found this KB article: http://support.microsoft.com/kb/2753709 but having performed the steps in the workaround, the string CN=Deleted Objects does not appear in the .ldf file generated (nor even the word Deleted).

I'm not sure what to attempt at this point. If I create a profile on my PC with his mailbox, the same issue occurs so it's not Outlook or his PC I'm pretty sure...

One of my employees is having trouble sending mail with attachments to an external party. We're using Outlook 2010 in conjunction with Exchange 2010 Standard.

Here's what I've deduced so far:

1. Sending from employee's mailbox on employee's PC to external party - email arrives with no attachment
2. Sending from employee's mailbox via OWA to external party - email arrives with attachment
3. Sending from my mailbox on employee's PC to external party - email arrives with attachment
4. Sending from employee's mailbox on my PC to external party - email arrives without attachment
5. Sending from employee's mailbox on my PC to my gmail account - email arrives with attachment

In all cases where the email does not arrive with the attachment, pulling the message up in OWA does show the attachment intact.

Initially I thought it was an issue with his Outlook setup, but now I'm not sure. The attachment is innocuous and actually doesn't appear to matter... We're trying to send a PDF but other types like images don't arrive either in the same circumstances as above.

At this point I have no idea what the issue could be. The recipient mailbox is hosted by a local ISP, so I have an idea he should maybe be reaching out to them, but the circumstances above are so bizarre I don't think they would be able to help. Can anyone suggest what might be going on here?

EDIT: I've just found out that this is affecting at least one other employee as well.

I know that your Exchange mailbox retains some information about Outlook properties... If I customize my view in Outlook, say, and move to another PC and load up my mailbox it brings those settings along. Is it possible to clear or reset these settings in an Exchange mailbox?

Basically my issue is spelled out in the title... I'm trying to enable access to OWA for internal users via the server name directly, which worked fine when we had Exchange 2003, but with my Exchange 2010 server it's being forwarded to the URL specified above. The OWA URL for external access is owa.domain.com/owa, so I'm not sure where it's getting this webmail prefix from... Any ideas?

Thanks!

I am attempting to create an account for an external contractor so that they can have an @domain.com email address and access that from OWA, but not log into any server or PC on the domain.

I've tried setting the Log On To... property to a non-existent PC, and this works in that they can't log into any PCs or servers, but they also can't log into OWA. I'm reluctant to grant them login access to the mail server, as I really want to deny them login access to any PC or server.

I'd also rather not need to use group policy to complete this, as I'd like it to only apply to this one user, and be easy to undo when/if they leave.

Thanks!

Is there a way that, upon first successful sync via ActiveSync, a user could be added to an Active Directory group?

I am trying to grant the Domain Admins group full access to all mailboxes in Exchange 2010, including new ones created after this is implemented. Doing some reading, I came up with the following Powershell command:

Get-MailboxDatabase | Add-ADPermission -User "Domain Admins" -AccessRights ExtendedRight -ExtendedRights Receive-As,Send-As

This didn't work, however. How can I do this?

Thanks!

In our organization we are running Exchange 2003 and 2010 simultaneously, with the hopes of migrating everyone to Exchange 2010 sometime within the next few months. Everyone is using Outlook 2010.

Recently, we had an issue with transaction log storage on the Exchange 2003 server. This was resolved, but for some reason no meeting rooms on the Exchange 2003 server will automatically book meetings any longer. I have played around with this for a while, changing calendar permissions, turning resource scheduling off and back on, etc. No dice.

My next step was to try migrating a resource to the Exchange 2010 server. After doing so, and setting it up as a Room, enabling Auto-Accept and removing the EnableDirectBooking registry entry on my PC, I can book a meeting with this room. If EnableDirectBooking is enabled, I get an error message stating:

"Meeting Room" declined your meeting because it is recurring. You must book each meeting separately with this resource.

This is despite the fact that the meeting I'm attempting to create has no recurrence.

Now, I have also created a new test Room from scratch on the Exchange 2010 server, and I can book a meeting with this Room regardless of whether or not I have the EnableDirectBooking reg entry in place. All users here have this registry entry, and I'd rather not have to figure out how to push something out to remove it from every PC. Rather, I'd like to figure out what's different between the configurations of these two meeting rooms so that I could book a meeting room regardless of whether EnableDirectBooking is enabled or not.

Any ideas, anyone? Thanks!