Brettski's questions

We are looking for a recommendation on setting up a redundant file share in AWS. AWS does provide the Amazon EFS (Elastic File Service), though it only supports NFS and doesn't play well with windows machines. It also seems Windows NFS support is pretty poor.

The EC2 VM's we'll be using, which need to access the file share, are Windows Server 2012R2 and AD joined. We would like to be able to have access to the files from at least 2 availability zones.

Amazon Storage Gateway was considered, though wanting access from two AZ's means there will be two writers pointing to one S3 bucket which is not recommended by Amazon.

Do we cluster two servers in two different AZ's? It seems like a lot of overhead and manual maintenance, but if that's the best approach...

I have noticed when I make changes to web sites or application folders in IIS7 the changes will be put in the web.config. Example changes are, default documents, response headers, etc.

I would like these changes saved in the applicationHost.config. I can use appcmd to achieve this, is there a way to achieve this using the gui?

The changes should remain site specific.

The following command can be used to determine if there has been configuration drift on a system:

Test-DscConfiguration –CimSession $session

The command only returns true or false. Is there a way to retrieve a list of what those differences are?

Is there a way to build a PowerShell desired state configuration (DSC) configuration file from a current system? Opposed of building the entire file from scratch?

A VM Windows 2008 R2 server was just setup with 12 cores and 12 GB ram. When I look at Task Manager only 8 cores show. When I look at WMI only 8 cores show. Looking in Device Manger 12 processors show. Can someone explain the difference between the core count in Device manager vs. WMI?

We have three machines with this config and they all show this way. In addition Computer Properties only says 4 processors; which matches with the 8 cores reported in WMI (4 * 2).

Oh and there are 12 cores allocated to this VM in the VMWare configuration

Is it that the Windows 2008 R2 license/version only allows up to 4 CPU? Is there a way I can check?

I am in the process of standing up new web servers from one in the farm (expanding the farm). These are Windows 2008 R2 servers (IIS 7.5). Part of the process of copying the applicationHost.config from one machine to a new one is that the RSA keys need to be copied to that machine as well; otherwise there may be issues with your application pools especially if you are using a domain user as a custom [pool] identity.

On the farm machine I am modeling from I use the following commands to export the .NET v4 keys:

aspnet_regiis.exe -px "iisConfigurationKey" "c:\temp\iisConfigurationKey.xml" -pri
aspnet_regiis.exe -px "iisWasKey" "c:\temp\iisWasKey.xml" -pri

When I run either of these commands I receive the error "RSA key container was not found". I have tried this from both .NET v2 & v4 and from Framework and Framework64 with the same results.

Is there a way I can determine where the keys are stored on this machine so I may get them transferred. I am a bit stuck until I can do this and be able to decrypt data in the applicationHost.config and get the app pools running again.

I guess my other question is, is there a way to reset the keys on the new machine (or reset the applicationHost.config file) so I may set a new custom identity on the application pool?

I use a Windows 2008 R2 server for sending (relaying) outbound emails to clients. Many of these clients are now requiring TLS connections to send them email. To date I have set up a an SMTP "Remote Domain" and forced TLS to that domain. Keeping up with the list of domains is becoming a daunting task. A. Windows SMTP doesn't have an easy way to script the addition of remote domains, and B. there is no way to import or export the domains.

To remove all this manual work we would like to set up opportunistic TLS on the server so any receiving SMTP server requesting TLS, my server will connect using TLS. Is this at all possible to setup in Windows Server 2008 R2?

We are using self-signed certificates for internal development machines and other internal connection encryption.

The certificates were created using Microsoft Certificate Server.

I need to move the certificate server from an old DC to a new DC, I am wondering how long the certificate server can be unavailable before the certificate cannot be verified and connections begin to fail.

I don't believe it is immediate, but I don't recall for sure.

I am considering using BitLocker to encrypt a server's data partitions. It isn't fully clear in the documentation; does the system volume (partition) need to be encrypted before other partitions on the system may be encrypted?

I have an SQL 2008 Server configured as a fail-over cluster an have a requirement to have the database files (mdf/ldf) encrypted. We have tried to use EFS for this but there are a lot of issues doing this and often the file get corrupted and unusable.

Other than using SQL 2008 Enterprise are there any other options you can suggest?

A client wants us to push data files to them on a daily basis using SFTP (FTP over SSH). We are a 100% Microsoft shop with no Linux admins on staff. I am looking for recommendations on how to do achieve this. I have seen different applications for automating the sending of files via SFTP, but I don't know if they are a good approach or not.

What have you found to be the easiest way to deal with this in a Microsoft Environment?

We have subdomain entries in our local DNS server which we use for web development. The IP's they point to our bound to web sites.

For Example:
FarmA.webstaging = 10.1.10.10
FarmB.webstaging = 10.1.10.11

The domain name entries have been setup for many years now and work fine with XP and Server 2003 systems.

Now that we are rolling Windows 7 into our environment we are having issues with these entries. You cannot browse or ping the names, but if I use nslookup I do receive the correct IP address.

When you ping the FQDN (e.g. FarmA.webstaging.ourdomain.com) the name resolves as expected. Checking the DHCP information I received I have a primary DNS Suffix of ourdomain.com and ourdomain.com is listed in DNS suffix search list. So I should not need to include the domain name.

If I add entries into the hosts file, I am able to browse and ping the name, it resolves correctly.

What I would like to find out is why this is happening and if there is a way to correct this issue without having to add hosts file entries to each windows 7 machine. (I have not tried Windows Server 2008 yet).

Update: What I have noticed is that the name will resolve using nslookup.

nslookup FarmA.webstaging 

works fine in resolving the ip address; ping cannot resolve.
I have noticed in the past that ping and nslookup seem to resolve addresses differently, something I have not been able to discover why.
I

We have recently received a few client contracts where all client files must be encrypted at all times. The challenge we are having is sharing encrypted files and simultaneous access on network shares.

There are thousands of files which need to remain encrypted and accessed by different users and services. Microsoft's encryption hasn't worked very well for us under Windows XP and assigning multiple certificates to a file so multiple people may access them is cumbersome and error-prone.

We are currently using PGP NetShare on our clients folders but are running into issues when multiple people access a file (e.g. Microsoft Access) or viewing thousands of files in a folder (the list keeps refreshing returning your view to the top, Windows Explorer).

We are contacting PGP about these issues, but I thought it a good time to find out what has worked in the wild; what solutions others have come up with to deal with selective file encryption on network shares.

Our basic need to is to restrict file access to only those who are allowed to access the files for a given client. This restriction will be directory based, so there are not files that are encrypted and not-encrypted in the same directory. The files are stored on Windows Server 2008 storage server access via Windows shares. In a best case scenario we would be able to allow a service (using network credentials/user) to access and decrypt the files on a share. Something not possible with PGP NetShare (they can be access, but not decrypted).

I am currently locking down a companies remote desktop access via a VPN. What I need to do is disable remote printing, file transfer and clipboard via active directory for the workstations that will be accessed. I am having trouble figuring out which GPO's are used to restrict this.

My basic approach is to restrict VPN users to port 3389 so the will be able to access their work computers remotely but nothing else (I will look into layer 7 scanning later). With this I want to ensure they are unable to transfer and data via files, printing or the clipboard.

The environment is Windows Server 2003

I have a production server with it's cpu's running excessively high. Except in critical circumstances nobody is allowed to logon to servers during non maintenance times. I am looking for an application I can use to look at the processes on the remote server which include CPU % usage. An application like top. Windows native tasklist.exe doesn't show percentage, nor does sysinternals pslist.exe. Suggestions?

I have always wondered if there are multiple people monitoring a server using Performance monitor, does this create any type of load on the system? I am not sure where the counters are stored, so if there are ten or fifteen monitors running against a server, will there be any effect?

Edit:
My experience with Performance Monitor does show that the machine running the application will have a slight to moderate performance and memory hit. The scope of this question is remotely monitoring a system, where Performance Monitor is not running on the machine being monitored. Plus, the machine being monitored may have multiple monitors accessing it from different locations. Why you ask, because there are many people in the company monitoring the health of a farm or group of servers.

I haven't really noticed any extra load on monitored systems, though I ask the question to see if anyone else has experienced a load and what the threshold may be.

In an MS SQL 2005 instance there are two databases.
A specific user has execute rights on the dbo schema for both of these databases.

In database A I have a stored procedure which contains a select statement on a table in database B.
Are the dbo schema execute permissions sufficient for this call, or will the user have to have select access on the table in database B?

We use stored procedures for all database access and would prefer the user only have execute rights.

We recently went through some system load testing and were told that there where many SSL negotiation issues and timeouts. I couldn't find anything in the iis logs about this (all requests where 200). Is there somewhere else where Windows 2003/IIS may log this information?

UPDATE: Seeing that the SSL cert is configured with IIS, isn't IIS responsible for making the connection to the client via SSL? Or is SSL negotiated separate from IIS and IIS just handles the HTML over SSL part? It is IIS that responds to to port 443 (assuming 443 configured for HTML of SSL), so I am a bit confused why it wouldn't log about these connections?

I used the SSL Diagnostics application, it is quite easy to setup and use. I didn't find any issue with the actual negotiation of the SSL channel, it is just taking a long time for the handshaking complete. So my next step is to determine what we need to do to improve our SSL handshaking time. First thought is to have SSL handshaking to occur at the load balancer, not the servers themselves.

Using Windows AD for security, I have three servers in a farm configured with the same share on all three. One one of the servers I cannot access the share it says my access is denied even though it is setup the same as the others.

I logged into another workstation and I am able to access the third server without issue.

What can I do/check on my workstation to see why I am being denied access to the server?

I have obviously rebooted and cleared all current connections and I am still having issues connecting. Is there a chance my workstation is being denied?

Thank you for any assistance,

Brett

edit: It's only from my main workstation I cannot access this one server of three. If I login to a different workstation I am able to access the share on the third server.

Tried IP address instead of machine name, same issue so not dns.

Don't know if this makes a difference, but I can map to the share, but receive an access denied when trying to use it. (only from my workstation)

I have explicitly given myself (domain\username) full control to the share and create rights on the folder and still cannot access the share.

Have tried to remove and recreate the share and am still receiving access denied.

EDIT:
Now this is an interesting finding (to me anyway) If I add the local group everyone to the share permissions I am able to access it. If I add myself or our domain everyone to the share permissions I receive an access denied. Remember this issue is only happening from one workstation to a one server. I setup a new share on the server and it acts the same exact way as the others.
Have I mentioned that I can access the scheduled tasks share?

I have always wondered about this and never totally understood how 32 bit machines are addressing more than 4 GB of RAM. I mean, there are no more address lines left, correct?

I know even in our facility that we have Dell database servers with 8 GB of RAM addressable by the machine and a 32-bit version of SQL Server. Is it achieved similar to EMS memory of the 20 address line 8086, using a window of rotating memory?