I'm reviewing the new Windows Nano Server Installation option. I'm using the Server Technical Preview 2 and installed a Nano Server OS in a VM on a Server 2012 R2 Hyper-V host.
I can connect to the Nano-Server via PowerShell remoting and can do all kinds of things in the remote PowerShell session.
On a second Server 2016 with full GUI I opened Server Manager and connected to the Nano server, that works, but Computer Management is grayed out:
Is this by design?
Microsoft lists the IIS http status codes including the substatus codes here.
In the 404 section there are substatus codes between 0 and 20, but in my logs I get a 503 as sc-substatus
I can't find any information about it. Don't confuse this with the standard http 503 (Service unavailable) status.
We are using Hyper-V replication on Windows Server 2012+ outside Active Directory, so we are using SSL certificates issued by our own internal CA.
When setting up replication, I made sure that both the source host and the replica server had access to the CA server.
However in normal operation due to our network topology, the Hyper-V hosts have no access to the CA server.
This seems to work fine, but I'm wondering whether the Hyper-V hosts will ever need to access the CA server again to check for revoked certificates.
Because there are less components installed on a Windows Server core OS, it needs less patches than the full OS. I read in several places that therefor it needs less reboots after patching.
I'm running Server 2012 core in production since September 2012 now and I don't remember a single patch-Tuesday when I did not have to reboot the server after installing Windows updates.
Are there any hard numbers out there that compare the required reboots for core vs. Full OS?
Less reboots may be the main reason why people choose to go with Server core. If it actually requires just as many reboots as the full OS install, they may think again the next time they set up a server.
Another second Tuesday of the month, another set of updates, on my Windows Server 2012 Core I get:
List of applicable items on the machine:
1> Update for Windows Server 2012 (KB2769165)
21> Cumulative Security Update for Internet Explorer 10 for Windows Server 2012
(KB2792100)
26> Security Update for Windows Server 2012 (KB2778344)
Select an option:
(A)ll updates, (N)o updates or (S)elect a single update?
As you see there is one update for IE10 which my machine does not have, so much for 'applicable'.
I could now select the other 25 updates one by one which would be a pain, so I go for All.
When done, the installed hotfixes include one for KB2792100, the IE patch.
Okay that one was a recommended update, not a critical one, but still why does it download 14MB and installs it, shouldn't it figure out that this is a Server Core installation which does not have Internet Explorer?
Or does it actually patches the IE files that are somewhere in WinSxS just in case I may change into GUI mode some time in the future?
One marketing argument by Microsoft for Server Core is that it requires less patching, is that actually true?
When using Microsoft's Remote Desktop Connection, one can set certain local drives to be available on the remote machine.
On the remote box they show up in Explorer as 'E on LOCALBOX' and provide a simple way to copy files back and forth.
On Server Core installations there is no Explorer, so how can I access the drives from the command line?
When using third party file managers that run on Server Core, the drives show up as 'System Folder' but am I unable to open them.
I have an ASP.NET site on IIS8, but IIS7.5 behaves exactly the same. When I enter a URL like:
mysite.com/foo/bar..
I get the following error with a '500 Internal Server Error' status code:
even though I have custom error pages set up for 500 and 404 and I don't see anything wrong with my custom error page.
In my web.config system.web node I have the following:
<customErrors mode="On">
<error statusCode="404" redirect="/404.aspx" />
</customErrors>
If I remove that section, I get a 404.0 response back but the page itself is blank.
In web.config system.webServer I have:
<httpErrors errorMode="DetailedLocalOnly">
<remove statusCode="404" subStatusCode="-1" />
<error statusCode="404" prefixLanguageFilePath="" path="404.html" responseMode="File" />
</httpErrors>
But whether that is there or not, I get the same blank 404.0 page rather than my expected custom error page, or at least an internal IIS message.
So first of all why is the asp.net handler picking up a request for '..' (also works with one or more trailing dots)
If I remove the following handler from applicacationHost.config:
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" responseBufferLimit="0" />
I get my expected custom 404 page, but of course removing that handler breaks routing in asp.net among other things.
Looking at the failure trace I see:
Windows Authentication is disabled for the site, so why is that module even in the request pipeline?
For now my fix is to use the URL Rewrite module with the following rule:
<rewrite>
<rules>
<rule name="Trailing Dots" stopProcessing="true">
<match url="\.+$" />
<action type="Rewrite" url="/404.html" appendQueryString="false" />
</rule>
</rules>
</rewrite>
This works okay, but I wonder why IIS/ASP.NET behaves this way?
Is it possible to run SQL-Server 2008R2 or 2012 on Windows Server 2008 R2 Core installation.
There are three questions to answer:
This question came up on a question about WSUS on Server Core, other products require SQL-Server as well, so it would nice nice to know.
I create a new Word document in 'Office Open XML' format (docx). I then encrypt it using EFS and add several other users to access the file.
Now I open the document and edit it, after saving it, the file is still encrypted but the additional users are gone! This means I have to remember which users I gave access to originally and add them again every time I edit a document.
If I do the same with a different file type, say *.txt, the additional users are kept after editing.
I assume this happens because the new Office documents are zip files that are unpacked and then re-created rather than just opened and closed. Word is smart enough to apply EFS encryption again, but only for the current user.
Does anybody know a way around this?
We are using Office 2010 on Windows 7 with AD based EFS.
I have a Windows Web Server 2008 R2 Core, which runs several web sites. There is no AD.
One of the web applications requires Windows Authentication for a single user.
I would like to restrict the user from doing anything except being used for IIS Windows authentication.
Here's what I did so far?
When I do a 'whoami.exe /all' for the user, he still gets:
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
====================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Guests Alias S-1-5-32-546 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192 Mandatory group, Enabled by default, Enabled group
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== ========
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
Why does this still show 'BUILTIN\Users', even though 'net user' shows:
...
Logon hours allowed All
Local Group Memberships *Guests
Global Group memberships *None
The command completed successfully.
When the user connects to a share on the server, he succeeds but then using the mapped drive gives him an 'Access is denied' because he has no permissions on the share or folder.
What else can I do to limit what this account can do?
I am worried that the account credentials will get compromised if the user uses an unsecure machine with a keyboard logger installed.
The site only allows SSL and the server is behind a firewall that only permits 80 and 443.
If someone gets the user credentials from another server in the data center, I want to make sure that this web server is still secure.
I'm working on an automated setup of a Windows Server 2008 R2 Core with IIS and SQL Express
I'm starting with a fresh (just installed) OS in a VM (virtualBox in this test case)
My scripts then create users, install dot.NET 3.51 and 4, IIS and SQL-Server 2008 R2 Express. They also set up web sites and services, all is fine.
At some point I need to restore six SQL-Server databases, .bak files with just one full backup in them.
I'm using something like this:
RESTORE DATABASE FooBar FROM DISK = N'E:\temp\db\FooBar.bak' WITH FILE = 1, NOUNLOAD, REPLACE, STATS = 10
By now to tune my scripts I've done the whole setup procedure at least 40 times, most of the time the restore works fine, but sometimes one of more restore operations fail, even though the SQL-Server setup and the backup files are always the same.
There is one database which has FullText catalogs and that one fails more often than the others.
When I remotely connect to the server in Management Studio and run the same SQL, it usually still fails, however when I do the restore manually in SSMS it usually works.
What baffles me is that even though the sql-environment is always the same, the restores sometimes work and sometimes they don't.
Here's the actual error message:
100 percent processed.
Processed 11128 pages for database 'FooBar', file 'FooBar' on file 1.
Processed 3 pages for database 'FooBar', file 'FooBar_log' on file 1.
Msg 9004, Level 21, State 1, Server LAB45, Line 1
An error occurred while processing the log for database 'FooBar'. If possible,
restore from backup. If a backup is not available,
it might be necessary to rebuild the log.
Msg 3013, Level 16, State 1, Server LAB45, Line 1
RESTORE DATABASE is terminating abnormally.
Any ideas what the problem could be?
When installing the Management service for IIS7+ a self-signed SSL certificate is created and assigned, it has the name 'WMSvc-ComputerName'.
In the GUI version I can change this to a different 'proper' certificate installed on the server, so it is trusted by remote clients.
The GUI module for the Management Service is not available when connecting to the server remotely.
So I need to change it using the command line on the server itself. How do I do this?
Solution in PowerShell:, (thanks to Mathias R. Jessen)
# get the thumbprint for the certificate we want to use:
$thumb = (Get-ChildItem cert:\LocalMachine\MY | where-object { $_.FriendlyName -eq "www.stackoverflow.com" } | Select-Object -First 1).Thumbprint
# get a new guid:
$guid = [guid]::NewGuid()
# remove the self-signed certificate:
& netsh http delete sslcert ipport=0.0.0.0:8172
# add the 'proper' certificate:
& netsh http add sslcert ipport=0.0.0.0:8172 certhash=$thumb appid=`{$guid`}
On Windows Server 2008 R2 core I use dism.exe and the featurename: 'NetFx3-ServerCore' this feature is not available on Server 2012 (Windows Server 8).
Using the standard 3.51 Installer on Server 2012 Core tells me: "You must use the Role Management Tool to install or configure Microsoft .NET Framework 3.5"
In the GUI version (of Server 2012) I can do this and it downloads a package from Microsoft.com, but how do I do this on Core?
I have several standalone Win2008 (R1+R2) servers (no domain) and each of them has dozens of scheduled tasks. Each time we set up a new server, all these tasks have to be created on it.
The tasks are not living in the 'root' of the 'Task Scheduler Library' they reside in sub folders, up to two levels deep.
I know I can use schtasks.exe to export tasks to an xml file and then use:
schtasks.exe /CREATE /XML ...'
to import them on the new server. The problem is that schtasks.exe creates them all in the root, not in the sub folders where they belong. There is also no way in the GUI to move tasks around.
Is there a tool that allows me to manage all my tasks centrally, and allows me to create them in folders on several machines? It would also make it easier to set the 'executing user and password'.
I know normally it is the other way around, but after some hacking in the registry on two Windows XP Home SP3 machines, they boot fine in normal mode and work without problems but when booting into Safe Mode, I get a Stop Message 0x0000007B.
The story is that the client had DeepFreeze 5 installed (which we tried to get rid of), they forgot all passwords and don't have the original Setup files to uninstall it.
So I searched around and found a tip to manually remove the kernel mode driver from the registry. After doing this, I got the behaviour above.
Does anybody has any insight on why safe mode could fail, while normal mode works?
There used to be the tool Regini.exe from the Windows 2000 Resource Kit to do this, but it is no longer supported by Microsoft. Reg.exe can't do it either.
Any ideas?