marsh-wiggle's questions

On a Windows Server 2016 the ReFS volume can't be mounted any more. The eventlog shows

refs 133

The file system detected a checksum error and was not able to correct it. The name of the file or folder is ....

refs 135

Volume is formatted as ReFS but ReFS is unable to mount it; ReFS encountered status The volume repair was not successful.

Diskpart shows an emtpy, raw formatted 50TB disk.

All suggestion I found were to unmount / mount the disk (which didn't help) or to use a data recovery software.

The underlying hardware raid seems to work properly.

Has anybody faced this errors and solved it?

On a Server 2008 R2 (member of a domain but not a domain controller) we suddenly can't perform any administrative task. Every action (like net stop ..., whoami, ...) is denied with an access denied message. We can access the eventlogs but the only conspcious event is LSA 40961 (The Security System could not establish a secured connection ... )

Starting a program from explorer.exe works. Starting the same program from cmd.exe isn't possible (access denied).

What we tried so far

• Using local administrator instead of domain administrator => same behaviour
• Using elevated cmd.exe (right click run as administrator)
• Trying to disable uac (not possible due to access denied)
• Analyzing with sysinternals procmon => procmon can't be started
• anlyzing eventlogs => no conspicuous events

Edit
The attempt to disable UAC by the registry fails with the registry error: Error writing the value's new contents

Any ideas?

A customer Sophos-UTM reports Intrusion protection alert warnings INDICATOR-COMPROMISE suspicious .null dns query:

2019:01:15-11:54:13 utm-ba snort[31619]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="INDICATOR-COMPROMISE suspicious .null dns query" group="241" srcip="192.168.0.1" dstip="192.168.0.254" proto="17" srcport="49445" dstport="53" sid="48666" class="Misc activity" priority="3" generator="1" msgid="0"

We enabled DNS logging on the domain controller and get this data. (Names are obfuscated)

From the DNS log of the domain controller

Devices in the log

• 192.168.0.1 = domain controller (DomainServer.dom.local)
• 192.168.0.16 = QNAP NAS
• 192.168.0.254 = Sophos UTM

15.01.2019 11:53:39 2728 PACKET  000000E796562170 UDP Rcv 192.168.0.16    4c9e   Q [0001   D   NOERROR] AAAA   (12)NameOfServer(3)dom(5)local(3)dev(4)null(0)
UDP question info at 000000E796562170
  Socket = 556
  Remote addr 192.168.0.16, port 56856
  Time Query=533586, Queued=0, Expire=0
  Buf length = 0x0fa0 (4000)
  Msg length = 0x0031 (49)
  Message:
    XID       0x4c9e
    Flags     0x0100
      QR        0 (QUESTION)
      OPCODE    0 (QUERY)
      AA        0
      TC        0
      RD        1
      RA        0
      Z         0
      CD        0
      AD        0
      RCODE     0 (NOERROR)
    QCOUNT    1
    ACOUNT    0
    NSCOUNT   0
    ARCOUNT   0
    QUESTION SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(12)NameOfServer(3)dom(5)local(3)dev(4)null(0)"
      QTYPE   AAAA (28)
      QCLASS  1
    ANSWER SECTION:
      empty
    AUTHORITY SECTION:
      empty
    ADDITIONAL SECTION:
      empty

15.01.2019 11:53:39 2728 PACKET  000000E7932A4220 UDP Snd 192.168.0.254   4eb1   Q [0001   D   NOERROR] AAAA   (12)NameOfServer(3)dom(5)local(3)dev(4)null(0)
UDP question info at 000000E7932A4220
  Socket = 11688
  Remote addr 192.168.0.254, port 53
  Time Query=0, Queued=0, Expire=0
  Buf length = 0x0fa0 (4000)
  Msg length = 0x003c (60)
  Message:
    XID       0x4eb1
    Flags     0x0100
      QR        0 (QUESTION)
      OPCODE    0 (QUERY)
      AA        0
      TC        0
      RD        1
      RA        0
      Z         0
      CD        0
      AD        0
      RCODE     0 (NOERROR)
    QCOUNT    1
    ACOUNT    0
    NSCOUNT   0
    ARCOUNT   1
    QUESTION SECTION:
    Offset = 0x000c, RR count = 0
    Name      "(12)NameOfServer(3)dom(5)local(3)dev(4)null(0)"
      QTYPE   AAAA (28)
      QCLASS  1
    ANSWER SECTION:
      empty
    AUTHORITY SECTION:
      empty
    ADDITIONAL SECTION:
    Offset = 0x0031, RR count = 0
    Name      "(0)"
      TYPE   OPT  (41)
      CLASS  4000
      TTL    32768
      DLEN   0
      DATA   
        Buffer Size  = 4000
        Rcode Ext    = 0
        Rcode Full   = 0
        Version      = 0
        Flags        = 80 DO

Questions:

• Does anyone have an explanation why this is a potentially dangerous request?
• Is it only due do the (3)dev(4)null(0)part in the request?

(We currently don't know why this requests are sent and I already asked on Superuser: DNS queries “DomainServer.dom.local.dev.null” by QNAP NAS)

Under Windows 10, I connected an APC UPS via USB. In case of a power failure, the servers are shut down by a script.

Installing the APC Powerchute I get the error message The installer is unable to locate an APC battery .... The software can not be installed. The recommended troubleshooting does not show any abnormalities.

• The UPS is shown in the device manager
• Using USBDeview by nirsoft (which is recommended by APC to troubleshoot this problems), does not show any errors.

On a Windows 2016 terminal server I can't query the logged on users (even as domain administrator). In task manager the users tab is empty.

Using qwinsta.exe I get:

Error 5 getting sessionnames
Error [5]:Access is denied.

I know this may happen when I query a remote computer and AllowRemoteRPC is disabled. But here I'm logged on locally and AllowRemoteRPC is enabled.

In Veeam we have a backup copy job for creating offsite backups on usb disks.

Now I see that Veeam performs a health check on the usb disk.

I can't find any possibility to configure health check for copy jobs (Only for regular backup jobs as described here: Veeam documentation)

The windows system eventlog does not show any errors for the disk.

Edit
There is no unexpected cancelation in the history of the backup copy jobs.

Questions:

• May the health check indicate that Veeam found an error on the usb disk?
• Can health checks be configured for backup copy jobs?

Problem We have lots of not working .lnk files on a Windows Server 2016.

Example: Clicking on the shortcut 91205248__Orig.lnk causes the error:

Problem with shortcut - the drive or network ....

What I found out

• The .lnk file can be edited in explorer
• The stored path is correct "R:\my subfolders\Fallordner 2012\91205248"
• After cutting out and saving the same path again the .lnk works
• Size not working .lnk files: 15kb
• Size working .lnk (after resaving): 2kb

Tracing with sysinternals procmon.exe

Working .lnk file:

Not working .lnk file:

Size changes after re-saving

15 kb = not working original

History

The system is migrated from Windows 2008 R2 file server / terminal server to server 2016 file server / terminal server

Questions

• How can malformed .lnk files be recognized?
• Is there any way to fix it (except manually opening and saving each .lnk file again)?

Edit
.lnk files are no text files, so simple search / replace operations won't work.

Edit2
I hesitate to perform a bulk operation and rewrite all paths in the .lnk files (as described here: Modify shortcut file (.lnk) target path using Powershell). So I hope there is somebody who faced a similar problem and solved successfully.

We carelessly sold a Dell T130 server with a H330 controller to a customer who wanted an as cheap as possible soultion.

Due to performace issues he is asking now to replace the H330 controller with a R730 controller.

Dell support tells me that that the controller can be replaced except the cable for the HDD LED which isn't available as "after sales product".

Has anyobody done this before and can confirm that the other cables fit?

Can the LED cable be replaced with a regular 2pin cable? like this cable

Is it true that on a Windows 2016 domain controller (bare metall installation), the disc write cache is turned off even if a battery-buffered RAID controller is installed and recognized by the system (by default after every reboot)?

(We don't have experience in Windows bare metall installations and there are contradictory informations on the internet)

After a reboot we encounter while the first backup (wbadmin) on a Windows Server 2016 these errors in the eventlog:

• Source: SPP
• Event ID 16389
• Details: The writer's timeout expired between the Freeze and Thaw events (0x800423f2)

Weak hardware
The server has only sata drives and the controller has no (buffered) cache (Dell T130; H330 controller).

Errors only after reboot
The errors occour while backing up MSSQL databases. We also encounter SQLWRITER errors and errors from the SQL Server itself while the backup is running. But the backup itself completes without prompting any error and until the next reboot the following backups are perfomed without any errors in the eventlog.

In the errorlog of the sql server I can see for every database:

2018-11-02 01:16:37.34 Backup      BACKUP failed to complete the command BACKUP DATABASE <name of database> Check the backup application log for detailed messages.  

vssadmin list writers: All writers report stable and no errors

Possible soulution?
We found hints to increase the SPP "CreateTimeout" to 20 minutes

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SPP\CreateTimeout  

Is this an appropriate way to solve the problems?

May this cause any other problems?

We installed complete new servers including new active directory and new Exchange server 2016. (Old was Exchange 2010). Emails were exported and imported.

After that sometimes internal mails couldn’t be delivert:

Remote Server returned '550 5.1.11 RESOLVER.ADR.ExRecipNotFound; Recipient not found by Exchange Legacy encapsulated email address lookup'

The error occurred after answering to an old email. We solved that problem by determining the legacy X500 addresses and adding them to the Exchange accounts proxyAddresses attribute. All worked fine afterwards.

Like here for "user1"

/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=<user name>

For "user1" now the error came again with a completely different X500 address:

/o=<company name> /ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=a6195749405b4b3daa678bdb0aee0358-<User1>

As far as I know Exchange can’t handle two X500 addresses.

Question
Is there any way to get generally rid of that problem?

Edit1
The X500 address for every user is already added to the proxyAddresses attribute.

My problem now is that there is at least one user who has two different X500 addresses. The first I found in the old Exchange LegacyExchangeDN attribute. The second I found today in the “could not deliver mail”.

So I precise my question:

• Can exchange handle more than one X500 addresses?
• How can I find the other X500 addresses for users before an error occurs?

Since some days Outlook is dayly auto-accepting meeting invitations from a specific user.

What happens

• Mail: "Microsoft Outlook has agreed to this meeting in the order of [employee2]"
• The mails come every day at the same time
• They usually accept every day the same meetings
• All meetings seem to be periodically meetings (like yearly birthday - reminder)
• No automatic accept or decline is set in outlook
• no rules are defined
• The meetings are on both accounts present
• Only one user is affected

Using
Exchange Server 2016, Windows Server 2016, Outlook 2016 on Terminal Server 2016

History
The complete IT was new installed in june (including active directory). All Mails, Meetings, ... has been exported and imported using PST files.

What i did so far
Similar behavior found here (in this case Exchange is periodically recreating missing meetings) https://andys-tech.blog/2017/02/exchange-users-receive-meeting-invitations-from-declined-instances/

Here a "Calendar Repair Assistant" is the cause. There seems to be a way to stop the "Calendar Repair Assistant".

From the log
I looked in the logs of the "Calendar Repair Assistant" There is the name of the old server stored. But only one user is affected, so it shouldn't be a general problem.

<89B4B51C6F61BD4CA7BDFCE66559077EBB4379@SERVER.OldServerName.local>

Questions

• Should the "Calendar Repair Assistant" be stopped?
• Does this behavior indicate a deeper error or misconfiguration?

Suddenly we got a problem on some windows pcs when accessing the dfs share. Before this the DFS access was working.

The Problem
Some clients suddenly cannot access the dfs share like: \\thedomain\dfs

Error: The Network Path was not found

\\thedomain.local\dfs resolves, but doesn't work either

When it starts happening
It seems to happen on clients which were rebooted.

What happened before
An Exchange 2007 was uninstalled from one of the domain controllers.

Environment

• Server 2008 (10.15.24.9) (domain controller; formerly sbs2008)
• Server 2016 (10.15.24.8) (dfs server)
• Windows 10 / Windows 7 Clients

We already checked

• works on most pcs: \thedomain.local\dfs
• works on most pcs: \thedomain\dfs
• works: net view \\10.15.24.8
• works: nslookup thedomain.local
• works: Access via IP \\10.15.24.8\dfs
• fails: dfsdiag /testdfsconfig /dfsroot:\\thedomain.local\dfs
  • result: RPC Server is unavailable
• works: dfsdiag /testdfsconfig /dfsroot:\\thedomain\dfs

We installed a complete new server 2016 environment with 5 terminal servers in a farm. We also use User Profile Disks for the profiles.

The fault:
When the domain administrator is logged on to any terminal server and the terminal server gets started, we get after the logon of the domain administrator this message:

We can't sign into your account

... and the administrator gets a temporarily profile.

After logoff / logon the message isn't shown and the regular profile is loaded.

• We use the console logon for the rdp connection
• There is only one administrator logged on at one time
• The eventlog doesn't show any conspicuity.

Edit#1
From a comment: A similar error is described here: technet group. The cause in this case are DVDROM drives, which are connected to the location 1 on on the scsi-controller.

In my case the DVDROM drives are connected to SATA. For testing I removed the drives but the error still behaves.

BUT: This may be an hint, that also in my case the user profile disks couldn't be properly connected.

We use Veeam 9.5 for backing up an ESX farm.

For the Copy Job we plan to switch over from USB devices to NAS with network share, like:

\\thenas01\VeeamCopy
\\thenas02\VeeamCopy
\\thenas03\VeeamCopy

The NAS will be changed periodically. At a time only one NAS will be connected to the network.

We could configure three Copy Jobs but will get failed errors for the two missing NAS.

Question: Is there a way co configure a single Copy Job which supports this constallation without reporting errors for the missing NAS?

I've installed an AD LDS on a Windows 7 Machine in the context of an local user (ws-cs-03\rseuser).

This user can access and administrate the AD-LDS instance.

Question: Where is the information stored thas this user is the administrator?

Abstract

I need an encrypted TCP connection from multiple clients to a single port over the internet. Can this be realized with Squid?

Concrete situation

We use a monitoring and client management solution in our company which is accessible over LAN and VPNs. It should be now accessible from external notebooks which don't use the company VPN. The communication must be encrypted (TLS). The clients authentication must use clients certificates. The communication is initiated by the clients and uses a single TCP port.

Results of my investigations

NGINX Plus seems to offer this feature but our admin prefers squid or apache. At the squid wiki I found that: Feature: HTTPS (HTTP Secure or HTTP over SSL/TLS) where TCP encrypting is mentioned. But I also found this warning:

It is important to notice that the protocols passed through CONNECT are not limited to the ones Squid normally handles. Quite literally anything that uses a two-way TCP connection can be passed through a CONNECT tunnel. This is why the Squid default ACLs start with deny CONNECT !SSL_Ports and why you must have a very good reason to place any type of allow rule above them.

Similar question

This question Encrypt client connection with squid forward proxy using SSL is simlar, but doesn't treat reverse proxies / TLS termination proxies.

What I need to know

I have only basic knowledge about that technologies and our admin asked me for general feasibility.

• Can Squid be used for save encrypting of TCP connections?
• Can this be realized using authentication with client certificates?
• Or should it be used only for HTTPS connections?

The applied WMI filter to a group policy is ignored by certain clients. It works fine on other clients, returns the correct value, but on some clients it is just not applied and does not appear in group policy results.

Group Policy:

• Computer Settings: Set WSUS configuration
• User Settings: [empty]

WMI Filter:
“Select * from Win32_ComputerSystem where Caption = …”

Group Policy Results Wizard:
Computer Configuration:

• Case 1: WMI filter is ignored by some clients, the policy is applied nevertheless
• Case 2: WMI filter is applied correctly and policy will only be applied to the correct clients (as it is defined in the wmi filter)

User Configuration:

Policy is applied regardless of the WMI filter, but that is no problem since the user configuration is empty

What is the best way to determine why some of the clients are ignoring the WMI filter?

Edit Wmi is tested and working on all machines. The seems to that the group policy dosn't start the query on the remote machine, and not that the query is started and not working.

We have a sporadic problem accessing some internal links on websites. (Windows Firefox, Internet Explorer, Chrome)

Behaviour
On first clicking a link, the browser will load infinitely. The second click on the same link then works perfectly fine.

The clients
We are running Windows 7 on the client-side and already tried different browsers (IE11, Firefox and Chrome). Avira Antivirus has its Browser-Security plugin enabled on these clients.

The web server
The server is running Debian Jessie, Apache 2.4.10 and Joomla.

Analyzing the network trace
When we trace the connection using wireshark, we find that the webserver misses to react on an ackowledgement the client sends, then sends a FIN-package, which is ignored by the client. The client continues to use the same TCP-connection, that was finished by the server.

Network-Trace: (all captured within a single tcp session)
1. Client sends ACK
2. Server recieves ACK
3. Server sends FIN-package after 5 seconds
4. Client recieves FIN-package
5. Client ignores FIN-package and continues to send data
6. Server recieves data, sends ACK-package, but no answer on the data
7. The browser session freezes

The avira plugin
What we know so far is that the error wont occur, if we disable the Browser-Security plugin of Avira or exclude the URL from being monitored. Avira has confirmed the error, but cant tell us when it will be fixed.

Questions
Anyway, the problem occours only on that web server, all other web servers are not affected.

So it can be influenced by the configuration on the web server.

I'd like to ask if anyone experienced similar errors so far?

Another question would be if there are settings regarding Apache or the TCP-stack to disable the ACK (point 6) which seems to be incorrect anyway.

EDIT
The typo3 sites are also affected.

As a workaround: After increasing the keepalive on apache from 5s to 90s the error doesn't occour anymore. (But we'd like to avoid such high keepalives)

We have trouble with the SearchIndexer on Windows 2012 R2. Microsoft suggests do uninstall the feature and reinstall it.

Where can I do that in Windows Server 2012? Can't find the feature in the feature list.