We're in the process of upgrading our exchange 2007 to 2013, but after running the readiness checks, we're getting an error.

Error reads: "One or more servers in the existing organization are running Exchange 2000 Server or Exchange Server 2003. Installation can't proceed until all Exchange 2000 or Exchange 2003 servers are removed"

We don't have any Exchange 2000 or 2003 servers, but legacy records seem to still linger.

Resolution attempts:

• ADSIEdit removal of CN=childsite-Domain and sub entries located in Administrative Groups/site/Microsoft Exchange/Services/Configuration referring to legacy Exchange 2003 server previously installed into the root via the child domain.
• Removed residual objects in Sites and Services

We need to know where the Readiness Checker is gathering the information from and how to clear it.

One of the external NTP servers (the primary one--currently) we're using as source seems to not be responding to NTP calls. Unfortunately, on our core router (Cisco 6509), the NTP functionality hasn't switched to the secondary NTP external server as it was expected. As a result, our core router which is pretty much our main internal NTP source is 2 minutes late.

I'm planning to fix the external router issue by making the external NTP source be the one currently working. I'm wondering, how much will a 2 minute change affect my users and services? Specially since these days, we're heavily relying on certificate-based authentication.

We're a Windows/Cisco shop.

Internal NTP setup:

[Core Router 1 / Cisco 6509]:
looking out to two external NTP servers (in which the primary one is not responding to NTP calls)

[Core Router 2]:
Synching with Core router 1 (primary), working external router (secondary)

[Other Cisco network devices]:
Synching with Core router 1 (primary), core router 2 (secondary)

[Domain controller(s)]:
Synching with Core router 1

[All windows clients/servers]:
Synching with domain controllers

Data Protection Manager 2010 has allocated 100% of our storage pool. We currently have all our protection groups set to 'automatically grow the volumes' [checkbox].

As we were trying to add a backup member (a network folder), we received the following error :

"There is insufficient free space in the storage pool for this protection group. To increase the free space, cancel this wizard and add disks to the storage pool or remove non-DPM volumes from the disks in the storage pool. To assign custom volums to select members, click Modify."

As you can see, the actual disk used is about 5.3TB, but DPM has allocated 99% of the storage pool. Where do we go from here?

• Will we have to recreate our protection groups without the 'auto grow' option?
• Is there a hybrid method between auto/manual disk allocation?
• Is there a method for controlling disk allocation?

At my old job, we used an open-source, (IMO) secure method for managing network infrastructure, and other important hosts' passwords [with Keepass]. At my new job however, it seems like they're using password-protected excel spreadsheets.

Before I made a fuzz about password security, I browsed the interwebs and found that Microsoft has been getting better at implementing encryption features to their office products.

Main questions:

• How safe is MS Excel/office 2010's password encryption feature? I've been thinking this was an insecure way of dealing with passwords, is this not the case any more?
• Are there many drawbacks to using an excel 2010 document for password management?

SETUP:
Windows Server 2003 SP2 with a replication error (this is the only DC in the domain) [image below]: Journal Wrap Error on sysvol share

• Is there a way to find out what is broken/corrupt/malformed in this DC's sysvol?
• Is there a way to fix the sysvol share other than from a system-state restore point (which we don't have), or from another domain controller (which we also don't have)?

Any ideas why a tracert (traceroute) to an external host would return with the following:

tracert 10.34.25.23

 1  myborderouter.example3.com (10.52.2.41)  1.113 ms  1.103 ms  1.100 ms
 2  ae0--931.maincorerouter.example2.com (10.102.65.44)  4.028 ms  4.046 ms  4.042 ms
 3  gi0-1.mainrouter.example2.com (10.72.12.85)  6.653 ms  6.661 ms  6.645 ms
 4  * * *
 5  somebox.example.com (10.34.25.23)  7.361 ms  7.339 ms  8.723 ms
 6  somebox.example.com (10.34.25.23)  11.047 ms  10.882 ms  10.802 ms
 7  somebox.example.com (10.34.25.23)  8.318 ms  7.076 ms  7.016 ms

When * * * should be: 10.34.25.23 (No other devices between 10.72.12.85 and 10.34.25.23)

ping 10.34.25.23
PING 10.34.25.23 (10.34.25.23) 56(84) bytes of data.
64 bytes from 10.34.25.23: icmp_seq=1 ttl=122 time=8.21 ms
64 bytes from 10.34.25.23: icmp_seq=2 ttl=122 time=8.28 ms
64 bytes from 10.34.25.23: icmp_seq=3 ttl=122 time=7.73 ms
64 bytes from 10.34.25.23: icmp_seq=4 ttl=122 time=7.21 ms

****All Addresses have been changed to not reflect the real addresses.**

I'm looking for some ideas on how to disconnect, logoff, or reset a user's session in a 2008 Terminal Server (unable to login as the user either as it is completely locked-up). This is a production environment, so rebooting the server or doing something system-wide is out of the question for now. Any Powershell tricks to help us with this?

We've tried to disconnect, log the user off and reset the session as well as killing the session's processes too, directly from the same terminal server (from the task manager, Terminal Services Manager and the Resource Monitor) with no results.

Help!

UPDATE: We ended up rebooting the server as no other attempts that we could think of worked. I'll leave this question open hoping someone might have more information about this one issue, and it's potential fixes

The issue:
An unknown private (NAT) client is infected with malware and it's trying to access a Bot server at random times/dates.

How we know about this:
We receive bot traffic notices/alerts from REN-ISAC. Unfortunately, we don't receive those until the next day after it has happened. What they provide to us is:

• The source address (of the firewall)
• The destination addresses (it varies, but they're going to network subnet allocated to a German ISP)
• The source port (which varies--dynamic ports).

Question:
What would be the best approach to finding this internal host (historically) with a Cisco ASA as firewall?

I'm guessing blocking anything to the destination address(es), and logging that type of traffic/access might allow me to find the source host, but I'm not sure which tool/command would be the most useful.

I've seen Netflow thrown into a few responses when it comes to logging, but I'm confused with it's association of Logging, NAL, and nBAR, and how they relate to Netflow.

From time to time, I've encountered issues with OS X clients' network connections (Wired and Wireless, Leopard/Snow Leopard) where nothing will fix the issue, until you reboot.

• Is there a particular 'network service/process' I should be watching out for?
• I was thinking it would be useful to know of a command that will reset a 'network connection' type service/process (same as running a sudo /etc/init.d/networking restart).

After basic troubleshooting such as DHCP, DNS, checking for interface malfunction (disable/enable), checking logs and not finding enough helpful info, sometimes when everything else fails the best thing is just to reboot the machine. I'm not sure what all the 'init.d/networking restart' does in Linux, but I know it's way more helpful than disabling and enabling interfaces.

Thanks!

We have a Windows 2008 (R2) Terminal Server environment and would like to find a way to automate the addition (Pinning) of programs to the Windows taskbar for our users.

My first thought was to do this from a Group Policy, but haven't been able to find a setting for this. I've heard you can 'probably' do it via a script, but haven't seen any examples yet (I'm not a programmer, but have worked with batch scripts before). Are there any other methods?

Please advice.

Thanks!

Is the use of 'Add-ons' on Firefox safe (stable) and secure on a terminal server?

The install of a few Firefox add-ons has been recently proposed to us for our Terminal Server users. Has anyone had experience with enabling some very user oriented add-ons on Firefox?

I failed to come up with good documentation, admin notes, blogs posts, or research on this topic so I thought I'd ask.

I'd also like to know how much this complicates our setup, if this is a No-No, or if we should be looking at something in particular about this kind of setup.

In case you're wondering, the specific add-ons proposed were Delicious and Web of trust, but don't dwell too much on those, I'd like to find out about extensions/add-ons in general.

We manage our Blackberry devices from the BlackBerry Manager (with a "BlackBerry Professional Software" license), but I'm sure it's somewhat similar to the enterprise edition/solution.

What steps should we take for securing (via server policies) our devices from rogue software updates, evil 3rd party applications, spyware, viruses and such? (or are the latter types of attacks on Blackberry devices only 'proof of concepts' at this point?)

What security policies are recommended for keeping Blackberry devices secured?

• Is being Paranoid considered an (unspoken) 'requirement' for a Sys/Net admin to have (obviously for security reasons)?

• Is there such a thing as being overly paranoid?, or should we be trustful of others and not completely dwell on questioning scenarios through schizophrenic goggles?

  Is there a 'mid-ground' for this characteristic when it comes to security? (basically, what I'm asking is, who would YOU hire?)

UPDATE: I didn't expect people emphasizing so much on the word "PARANOIA". Please don't dwell too much on it, I could have used another word, but Paranoia is a word we commonly use with security. I've heard "too paranoid" and "need to be more paranoid" from a bunch of IT folk.

Wouldn't you want your crucial hosts being served with the most signal-reliable/improved method of connectivity?

Gig Switch<->Cat5E<->Server?

or

Gig Switch<->Cat6<->Server?

My understanding about Cat6 is that it delivers improved signaling between two NICs. I've heard people suggest Cat5E for short distances and Cat6 for longer than 20'. Is this the correct assessment for choosing Cat6 over Cat5E cables?

I'd like to clear my notion of needing it for improved performance.

Should we be suffering from connectivity problems due to having a hidden SSID?

At work, we're past the "Hidden SSIDs make our network more secure" argument, but for user's 'convenience' and in order to make it less confusing with our other broadcasted SSIDs, we've added a hidden SSID to our wireless controller (for the use mostly of network admins). We've noted a couple of disconnects, and would like to know if there are some known performance/reliability implications for this kind of setup, particularly with multiple access points with the same SSID on our site.

Does having a hidden SSID on an access point affect connectivity?

I have seen telcos install one-strand fiber links at full-duplex, but haven't found much documentation about this configuration.

What are the bandwidth limitations, troubleshooting complications, advantages and/or disadvantages for this kind of setup?

What's the best approach towards determining if I have a rogue DHCP server inside my network?

I'm wondering how most admins approach these kinds of problems. I found DHCP Probe through searching, and thought about trying it out. Has anyone had experience with it? (I would like to know before taking the time to compile it and install).

Do you know any useful tools or best-practices towards finding rogue DHCP servers?

How many bluetooth headsets can exist in a small space without there being interference or reliability issues?

We're about to switch our phone infrastructure to IP. New phones are on the way and we just realized 1) Headset support is expensive (Wired or Wireless), 2) The phones we HAVE TO get (for a completely different reason) supports bluetooth.

Seven or more people will have Bluetooth capability on their new phones (Nortel 1140E). Most are within 10 feet from each other ('next-to' cubicles in a semi-circle), and in the center we have an Aruba Access point (802.11a/b/g) serving clients within a 30-40' radius.

Has any of you had experience with this? Do you have good recommendation(s) for minimizing interference? Do you have an opinion on the best bluetooth headset to support this kind of setup?