Neobyte's questions

I have a bunch of Dell machines that came with BIOS-injected Windows 7 licenses. They have all been upgraded to Windows 10 and now show as having a valid "digital entitlement" license.

These are powerful machines that are normally booted into Ubuntu (dual-boot) as development environments.

We have a corporate Active Directory and I'd like to have the machines run a Windows VM on Virtualbox so they can be domain joined and easily access the Windows managed network resources when they need to. Physically rebooting the whole machine into Windows is too painful as it requires my devs shutting down all their other development VMs and effectively interrupting all their other work.

Is there any way I can use the valid Windows license (in the BIOS) that these machines have within a VM? I should mention that my devs aren't interested in having Windows as the physical host OS.

Ubuntu: 14.04

Wordpress: 3.8.2

I'm migrating an old website to a fresh setup using wordpress front-ended with nginx. It's mostly gone fine, including creating a custom theme, but when I upload images they will only show as broken links.

The upload process itself seems to work. I checked the location on the file system and the files are there in all their different sizes. If I go into "Edit Image" for the uploaded image, I can see it, but every other location in wordpress admin and the main website shows a broken link.

Here is proof that the files are successfully uploading through wp-admin:

root@[hostname]:/srv/www/wp-content/[hostname]/uploads/2014/11# ls -al
total 284
drwxrwxr-- 2 www-data www-data   4096 Nov  8 01:12 .
drwxrwxr-- 3 www-data www-data   4096 Nov  8 01:03 ..
-rw-rw-r-- 1 www-data www-data  10450 Nov  8 01:03 SJB_0227-150x150.jpg
-rw-rw-r-- 1 www-data www-data  20732 Nov  8 01:03 SJB_0227-199x300.jpg
-rw-rw-r-- 1 www-data www-data  89325 Nov  8 01:03 SJB_0227.jpg
-rw-rw-r-- 1 www-data www-data  10069 Nov  8 01:12 SJB_0229-150x150.jpg
-rw-rw-r-- 1 www-data www-data  22616 Nov  8 01:12 SJB_0229-300x199.jpg
-rw-rw-r-- 1 www-data www-data 118579 Nov  8 01:12 SJB_0229.jpg

My /etc/wordpress/config-[hostname].php includes:

define('WP_CONTENT_DIR', '/srv/www/wp-content/[hostname]');

The relevant part of my nginx config:

root /var/www/html/wordpress;
        index index.php;
        server_name [hostname];

        location / {
                try_files $uri $uri/ /index.php?$args;
        }

        location ~ \.php$ {
                try_files $uri =404;
                fastcgi_pass unix:/var/run/php5-fpm.sock;
                include fastcgi_params;
        }

I should note that ubuntu automatically created a full /var/www/html/wordpress/wp-content directory, although I'm not sure what that is used for as the files uploaded through wp-admin show up in WP_CONTENT_DIR defined above.

On my main website the links do not work, and are formed like:

http://[hostname]/wp-content/uploads/2014/11/SJB_0229.jpg

Everything except for viewing images works fine with the website. What am I missing?

UPDATE:

I have a solution below. I should also note that the /var/www/html/wordpress path above was actually a symlink to /usr/share/wordpress that I had created and forgot about. However the issue persisted when it was changed to the actual location.

We have a wireless authentication server (Windows 2003 SP2 with IAS). It is configured with a DigiCert certificate. The certificate chain looks like this:

Entrust.net Secure Server Certification Authority
  DigiCert High Assurance EV Root CA
    DigiCert High Assurance CA-3
      ourserver.ourdomain.com

When a Windows 7 client connects to the wireless for the first time, they get a warning about the certificate. It will look like this:

The server "ourserver.ourdomain.com" presented a valid certificate issued by "Entrust.net Secure Server Certification Authority", but "Entrust.net Secure Server Certification Authority" is not configured as a valid trust anchor for this profile.

That is not a big deal as it's supposed to be a one-off. But the root certificate it complains about is inconsistent. Half the time, they get this instead:

The server "ourserver.ourdomain.com" presented a valid certificate issued by "DigiCert High Assurance EV Root CA", but "DigiCert High Assurance EV Root CA" is not configured as a valid trust anchor for this profile.

The reason this is an issue is that it means the client is prompted a second time at some later point when they reconnect to the wireless network, where the connection seems to arbitrarily choose the "other" certificate in the chain as the missing anchor, rather than the first. The selection appears to be random.

To be clear, this has been reproduced where:

• 2 Windows 7 laptops are in the same physical location (on same AP).
• One, when initially configured, prompted with the Entrust root cert.
• The other, when initially configured, prompted with the EV root cert.
• Both were connecting to the same IAS server, which only has one certificate installed.

Any ideas as to the cause of this inconsistency, and how I can stop it?

I'm using the instructions here:

http://technet.microsoft.com/en-us/library/cc737541%28WS.10%29.aspx

to try and limit a particular 2003 DC from servicing authentication requests. I set the LdapSrvPriority to 250 (rather than the default 0), restarted the DC, and confirmed this has updated in DNS. I have also confirmed that the TTL on the DCs LDAP DNS entries are 10 minutes. It is now 30 minutes later. According to my reading, this DC should now not service authentication requests unless there is no other DC available of a lower priority.

When looking in the Security log on the DC, I see it is still servicing requests (users and computers) - over 100 a minute. Does anyone know why this is the case? Domain members are by definition all AD aware so I would not expect to see computer authentication requests against this DC when I have 4 other DCs with a lower priority available in the site.

I've just installed a fresh copy of NPS on a new 2008 R2 Std server. When I go to add a Radius client, I get "NPS Error: The service being accessed is licensed for a particular number of connections. No more connections can be made to the service at this time because there are already as many connections as the service can accept. (Exception from HRESULT: 0x80070573)".

What do I do? This is the first Radius client I am installing (and the first change to the vanilla NPS since running the role installation wizard) so obviously I have not hit the 50 client max.

Cheers

Could someone explain to me why this does not work?

Import-Module ActiveDirectory 
$dcs = Get-ADComputer -Filter {DistinguishedName -Like "*Domain Controllers*"}

I get no results for this query.

Alternatively, could someone suggest a way using the module above that I can generate a list of systems on my domain that are NOT Domain Controllers (which is what I'm eventually trying to achieve).

Cheers

When you install a Windows forest CA you have the option to make it standalone or enterprise. I have an existing installation which I am assuming is standalone as it doesn't have a certificate templates folder when I load the management console.

However, I can't find anything that definitively says "This is a standalone CA", such as under an "About" option in the management console. For all I know this could be a malfunctioning enterprise CA. How do I definitively tell whether my CA is standalone or enterprise?

Cheers

I want to copy a user account from my production domain to my test domain. Here is what I am trying:

$me = Get-QADUser myAccount -IncludeAllProperties -connection $prodDomain
$me | New-QADUser -parentcontainer 'domain.local/test' -connection $testDomain

On the new account, the only thing copied across is the CN. None of the other attributes - samAccountName, FirstName, exchange attributes etc, have come across. What am I doing wrong?

I have a scenario where there is a root domain (RD) and two child domains (CD1 and CD2). Users have accounts on both CD1 and CD2, with identical samAccountNames, names etc, and various applications either use the CD1 or CD2 account for authentication to resources.

I need to collapse CD2 into CD1, so I want to merge the accounts together. However ADMT does not allow me this option (merge options are greyed out), I think because it does not support intraforest merge of accounts (although it does not explicitly state this anywhere in the documentation).

My question is - what is the easiest way for me to merge these accounts? Ultimately all I really need (I think) is for the SID of CD2\user1 to be added to the SIDHistory of CD1\user1 - is there a tool that supports this?

Computer accounts and profiles are not a concern for this scenario. Group migration is unlikely to be an issue either - CD2\user1 is usually granted resource access through membership of a group on CD1.

How can I query AD to give me all users that are enabled, but not expired? I use the QuestAD tools with PowerShell but it doesn't have a "-NotExpired" option or equivalent with Get-QADUser.

I would prefer a PowerShell solution if possible to make it easier for me to play with the data.

I have my personal profile's Documents folder redirected to a network drive H:\ . This was done by right clicking on Documents, Properties, choosing Location, and selecting H:\ .

I have a problem where some (I am not sure whether it is all) MSI installers will fail with an "Error 1327 Invalid Drive H:\" when I attempt to install them.

As a workaround, I can edit the registry at

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\

and set the registry key "Personal" temporarily back to "%USERPROFILE%\Documents", do the install, and then change it back. I don't know why this needs to be done though, as nothing is actually installed into that directory.

Does anyone have a more elegant solution?

After installing SP2 to W2K3 straight after adding a second drive, my VM after restart is now detecting the 2 disks the wrong way around. I am getting "Operating System not found" and when I boot from a recovery disk it offers me the chance to log into "D:\Windows" - it should be C:!

What is the quickest way for me to get the VM detecting the drives in the correct order again so I can boot?

UPDATE:

Ultimately LukeR below is correct. I was able to do it from within "Edit Settings" on the individual hard drives rather than editing the vmx directly, but the SCSI order was the correct solution.

WHY did it happen? Because this was originally, months ago, a P2V server, and the P2V process had assigned C drive to SCSI 0:1 rather than 0:0. That was fine, right up to the point I added a second HDD, which ESX gave the ID 0:0. As soon as I rebooted, it decided 0:0 was the lowest and therefore primary partition, and tried to boot off that. All I had to do was switch the IDs around.

I have a template Win2k3 machine with IIS 6 installed with a valid SSL certificate. The https site works perfectly.

However, after cloning this machine from Virtual Center and applying a unique SID customization, the https site no longer works. IIS still claims to have the SSL certificate installed correctly, but ssldiag says there is a problem.

I have tried resetting the permissions on the MachineKeys directory and contents and various other fixes I've found online, but to no avail. I get the impression that sysprep (which VMwares customization uses) is not handling translation of IIS's metabase properly when it has a SSL certificate installed, but I haven't been able to find any definitive documentation to back this up. Microsoft claims sysprep handles the IIS metabase properly.

Any ideas? Has anyone else had this issue?