Stephane's questions

I'm trying to configure a set of deployment pipeline in Azure DevOps for deploying an ASP.NET core 2.2 application to local servers (not azure).

I'm hitting a wall with something that seem trivial to me: I'm trying to add a set of objects the the appsettings.json files.

I tried to use the JSON variable substitution option if the IIS Application deployment task but it only works to adjust existing entries in the appsettings.json files, it doesn't seem to be able to add any new one.

I need to add these entries (not update them) because one of them is mapped to a dictionary that will have many more entries in production that in dev.

I also tried to use magic-chunk but it seems to have the same problem: if the JSON path does not exists, it crashes with an ReflectionTypeLoadException error.

This is a rather old issue but it's starting to get more and more frequent.

We are providing an application to external users trough Citrix XenApp 6.5. The users have a number of different version of the receiver but the problem is the same even with the latest one (4.9 at the time I write this, it wa confirmed at least as far back as 4.2).

The users typically have a windows 10 system with multiple display. They attempt also have different zoom factor for each screen (display settings -> Scale and Layout).

At connection, the application gets zoomed according to the display factor of the screen is initially starts on. This works fine until the user moves one of the application's windows (even partially) to the second screen. Then several things happen:

• The "clipping region" that Citrix uses to display the application in seamless mode get desyncronized with the actual position of the window (on the second screen only). This results in only part of the application to be displayed on the client with blue background next to it.
• The mouse position isn't forwarded properly to the server any more in both screens: the user cannot click on any UI element because the server receives a different location that where the user clicked.

The problem can be solved by synchronizing the zoom factors of both screens but, of course, that is a major inconvenience when the user has several screens with very different DPIs (typically, a laptop or tablet with a QHD or UHD screen and a main display with a 1080p one). In such a situation, the user has more or less to stop using one of the screens.

I'm having a bit of a problem with LDAP search that should specify whether a user is a member of a given AD group or not (recursively).

Basically, what I'm doing is issue a LDAP search with the following parameters:

get-aduser -LDAPFilter "(memberof:1.2.840.113556.1.4.1941:={group LDAP path})" -SearchBase "{AD LDAP base}"

This does yield the expected result: instead of getting all users who are directly or indirectly members of the group I'm searching for, I get all direct members of that group, plus a random selection of indirect members (members of groups that are member of the searched for group).

The list I'm getting seems arbitrary: I can't find any difference in group membership between two users who should be present in the result set but one is there and the other isn't.

(I need to solve this issue with LDAP search because the result will be used in an application, not through powershell. But using powershell in this way, I can reproduce the original problem in the way described).

I need to revive an application so it can be safely archived by a third party before being phased out.

In order to do so without endangering the whole server, I want to force the user to authenticate before connecting, which means requiring TLS.

Unfortunately, the 443 port on that server (xxx.xxx.xxx.120) is taken by another application (a web mail system that uses its own HTTP server) so I added a new public IP to the server (xxx.xxx.xxx.120) and added a binding in IIS for port 443 on this new IP:

I also made sure that the other app is NOT bond on 0.0.0.0:443 but uses the specific IP address.

Finally, I ran netstat -ano | find ":443" and got this:

TCP    xxx.xxx.xxx.120:443     0.0.0.0:0              LISTENING       3016
TCP    xxx.xxx.xxx.120:443     0.0.0.0:0              LISTENING       3016

xxx.xxx.xxx.120 is the initial server IP address, the new one being xxx.xxx.xxx.122.

For good measure, I also ran netstat -aon | Find "xxx.xxx.xxx.122:443" (the new IP) and got nothing back, as expected.

Unfortunately, when I try to start the web application, I got this error message:

This error is the one IIS throws if IP:Port it tries to bind to is taken and yet netstat clearly say it is available.

What am I missing ?

Edit: There are two events in the system event log when I attempt to start the service:

Log Name:      System
Source:        Microsoft-Windows-IIS-W3SVC
Date:          7/19/2014 11:59:44 AM
Event ID:      1004
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      xxxx
Description:
The World Wide Web Publishing Service (WWW Service) did not register the URL prefix https://XXX.XXX.XXX.122:443/ for site 2. The site has been disabled. The data field contains the error number.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-IIS-W3SVC" Guid="{xxxxx}" EventSourceName="W3SVC" />
    <EventID Qualifiers="49152">1004</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-07-19T09:59:44.000000000Z" />
    <EventRecordID>119596</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>xxxx</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="UrlPrefix">https://XXX.XXX.XXX.122:443/</Data>
    <Data Name="SiteID">2</Data>
    <Binary>20000780</Binary>
  </EventData>
</Event>

And

Log Name:      System
Source:        Microsoft-Windows-HttpEvent
Date:          7/19/2014 11:59:44 AM
Event ID:      15005
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      XXX
Description:
Unable to bind to the underlying transport for [::]:443. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine.  The data field contains the error number.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-HttpEvent" Guid="{xxx}" EventSourceName="HTTP" />
    <EventID Qualifiers="49152">15005</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-07-19T09:59:44.330234300Z" />
    <EventRecordID>119597</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="88" />
    <Channel>System</Channel>
    <Computer>XXX</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="DeviceObject">\Device\Http\ReqQueue</Data>
    <Data Name="Address">[::]:443</Data>
    <Binary>0000040002003000000000009D3A00C0000000000000000000000000000000000000000000000000430000C0</Binary>
  </EventData>
</Event>

After a recent incident with Outlook, I was wondering how I would most efficiently resolve the following problem:

Assume a fairly typical small to medium sized AD infrastructure: several DCs, a number of internal servers and windows clients, several services using AD and LDAP for user authentication from within the DMZ (SMTP relay, VPN, Citrix, etc.) and several internal services all relying on AD for authentication (Exchange, SQL server, file and print servers, terminal services servers). You have full access to all systems but they are a bit too numerous (counting the clients) to check individually.

Now assume that, for some unknown reason, one (or more) user account gets locked out due to password lockout policy every few minutes.

• What would be the best way to find the service/machine responsible for this ?
• Assuming the infrastructure is pure, standard Windows with no additional management tool and few changes from default is there any way the process of finding the cause of such lockout could be accelerated or improved ?
• What could be done to improve the resilient of the system against such an account lockout DOS ? Disabling account lockout is an obvious answer but then you run into the issue of users having way to easily exploitable passwords, even with complexity enforced.

We have in our infrastructure a number of powershell scripts used for various tasks ranging from user login to support technician simulating a user context.

These scripts are centralized on our file server (through DFS) for easier management. Some of them are run at logon, some are run through published Citrix applications.

We have applied a policy for the whole domain and all users that sets the Powershell execution policy to "unrestricted" so that the scripts can run from the file server.

This works perfectly fine for logon script (at least, so far) but for scripts that are run later (usually through a published application but the same applies when using terminal services and a full desktop), the results are inconsistent: some users can run the script fine, some are always prompted in the powershell console for letting the scripts run.

I cannot find anything that could cause this behavior and it's really inconsistent: if I start powershell manually and runs get-executionpolicy, I am told that the current policy is unrestricted. Yet, if from the same session I try to run a script through a program that calls powershell <script file name> <parameters> I get prompted before the script can run.

What could cause such behavior ?

I know it sounds like a programming question but it's actually not. Bear with me please:

I have a customer who is experiencing a strange issue that I cannot explain: a program uses a file on a shared SMB drive (Windows 2008R2 server) open in shared mode.

Before performing an update inside the file, the program will lock specific potions using LockFile, read the data, write the required changes to these portions and then unlock them.

This is done to ensure that several instances of the same program can overwrite each other's changes.

In my customer case, this program (which behaved perfectly well for years in all other locations) succeeds in locking the file but the subsequent call to ReadFile on the same handle fails and GetlastError returns error 64 The specified network name is no longer available

Thus, my question:

Is there some setting in the windows SMB client or server that could cause something like this ?

It looks like an optimistic lock to me but windows doesn't do optimistic locks by default (it does opportunistic locks).

My first suspicion is that this problem is cause by the anti-virus software (Kaspersky) but the site admin swear that all AVs have an exclusion for this network path, both on client and on the file server.

The client OS is a mix of Windows XP, 7, 2003 and 2008R2 (via terminal services). It seems to happen only in time of heavy load (in the morning when everyone comes in or in he evening when everyone logs out).

I have a Windows 2008R2 server that experience high CPU load for several minutes about once every couple of weeks.

Unfortunately, when these events occurs, logging into the system through RDP or at the console takes so long that, when it's done, the problem is usually gone.

So, I've prepared a perfmon data collector that will capture the relevant data (CPU time per process, details of IIS worker processes, etc.) but I have no idea how to trigger it automatically under high-CPU load condition (as defined in Nagios: that's >99% CPU usage for more than 300 seconds).

Unfortunately, the low frequency of these events makes it difficult to let the data collector run on its own.

I have currently worked around it by using circular logging and leaving it running but that's not really a satisfactory solution.

So, is there a (simple) way to get that data collector started under these conditions ?

I have an issue with our new Citrix XenApp 6.5 deployment with Web Interface 5.4 and CSG 3.3.1

We have external users who share the same access (we charge them by access so they don't order more than they need and manage that internally). This setup was working just fine with XenApp 4.5: users could log into the web interface twice but, when they tried to access the same published app, they would not be allowed to go through and be greeted with a "you have reached the limit of allowed sessions for this resource" dialog.

Now, with 6.5 (and Citrix web interface 5.4), we have a different behavior: as soon as the second user logs into the WI, the first user's session is disconnected. Pretty often (but, apparently, not every time) the second user will automatically reconnected to the first user's session.

I suspect that this behavior is due to the session reliability parameter but I'd like a confirmation.

More important: If it is indeed session reliability that is causing this behavior, is it possible to maintain its advantages (mostly ability to seamlessly reconnect THE SAME RECEIVER to its session in case of network glitch or if we restart the CSG) without having "auto reconnection at web interface level" enabled ?

I have a rather unexpected situation here. I have a small application that connects to a WebDAV server (Sharepoint) using the standard WebDAV windows client (WebClient service, part of the "desktop experience" feature), walk through a number of folder and download all PDF files it finds.

The overall process works. However, I'm experiencing a strange issue: when I run the application directly from the server's console or RDP desktop, it runs in about 10 seconds (assuming there is no file to download). When I run the same task from the same user but from a scheduled task, then it takes 5 minutes to complete and yield exactly the same result (files are downloaded if present).

I've added debug to the application to see where the latency happens and the result of this is that the operation of listing the file directory seems to take forever, even if the file filter used causes no file to be returned. The same behavior can be observed when using ProcMon: the latency is within the Win32 calls and ourtside of the application alltogether.

Now, this isn't really critical since the process works, but the more directories the are added the slower it gets and there will be a point where I will have to decrease the frequency at which the script is run so it can actually complete (or change the application so it start to process the directory in parallel).

Would anyone have some kind of explanation why the WebDAV client seems to be several orders of magnitude slower when running from a scheduled task ?

In case it matters, the connection is made with an explicit password each time and it goes over SSL.

I'm working on a set of script that will be used to migrate the users and structure from one active directory to another. For this, I'm using the Get-ADOrganizationalUnit commandlet to export the OUs like this:

Get-ADOrganizationalUnit -SearchBase $filterbase -filter * | export-csv $outcsv 

As it turns out, we have useful information stored in the "description" attribute of the source OUs. Unfortunately, it doesn't seem that this information is part of the data exported by the Get-ADOrganizationalUnit commandlet.

So, could anyone suggest a way in which I could get the same information from the source AD but including the Description ?

In truth, I can work very well if the only attributes I get back are DistinguishedName, name and description so if you have another way to list all OUs under a specific OU in AD that includes these attributes, (and can be piped to export-csv), it'll work as well.

A customer of mine is experiencing a very strange problem: a scheduled task is running twice from time to time, with only a few seconds between execution.

The task is scheduled using the windows scheduler. It's a very basic task that connects to a local service using TCP/IP, authenticate, gives it a command and disconnect. It is nearly instantaneous (the longest part actually is the SSL handshake).

It triggers an issue in the server application which I will fix but my problem is that I simply cannot find any valid reason why the task is being run twice: nobody is ever connected interactively to that machine (it's an application server) and the server log shows that all these connections come from 127.0.0.1. Sending port and thread IDs both changes indicating in a very clear way that this is no some internal "ghosting" effect in the server application.

Unfortunately, task history wasn't enabled on that server so I don't have a run trace on that front. I have enabled it and, should the problem occur again, I will check it. I've verified, however, that nobody was connected to the machine around the time to issue occurred.

Can anyone explain this ?

Thanks

I was tasked to port and move an old ASP application from a Windows 2003 server (x86) to a Windows 2008R2 server running IIS 7.5

A number of things needed to be changed (mostly related to registry access) but I stumbled across one problem that I couldn't solve in a satisfying way.

The application makes use of an external COM object (in-process dll). It will create an instance of that object during the login phase and store it as a session variable.

This used to work quite nice and worked well in my test but when I deployed it on the first production server, I started to have random "500" errors when users tried to log in. The error was really not consistent so I used procmon to trace the source of the problem and got this: when a user tries to access the web site, the IIS worker process tries to open the Dll that hosts the COM object but fails with an access denied error.

Now, I don't understand this: the web application uses a service account for accessing the local resources. That service account has explicit rights on the directory where that COM library is located. Yet, the access to that file is still denied.

I "fixed" the issue by giving "everyone" explicit read and execute access on the dll and it (seems to) have solved the problem.

But I don't know why.

The strangest thing is that is I use a local administrator account to connect to the web page once (and just once), then the issue was fixed for as long as the application wasn't recycled.

I would appreciate if anyone could shed some light on that issue. I can live with the fix, but I really would like to understand.

Edit To clarify: the web site is NOT set to impersonate the connecting user. In fact, the only authentication scheme enabled is "Anonymous Authentication". The basic settings, however, are set to use the service account.

Edit The identity reported by procmon during the access denied is "IIS APPPOOL\(application name)"

We ran into the following problem: we added a new LUN to our small SAN when we upgraded from ESX 4.1 to ESXi 5.0. We wanted to move a number of VMs from one LUN to the other using storage vMotion. One of the reason for that was to make sure the VMs are safe when we'll upgrade from VMFS 4 to VMFS 5.

Unfortunately, we ran into the following error when we try to perform a storage vMotion:

A general system error occurred: Failed to initialize migration at source.
Error 0xbad0060. Necessary module isn't loaded.

The same error occur when trying a host vMotion.

Any idea what could cause this ?

I have a machine that has a problem I've never seen and cannot understand.

The machine is a Dell laptop with Windows 7 Ultimate. The user tried to do something fancy with this machine (bridging the WLan interface with the Ethernet one in order to connect his Mac to his home network. Anyway...) and after he disabled his changes, the network stopped working properly on that system.

What happens is that the NIC can get a DHCP lease 1005 of the time but then packets will be randomly dropped. It will work for 10 seconds, then fail for 30 seconds, then work again, etc. The problem is the same whether we try to ping a local machine or the gateway.

What we've tried:

• Booting from a Ubuntu live CD.
• Clearing the ARP cache on the machine and switch.
• Changing the NIC configuration to 100Mb half-duplex and disabled all offloading.
• Changing the IP address.
• Moving the machine to a different switch.
• Connecting directly on the head switch.
• Reinstalling the network card.

The only thing that worked was take the machine to a completely different network (an ethernet port on the WRT54GL wifi router that we use to connect customer to a dedicated ADSL line that has nothing to do with our internal network).

I'm out of ideas here. There is something that changed in our internal configuration and not the whole network is having a fit when it is asked to handle that mac address.

When I start a PING on the faulty machine and uses Wireshark on the destination, I see the same thing happening: when the ping on the machine fails, i see nothing in my trace. When the ping succeeds, I see the echo request coming in and the replies going out. The MAC address I see in the packets matches.

I'm really out of ideas here about what is happening. Anyone cares to make a suggestion ?

I'm having a very annoying issue with an HP printer (CM2320): all of a sudden, any user who has that printer installed locally as default printer would crash any Windows 2003 terminal services or Citrix server (XenApp PS 4.5) as soon as he connect, causing the session to hang and other users to be unable to connect to the server.

To restore functionality, an administrator has to connect to the server's console session and acknowledge the error message about spoolsv.exe having crashed with an AV.

I tried downloading the latest drivers from HP (an adventure worthy of Lara Croft in itself) and install it on all servers but that didn't seem to have helped the situation: the spooler is still crashing.

Anyone has a suggestion about what I could do about this ?

I'm writing a tool to generate self-signed X509 certificates and X509 certificate requests and I'm wondering how the "critical" property of the SubjectAlternativeName (OID 2.5.29.17) should be handeled. The documentation isn't too clear for me.

Should I:

• Make it critical
• Make it non-critical
• Let the user decide
• Ask the question on stackoverflow instead ?

Thanks

The guys responsible for the DB performance tuning asked me to change the queue depth on the two HP p410(i) controllers of my DL380 G6 server. They want me to switch it from automatic to 64. Unfortunately, I can't find a way to do it.

I've tried to bring up the array config CLI and type:

controller slot=2 modify queuedepth=64

and I got back:

Error: This operation is not supported with the current configuration. Use the
   "show" command on devices to show additional details about the
   configuration.

(Same thing with the slot 0 which is the embedded controller)

Any idea ?

OS is Windows 2008 R2 (x64), the ACU CLI version is 8.50-60

I have to connect an (ADO) application running on a standalone Windows 2003 R2 server to a SQL 2008 R2 database that is a member of the domain.

I have setup an SQL authentication account for this and hard-coded the password into the connection string but I wonder if it wouldn't be possible to use certificate-based authentication for this instead. I haven't been able to find any documentation regarding this apparently new functionality of SQL 2008 R2 anywhere.

Could someone kindly point me at some good documentation ? Or at least a description of the functionality and whether it could be used in my case or not ?

Thank you in advance

I have a locked down environment where users are prohibited from doing, well, basically anything but run the specific programs we specify.

We just switched a program from using the venerable "WinHELP" help format to HTML help (CHM) but that seem to have an unwanted and rather dangerous side effect: when a user click on a hyperlink inside the HTML help, a new internet explorer window is opened and the user is free to browse and do terrible things to my server (well, not that much, but still...)

I have checked the session in this case and the IE window is actually hosted within the help engine: there is no iexplore.exe process running in the user session (and it cannot: it's explicitly prohibited).

We have disable all help right now until we find a solution. I'm working with the help team to have all external URLs removed from the help file but that is going to be a long and error-prone task. Meanwhile, I've checked all the group policies option but I have to say that I was unable to find anything that would prevent a standalone IE window hosted in a random process from running.

I don't want to disable WinHTTP or the IE rendering engine or anything of the sort. But I need to prevent all users members of a specific AD user group from ever having an IE window displayed to them.

The servers are running Windows 2003 and Citrix metaframe 4.5.

Thanks in advance