nray's questions

What's your MDT 2010 test and prod setup? What do you consider best practice?

Linked Deployment Shares
Is it best to use linked deployment shares, and replicate from development to production when testing is complete? What about backing out, if something breaks?

Multiple Share Names
Or what about moving the production share name from one deployment share to another, as you add and test more OS versions, drivers, attributes, etc? This might make sense if you weren't able to update boot images as easily - the PXE boot image would always connect to the same sharename, which could be moved around on the server.

Distributed File System DFS)
Does anyone run MDT shares in DFS, or is there no support in the WinPE boot image for DFS shares?

Given a public WiFi hotspot behind an ISA Sever and a single Internet address, which rules or content filters would be useful to achieve this configuration?

• Allow anonymous users to surf the web, chat over IM, and connect to their different workplace VPNs

• Restrict Bittorrent and other P2P clients from attracting the attention of MediaSentry and others.

What sort of tests will show if an ISA firewall policy is sufficient? For example, with the uTorrent client, you can configure the port used (for incoming connections?), so will changing to port 80 show you if P2P traffic is getting through?

The top P2P networks appear to be Bittorrent, DC++, eDonkey and Usenet.

How would you troubleshoot the following scenario?
What are some useful steps to take, and what should you look out for?

There are four domain controllers, two in one site and two in another site. Since the upgrade from Windows Server 2008 to Windows Server 2008 R2, Active Directory replication has stopped between the sites, however replication continues between the DCs on the same LAN.

There's an ISA Server 2006 in the middle, however whether replication traffic is being blocked or even seen by the ISA Server is not known yet. Administrators report some form of RPC errors (in Directory Services logs?). The ISA firewall policy was allowing RPC traffic before the upgrade.

Useful resources
How to troubleshoot intra-site replication failures
http://support.microsoft.com/kb/249256

Using Repadmin.exe to troubleshoot Active Directory replication
http://support.microsoft.com/kb/229896

Troubleshooting replication with repadmin
Repadmin.doc

I'll add more detail as soon as I get it.

We have a Head-Office/Branch-Office WAN like this,

Server LAN <-> Cisco PIX 515e <-VPN tunnel-> Cisco ASA 5505 <-> Client LAN 1
                              <-VPN tunnel-> Cisco ASA 5505 <-> Client LAN 2
                              <-VPN tunnel-> Cisco ASA 5505 <-> Client LAN 3
                               ...  
                              <-VPN tunnel-> Cisco ASA 5505 <-> Client LAN 66

Problem:
5% of these VPN tunnels degrade over time.

Symptoms:

• Clients respond to PING, but not to RPC or RDP.
• On the ASA, VPN tunnels goes from 1 x IKE, 2 x IPSec down to 1 x IKE, 1 x IPSec.
• A restart of the ASA resolves the problem temporarily.

This PIX has been unreliable, and will probably be replaced with a more modern bit of gear. Although usually under 10%, the CPU on the PIX periodically hits 80-90% with traffic spikes, but I can't say I've been able to correlate dropped tunnels with these loads.

I have a few specific questions, but am grateful for any and all insights.

1. Can I monitor (via SNMP) the total IPSec tunnels on the PIX? This should always be (at least?) twice the number of branch offices, and (at least?) twice the total IKE - if it drops then I probably have a problem.

2. Is there an event I can alarm on in the PIX's own logging, when one of these tunnels is dropped? Maybe,

   snmp-server enable traps ipsec start stop  
   

3. Is there anything I can do to keep this tunnel alive, until the PIX can be replaced? I was thinking of scriptable keep-alive traffic, PING doesn't seem to cut it. I am also looking at idle time-out values, maybe re-keying intervals, any other ideas?

PIX515E# show run isakmp
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20


PIX515E# show run ipsec
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac


PIX515E# show version

Cisco PIX Security Appliance Software Version 7.2(4)
Device Manager Version 5.2(4)

Supposedly, using the audit mode in sysprep allows you to maintain fewer images, as you can customize a base image (during audit mode passes) for the various departments or user roles you might have in your company.

However I am having trouble imagining where this would be less hassle than maintaining all the images you might need, or maintaining a few base images and customizing post-deployment through group policy and the like.

Is there anyone using audit mode routinely as a part of corporate Windows deployment? Is it useful outside of SMS/SCCM, in a LTI-type deployment?

A company recently upgraded from Internet Explorer 6 to 7.

Previously, when users were logged in as an account which was not allowed to surf, the ISA Server web proxy would promt them for credentials if they tried, and they could specifiy an anlternative account which was allowed to surf.

The username had a default value, and the default domain portion of this username was the company's (and I guess the ISA Server's) Active Directory domain.

Now the domain portion of the username in the login box is the ISA server's computername.

Is it possible to set the default domain in the login box a web surfer receives, when they first try to surf? As the clients are workgroup machines, ISA server has no way of knowing who the user is without prompting for a username, but seeing the ISA server's name there just comfuses people - it would be better if it were the correct domain, or even blank.

This might have more to do with Internet Explorer configuration than with ISA Server.

The scenario is a small company with a few hundred users. ISA Server 2006 (at time of writing) will be implemented primarily to restrict websurfing and various applications like instant messaging per user.

My experience with ISA server has been on HP Proliant DL360s and DL380s - is there any reason to reccomend some other server or configuration?

The DL360 is the least expandible, the G5 has one full-height slot to add a 4-port network card. But even this should be sufficient for the web proxy role?

If a production webserver with several sites has been set up as per the defaults, then websites will be created under C:\INETPUB, and log files will be written to C:\System32\LogFiles.

This has implications for disk space on C:as sites grow and logging increases. The size of that partition is not easily increased (without third party tools like Acronis Disk Director), and a better configuration is to move websites and logfiles to their own volume.

How do you migrate IIS to a new partition?
Is it better to simply xcopy each site, then reconfigure each site to point to the new files? New sites would still be be created on C:\INETPUB unless the webmaster remembered to change the default. And what about virtual folders, maybe buried deep and easily missed?

Or can IIS be moved all at once, maintaining the relative structure, but swapping out C: for D:\ wherever it appears?

Moving large sub-directories Another idea might be to redirect some large sub-directory (e.g. an uploads folder) to another parttion using virtual directories.

• Because of failed backups, the disk used for transaction logs appears to be full.
• The database is not accepting connections, so I cannot run the (HP Data Protector) backup job manually.
• The Oracle instance directly mounts disk from a SAN, so there isn't any file system visible to Windows.

The database service is running, however. Is there a simple way to recover the database, maybe to the point that the backup job can be re-run and restore service?

Assume no Oracle knowledge beyond tnsping ;-)

From the alert_mydatabase.log file, (<orahome>\admin\mydatabase\bdump\),

ORA-15041: diskgroup space exhausted 
...
ARCH: Archival stopped, error occurred. Will continue retrying
...

Can the "AcceptLanguage" header that IE sends be specified by a GPO on the client?

The setting I want to push out is,

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\International
    <namnlös>   REG_SZ
    AcceptLanguage      REG_SZ  en,sv;q=0.5

We have a Cisco MeetingPlace Express conference server, version 1.1. Logging in and scheduling meetings works, but Internet Explorer times out joining a meeting.

Client checks performed:

• Clients pass the browser test,
• Flash is working,
• pop-up blockers are off,
• the fault is the same in Trusted Sites and Intranet IE security zones.

Server checks performed:

• Full reboot,
• mpx_sys restart
• mpx_app restart

Interesting errors:

06/25 11:11:01:00 MAJ 1048780 exlog.cc 44 (90,0,0,0) sblob_dbs is 90% full

There's an IBM Informix Dynamic Server Version 10.00 database under all of this. Is the nearly-full "BLOB" DB causing the time-out?

Cisco MeetingPlace Express InfoCap

Web Conference Debug Log Set
/opt/macromedia/breeze/logs/support/debug.log

Notice all the slow queries,

[06-25 11:52:57] heck (d) SLOW QUERY: 429ms spid:23 com.macromedia.breeze.builder.Scheduler.getActiveHosts
[06-25 11:52:57] heck (d) SLOW QUERY: 253ms spid:23 com.macromedia.breeze.builder.Scheduler.updateExpiryDate
[06-25 11:52:58] w-24 (d) SLOW QUERY: 15056ms spid:26 com.macromedia.airspeed.dal.DAL.getUserSession
[06-25 11:53:03] w-22 (d) SLOW QUERY: 10941ms spid:51 com.macromedia.airspeed.dal.DAL.getUserSession
[06-25 11:53:11] w-22 (d) SLOW QUERY: 8725ms spid:51 com.macromedia.airspeed.dal.DAL.getUserSession
[06-25 11:53:16] w-22 (d) SLOW QUERY: 4255ms spid:51 com.macromedia.airspeed.db.DBConnection.update
[06-25 11:53:23] w-22 (d) SLOW QUERY: 7888ms spid:51 com.macromedia.airspeed.dal.DAL.getUserSession

I'm thinking that the fault is server-side. I'm grateful for any trouble-shooting tips for any of the products involved;

• Cisco MeetingPlace Express 1.1
• Macromedia Breeze
• IBM Informix Dynamic Server

Apparently this is really hard. The printer was bought to replace a twinax-connected printer, but the installer was struggling with two issues:

1. How do you set the IP address, netmask and gateway for the IBM 4247-003 printer? Or how do you set it to DHCP?
2. How do you print out the network configuration on a test page?

Is this straight forward, assuming you know what you are doing, or are there some gotchas? Is there any way to test if the networking components are faulty?

C'mon greybeard AS400 printer gurus, I'm grateful for any tips to pass on.

I mean really...

pictures... article... architectural appreciation

If I change the SA password for a Microsoft SQL Server, can I see in a log or a trace if some application somewhere is trying to log in with the old password?

As an administrator or a member of an Exchange 2003 organisation, can I send a mail to every (real, human) recipient in the GAL, or do I need to create a distribution list of "All Users" first?