phuzion's questions

So, at my company, we have three MS Exchange servers. 2 2007 servers (exchange1, and exchange3), and a 2010 server (exchange2), both Standard edition. We are going to take one of the Exchange 2007 servers down (exchange1) to rebuild and install Exchange 2010 on, since we are licensed for that. I'm in the process of moving all of the services from exchange1 to exchange3. I have set up exchange3 with the same roles as exchange1, and moved all of the mailboxes over.

My issue now, is that when I stop the Information Store service on exchange1, people can't get into their email. I'm thinking that Outlook is still going to exchange1 as the client access server, but I'm not entirely sure about that. I have tested, and after moving, the Outlook clients are told to restart, and the new server is in their account settings, but it seems like the organization as a whole is somehow dependent on the Information Store on exchange1 being up and running.

I feel like there is more to be done, but so far I cannot find a technet article or forum post anywhere describing how to do what I want to do.

For reference, here is the output of netstat running on a workstation whose Exchange mailbox has been migrated from exchange1 to exchange3:

Active Connections

  Proto  Local Address           Foreign Address              State
  TCP    workstation:4096        exchange3.example.com:epmap  TIME_WAIT
  TCP    workstation:4097        exchange3.example.com:1044  TIME_WAIT
  TCP    workstation:4103        exchange3.example.com:epmap  ESTABLISHED
  TCP    workstation:4104        exchange3.example.com:53428  ESTABLISHED
  TCP    workstation:4106        exchange3.example.com:1044  TIME_WAIT
  TCP    workstation:4107        exchange1.example.com:epmap  ESTABLISHED
  TCP    workstation:4108        exchange1.example.com:6139  ESTABLISHED
  TCP    workstation:4110        exchange3.example.com:53428  ESTABLISHED

Ok, so I have two subdomains going to my Exchange box at work (Exchange 2007 on Server 2008). The internal subdomain is exchange.company.com and the outside domain is webmail.company.com. Our AD domain is the same name as our website domain. Our DNS server internally points exchange.company.com to the Exchange box, and so does webmail.company.com. Exchange.company.com is not pointed to anything on the outside DNS.

So, in order to enable people to get to their email from outside and make it easier to deal with phones and such connecting in, I bought a GoDaddy SSL certificate the other day, and installed it. Unfortunately, the GoDaddy certificate points to webmail.company.com, and everyone's Outlook is directed to exchange.company.com. Therefore, people keep getting a "Certificate is valid, but the domain it is assigned to does not match the domain it is on" kind of message. I don't remember the exact wording.

Anyways, my question is this: How do I set up one certificate (the one distributed by the trusted CA from inside my company) to be used for MAPI, and the other to be used for IIS? Or, even better, if the machine is accessed as webmail.company.com, use the GoDaddy, if it's exchange.company.com, use the internal CA cert.

At my company, we have a Windows Server 2003 R2 server which is our primary AD server with just about everything Windows-based running on it (AD, filesharing, print sharing, etc). The Domain functional level is Windows Server 2003, but the Forest functional level is Windows 2000 (the domain used to be primarily hosted on a Windows 2000 Server machine).

A couple of weeks ago, a co-worker and I removed the Windows 2000 Server from the domain, moving all FSMO roles to the Windows Server 2003 machine, making it the primary and only domain controller. Unfortunately, we forgot to move a couple of things, such as GPOs and login scripts. The majority of the login scripts have been recreated, as well as the GPOs, but we still have a couple of small remaining issues. One of which is this little error we get roughly every 5 minutes:

Windows cannot access the file gpt.ini for GPO CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=OURDOMAIN,DC=com. The file must be present at the location <\OURDOMAIN.com\sysvol\OURDOMAIN.com\Policies{6AC1786C-016F-11D2-945F-00C04fB984F9}\gpt.ini>. (The system cannot find the path specified. ). Group Policy processing aborted.

Shortly after receiving this error, we receive the following error:

Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

Now, things that I've recreated such as Folder Redirection are currently working just fine, so as far as I can tell, the GPOs that exist are being found by the client workstations, and are being applied, so we're good on that part. However, I would like to get these errors to go away because it's rather annoying. (I receive copies of all errors in my inbox every morning).

I have attempted to run dcgpofix, however this only gives me the following error message:

Microsoft Windows [Version 5.2.3790] (C) Copyright 1985-2003 Microsoft Corp.

U:>dcgpofix

Microsoft(R) Windows(R) Operating System Default Group Policy Restore Utility v5 .1

Copyright (C) Microsoft Corporation. 1981-2003

Description: Recreates the Default Group Policy Objects (GPOs) for a domain

Syntax: DcGPOFix [/ignoreschema] [/Target: Domain | DC | BOTH]

This utility can restore either or both the Default Domain Policy or the Default Domain Controllers Policy to the state that exists immediately after a clean install. You must be a domain administrator to perform this operation.

WARNING: YOU WILL LOSE ANY CHANGES YOU HAVE MADE TO THESE GPOs. THIS UTILITY IS INTENDED ONLY FOR DISASTER RECOVERY PURPOSES.

The Active Directory schema version for this domain, and the version supported b y this tool do not match. The GPO can be restored using the /ignoreschema comman d line parameter. However, it is recommended that you try and obtain an updated version of this tool that may have an updated version of the Active Directory sc hema. Restoring a GPO with an incorrect schema may result in unpredictable behav ior. The restore failed. See previous messages for more details

As usual, if there's something important that I've left out and need to tell you in order to help fix this problem, comment and I'll include it.

More information since comments are limited to 600 characters:

I'm totally able to browse to \ourdomain\sysvol and \ourdomain.com\sysvol from both clients and the server. The real problem we're having is that on C:\WINDOWS\SYSVOL\sysvol\ourdomain.com\Policies directory on the primary AD server, there is no {6AC17...} directory in there. Period. It did not replicate at all. I don't think anything replicated to be honest, since we had to completely rebuild the login scripts and the GPOs by hand.

I wasn't the one who retired the old Win2k server, but from watching, the guy that did it ran into a problem and actually had to seize the FSMO roles on the new system. Sysvol had to be manually rebuilt if I recall correctly, and NETLOGON isn't set up exactly the way it should, although it DOES work, as do our current GPOs minus this one that seems to be referenced somewhere yet not exist.

Here's the list of steps I've taken to try to resolve this issue:

• Searched in C:\WINDOWS\SYSVOL\sosvol\ourdomain.com\Policies directory for the files, they do not exist
• Searched \ourdomain.com\sysvol and \ourdomain\sysvol for the files, which again, do not exist. These two right here tell me that the GPO straight up does not exist anywhere on our system.
• I have searched the server's entire filesystem for anything matching 6AC1786C and found nothing except an old backup from 6 years ago from the Windows 2000 Server.
• I have attempted to run dcgpofix, only to have it fail citing the fact that the schema type of the domain does not match the schema type for the tool.
• I have ran dfsutil /PurgeMupCache which effectively did nothing.

We have a program on our primary server that runs for some of our legacy machines. It's basically a customized time server so that old machines on the shop floor can keep accurate time (they are used for shop employees to clock in and out, among other things). Unfortunately, the program has no way to run in the background, which means the local console must be logged in at all times in order to keep this running. I'd like to eliminate the need for that, and make it start up at boot time. Currently, if the system goes down, I have to rush in and log in the local console so that the time server starts up.

Is there a way to make a process start at boot time, even before the local console is logged in? It's a simple program, runs in CLI fine, and no GUI or anything like that.