This doesn't work
CREATE ROLE "role-one" LOGIN;
CREATE ROLE "other_role" LOGIN WITH "role-one";
I get this error
ERROR: unrecognized role option "role-one"
LINE 1: CREATE ROLE "other_role" WITH "role-one";
What am I doing wrong? I can't find examples online that make it clear to me what the syntax is. From what I have seen this should work.
How do I create a new role with LOGIN and add it to another role named role-one?
Set-MpPreference -DisableRealtimeMonitoring disables the first one, what are the specific switches to disable the others you see when you open the UI? I have not found a clear example of this in the docs and I don't feel like running EVERY disable switch because MS docs are bad.
AWS documentation says "For Windows instances, the instance console output displays the last three system event log errors."
So thats obviously wrong. When I run "get system log" on one of my EC2 instances from the web console i see
2017/05/23 21:43:15Z: EC2ConfigMonitorState: 0
2017/05/23 21:43:15Z: Windows sysprep configuration complete.
2017/05/23 21:43:16Z: AMI Origin Version: 2016.12.14
2017/05/23 21:43:16Z: AMI Origin Name: Windows_Server-2012-R2_RTM-English-64Bit-Base
2017/05/23 21:43:16Z: OS: Microsoft Windows NT 6.3.9600
2017/05/23 21:43:16Z: OsVersion: 6.3
2017/05/23 21:43:16Z: OsProductName: Windows Server 2012 R2 Standard
2017/05/23 21:43:16Z: Language: en-US
2017/05/23 21:43:16Z: TimeZone: Coordinated Universal Time
2017/05/23 21:43:16Z: Offset: UTC 00:00:00
2017/05/23 21:43:16Z: EC2 Agent: Ec2Config service v4.1.1396
2017/05/23 21:43:16Z: Driver: AWS PV Network Device v7.4.3.0
2017/05/23 21:43:16Z: Driver: AWS PV Storage Host Adapter v7.4.3.0
2017/05/23 21:43:17Z: Message: Waiting for meta-data accessibility...
2017/05/23 21:43:17Z: Message: Meta-data is now available.
....
2017/05/23 21:43:26Z: KMS: Server:169.254.169.251; Attempt:1
2017/05/23 21:43:26Z: Message: Product activation was successful
2017/05/23 21:43:26Z: Message: Windows is Ready to useii
Thats not a windows event log and its not just the "last 3 errors". Where is the output Im looking at located on the instance and why does the documentation say it should be error system event logs when it is not?
Is there a way to know the current running config is outdated? Is there a way to view the current running config and compare it to the file?
It would be valuable for troubleshooting to know what the running config was before running reload. Also valuable if the command would tell me if it actually updated the config.
Running Centos 7 (various versions)
The rpm DB on my servers keeps getting corrupted. It seems like every few weeks I have to do an rpm rebuild on a server or two.
Where should I look to see what could be the culprit? I know how to fix this when it happens, but how can I identify if this is a specific package I'm installing or if something is triggering this?
I want to use cloudformation to automatically join new instances to AD.
When I googled this it looks like many people just use scripts in there cloudformation templates and pass in credentials- I don't want to do that.
This article shows how this is seamless if you have the AWS Directory setup.
I already have an AD Domain setup with my own DCs, can I just use the AD Connector or something so I can seamlessly join new instances to that like I can with the AWS Directory Service?
Windows 10, server 2012 R2 domain
I'm confused about the options for recovering a bitlocker encrypted drive offline.
Lets say I'm encrypting the HDDs of domain computers with bitlocker using TPM (not storing the keys on usb/floppy drives) and backing up the keys to AD and the keys are available to me.
Can I pull a HDD from one of these TPM bitlocker encrypted computers then attach it to another computer as an external drive (with usb to sata cable or whatever) and then recover the bitlocker key from AD for that drive and use it to decrypt it and read the data?
Where is the GAL actually stored in AD?
I always assumed in was inside of the GC. Is this correct? I know clients must query the GC in order to access the GAL, but is the GAL inside of the GC?
Where would I go to view it in adsiedit?
I want to clear a users stored credentials on a remote machine. Without having to have the user login and open the Cred manager GUI or run CMDKEY with them logged in.
Is there a place on the file system under the user's profile with the stored creds? Can I just delete them off the file system that way to clear the cached creds of another user?
On a Windows 8 client.
I can browse to my sharepoint site in 365 without issues: https://myPublicserver.sharepoint.com
But when I try to map a drive to that address I get this error: "The folder you entered does not appear to be valid"
I made sure to add https://myPublicserver.sharepoint.com to my trusted list of sites.
What could the problem be?
Edit: OK I tried to do it with net and this is the error I get:
C:\Users\me>net use b: https://mypublicserver.sharepoint.com/my%20lib
System error 224 has occurred.
Access Denied. Before opening files in this location, you must first add the web
site to your trusted sites list, browse to the web site, and select the option
to login automatically.
I can confirm though that the site has been added to the trusted sites list.
In bash I can do Ctrl+R and start typing a command to have it search my history.
How do I do that in powershell?
Is there a way to bind a key to something like?
function GH($str) {get-history | select-string $str}
But I would need to re-read the string for each char input or removed to output matching commands like Ctrl+R does.
Is this possible?
From VMware's docs:
Virtual NUMA topology is available to hardware version 8 virtual machines and is enabled by default when the number of virtual CPUs is greater than eight. You can also manually influence virtual NUMA topology using advanced configuration options.
So lets say I have a VM I have assigned 8 CPUs- its running Virtual NUMA. If I have an old non NUMA aware application running on the server would it not run very poorly or at the very least not as well as it would in non V-NUMA mode?
I assume V-NUMA is enabled like this because if an app vendor recommends 8 or more cores the software would most likely be NUMA aware. Or are there many applications with multi-core support baked in, but not NUMA support?
How would I identify a bottleneck caused by this possible issue?
Edit: Had a thought is there a metric in vCenter for monitoring remote NUMA calls?
I have never understood what a Site Link Bridge actually does, and from all the conflicting info on the web it seems almost no one else does ether.
But according to this guy (pretty reliable video training source), Site Link Bridges are just non-transitive Site Links.
He doesn't address this in the video, but that would mean that if I disable the Bridge All Site Links option, which means Site Links are no longer transitive are they then the same thing as Site Link Bridges?
This confuses me, because in a lot of stuff I have read it says you need to use Site Link Bridges when you disable bridge all site links, but from this definition it would seem they are only useful when you have Bridge All Site Links enabled.
Running debian (Linux Rick 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt11-1+deb8u6 (2015-11-09) x86_64 GNU/Linux)
Looking at my cpuinfo I can see I have vmx support:
flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 popcnt aes lahf_lm ida arat dtherm tpr_shadow vnmi flexpriority ept vpid
The host and guest OS(Centos minimal ISO) are both x64 so the architecture is the same between the two of them.
Following these steps to create a new VM from an ISO I get a warning about hardware acceleration support:
sudo qemu-img create -f qcow2 /var/lib/libvirt/images/centos01.qcow2 8192sudo virsh net-start defaultsudo virsh net-autostart defaultsudo virt-install -r 2048 --accelerate -n centos01 -f /var/lib/libvirt/images/centos01.qcow2 --cdrom /home/morty/ISOs/CentOS-7-x86_64-Minimal-1511/CentOS-7-x86_64-Minimal-1511.isoAnd I get this warning:
WARNING KVM acceleration not available, using 'qemu'
The VM is running, but I guess KVM acceleration isn't in affect? How can I enable acceleration and what am I missing without it?
On a Win7 box.
I downloaded mysql-5.7.9 and I am attempted to run it as its own self contained instance along side another instance of an old version that is already running.
I installed a new service with this command:
"C:\mysql-5.7.9\bin\mysqld.exe" --install mysql579 --defaults-file="C:\mysql-5.7.9\bin\my.cnf"
Here is the my.cnf:
[client]
port = 3307
socket = mysql579
[mysqld]
basedir="C:/mysql-5.7.9"
tmpdir="C:/mysql-5.7.9/tmp"
datadir="C:/mysql-5.7.9/data"
port = 3307
socket = mysql579
character-set-server = latin1
collation-server = latin1_general_ci
server-id = 2
[WinMySQLadmin]
Server="C:/mysql-5.7.9/bin/mysqld.exe"
I'm not sure if this is the right command to troubleshoot this because I don't think its using my options file, but this is what I see when I run C:\mysql-5.7.9\bin>mysqld.exe --defaults-file="C:\mysql-5.7.9\bin\my.cnf" --standalone --console
2015-12-16T20:59:53.098442Z 0 [Warning] TIMESTAMP with implicit DEFAULT value is deprecated. Please use --explicit_defaults_for_timestamp server optio
n (see documentation for more details).
2015-12-16T20:59:53.098442Z 0 [Warning] Insecure configuration for --secure-file-priv: Current value does not restrict location of generated files. Co
nsider setting it to a valid, non-empty path.
2015-12-16T20:59:53.098442Z 0 [Note] mysqld.exe (mysqld 5.7.9) starting as process 68544 ...
2015-12-16T20:59:53.114042Z 0 [Note] InnoDB: Mutexes and rw_locks use Windows interlocked functions
2015-12-16T20:59:53.114042Z 0 [Note] InnoDB: Uses event mutexes
2015-12-16T20:59:53.114042Z 0 [Note] InnoDB: Memory barrier is not used
2015-12-16T20:59:53.114042Z 0 [Note] InnoDB: Compressed tables use zlib 1.2.3
2015-12-16T20:59:53.114042Z 0 [Note] InnoDB: Number of pools: 1
2015-12-16T20:59:53.114042Z 0 [Note] InnoDB: Not using CPU crc32 instructions
2015-12-16T20:59:53.145242Z 0 [Note] InnoDB: Initializing buffer pool, total size = 128M, instances = 1, chunk size = 128M
2015-12-16T20:59:53.160842Z 0 [Note] InnoDB: Completed initialization of buffer pool
2015-12-16T20:59:53.238843Z 0 [Note] InnoDB: Highest supported file format is Barracuda.
2015-12-16T20:59:53.441644Z 0 [Note] InnoDB: Creating shared tablespace for temporary tables
2015-12-16T20:59:53.441644Z 0 [Note] InnoDB: Setting file '.\ibtmp1' size to 12 MB. Physically writing the file full; Please wait ...
2015-12-16T20:59:53.628845Z 0 [Note] InnoDB: File '.\ibtmp1' size is now 12 MB.
2015-12-16T20:59:53.628845Z 0 [Note] InnoDB: 96 redo rollback segment(s) found. 96 redo rollback segment(s) are active.
2015-12-16T20:59:53.628845Z 0 [Note] InnoDB: 32 non-redo rollback segment(s) are active.
2015-12-16T20:59:53.628845Z 0 [Note] InnoDB: 5.7.9 started; log sequence number 1210148
2015-12-16T20:59:53.628845Z 0 [Note] InnoDB: Loading buffer pool(s) from C:\mysql-5.7.9\data\ib_buffer_pool
2015-12-16T20:59:53.628845Z 0 [Note] Plugin 'FEDERATED' is disabled.
2015-12-16T20:59:53.628845Z 0 [Note] InnoDB: not started
mysqld: Table 'mysql.plugin' doesn't exist
2015-12-16T20:59:53.628845Z 0 [ERROR] Can't open the mysql.plugin table. Please run mysql_upgrade to create it.
2015-12-16T20:59:53.628845Z 0 [Note] InnoDB: Buffer pool(s) load completed at 151216 15:59:53
2015-12-16T20:59:53.628845Z 0 [Warning] Gtid table is not ready to be used. Table 'mysql.gtid_executed' cannot be opened.
2015-12-16T20:59:53.628845Z 0 [Warning] Failed to set up SSL because of the following SSL library error: SSL context is not usable without certificate
and private key
2015-12-16T20:59:53.628845Z 0 [Note] Server hostname (bind-address): '*'; port: 3307
2015-12-16T20:59:53.644445Z 0 [Note] IPv6 is available.
2015-12-16T20:59:53.644445Z 0 [Note] - '::' resolves to '::';
2015-12-16T20:59:53.644445Z 0 [Note] Server socket created on IP: '::'.
2015-12-16T20:59:53.644445Z 0 [Warning] Failed to open optimizer cost constant tables
2015-12-16T20:59:53.644445Z 0 [ERROR] Fatal error: Can't open and lock privilege tables: Table 'mysql.user' doesn't exist
2015-12-16T20:59:53.644445Z 0 [ERROR] Aborting
2015-12-16T20:59:53.644445Z 0 [Note] Binlog end
2015-12-16T20:59:53.644445Z 0 [Note] Shutting down plugin 'ngram'
...
I was googling this and didn't turn up anything.
If you have 100 some odd Cisco routers and switches how do you push out new IOS releases? Certain not by manually logging into every device. The only thing I found was the Cisco Auto-Upgrade Manager, but that's only for ISRs.
Is the only way to deploy Cisco switch and router updates through scripts? I could script this, but before doing this I wanted to be sure that the only way to do this is with my own scripts.
edit: Just to be clear I'm not looking for a way to make the routers automatically update themselves just an automated way to push out IOS updates to the routers.
Edit: Just as an update Puppet Device Managemnet (with Foreman) works pretty well, but I may just go with SolarWinds NCM
You can create and deploy a certificate trust list as detailed here, but I'm trying to understand the advantages of this over just deploying root and intermediate certs with group policy the normal way. Why would I want\need to do this?
I was reading some technet articles as well as this one regarding the differences between the way VMware and hyper v doing CPU scheduling.
I was wondering if I could get some objective info on this. It would seem that the gang scheduling used by VMware is a HUGE disadvantage, but I don't want to just drink the coolaid. Does it seriously impact performance or do the latest iterations of VMware's hyper visors resolve this?
Edit: When I say disadvantage I mean relative to Hyper V's "free processor scheduling" or however KVM does it. The material I was reading didn't say there was any problems with "free processor scheduling" that are avoided with gang scheduling.
According to Microsoft here is what Bootrec /FIXBOOT does:
"This option writes a new boot sector to the system partition by using a boot sector that's compatible with Windows Vista or Windows 7"
And this is what Bootrec /FIXMBR does:
"This option writes a Windows 7 or Windows Vista-compatible MBR to the system partition"
Now isn't the MBR just a type of boot sector? What other types of boot sectors would it fix? I'm confused when I would use one over the other- isn't mbr the only boot sector windows uses?
I was attempting to get disk info of remote machines, including whether or not SMART is enabled on the drive by using the win32_diskdrive class.
This is trickier than I thought. While it's easy enough the read the status property I discovered something interesting in the Capabilities property- namely the value denoting if "SMART Notification" is available. This value will not appear unless the command is run in an elevated security context. So for example if I run (gwmi win32_diskdrive).Capabilities the SMART value (10) does not appear in the array of values yet if I run it in an elevated prompt it does appear. As far as I know you can't run a winrm session in an elevated context (and I'm not interested in cheesy schtasks hacks or psexec).
So then I attempted to map win32_diskdrive to the MSStorageDriver_FailurePredictStatus class. I think I would have to do this anyway because even if SMART appears in the Capabilities property that doesn't necessarily mean its enabled right?
I was mapping the PNPDeviceID property of win32_diskdrive to the InstanceName property of MSStorageDriver_FailurePredictStatus, but now my problem is that I do not think the InstanceName property is unique enough for this to work. For example here is my InstanceName: IDE\DiskST3250312AS_____________________________JC47____\5&350bf0c3&0&0.0.0_0
It shows the interface type (IDE) the model number (ST3250312AS) the firmware version (JC47) what I thought was a unique identifier of some kind (5&350bf0c3&0&0.0.0) then what looks like an index number (_0). When I google 5&350bf0c3&0&0.0.0 it turns up some info on the drive so I don't think this number is unique. That means the the uniqueness is in the index number which is not included in the PNPDeviceID property of the win32_diskdrive class. This is an issue because many of our servers have multiple, identical, disks.
My concern is that MSStorageDriver_FailurePredictStatus would represent multiple disks like this:
IDE\DiskST3250312AS_____________________________JC47____\5&350bf0c3&0&0.0.0_0
IDE\DiskST3250312AS_____________________________JC47____\5&350bf0c3&0&0.0.0_1
IDE\DiskST3250312AS_____________________________JC47____\5&350bf0c3&0&0.0.0_2
And the PNPDeviceID property of win32_diskdrive of all of them would just be
IDE\DiskST3250312AS_____________________________JC47____\5&350bf0c3&0&0.0.0
How can I reliably map objects retrieved from win32_diskdrive to MSStorageDriver_FailurePredictStatus or do this another way with powershell via remote sessions?
Edit:
Well it looks like I was over-reacting. When I checked a bunch of servers I found InstanceNames\PNPDeviceIDs like this:
SCSI\Disk&Ven_TOSHIBA&Prod_MBF2600RC\5&354ecb35&0&000200_0
SCSI\Disk&Ven_TOSHIBA&Prod_MBF2600RC\5&354ecb35&0&000300_0
If no one can conclusively confirm this, in a day or so, I will just assume this value actually is unique and mark this as the "answer".