Knox's questions

We have a Dell PowerEdge R720 with a PERC H710 Raid Array. It is configured into two disk groups, disk Group 0 which has the OS and the data, and Disk Group 1 which for reasons unknown to me is configured as a RAID 0. One of the physical disks in Group 1 has failed. The server always boots into the RAID BIOS. How can i take Group 1 offline or disable it so that the server can boot?

I have cleared the checkboxes that say to go to BIOS on error.

The real problem is that changes are being stored in the cache that it can't write to the bad disk. It has the message:

There are offline or missing virtual drives with preserved cache.  Please check the cables and ensure that all drives are present.

I have a Windows 2008 R2 Service Pack 1 server. It's virtual, not that that should make any difference. It's only purpose in life is running IIS 7 and it does that quite nicely. However, when I go to the performance monitor, there's not a choice of ASP.NET or ASP.NET applications. There is a choice of APP_POOL_WAS which has instances of the application pools I'm interested, but the counters are not very interesting. There are also a bunch of other performance counter choices. The websites use 2 application pools, each which is using v4.0 of the .NET framework. If I look in the task manager, i see two w3wp.exe's running, each a IIS worker process. I had UAC turned on, but i turned it off. I added appDomainResourceMontoring to the aspnet.config file, but that didn't help. Here's the aspnet.config file if that's the slightest help.

<?xml version="1.0" encoding="UTF-8" ?>
<configuration>
    <runtime>
        <legacyUnhandledExceptionPolicy enabled="false" />
        <legacyImpersonationPolicy enabled="true"/>
        <alwaysFlowImpersonationPolicy enabled="false"/>
        <SymbolReadingPolicy enabled="1" />
        <shadowCopyVerifyByTimestamp enabled="true"/>
        <appDomainResourceMonitoring enabled="true"/>
    </runtime>
    <startup useLegacyV2RuntimeActivationPolicy="true" />
</configuration>

There's a new tool and service that makes it very easy to break MS-CHAP v2, which is used to secure VPNs. A good summary of the attach against MS-CHAP can be found at Ars Technica. Here's the way I currently have my VPN service running on Windows 2003 R2 SP2 configured:

Should or can I just go with EAP? My client machines that use the VPN are Windows-XP (a small number of machines which I could turn off), Windows 7, and iPads. I don't have any RADIUS routers or wifi or anything else that relies on the Windows VPN service. The EAP methods that my machine has are:

I would like to upgrade our 2007 Exchange server from the initial release (RTM) to SP1, or if it makes sense to a later SP. I would appreciate an order of magnitude kind of estimate, is it an hour, 6 hours, a weekend?

It's running on a Dell Server PE 2950, with a Xeon 5130 CPU (2 GHz) with 4 GB of RAM. Windows 2003 SP2 x64. We have about a TB of disk running with Dell RAID. Unfortunately, the C drive only has about 5 GB free; it was set up by a consultant years ago as only a 20 GB drive. The data stores for Exchange are around 600 GB on a separate D drive.

I know what a GET and a POST are, but it's almost impossible to Google for the word OPTIONS. Here's what I see (i deleted all the stuff at the end) of each:

11/23/11    0:02:13 10.100.0.14         GET       /CUpdate2.cshtml  _=1322006533495
11/23/11    0:02:13 10.200.0.10         OPTIONS   /AssignmentCount  _=1322006576798
11/23/11    0:02:13 10.200.0.10         GET       /media/faxSound.wav   -
11/23/11    0:02:13 10.200.0.10         GET       /Star/StarUpdates _=1322006578729
11/23/11    0:02:13 10.100.0.10         GET       /CUpdate2.cshtml  _=1322006533268

I have a website (Alpha) running successfully on an IIS 7.5 webserver running on Windows Server 2008 R2.

I basically want to clone Alpha and have a second website Beta, the same as Alpha, but will have somewhat different code. I've created the second website and also created a second Application pool. As far as I can tell, the two application pools are configured the same: auto start, v4.0, Integrated, Identity: ApplicationPoolIdentity.

The second website (Beta) doesn't work if I connect it to its own Application Pool, but works fine if I connect it to Alpha's Application Pool. As far as I can remember, I did not do anything special to Alpha's Application Pool. As far as I can tell, the advanced settings are the same for both.

The failure Beta has when connected to its own Application Pool is is getting an unhandled exception: Exception Details: System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

Any ideas on how to compare the two Application Pools, or to debug the overall system would be appreciated.

I tried deleting Beta's Application Pool and re-creating it.

I would like to have an disk image backup of Exchange, before doing some significant upgrades and expanding a too-small C-Drive. Can I use something like Acronis Backup & Recover 10 Server (price on 11/11/2010 $860) and not use Acronis Backup for Exchange which is like 50% more expensive? Or is there a better alternative to get a disk image backup?

What is the number of computers being managed where the effort and cost of setting up and maintaining and managing a Windows Server Update Services (WSUS) server is the same as individually managing the computers?

In our case, we have about 60 computers, all belonging to the domain, all limited users. However, some are laptops, some are servers (windows 2003 and 2008), a few virtual machines, most XP, and a few Windows 7. Most have common software, like MS Office, but there subsets with various specialized software, such as Quickbooks. My tech guys recommend going to WSUS, but I've been resisting, figuring we were still a bit too small.

My own gross-guesstimate is that 100 computers is the breakeven, but if it's 10, then I've been too conservative. If it's 50 computers, even though we're somewhat over that number, I'll probably leave well enough alone. We currently use various automation tools to manage the computers: group policy, log in scripts, PSExec, and scheduled tasks to crudely do what I imagine WSUS would help us better do with a lot less bandwidth.

My production system has two Windows Server 2003 R2 servers acting as domain controllers. Can I add a Windows Server 2008 DC to the existing domain without changing the schema? This is a similar question to Can a windows 2008 R2 server join a 2003 domain? but in that case, the 2008 server being added was not a domain controller.

I have a Microsoft Exchange server 2007 running on Windows 2003 R2. I need to search everyone's emails for legal discovery purposes. I'd like to do this in some centralized fashion with administrator rights rather than going account to account. Is there a way to do this?

Is there a command line or even through the sql server studio to gracefully stop SQL Server 2005?

One of the risks to small and medium businesses is losing your bank credentials to bad guys by use of a key logger or other malware as Bruce Schneier blogs about. A particular threat is real-time key loggers as described in the NY Times. The bottom line is that with commercial bank login information, bad guys can wire money out of your accounts and there may be no recourse. Commercial bank account logins are truly the keys to the kingdom.

I’ve decided to substantially increase the security on the machines where these bank credentials are used. My standard security recommendations are Windows XP SP3 with patches being applied automatically nightly. Virus protection is on (We generally use ESET). Users are Limited users; they can’t add software. Software restrictions prevent the user from accidently or deliberately downloading software and running it out of their user directory. We use IE8 because of the ease of managing it in a Active Directory environment, but I recognize this as a potential weakness. Unfortunately, the most likely vector of a zero day exploit is flash or acrobat, both of which we use.

Security is always a tradeoff of convenience versus safety, so answers and suggestions should give pros and cons. I’m going to answer with a few suggestions, so you can see where my thoughts are going.

We have Microsoft Standard Exchange 2007. Sometime recently we have suddenly lost the ability to receive emails from AOL. As far as I can tell, we are receiving all other email normally.

The only anti-spam solution we use is a blocklist from zen.spamhaus.org. I've temporarily disabled it with no change. I didn't think it would make a difference anyway since the aol servers don't appear to be in zen.

We use OpenDNS as our DNS provider, but it's not blocking aol.com.

We are able to SEND to aol.com and these messages are received so it's not like they are blocking our domain.

============================================
UPDATE 1: Here's a typical aol log (I chopped out the IP's and other stuff):

,<,EHLO imr-da02.mx.aol.com,
,>,250-mail.mydomain.com Hello [205.188.105.144],
,>,250-SIZE,
250-PIPELINING,
250-DSN,
250-ENHANCEDSTATUSCODES,
250-STARTTLS,
250-AUTH GSSAPI NTLM,
250-X-EXPS GSSAPI NTLM,
250-8BITMIME,
250-BINARYMIME,
250-CHUNKING,

,250 XEXCH50,
<,MAIL From: SIZE=8356995,
,08CBB8907FCC1A80;2009-08-18T18:37:33.812Z;1,receiving message
,250 2.1.0 Sender OK,
<,RCPT To:,
,250 2.1.5 Recipient OK,
<,DATA,
,354 Start mail input; end with .,
,+,,
,,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions
,>,"220 mail.mydomain.com Microsoft ESMTP MAIL Service ready at Tue, 18 Aug 2009 14:37:45 -0400",

======================================================================
UPDATE 2: Using the Microsoft Troubleshooting assistant, the mail tracking results for a specific email gave this error message:

550 5.2.0 STOREDRV.Deliver: The Microsoft Exchange Information Store service reported an error. The following information should help identify the cause of this error: "MapiExceptionNamedPropsQuotaExceeded:16.18969:23010000, 17.27161:00000000E4000000000000000000000000000000, 255.23226:00000000, 255.27962:7A000000, 255.27962:56000000, 255.17082:00090480, 0.16993:80030400, 4.21921:00090480, 255.27962:FA000000, 255.1494:00000000, 255.26426:56000000, 4.6363:0F010480, 2.31229:00000000, 4.6363:0F010480, 2.22787:00000000, 2.22787:00000000, 2.22957:00000000, 2.19693:00000000, 2.17917:00000000, 2.27341:00000000, 2.22787:00000000, 4.5415:00090480, 4.7867:00090480, 4.4475:00090480, 4.4603:00090480, 4.5323:00090480, 5.10786:000000004E414C2D4D41494C303100100F010480, 255.1750:00090480, 0.26849:00090480, 255.21817:00090480, 0.24529:00090480, 4.18385:00090480".

What are common drawbacks, gotchas, and problems of choosing Vista 64-bit versus 32 bit? We recently purchased two laptops and selected Vista 64 bit, but I'm considering downgrading to Vista 32 bit on both. The only reason for going 64 bit was to get access to the additional RAM.

Obvious issues include that many drivers only come in 32 bit versions which won't run in 64 bit Vista. Less obvious is that ODBC drivers are also drivers - they can be accessed using a 32 bit ODBC manager included in Vista 64 bit. Some programs which run fine under the WOW (Windows 32 bit on Windows 64 bit) environment include 32 bit printer drivers to facilitate for example printing to PDF. That doesn't work so fine.

What else is there?

When using Outlook 2007 connecting to our Exchange server through the public URL, I get the following error: There is a problem with the proxy server's security certicate. The name on the security certificate is invalid or does not match the name of the target site mail.contosco.com.

Outlook is unable to connect to the proxy server. (Error Code 0)

(The message has our company URL instead of Contosco) We've set this up with self-signed cert and the system works remotely for all of our remote computers except this one. This one is different in that it is the first Vista 64bit to be tested for deployment. It's Vista SP2 also. Our mail server is set up FQN of mail.contosco.local.

I've made sure if I visit the website mail.contosco.com using a browser, that the certificate is considered trusted since I have installed the signing cert into cert list.

If I turn off the "Only connect to proxy servers that have this principal name in their certificate:" which contains msstd: mail.contosco.com, then it works. I'm convinced all the other settings are the same as our other Vista Outlook 2007 machines which all work. Any ideas?

We have a primary file server for our Windows Server 2003 (Standard Edition) domain. We're running active directory in a plain vanilla type environment. When we recently migrated from an old server to a new one, I set up a DNS entry as Files.OurDomain.local as an Alias (CNAME) to the real server name. I disabled Strict Name Checking (see MSDN link text). All client machines now refer to \\Files or \\Files.OurDomain.local to get to their files. No one ever uses RealServer.OurDomain.local. Printers also use an alias to get to their server.

I plan to use this setup in the event of a significant server problem to switch the dns alias to another server as a poor man's warm standby. Also it should make server migrations in the future very easy. I tried DFS but it didn't give me the comfort that I had exact control over where files were going. The default TTL (Time to Live) for the DNS entries is 1 hour. That's probably what it would take the tech staff to determine that the server had been lost and we would really need to switch to the backup.

Any concerns or problems (or even accolades) with this approach?