phenry's questions

Trying to recover some disk space by shrinking the size of our WSUS database, or at least figure out why it's so big, I tried to connect to the Windows Internal Database in SQL Server Management Studio (using the \.\pipe\mssql$microsoft##ssee\sql\query database name I've seen referenced in multiple places) and got an error:

Cannot connect to \.\pipe\mssql$microsoft##ssee\sql\query.

---

ADDITIONAL INFORMATION:

Login failed for user '[ourdomain]/[myusername]'. (Microsoft SQL Server, Error: 18456)

Server Name: \.\pipe\mssql$microsoft##ssee\sql\query

Error Number: 18456

Severity: 14

State: 1

Line Number: 65536

My account has domain administrator privileges, so I don't understand why it wouldn't work. The help link it gives me says that "If your error indicates state 1, contact your SQL Server administrator" (who, unfortunately, is me).

I also tried the WsusDBMaintenance script from here, which should apparently just work, and got the same "Login failed for user" message.

Update: I found the corresponding entries in the error log, which say:

2009-10-09 14:13:51.30 Logon       Error: 18456, Severity: 14, State: 11.
2009-10-09 14:13:51.30 Logon       Login failed for user '[domain]\[user]'. [CLIENT: <named pipe>]

It says here that state 11 = "Valid login but server access failure".

Microsoft Security Essentials seems to be a fine, lightweight AV solution, and it's getting a lot of positive reviews. Microsoft is explicitly positioning it as a solution for home PCs, but are there any reasons not to run it on a server? We use McAfee Total Protection Service on our desktops, but it's not entirely compatible with the server, and in any event the software firewall and link protection features aren't necessary on the server anyway. We have a single SBS 2008 server running things, so I want to make sure it has decent protection. Is MSE the answer?

I was using browsershots.org to check out what our redesigned Web site looks like in different browsers. One of the distributed VMs giving results (specifically, vm-fab-964) apparently lives behind a content-blocking filter, and gave this error message:

Access Denied (content_filter_denied)

Your request was denied because of its content categorization: "Internet Radio and TV;Bandwidth"

For assistance, contact your network support team.

Our site is not remotely related to Internet radio or TV and our bandwidth usage is trivial, so I need to contact whoever makes this software and arrange to have our site removed from the blacklist. All I have is a screenshot, so I can't view the source to see if the vendor is named in an HTML comment or something. Does anyone recognize this blocking software from the wording of the error message?

The C: drive on our SBS 2008 server just ran out of space. The culprit appears to be IIS, which is logging an incredible amount of activity in one particular log folder. Most of the IIS log folders look normal, but each of the daily files in C:\inetpub\logs\LogFiles\W3SVC1372222313 is at least 4.4MB, with the largest being yesterday's, at 1.67 GB!

The largest ones I can't even open on the server, but I've examined several of the smaller ones. They all show several dozen entries being made every few minutes that look like this:

2009-07-11 00:00:02 fe80::5558:434c:a610:405a%10 POST /ApiRemoting30/WebService.asmx - 8530 [DOMAINNAME]\[SERVERNAME$] fe80::5558:434c:a610:405a%10 Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.4016) 200 0 0 3

Typically 40 or 50 of these entries will be made in the same second, with gaps of 2-5 minutes between each batch of entries. The other 1 percent of the entries in the file appear to involve WSUS.

I'm going to delete most of these files, because I don't really have a choice, but I'd like to know what's causing this out-of-control logging and how to put a lid on it in the future.

UPDATE: Okay, I've been able to examine a few more files. The bloat is apparently being caused by something going wrong when someone (i.e., me or another admin) logs in to WSUS interactively:

1. The trouble begins with a single log entry with no username (just "-"). It gets an HTTP status of 401.2 and a sc-win32-status code of 5.

2. This is followed by a long stretch of entries that alternate between no username and my own username. The ones with no username have an HTTP status of 401.1 and a sc-win32-status of 2148074254. The ones with my username are normal HTTP 200 entries.

So as far as I can tell what appears to be happening is that when I log in to administer WSUS via the SBS console, NTLM authentication is not persisting behind the scenes, causing continual reauthentication attempts throughout the session, transparently to me. Hundreds of these entries are being created every second, adding about 70MB per hour to the log file. I have no idea why this is happening.

I'm developing a Web site on my Windows Vista Ultimate (64-bit) workstation using IIS 7.0 locally for testing. At random times, I receive an "IIS Worker Process stopped working and was closed" error popup. I'm able to keep working on the site after that, so IIS seems to be spawning new worker processes without any trouble.

It appears from looking at the error logs that what is happening is that IIS is shutting down the worker process after a specified period of inactivity, as it is designed to do. So far, so good, but why is that causing an error?

The site is hosted on localhost port 8008 and uses PHP (ISAPI) and the URL Rewrite module, but is otherwise configured fairly simply. The relevant error log entries follow, in chronological order:

System log, 12:10:18 PM (Information, Event 5186, WAS):

A worker process with process id of '6288' serving application pool 'SDL' was shutdown due to inactivity. Application Pool timeout configuration was set to 20 minutes. A new worker process will be started when needed.

Application log, 12:10:20 PM (Error, Event 1000, Application Error):

Faulting application w3wp.exe, version 7.0.6002.18005, time stamp 0x49e023cf, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03824, exception code 0xc0000374, fault offset 0x000ab0bf, process id 0x1890, application start time 0x01ca0255c7b92db0.

System log, 12:10:24 PM (Warning, Event 5009, WAS):

A process serving application pool 'SDL' terminated unexpectedly. The process id was '6288'. The process exit code was '0xff'.

Microsoft disgorged a couple dozen new language packs for Windows Vista yesterday, which are currently sitting in Windows Server Update Services on our SBS 2008 machine marked as Optional. No one in the organization needs them, so I'd like to decline them all to prevent any potential confusion or support requests. Declining each one individually is time-consuming and tedious. Is there a way to select a group of updates in WSUS and decline them all?

I'm managing a small network with Small Business Server 2008 and 7 clients running a mix of Vista and XP. The server and clients are all running McAfee Total Protection Service for malware and spyware protection; the clients are also using the McAfee firewall and browser protection features as well.

The McAfee TPS product, which is managed from the cloud, is shown as functional in Windows Security Center on the clients, but the clients are not reporting their protection status to SBS. The SBS Console lists "Critical" status for all clients for both virus and spyware protection, and says that the clients "cannot be queried."

This Usenet thread suggests that WMI traffic is being blocked, although WMI Provider Host has been granted access through the McAfee firewall on the client (the Windows firewall is off).

These clients formerly ran AVG antivirus and they didn't successfully report to SBS then either, which makes me doubt that it's a vendor-specific problem.

Update: Alejandro Campos Magencio's most recent comment on this blog post suggests that McAfee may not be using Microsoft's new super-secret API to report security status to the server. I have a question in to McAfee support about this, though I'm not holding my breath.