MikeBaz - MSFT's questions

I'm trying to get a k3os cluster running on a set of Raspberry Pi nodes using https://github.com/sgielen/picl-k3os-image-generator. I'm successfully generating images and I am able to boot from them. However, even though I have a token entry in each of my config files (token and secret replaced):

k3os:
  token: K10e8c37ea0000000000000000000000000000002cbdaef2f8d7bd2f5b6931b4f52b::server:secret

when the first node boots, it seems to generate a new secret for the cluster anyway, which means the other nodes can't join. I know I can pull out the new token from the cluster and rebuild the images, but I'd rather figure out how to have one image that I create once and use. I'm sure I'm missing something silly...

Somehow, and I'm not sure how, we have configured an nginx reverse proxy that is acting as an open proxy.

The log files tells us the matching requests are going against the following conf file:

map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
}

access_log      /var/log/nginx/access.p.log;
error_log       /var/log/nginx/error.p.log;

proxy_next_upstream     error timeout invalid_header http_500 http_502 http_503 http_504;
proxy_buffers           8 32k;
proxy_buffer_size       64k;
proxy_http_version      1.1;
proxy_set_header        Host            $host;
proxy_set_header        X-Real-IP       $remote_addr;
proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect          off;
proxy_set_header        Upgrade         $http_upgrade;
proxy_set_header        Connection      $connection_upgrade;

server {
        listen          80;
        server_name     ~first.*\.second\.com;

        location / {
                resolver                172.16.1.1 172.16.1.2;
                proxy_pass              http://$host;
                proxy_read_timeout      7200s;
        }
}

server {
        listen          443;
        server_name     ~first.*\.second\.com;
        ssl             on;

        location / {
                resolver                172.16.1.1 172.16.1.2;
                proxy_pass              https://$host;
                proxy_read_timeout      7200s;
        }
}

The top-level conf file looks like this:

user nginx; worker_processes 8; pid /var/run/nginx.pid;

events { worker_connections 4096; # multi_accept on; }

http {

    ##
    # Basic Settings
    ##

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # nginx-naxsi config
    ##
    # Uncomment it if you installed nginx-naxsi
    ##

    #include /etc/nginx/naxsi_core.rules;

    ##
    # nginx-passenger config
    ##
    # Uncomment it if you installed nginx-passenger
    ##

    #passenger_root /usr;
    #passenger_ruby /usr/bin/ruby;

    ##

    include /etc/nginx/conf.d/*.conf;
    #include /etc/nginx/sites-enabled/*;

}

what here is causing this?

This is a short question: I have a Remote Desktop Gateway server on Windows Server 2012 R2. It is working for users. However, not all of the connections show up under "Monitoring". I can connect to a server on the internal network (we don't have VPN etc. so there's no other "normal" way for me to get in unless I use the gateway), I look at the Monitoring view, and I don't see the very connection I'm using.

Are there situations that cause the gateway not to show connections under Monitoring?

EDIT: To be clear, I'm looking in RD Gateway Manager, not in Server Manager.

I have a working IIS 8.0 server (on Windows Server 2012) that has a working SSL installation. The certificate is due to expire in a few days, so I am trying to renew it.

When I try to create a renewal request in the IIS Manager, it fails when clicking Finish with the following:

---------------------------
Renew an Existing Certificate
---------------------------
There was an error while performing this operation.



Details: 

Object reference not set to an instance of an object.
---------------------------
OK   
---------------------------

When I try to do it through the Certificates snap-in in MMC, I find I don't have the option to renew in the context menu. I believe both of these issues are due to the certificate being located in the WebHosting (Web Hosting) certificate store.

How do I create a renewal request in this circumstance?

Thanks!

I have installed Hyper-V Server 2012 R2 on a server that had Hyper-V Server 2012. When I did this, the standard Windows.old folder was created. I now would like to remove that folder safely. The standard way to do that with a full GUI would be to use Disk Cleanup, but of course I don't have that option on Hyper-V Server.

Is there a formal way to remove that folder in this scenario? I know if this was Server Core I could install the full GUI including Desktop Experience, but that would be a lot of nonsense just to cleanly remove a folder.

My primary reason for asking, as opposed to just doing rmdir /s or some such, is that the Windows.old folder has a lot of junctions, and I don't want to break anything in the production OS copy as part of doing this.

I'm looking at enabling Azure Multifactor Authentication as a service for remote access scenarios. This doesn't appear to be a big deal.

However, Office 365 is in use with DirSync. I found http://community.office365.com/en-us/blogs/office_365_technical_blog/archive/2013/06/19/enabling-office-365-multi-factor-authentication-for-online-administrators-grid-user-post.aspx which talks about enabling multifactor going through https://activedirectory.windowsazure.com/. However, that appears to be exclusively for accessing Office 365, not for general multifactor use. Furthermore, that is an interface that is EOL (there's a warning about it when you sign in), so even if that was right, it would be wrong. It appears the primary portal has a similar set of options, but again, only for Office 365 administrator access.

If we did not have Office 365 in the environment, we could use a standard Azure Active Directory configuration with DirSync. But we do have Office 365.

What is the right way to address this? It seems like we need to do one of the following:

• expose the existing Office 365 AAD instance somewhere. Accessing the Azure portal as the Office 365 portal user does not show the instance, so I'm not sure where else I'd go

• Do multiple targets for DirSync somehow - one as Office 365 and one an exposed Azure Active Directory instance. This feels very wrong.

• Give up

I can't think of another option.

What is the right way to do this?

A client has found that Lync 2010 Mobility does not work for users homed on SBAs. This seems reasonable (although very annoying) because the appropriate services are not on the SBA server. This is actually a major problem for Mobility in Enterprise Voice scenarios because the best practice is to home users on their local SBA to allow voice support in the event of a central site loss, so following best practices leads to mobility not being available.

I have three questions around this:

1. Is this statement accurate? If so, where is there an official Microsoft statement around this restriction? I'm only aware of unofficial sources and the client would like something from MS directly if possible.

2. Is it supported to install the mobility services on SBAs?

3. Does Lync 2013 change anything around this specific area?

Thanks!

I have added a new web site on an existing Windows Server 2012 IIS installation. The installation already had ASP.NET configured on the existing sites.

What is the right way to enable ASP.NET on the new web site? All the documentation I've found talks about using Server Manager to add the role/feature, but that's already there so that's not helpful.

On previous versions I would use aspnet_regiis -i but that doesn't work on Server 2012:

C:\Windows\Microsoft.NET\Framework\v4.0.30319>aspnet_regiis -i
Microsoft (R) ASP.NET RegIIS version 4.0.30319.17929
Administration utility to install and uninstall ASP.NET on the local machine.
Copyright (C) Microsoft Corporation.  All rights reserved.
Start installing ASP.NET (4.0.30319.17929).
This option is not supported on this version of the operating system.  Administr
ators should instead install/uninstall ASP.NET 4.5 with IIS8 using the "Turn Win
dows Features On/Off" dialog,  the Server Manager management tool, or the dism.e
xe command line tool.  For more details please see http://go.microsoft.com/fwlin
k/?LinkID=216771.
Finished installing ASP.NET (4.0.30319.17929).

What is the correct procedure?

Edit: Here's a screenshot proving the role is correctly configured.

The machine is running ASP.NET applications correctly on another web site so I know the role is 100% installed correctly.

I am attempting to add some external packages to Ubuntu 12.10 from a PPA. To do so, I need to use add-apt-repository. Easy enough - add-apt-repository: command not found in Ubuntu 10.04 tells me to install python-software-properties. I have done that - here's proof that it is already there:

user@hostname:~$ sudo apt-get install python-software-properties
Reading package lists... Done
Building dependency tree
Reading state information... Done
python-software-properties is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 58 not upgraded.

Yet, I still don't have add-apt-repository:

user@hostname:~$ sudo add-apt-repository
sudo: add-apt-repository: command not found
user@hostname:~$ add-apt-repository
The program 'add-apt-repository' can be found in the following packages:
 * python-software-properties
 * software-properties-common
Try: sudo apt-get install <selected package>

What (obvious?) thing am I missing?

In the Hyper-V GUI, it is possible to create a collection of snapshots across multiple VMs by selecting multiple VMs, then clicking Snapshot.

In PowerShell on Windows Server 2012, you can request more than one at once by passing the list of VMs as Checkpoint-VM -VMName @('server1', 'server2') (for example). But, that does them in series, not in parallel. This matters when you have machines that interact with each other.

Can you only do this by creating snapshots as jobs and letting the asynchronous job start get it very close? Is that was the GUI is doing? Or is there a "proper" way to do this?

Thanks!

We are experimenting with Azure IaaS and see weird behavior. Here's what we did:

1. Created a Windows Server 2008 R2 Core VHD.
2. Uploaded it to Azure (not sysprepped).
3. Created a VM against that VHD.
4. Confirmed that I could RDP into the VM as both Administrator and a second Administrator account.
5. Shut down the VM.
6. Made a copy of the VHD in Blob Storage using the Azure API
7. Created a new VM pointing at the copied VHD.
8. Started the VM. It started fine.
9. Attempted to RDP in to the VM.

The RDP session fails as either of the two users - access denied.

I downloaded one of the copied VHDs and created a VM locally in Hyper-V. I can see the VM boots properly and gets to the Ctrl-Alt-Del prompt. But sure enough, both users fail.

I attached the VHD as a local drive, and looked at Event Viewer. The code and subcode tell me it's a correct username, but incorrect password.

Any ideas?

I have a VHD in Azure storage. That VHD is configured as an OS disk through a command like the following:

Add-AzureDisk -DiskName $newCode -MediaLocation "http://$script:accountName.blob.core.windows.net/$newCode/$sourceVhdName.vhd" `
    -Label $newCode -OS "Windows"

I would like to create a new VM pointing at that disk. From what I can tell if I was doing this with an image I would do something like:

New-AzureVMConfig -Name $newCode -InstanceSize $instanceSize `
    -MediaLocation "http://$script:accountName.blob.core.windows.net/$newCode/$sourceVhdName.vhd" -ImageName $newCode  `
    | Add-AzureProvisioningConfig -Windows -Password $adminPassword `
    | New-AzureVM -ServiceName $newCode 

However this is wrong for me because I don't have an image - I have a configured VHD that is not sysprepped and can't be.

How can I create the VM in PowerShell to point at the existing disk like I can through the portal?

We have been seeing an issue in Windows 8 RP and Windows 8 RTM that is stumping us. The first time each day, when the machines come up, the Security Center service (always), and sometimes other services such as the Hyper-V Virtual Machine Manager and IP Helper, despite all being set to "Automatic" or "Automatic (Delay Start)", all are not actually starting. We have some user reports that it works until either SCCM is installed or the workstation is moved to the local workstation OU, but we don't see any GP settings or SC settings that would explain how this is happening. The event logs aren't showing anything useful as best as we can tell, and neither are the local CCM log files, but it's possible we aren't looking at the right things or in the right ways to see what they are trying to tell us.

We don't see this issue on Windows 7 that we know of.

SCCM is 2012. Evaluating the user or machine policies manually (via Control Panel) doesn't stop any services.

Later boots don't seem to have the issue. If we leave the machine up overnight, then at some time the services stop. The last time we saw that was 12:37 am, and all that is in the logs about that time is the WMI service changing from auto start to disabled and then back about thirty seconds later. We don't have any evidence the two things are connected, but it seems unlikely they aren't.

I know there's a lot of "not helpful" information here but this is the most we have right now.

Ideas? I am hoping someone else has seen this and can point me at a quick answer as users are starting to complain about the issue. Or at least can give me a better idea of what to look for.

A customer removed their Lync Edge Server from the local domain (following best practices - it was in the domain before but they knew theis was wrong). When they did, everything worked fine, but there is a warning every hour about truing to validate the service account:

Active Directory operation failed while verifying validity of service account password

Active Directory operation failed with error code: 0x80070005 (Access is denied. ) Cause: The service account may not have required privileges to access Active Directory. Resolution: Check domain controller/global catalog server connectivity and whether the service account has sufficient privileges to access the Active Directory. If the problem persists, contact Product Support Services.

I am not sure what service account is being referred to here as Lync runs everything under Network Service (unlike OCS before it).

Ideas?

EDIT: We tore down the Lync components via bootstrapper /scorch and put everything back, and we are STILL seeing the problem. We'd rather not have to rebuild the machine from bare metal.

First let me start by saying I know very little about Notes/Domino, so if I am asking something stupid, I apologize.

As a result of political details I won't get in to, and related to a current e-mail migration project from four different legacy mail systems to a new hosted environment, where no user data is being migrated and users are being actively prevented from sending mail into the new environment from the old environment, the following request has come up.

Once the new system is production, we would like to facilitate user access to the legacy environments. This will allow continuity of information contained in e-mail (e. g. day one on new system, users can send a new message as a reply to a message visible in the old system). We would like to do this in a read-only fashion, to ensure that no changes are occurring as a result of user actions in the legacy environment. (This "lock" of the old environment is related to e-discovery concerns from the legal department.)

For the purposes of this question, the legacy environments of interest are a set of distinct Domino environments, with clients ranging from 5.x to 8.x. I believe all of the Domino servers are 8.x. Most users have the Notes client although iNotes access is available.

Our first thought is just to mark the user mail NSFs as "read-only" on the server. I've seen some references online that suggest this is a workable solution, but my search-fu has failed me on finding a definitive answer.

Is there a "good" way to do this?

Thanks!

p.s. just to forestall questions on this, we don't expect 100% prevention of user information forwarding as there are too many ways for it to happen - we're just preventing as best as we can and stating as policy that they can't do it other ways. Not my decision - just following orders. The proposed migration plan is not a discussion point at this juncture - it's just finding out if one piece of it is at all reasonably doable.

p.p.s. the legacy systems include Exchange as well so I've asked the same question again with Exchange as the source. It didn't feel right to make those two into one question.

As a result of political details I won't get in to, and related to a current e-mail migration project from four different legacy mail systems to a new hosted environment, where no user data is being migrated and users are being actively prevented from sending mail into the new environment from the old environment, the following request has come up.

Once the new system is production, we would like to facilitate user access to the legacy environments. This will allow continuity of information contained in e-mail (e. g. day one on new system, users can send a new message as a reply to a message visible in the old system). We would like to do this in a read-only fashion, to ensure that no changes are occurring as a result of user actions in the legacy environment. (This "lock" of the old environment is related to e-discovery concerns from the legal department.)

For the purposes of this question, the legacy environment of interest is an Exchange 2003 environment, with Outlook and OWA access available. Users have Outlook 2003 profiles today that work against the legacy environment.

We have thought of some hack answers - like scripting out changing permissions on every user mail folder to prevent changes - but don't think there's a "good" answer to this problem. Specifically, we're worried about changing one's own information (e. g. deleting e-mails), and about intraorganization e-mail (e. g. user in Exchange organization e-mails to another user in the organization, despite being told not to do that).

The environment is approximately 15 TB at the moment, so the idea of exporting everything to PSTs and giving users access to those was discussed but discarded as unfeasible.

Is there a "good" way to do this that we haven't thought of? I'm aware that the basic underlying question is akin to asking, "how do we stop this mail system from doing any mail traffic?" I'm not saying this is a reasonable request. I'm just doing due diligence to find out if it's possible in a sane way.

Thanks!

p.s. just to forestall questions on this, we don't expect 100% prevention of user information forwarding as there are too many ways for it to happen - we're just preventing as best as we can and stating as policy that they can't do it other ways. Not my decision - just following orders. The proposed migration plan is not a discussion point at this juncture - it's just finding out if one piece of it is at all reasonably doable.

p.p.s. the legacy systems include Notes as well so I'm going to ask the same question again with Notes as the source. It didn't feel right to make those two into one question.

Edit: Just to be 100%, preventing send/receive is part of this, but so is maintaining the integrity of the existing data, e. g. preventing deletion of an existing item.

Second edit: to the point about "you can't, let them do whatever, just tell them not to" line of thinking, I'm wondering if we could just up the dumpster window to the window where they have access to legacy, then know everything exists SOMEWHERE even if they do it and then delete it. Part of the pushback coming from the legal side is that they don't want to have to search a whole ton of backups. (No, there's no archive in the old system, and yes, the new system has archiving, and yes, that means some of this is a stupid line of thinking, but as I said, I'm forced to ask the questions. I'm just looking to make sure no one on here says "oh, here's an easy way - blah blah blah" and the technical implementation team doesn't get burned. Due diligence and somewhat CYA.)

Edit 3: OK, so I just spoke with my boss and there was an interesting idea brought up. If we do as discussed below in one of the answers and grab a presnapshot, then prevent all mail flow, we don't care about deletes, because the snapshot has everything in it of value. There's no way to "add" something discoverable because of broken mail flow. So maybe that's close enough. If we disable the MTA service, will that stop intradatabase mail flow? Is that a reasonable plan of attack for getting to a "known good" discovery state while still allowing data access?

How does Exchange 2007 decide which receive connector to use if there is a possible conflict?

Background as to why I'm asking:

• Four receive connectors at customer site on a hub transport server
• Two of them are the default connectors, unchanged
• Third connector is configured for anonymous port 25 relay from three specific IPs for a specific device/service.
• Fourth connector is configured for anonymous port 25 relay from two other specific IPs for a different device/service.

When the source IP targeting the third connector connects, everything is good. When the source IP targeting the fourth connector connects, then one of the default connectors is used instead of the specific IP connector. If we move the IPs from the fourth connector to the third connector, everything works. So it's either something wrong on the fourth connector, or it's something with how Exchange is deciding which connector applies. A comparison of the third and fourth connectors doesn't show any differences.

So how does Exchange decide which connector - more importantly I guess for now, is there a way to troubleshoot/trace its logic on which connector to use?

As part of a mail migration project from one Exchange organization to another, we need to be able to prevent users from moving/copying messages between their accounts in each organization. (Yes, users will think this is evil; no, it's not my decision; yes, users will hate us.)

Luckily, we thought, Outlook 2010 provides the DisableCrossAccountCopy registry value/policy (cf. http://technet.microsoft.com/en-us/library/ff800883.aspx). (Because you can't do multiple Exchange organizations in a single profile before Outlook 2010, this only matters on Outlook 2010. Yes, I'm ignoring for the sake of this question copy/move to/from the filesystem.)

In our test lab, in a test forest with a test Exchange organization, with a second Exchange account added to the profile in either of the "real" Exchange organizations, with the value set to "*", everything works as expected.

On a workstation in one of the production domains, however, the setting does not seem to work. We have tried it under HKCU, HKLM, HKCU\Software\Policies, and HKLM\Software\Policies. It simply seems to be ignored.

The value was set in the OCT on a test machine, but the OCT (and the ADM/ADMX file) have the wrong type for the value. We have located the value in the registry and removed it everywhere it is found, we think, and put it back in HKCU, but it still isn't taking. At the moment, a clean Outlook install is not an option - even if it was, we at this point would need to know what to do to fix the pushed copy (I didn't push the copy out to thousands of machines, I've just been asked to help clean up the current mess).

Thoughts?

I have a simple question that I seem to be having a hard time getting a straight-up answer for. What is Apple's support policy for Mac OS X client versions? When do they drop support? For example, is 10.0 still supported?

A colleague has called Apple twice, and both times didn't seem to get a real answer despite being shunted to many different people. At one point he was told "we support all versions forever," at which point he asked, "so if I have System 7 on an old 68K machine, you'll still give me full support on it, patches, etc.?" he was told "yes", which is somewhat beyond reailty.

Our guess is that it's pretty much current version only. We're asking because we are an ISV (web-based application) and we're trying to decide what Mac OS versions we can drop support on. On the Microsoft side we follow their mainstream lifecycle (so for example Windows 2000 clients with IE 5.01 are no longer supported). We don't have the luxury of saying "just get the latest and greatest" as the customers are not in a situation to always update immediately, but we can use the OS vendor as a guide.

The Apple web site seems to suggest that 10.2+ is supported at the moment, although even that is not really clear.

Can anyone point me at a definitive source? Ideally we'd like to see something like http://support.microsoft.com/lifecycle/?LN=en-us&x=19&y=9 or even better something like http://support.microsoft.com/gp/lifeselectindex.

We have a (remote, via a reseller) customer who configured their IIS6 server to not have any port 80 HTTP bindings, only port 443 SSL bindings. We would like to reproduce this without going through the three layers (!) to get to the customer to test some error scenerios.

However, whenever I try to get IIS to not listen on IIS at all, I can't do it. If I do it in the UI, either leaving in the main properties page, or in the advanced bindings page, the UI does not let me proceed. If I remove the HTTP ServerBindings from the metabase.xml directly, IIS makes it port 80, all unassigned addresses anyway.

Is there a way to get to the "SSL only" state naturally? Please note I am NOT talking about the "require SSL" checkbox or underlying metabase setting, as that still listens on port 80 (or whatever) to give the "SSL required" error message. I'm talking about not having any bindings listed at all for HTTP.