Heinzi's questions

TL;DR: See title.

Background: Back in the "old days", we did a lot of bad things: We used the same server for Active Directory and other services (anyone remember Windows Small Business Server?), and did not follow best practices with respect to Group Policies.

Fortunately, those days are over, but we still use the same Active Directory domain as back then. We recently noticed that the "Default Domain Controller Policy" contains entries which are obviously no longer correct (as the most striking example, regular users and outdated service accounts can log on locally to our domain controllers). I'd like to "clean up" the policy and make sure that we follow up-to-date security recommendations.

I know that it's possible to reset this policy with dcgpofix.exe, but I'm afraid of breaking something by doing that. Instead, I'd like to

• compare each current setting of the "Default Domain Controller Policy" with the default setting,
• make sure I understand what this setting does, and
• then reset it to the default setting if I'm sure that the modification is no longer needed.

To do that, however, I need to see the default "Default Domain Controller Policy", and a Google search on this fails me (probably due to the double meaning of "default" in this context). Hence my question:

What are the default settings for the "Default Domain Controller Policy" in a newly created Active Directory domain?

Since Windows Server 2008 R2 (up to and including Server 2019, as far as I know), Windows Server Backup performs automatic management of full and incremental backup:

Automatic management of full and incremental backups. You no longer need to manage full and incremental backups. Instead, Windows Server Backup will, by default, create an incremental backup that behaves like a full backup. You can recover any item from a single backup, but the backup will only occupy space needed for an incremental backup. In addition, Windows Server Backup does not require user intervention to periodically delete older backups to free up disk space for newer backups—older backups are deleted automatically.

This sounds like a nice feature.

We, however, use two backup disks: One is always attached to the server for daily backups, and one is always in off-site storage. Every week we switch those disks, to ensure that we always have an off-site server backup that is as most a week old.

How do those incremental backups work with alternating disks?

Obviously, this would be fine (Option 1):

Day  1: Full backup on Disk A.
Day  2: Incremental backup (w.r.t. Day 1 backup) on Disk A.
Day  3: Incremental backup (w.r.t. Day 1+2 backup) on Disk A.
        ...
Day  8: Full backup on Disk B.
Day  9: Incremental backup (w.r.t. Day 8 backup) on Disk B.
Day 10: Incremental backup (w.r.t. Day 8+9 backup) on Disk B.
        ...
Day 15: Incremental backup (w.r.t. Day 1-7 backup) on Disk A.
Day 16: Incremental backup (w.r.t. Day 1-7+15 backup) on Disk A.

But this would not be fine (Option 2):

Day  1: Full backup on Disk A.
Day  2: Incremental backup (w.r.t. Day 1 backup) on Disk A.
Day  3: Incremental backup (w.r.t. Day 1-2 backup) on Disk A.
        ...
Day  8: Incremental backup (w.r.t. Day 1-7 backup) on Disk B.
Day  9: Incremental backup (w.r.t. Day 1-8 backup) on Disk B.
Day 10: Incremental backup (w.r.t. Day 1-9 backup) on Disk B.
        ...
Day 15: Incremental backup (w.r.t. Day 1-14 backup) on Disk A.
Day 16: Incremental backup (w.r.t. Day 1-15 backup) on Disk A.

because it would require both disks to restore (and, thus, defeat the purpose of having two disks).

Does Windows Server Backup use Option 1 or Option 2? And were is this documented?

(To clarify: The question is the previous paragraph in bold. It's not "how do I add a second disk to my backup set", nor is it "how do incremental backups work in general".)

I'd like to shrink an NTFS data partition on one of my servers. Unfortunately, it has an "unmovable file" located at an inconvenient position.

Here is the relevant event log entry:

A volume shrink analysis was initiated on volume Daten (C:\Daten). This event log entry details information about the last unmovable file that could limit the maximum number of reclaimable bytes.

Diagnostic details:
- The last unmovable file appears to be: \$Extend\$Deleted:$I30:$INDEX_ALLOCATION
- The last cluster of the file is: 0x1138f943
- Shrink potential target (LCN address): 0x18a51d6
- The NTFS file flags are: ----I
- Shrink phase: <analysis>

To find more details about this file please use the "fsutil volume querycluster \\?\Volume{4ad80633-d2d5-415e-97b4-9ad5f648bb0c} 0x1138f943" command.

The command mentioned at the bottom of the event log entry does not yield any useful additional information:

C:\> fsutil volume querycluster \\?\Volume{4ad80633-d2d5-415e-97b4-9ad5f648bb0c} 0x1138f943
Cluster 0x000000001138f943 used by ----I \$Extend\$Deleted:$I30:$INDEX_ALLOCATION

(Note (note sure if it's relevant): The last thing I did on the drive was to delete all shadow copies.)

I am aware that $Extend is not a "regular" folder but some kind of NTFS system file. Thus, my question:

What is this $Extend\$Deleted file system entry and how do I get rid of it? (Or, at least, get rid of its "unmovability" so that I can shrink my volume...)

I have a Windows Server 2008 R2 Hyper-V guest (the host is Windows Server 2016) which sometimes (for example, right now) fails to get more memory even though

1. dynamic memory is enabled,
2. plenty of memory is available on the host, and
3. the guest requires more memory.

Ad 1:

Ad 2:

Ad 3:

As soon as I manually restart the guest, dynamic memory allocation works properly again (until it stops working properly again).

I have found the following similar questions and resources, but they only apply to other operating system versions:

• Hyper-V dynamic memory not correctly assigning more memory (applies only to Windows Server 2012/2012R2)
• Hotfix: Hyper-V Dynamic Memory does not work on a Windows Server 2008 Standard Edition or Windows Web Server 2008 virtual machine (VM) (applies only to Windows Server 2008)

Is this a known issue? If yes, what can I do to fix it?

Note: Since the problem only occurs sporadically, I won't be able to give timely feedback on "Try this: ..." answers.

I have written an application which contains language files localized in ru-MD (Russian as used in Moldova) and ru-RU (Russian as used in Russia).

According to this table, the locale ru-MD is supported in Windows 10/Windows Server 2016 and above. I, however, need to install my application on a Windows Server 2012. As expected, a CultureNotFoundException is thrown when trying to run my application on Windows Server 2012.

I know that I can create and install a custom locale using tools such as MS Locale Builder, but I'm not an expert in variants of the Russian language (I don't speak the language at all).

Thus, I'd prefer to "backport" or copy the locale from a newer Windows system to the target system. Is that possible and/or supported? If yes, how?

Windows Server 2016 (and Windows 10) contain the mysterious "Data Sharing service", which

• happens to crash every now and then, polluting our service logs.

• Apparently, even Microsoft employees don't know what it is and just quote the service description "Provides data brokering between applications"-

What is it? What will break when it is disabled? Can event log messages about it crashing be safely ignored?

As a small shop (~10 PCs), we have only one physical server machine. This physical server machine runs the following two virtual machines:

• one AD domain controller and
• one "production server" (file server, database server, etc.).

Now, all best practice guides out there tell me that having a second AD domain controller (a "backup DC") is highly recommended.

Putting it on the same physical machine as the primary DC seems pretty pointless, so I thought of putting it as a VM on one of the stronger workstations which usually runs 24-7 anyways. Since it's just a backup DC, I'd give it very little CPU/RAM resources, so it should not affect the user too much.

Does this sound like a good plan or are there any pitfalls that I should be aware of?

My IIS web applications run using the built-in application pool identity IIS APPPOOL\Foo.

Is it possible to run a command-line in the context of IIS APPPOOL\Foo using psexec or some other tool?

There are various blog entries out there showing how to get the password of an application pool, but they only apply if the application pool uses a specific Windows identitiy, not when the application pool uses the built-in IIS APPPOOL\... identity.

I know what the "defer upgrades" option in Windows 10 does - it allows you to choose between the "Current Branch" and the "Current Branch for Business".

Windows Server 2016, on the other hand, always uses the "Long Term Servicing Branch".

Thus, I was surprised to find the following option in the advanced Windows Update options on my newly installed Windows Server 2016 Standard:

What does it do? I tried to click on "learn more", but it just links to a bing search of defer upgrades in Windows 10, which, obviously, does not apply to Windows Server 2016.

I have a (physical, not Azure VM!) Windows server whose files are automatically backed up using Azure Backup.

If the server gets compromised, how much damage to the backups can the attacker do?

Background: Newer generations of ransomware have the unfortunate tendency to actively search for and delete backups (volume shadow copies, external hard drives, etc.). I guess it's only a matter of time before they start targeting cloud backups as well.

Research I have already done: I think that the worst damage that an attacker could do would be to lower the retention period to the minimum of 7 days, thus destroying backups older than a week. I have looked through the Azure Backup Powershell Cmdlets (which seems to be the official API for Azure Backup instrumentation) and have not found any way to explicitly delete or overwrite recovery points.

Related question: Protecting Azure Backup from malicious deletion. That question is about the case where the Azure management credentials get compromised. My question is about the case where only a vault-registered server gets compromised, but the management credentials are safe.

We have the following setup:

• One Domain Controller (DC, Server 2003 R2 Standard x64)
• One SQL Server (SQL, Server 2008 R2 Standard x64)
• some clients.

All machines are in the same domain. All user accounts in use are domain accounts. SQL runs one instance of each SQL Server 2005, 2008, 2008R2, 2012 and 2014.

Since tonight (DC rebooted to install automatic Windows security updates), accessing the SQL 2005, 2008 and 2008R2 instances through Windows authentication does not work properly anymore:

When accessing one of these instances

• from one of the clients
• using Windows authentication

the following error occurs (it's the 2008R2 message, the 2005/2008 messages are similar):

Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. (Microsoft SQL Server, Error: 18452)

Obviously, the message text does not apply, since there is only one domain.

Now the surprising thing is: As soon as user is logged in on SQL (starting an RDP sesson or even simply running runas /user:MYDOMAIN\someuser cmd and keeping the window open), this user can access all SQL Server instances from all clients without any problems until the process running with that user's credentials is closed.

This means that I can just workaround this problem by executing the above runas command for all users on SQL once (and keeping the windows open), but, obviously, something is severely broken. I suspect tonight's security updates on DC have something to do with it (since that's the only thing that changed), but I'd rather avoid uninstalling and rebooting each one of them (12 updates were installed and DC is really old and slow).

Has anyone encountered this issue before and knows how to fix it permanently? Any other ideas (other than spending the next few days becoming a Kerberos expert)?

Let's say I have a Windows Server 2012 R2 server with a UPS attached.

Is there a generic way to make Windows Server 2012 R2 shut down when power fails, i.e., the system switches to battery power?

I know that most UPS vendors provide proprietary software to do that, and there are lots of tutorials online on how to configure them. However, I want to create a generic server image that will run on a variety of servers with (possibly) different UPS systems. Is there some way to do that without installing vendor-specific software?

I have a scheduled task (in Windows Task Scheduler) that connects to SQL Server using SMO (Windows Authentication) and creates a database backup. So far, this task was running under the Administrator account and I wanted to change it to use the SYSTEM account instead.

I changed the scheduled task and, to my utter surprise, it worked out-of-the-box.

I'd like to understand why this is the case. The system is Windows Server 2012 R2, and the database is SQL Server 2012 (SP1) Express Edition. It's a standard installation with one SQL Auth user added.

In SSMS, these are the logins and their associated server roles:

• ##MS_PolicyEventProcessingLogin## (disabled)
• ##MS_PolicyTsqlExecutionLogin## (disabled)
• MyServer\Administrator (public, sysadmin)
• MySqlAuthUser (public)
• BUILTIN\Users (public)
• NT AUTHORITY\SYSTEM (public)
• NT SERVICE\MSSQLSERVER (public, sysadmin)
• NT SERVICE\SQLWriter (public, sysadmin)
• NT SERVICE\Winmgmt (public, sysadmin)
• sa (public, sysadmin)

The database itself has the following users and their roles:

• MySqlAuthUser (Login MySqlAuthUser) (db_owner)
• dbo (Login sa) (db_owner)
• guest (disabled)
• INFORMATION_SCHEMA (disabled)
• sys (disabled)

Viewing the "effective permissions" of user NT AUTHORITY\SYSTEM yields the following output:

• ALTER ANY AVAILABILITY GROUP
• CONNECT SQL
• CREATE AVAILABILITY GROUP
• VIEW ANY DATABASE
• VIEW SERVER STATE

Why does NT AUTHORITY\SYSTEM have permission to backup databases? I'm glad that it does, but I'd really like to understand why...

Apparently Windows Server Backup has some support for backup of SQL Server databases:

Ability to recover applications. Windows Server Backup uses VSS functionality that is built into applications like Microsoft® SQL Server® to protect application data. [Source: TechNet]

In addition, people report that Windows Server Backup seems to trigger some sort of backup operation in SQL Server.

However, I fail to find (official) documentation on how exactly to backup SQL Server databases using Windows Server Backup.

• Do I just need to backup the .mdf? The .mdf and the .ldf?
• Online or just offline?
• What's the official procedure for restoring SQL Server databases backed up this way?
• Is there anything special to consider when doing incremental/differential backups?
• Where is all of this documented?

(I know how to do backups with SQL Server Maintenance Plans, sqlmaint.exe, T-SQL BACKUP and SQL Server Agent. I'm just interested in the alternative that Windows Server Backup (apparently?) offers.)

I need an operating system for an IIS-based web server that should serve both public and private (authentication required) web content and -services. (In other words, it should host all the stuff we develop with ASP.NET.)

Looking at the Windows Server 2012 Editions, it seems that the Essentials edition would be a good fit:

• It does not require CALs.
• The 25 user limit should not be an issue, since the only Active Directory users are admins uploading or configuring software, or "servce accounts", for example, for SQL Server.

On the other hand, other documents from Microsoft present Server 2012 Essentials as a successor to Windows Small Business Server, which is quite different from a typical web server.

Are there any nasty surprises to be expected when using Server 2012 Essentials as a public web server?

On my Windows 7 dev machine, I have two applications configured on IIS 7.5: Both have the same web.config, but one of them works and the other doesn't (no HTTP reply, browser keeps waiting forever).

I'm wondering if the IIS settings for these directories are different. Is there an option in IIS manager (or maybe using some command-line tool) to output the configuration for a specific directory (like script handlers, authentication, etc.) into a text file?

When connecting to our virtual Windows 2003 Server (SBS 2003 SP2) via a normal RDP session, everything works fine. However, when connecting with /admin to get to the console session, the following happens:

• normal login window,
• after login, screen goes black,
• after about a minute, the screen switches to the default background color (some shade of gray).

Only the background is visible and I cannot do anything, not even Ctrl-Alt-End works.

Since normal (non-console) RDP connections work perfectly fine, I guess that this cannot be a connection issue. I've asked the admin of our hosting provider to have a look at the console of our virtual server (VMWare, AFAIK), and he says that it's all black and it looks like the system has crashed. Obviously, this is not the case: All services (Web, SQL, ...) work, and non-console RDP connections can be established without problems.

The event log contains nothing of relevance (as far as I can tell), and a reboot fixes the problem (until it occurs again after a few days).

I know this is very vague, but I don't know which additional data to provide. Any ideas?

I run a Postfix server that hosts a small, alias-based mailing list. Let's say people@myserver forwards to alice@someprovider and bob@someotherprovider. Now, alice@someprovider might use a more restrictive spam filter than I do.

When a spam mail from (forged) backscattervictim@somewhere to people@myserver arrives, and my spam filter detects it as spam, it is rejected in the SMTP phase --> no harm done.

However, when the same mail gets through my server, my server tries to forward it to alice, and her server rejects it during the SMTP phase, my server creates a bounce message to the innocent backscatter victim. (Which makes sense from the point of view of my server, but it's annoying for the backscatter victim.)

Is there a way to prevent this behavior? I don't want to turn off NDRs, since (in general) they serve a legitimate purpose.

Is there a "recommended way" to disable a service in Debian? (Disable = The service is installed but won't start automatically when the machine boots.)

I know that you can update-rc.d -f service remove (which basically removes the links in rcX.d), but doing this you lose the sequence number of the service (SXXservice, with XX being the sequence number), making life harder when you want to re-enable the service. I also know that I can just rename the links in rcX.d so that they don't start with S (or move them somewhere else), but I wondered if there is some "Debian-approved best-practice" way to do this.

I've just read through a lot of MSDN documentation and I think I understand the different recovery models and the concept of a backup chain. I still have one question:

Does a full database backup truncate the transaction log (using full recovery mode)?

• If yes: Where is this mentioned in the MSDN? All I could find was that only BACKUP LOG truncates the log.

• If no: Why? Since a full database backup starts a new backup chain, what's the point in keeping the transactions that were finshed before the full backup active in the log?