Joel Coel's questions

I have a new Server 2022 Hyper-V host that will have (initially) 6 guests. It has two NICs that I want to team to connect to the physical switch for performance and reliability.

My understanding is there are two ways to do this:

1. Old-and-busted LACP teaming at the OS level from 2012.
2. New-hotness Switch Embedded Teaming for Server 2016 and later.

I was able to make both options work in setup and testing so far, but everything I've read says I should strongly prefer option 2.

Here's the issue: from what I've seen for option 2, Hyper-V does load balancing by binding MACs from different guests to the different physical ports. This means one VM will never have more bandwidth than you'd see on a single port. And indeed, the interface visible in the guests when using this option looks like a single NIC with the speed of the one of the individual host NICs.

This is wrong for my setup, because one of the guests is not like the others. It's the main reason for the physical hardware to exist and should see the lion's share of the traffic. I know that with most teaming options no one session can exceed the speed of a single port, but I also expect this server to support many sessions.

So the question:

Did I miss something for Switch Embedded Teaming to make better use of the available ports, and if so what do I need to do to correct it? Or alternatively, is this a situation where I should use the older teaming option?

I'm preparing to onbaord a new set of users for MFA authentication with Entra/AD FS, and running into some trouble (thankfully still during the testing phase!)

The environment is an on-premise AD/AD FS server (2019), synching to Entra with P1 to support MFA. This is working for most users. When users activate a new account they are redirected to the MS "ProofUp" process at mysignins.micrsoft.com/security-info per the documentation, and can finish the registration/authentication. It allows them to initially bypass the MFA requirement to reach the "mysignins.micrsoft.com/security-info" page until additional factors are provided, as it should.

However, we have a class of users now who come to us where they already have the Microsoft Authenticator app, and have already signed into the app with our "Work or School account", but have not yet actually finished registering the app for MFA with our Azure/Entra tenant. Notably, the app does NOT appear at all in the Authentication Methods section for the user in the Entra admin console. These are students (we are a university) who used the app to do MFA with an outside service from back before we required student MFA, and we now no longer use that service.

These users are NOT able to load the mysignins.micrsoft.com/security-inf ProofUp page, and instead enter a redirect loop where they continually end up back at our AD FS site saying they need to complete MFA registration.

One key is at no point does the user ever see an actual error message. They just can't move past the AD FS page asking them to register MFA tokens. Anything they do to move forward will redirect them back to this point. Additionally, sign-in logs for these users in Entra will only show "Success" results unless they actual do enter a bad password, and even these are from before we turn on the MFA requirement for the user (or after we release them due to failure).

UPDATE:

I am now able to recreate this for a new test user on demand with these steps:

1. Create a user in the local Active Directory
2. Make sure the user is NOT yet required for MFA and let it sync to Azure AD/Entra
3. Take a test mobile device that is NOT already registered with Entra
4. Install the MS Authenticator app fresh on the device (completely remove it first and then re-install if it's already there so any local data for prior tests is cleared)
5. Login to the Authenticator app as a work/school account with the user credentials created in step 1
6. Close and quit the app.
7. Set the user to require MFA for one of our AD FS Relying Parties (we do that here by adding a group membership in AD)
8. Have the user try to access a protected app

The important thing was steps 5 and 6 happened before step 7.

AD FS will now correctly determine the user needs to complete MFA; it will show them a message per the documentation and then attempt to redirect them to the Entra ProofUp page after 5 seconds. But the proof-up page will not allow access and immediately redirect them back to AD FS to repeat the cycle. The user is prevented from completing the ProofUp process.

Using the "Require Re-register multifactor authentication" button shown below for the user in the admin console does not work to resolve this.

So far, I have two ways I can move these users forward:

1. Manually enter an additional factor for them (such as a cell phone). We'll soon be brining several hundred additional users onboard this way, where I don't necessarily have those cell phone numbers. I need something better.
2. Change the access control policy for the Office 365 app specifically to not require MFA. This isn't as bad as it seems at first, because we use Google Workspace for email and most document services, but it's also obviously not good and not something I want to live with long term.

How can I clear the half-finished Authenticator app registration for these users, or otherwise allow them to move forward with MFA registration?

I can't be the first person to run into this, because it could happe to anyone who skips a step in the normal process and tries to add the Authenticator App too soon.

I'm at a college where we have a campus licensing agreement with Microsoft for licensing Windows and Office that now includes Office 365 online services, which includes Skype for Business. I'm playing with Skype, and it's a decent IM and presence app on it's own. The screen sharing features are nice.

The trick here is that we don't have Exchange anywhere (we have G Suite Apps for Edu handling our e-mail services). I've come across a few places in the Skype program that complain about this:

The thing is... I am able to sign in and exchange messages with another user. Accounts are synced from Active Directory to Azure AD, and authentication happens via AD FS.

We have no plans or desire to add Exchange here. However, I have a hard time recommending anyone use the software if it's going to have so many "errors" right on the surface. It looks like it's my fault, that I've missed something, and will create lots of service calls. Can I make these errors go away? Have I just missed something in the setup?

Background

I have a Windows DHCP server (Server 2008 R2) handing out addresses for several scopes. One of those scopes is for some Mitel IP Phones. The phones are configured to use dhcp option 125 to get configuration information. When a phone starts up, it doesn't know what vlan to use, and so it just gets the default (untagged) vlan of whatever port it's connected to. The dhcp server gives it a response that includes option 125 information, and the phone is able to read what vlan it should use from this response. The phone then releases its original address and requests a new dhcp lease using the correct vlan tag. The phones also usually have computers connected to a pass-through port. The packets from the computers are never tagged, and so the PCs will stay on the original (untagged) vlan for the port. This has worked for us for years.

Problem and Symptoms

Somewhere in the last several weeks, something changed, and I'm not sure what. The phones will continue to work as long as they do not restart, meaning dhcp renew requests must be processed correctly. Phones connected to certain switches can even a survive a restart. Phones connected to other switches, however, will fail to complete the process when they reboot. All of our phones are using PoE that is backed up by a UPS, so it's been a long time since any have restarted. This means I have no idea when the problem first appeared. What I do know is that one phone failed when it restarted yesterday, and in troubleshooting it today we reset that switch closet. Now none of the phones on that switch are working (thankfully it's still a small number). I also know that things were working near the end of the January, when we moved a phone for an injured user to a temporary workspace on the ground floor.

As I watch a phone boot up, I can see it successfully get the first address. It then successfully reads the option 125 information, sets the correct vlan tag, and releases the original IP lease. It is even able to receive and accept an offer on the correct vlan from the server. However, that's where things stop. The phone has a message on the screen that says, "DHCP: Offer 2 ACC", but the Windows DHCP server has not recorded the lease and the phone never moves on. I can only guess that the DHCP REQUEST packet never reaches the Windows server, and so the phone is waiting for the final ACK from Windows that it's okay to continue.

Workaround

I was finally able to get a phone working again. To do it, I had to first disconnect the computer. Then I set the phone's switch port to be untagged on the phone vlan, with no membership on the PC vlan. The phone will now reboot correctly. At this point, I can put the switch port configuration back where it should be, and as long as no one tries to call that number as I'm resetting the port, the phone never misses a beat. Then I can reconnect the computer. Obviously, that's not an ideal process, though since phones reboot so rarely I will be able to use it to get people working again until I can find the root cause. Offices are closed now for the week, and so this issue will actually be allowed to sit over the weekend (I don't have keys for individual offices where the phones are).

This phone I fixed is the service phone in the server room, connected directly to our core switch. It is possible the problem is an issue with routing or processing tags on the core switch, such that the workaround will not be effective on the remote offices where packets are first passed through (tagged by) other switches, but I'll be very surprised if that happens, given that I know it must be processing dhcp renewals and actual phone conversations correctly.

A twist is that leaving the port tagged on the PC vlan means that phone instead fails with the message "DHCP: Offer 1 ACC". I need to remove that vlan entirely for this to succeed.

Note: I have now confirmed that the work-around is effective in remote buildings. This leads me to suspect that my devices are somehow not assigned to the correct vlan. That fact that I experienced the problem on my core switch, and that it happened in several places on the network at about the same time, indicates that the core switch may be the problem. With nothing specific to look at, I'm scheduling a maintenance window near the end of the week to reboot the switch. I may also update the firmware.

Environment

Our core switch is an HP 5406zl. This switch handles inter-vlan routing. The Windows DHCP server is connected directly to the switch. Endpoint switches are connected to the core switch via fiber SFPs, and these ports are tagged for all vlans on both ends. The core switch configures each vlan with an ip helper-address setting that points it to our DHCP server, and a dhcp relay-option 82 replace line so that the dhcp server will know what scope to use. These configurations, and the port configurations on the endpoint switches, have not changed in at least 16 months. We have had other switch and phone resets in that time.

Most of our endpoint switches are HP 2530 series. These switches seem to work correctly (phones on 3 different 2530's have restarted correctly today). It's older switches that have problems. We have one old 3Com 4200 and one 4210 that will not work. The service phone connected directly to the core switch mentioned earlier also would not work.

Question

At this point my best guess is that a Windows update on the dhcp server changed the behavior, but I can't see how. Or possibly the core switch is not handling that REQUEST packet correctly, but I'm sure that nothing changed there, and it doesn't explain why only certain endpoint switches are effected. How can I resolve this issue?

Update:

Here is a dhcp log excerpt from a failed phone:

10,03/06/15,12:40:40,Assign,10.1.2.158,,08000F197844,,3189088995,0,,, 11,03/06/15,12:40:40,Renew,10.1.2.158,,08000F197844,,3189088995,0,,, 12,03/06/15,12:40:41,Release,10.1.2.158,,08000F197844,,3189088995,0,,, 15,03/06/15,12:40:45,NACK,10.1.2.154,,08000F197844,,0,6,,, 15,03/06/15,12:40:45,NACK,10.1.2.154,,08000F197844,,0,6,,,

The 10.x.x.x addresses are the PC vlan (that choice pre-dates me at this place). Phones should get that kind of address at first, so that's expected. However, after the release message I also expect to find an offer for an address in the 192.168.16.x range, because I can see on the phone that an offer was accepted (unless I'm misinterpreting "ACC"). It's interesting that I never see the server try to issue an address like that, even though the phone thinks it received one.

I considered the idea there's a rogue dhcp server on the network (it hands out an address before the Windows server, but without the dhcp options needed by the phone to continue), but that doesn't explain why the phones work if and only if I completely remove any path to the PC vlan. I'll test for it anyway in the morning by connecting my laptop to a port set for the phone vlan, but if anyone else has a better explanation in the meantime, I'd love to hear it.

Here's a copy of the switch config:

http://pastebin.com/veXjCRXu

I have a single server rack (31 of the 42U occupied) in a small (about 10'x10') basement room in a building that is seeing some light renovation... nothing huge, but some non-load-bearing-walls going up in what used to be a cafeteria to create a hallway and rooms, with associated drywall, dropped ceiling, and new floor tile work. Specifically, there will be a mudding/sanding crew coming fairly soon for finish work on the drywall. I can't move or disconnect the equipment in the rack. What can I do to protect my switches and servers from the resulting dust?

Specifics on the room: there is a dedicated air conditioner just for the server room, but it's not by any stretch a clean room. Workers will not have access to the server room, and there is no drywall work in the room itself. I already have a small home air purifier in the room that is getting a new filter prior to the work, and I'm planning some extra down time in late May when I can open up individual machines for cleaning (think PC vacuum and canned air). Is there anything else I can or should do to protect the equipment from dust? I'm most worried about it getting in the bearings of cooling and power supply fans.

We have a Windows 2008 R2 file server sharing home folders for about 600 users. These folders are mapped to a shared drive for each user when they log in on their own workstations, and that mapped drive is in turn set as the default location in the Documents library in windows on everyone's profile, including the default profile on each of our machines. Log in to a new machine for the first time, and your Documents library will point at the file server. For laptop users, we also use the Offline Files feature, so that this follows them even when they're away from work.

My problem is that, looking at these folders on the server, they all show up in Explorer as "My Documents", instead of the actual folder name (set to match the username). How can I prevent Windows Explorer from doing this?

I'm looking to purchase a rack/enclosure for some servers. As this is my first time shopping for this type of equipment, I need to know what to look for. I'm asking not only about how to buy the rack, but also what accessories will I need? What can I do without? What should I look for in terms of delivery and assembly? What do I need to prepare for in terms of power? Cooling inside the cabinet? Anything else I might be overlooking?

I'll share some back story in case anyone finds it helpful, but really generic answers for anyone who is shopping for rack equipment is helpful.

Where I'm at we used to have mainly tower servers... even a number of glorified desktops that lived in our server room. We do have a couple two-poster racks for switches, but everything sits in a wooden bench made of 2x4's and plywood that's been here much longer than I have. Over the last three years I've been able to virtualize the desktop "servers" and as items have come up for refresh I've purchased rackmount servers, with rails. I put the servers on their sides in the old space, and set the rails aside in the store room, biding my time.

We are now (at last!) to the point where in the next six months I'll be down to only a single tower server, and it just happens to be 19 inches high, so I'm thinking 1U shelf. Everything else except the the UPS equipment should mount in a rack. In anticipation of that event, I'm looking to spec out a server rack enclosure to purchase and install this summer. I want to be get preliminary shopping done over the next month or two so I can get it put into the budget for next fiscal year, in time to actually execute the project late this summer.

For size, we should fit comfortably inside a single 42U height-wise, even including mounting our existing switches, so I'm pretty sure one rack will handle it. ... I just need to know what to look for in that rack.

The small college where I work is having some very strange network issues. I'm looking for any advice or ideas here. We were fine over the summer, but the trouble began few days after students returned to campus in force for the fall term.

Symptoms

The main symptom is that internet access will work, but it's very slow... often to the point of timeouts. As an example, a typical result from Speedtest.net will return .4Mbps download, but allow 3 to 8 Mbps upload speed. Lesser symptoms may include severely limited performance transferring data to and from our file server, or even in some cases the inability to log in to the computer (cannot reach the domain controller). The issue crosses multiple vlans, and has effected devices on nearly every vlan we operate.

The issue does not impact all machines on the network. An unaffected machine will typically see at least 11Mbps download from speedtest.net, and perhaps much more depending on larger campus traffic patterns at the time.

There is one variation on the larger issue. We have one vlan where users were unable to log into nearly all of the machines at all. IT staff would log in using a local administrator account (or in some cases cached credentials), and from there a release/renew or pinging the gateway would allow the machine to work... for a while. Complicating this issue is that this vlan covers our computer labs, which use software called Deep Freeze to completely reset the hard drives after a reboot. It could just the same issue manifesting differently because of stale data on machines that have not permanently altered low-level info for weeks. We were able to solve this, however, by creating a new vlan and moving the labs over to the new vlan wholesale.

Instigations

Eventually we noticed that the effected machines all had recent dhcp leases. We can predict when a machine will become "slow" by watching when a dhcp lease comes up for renewal. We played with setting the lease time very short for a test vlan, but all that did was remove our ability to predict when the machine would become slow. Machines with static IPs have pretty much always worked normally. Manually releasing/renewing an address will never cause a machine to become slow. In fact, in some cases this process has fixed a machine in that state. Most of the time, though, it doesn't help. We also noticed that mobile machines like laptops are likely to become slow when they cross to new vlans. Wireless on campus is divided up into "zones", where each zone maps to a small set of buildings. Moving to a new building can place you in a zone, thereby causing you to get a new address. A machine resuming from sleep mode is also very likely to be slow.

Mitigations

Sometimes, but not always, clearing the arp cache on an effected machine will allow it to work normally again. As already mentioned, releasing/renewing a local machine's IP address can fix that machine, but it's not guaranteed. Pinging the default gateway can also sometimes help with a slow machine.

What seems to help most to mitigate the issue is clearing the arp cache on our core layer-3 switch. This switch is used for our dhcp system as the default gateway on all vlans, and it handles inter-vlan routing. The model is a 3Com 4900SX. To try to mitigate the issue, we have the cache timeout set on the switch all the way down to the lowest possible time, but it hasn't helped. I also put together a script that runs every few minutes to automatically connect to the switch and reset the cache. Unfortunately, this does not always work, and can even cause some machines to end up in the slow state for a short time (though these seem to correct themselves after a few minutes). We currently have a scheduled job that runs every 10 minutes to force the core switch to clear it's ARP cache, but this is far from perfect or desirable.

Reproduction

We now have a test machine that we can force into the slow state at will. It is connected to a switch with ports set up for each of our vlans. We make the machine slow by connecting to different vlans, and after a new connection or two it will be slow.

It's also worth noting in this section that this has happened before at the start of prior terms, but in the past the problem has gone away on it's own after a few days. It solved itself before we had a chance to do much diagnostic work... hence why we've allowed it to drag so long into the term this time 'round; the expectation was this would be a short-lived situation.

Other Factors

It's worth mentioning that we have had about half a dozen switches just outright fail over the last year. These are mainly 2003/2004-era 3Coms (mostly 4200's) that were all put in at about the same time. They should still be covered under warranty, buy HP has made getting service somewhat difficult. Mostly in power supplies that have failed, but in a couple cases we have used a power supply from a switch with a failed mainboard to bring a switch with a failed power supply back to life. We do have UPS devices on all but three of four switches now, but that was not the case when I started two and a half years ago. Severe budget constraints (we were on the Dept. of Ed's financially challenged institutions list a couple years back) have forced me to look to the likes of Netgear and TrendNet for replacements, but so far these low-end models seem to be holding their own.

It's also worth mentioning that the big change on our network this summer was migrating from a single cross-campus wireless SSID to the zoned approach mentioned earlier. I don't think this is the source of the issue, as like I've said: we've seen this before. However, it's possible this is exacerbating the issue, and may be much of the reason it's been so hard to isolate.

Diagnosis

At first it seemed clear to us, given the timing and persistent nature of the problem, that the source of the issue was an infected (or malicious) student machine doing ARP cache poisoning. However, repeated attempts to isolate the source have failed. Those attempts include numerous wireshark packet traces, and even taking entire buildings offline for brief periods. We have not been able even to find a smoking gun bad ARP entry. My current best guess is an overloaded or failing core switch, but I'm not sure on how to test for this, and the cost of replacing it blindly is steep.

Again, any ideas appreciated.

Update:
Core switch is replaced. After 4 days, everything is running well... but I'll wait for the two week mark before calling the issue resolved.

We very recently completed a project to retire two old domain controllers running Server 2003 R2. They are now replaced with shiny new 2008 R2 boxes. However, the functional level of the domain has not yet been updated for the 2008 R2 servers, just in the long-shot case of the need for a rollback to the old controllers. I expect to have the all clear to update the domain by next weekend.

I also want to note that our desktop clients are still 95% Windows XP. However, we're about to start a project to update our 200 or so clients to Windows 7 before the end of the calendar year.

Is there any advantage to holding the domain at the 2003 functional level while we are still supporting more Windows XP than Windows 7, especially given that some of the management stations are still XP?

Update: I forgot to mention earlier that we still have a pair of windows 2000 servers (not domain controllers) that support some legacy software. I'm working to replace those, but in the meantime I need to be sure that Windows 2000 can still participate in a 2008 R2 domain.

When I create a new account in Active Directory, I enter the new user's first name and last name, and it auto-fills the full name in the form "First Last". Can I set AD to use "Last, First" instead? The domain controller is currently Server 2003.

We're a small college, where every student is assigned an Active Directory account. We have a couple computer labs where the machines are all joined to the domain and students can log in to any machine. Over the course of a semester, most students will log in to most machines.

In the past, under Windows XP, we have managed this using the old Copy Profile functionality, along with a product called Deep Freeze, such that profiles are effectively cleaned up automatically. A lot of schools have used this technique successfully for a long time.

Unfortunately, Windows 7 breaks all this. We can no longer use the Copy Profile feature to prepare template profiles for the workstations. Group Policy could work for setting up the machines, and this is the official method for handling the problem. Unfortunately, this doesn't work as well, for two reasons. The first is that Group Policy is no where near as friendly for setting up the profile tweaks. We can't move as quickly on changes we want to make, and some things can only be done to the machine before running sysprep (which would require more frequent re-imaging of the entire OS). The result is that we end up with a less-polished desktop experience.

We could bite the bullet on the that first issue, but the second issue is that all the group policy settings result in incredibly slow login times when used in conjunction with Deep Freeze, because you have to re-apply nearly all the GP tweaks with every login. Windows 7's improved security features over XP (namely UAC) allow me to feel comfortable trying a semester without Deep Freeze... except that we'd still end up with hundreds of user profile accounts on each machine by the end of each semester, and that's after putting in more work to get group policy set up to produce a diminished result.

So are there any suggestions for better ways to approach this problem?

We want to do things like map the documents libraries to network shares, set a default wallpaper, add specific shortcuts to the bookmarks toolbars in IE and Safari (we deploy safari because we have a 1:1 iPod Touch program and need iTunes as well), and lots of other tweaks to these public workstations. We want to be able to do it quickly, where we can get good feedback on the results of a change, and we need to do it so that hundreds of users can log in with their Active Directory credentials. We've gone down the roaming profile path in the past, and that's not really a good option either.

Currently our domain controllers are still running Server 2003, and we'd also much rather use CloneZilla than sysprep to handling imaging the machines.

I'm also reluctant to use group policy simply as a matter of workflow. When we could use template profiles, if you found something you wanted to change you just logged in as the correct user, changed it, log out, and the change would be applied the next time we updated the machines. Now we have to hunt down the right GP setting, if it even exists. It could take more than hour to complete what used to be a five minute thing.

Once upon a time, I was taught to spread an order among at least two retailers whenever I needed around six or more hard drives, and three when the order gets up around 20 drives or more. Use the same make and model of disk, but source them from different places (this was back when raid cards would only work right if all the disks matched exactly). When installing the disks, make sure each RAID array has a mix of disks from each of the sources.

The purpose here is to prevent problems if the there's a bad lot of disks and the vendor just adds them to your shipment sequentially. This could result in multiple disks in the same RAID arrays failing at near the same time, which could mean data loss.

Is this still good guidance, or are most reasonable enterprise vendors (ie: not newegg, tiger direct, or amazon, that deal mainly with consumers) aware of the situation and now deal with it correctly? Is it dealt with at the manufacturer level (manufacturing runs are broken up before vendor delivery)? Is it something you have to ask for? Or am I just worrying too much?

Today we had a number of machines stop getting internet access. After a lot of troubleshooting, the common thread is that they all had their dhcp lease renewed today (we're on 8 day leases here).

Everything you would expect looks good after the lease renewal: they have a valid IP address, dns server, and gateway. They have access to internal resources (file shares, intranet, printers, etc). A little more troubleshooting reveals they are unable to ping or tracert to our gateway, but they can get to our core layer3 switch just in front of the gateway. Assigning a static IP to the machine works as a temporary solution.

One final wrinkle is that so far reports have only come in for clients on the same vlan as the gateway. Our administrative staff and faculty is on the same vlan as the servers and printers, but phones, key fob/cameras, students/wifi, and labs each have their own vlans and as far as I've seen nothing on any of the other vlans has had a problem yet.

I have a separate ticket in with the gateway vendor, but I suspect they'll take the easy out and tell me the problem is elsewhere on the network, so I'm asking here as well. I've cleared arp caches on the gateway and core switch. Any ideas welcome.

Update:
I tried pinging from the gateway back to some affected hosts, and the odd thing is that I did get a response: from a completely different IP address. I tried a few more at random and eventually got this:

Fri Sep 02 2011 13:08:51 GMT-0500 (Central Daylight Time)
PING 10.1.1.97 (10.1.1.97) 56(84) bytes of data.
64 bytes from 10.1.1.105: icmp_seq=1 ttl=255 time=1.35 ms
64 bytes from 10.1.1.97: icmp_seq=1 ttl=255 time=39.9 ms (DUP!)

10.1.1.97 is the actual intended target of the ping. 10.1.1.105 is supposed to be a printer in another building. I have never seen a DUP in a ping response before.

My best guess at the moment is a rogue wifi router in one of our dorm rooms on the 10.1.1.0/24 subnet with a bad gateway.

...continued. I've now powered down the offending printer, and pings to an affected host from the gateway just fail completely.

Update 2:
I check arp tables at an effected machine, the gateway, and every switch between them. At each point, the entries for those devices were all correct. I didn't verify every entry in the table, but every entry that could possibly impact traffic between the host and the gateway was okay. ARP is not the problem.

Update 3:
Things are working at the moment, but I can't see anything I did to fix them and so I have no idea whether this might be just a temporary lull. Anyway, there's not much I can do to diagnose or troubleshoot now, but I'll update more if it breaks again.

I have a pair of IBM System x3620 servers. These servers do fine once they finally reach the point where the operating system takes over, but it takes them forever to get past the new-fangled UEFI boot system... a good five minutes or so; maybe longer. I haven't timed it, but it's the kind of thing where you go get a cup of coffee while you wait and it's still going when you come back.

Normally the only time I shut these down is for a monthly maintenance cycle (usually just windows updates). It's built-in maintenance time, and so the extra 5 minutes don't count against our SLAs and aren't a big deal. However, in the case where I might have an outage I'd sure like to get those 5 minutes back. Is there anything I can do to tell them to just go ahead and boot already? I've already disabled everything I can find to disable as far as extra boot options go.

I have a 1998-era Netware 3.12 server that runs everything on our campus: general ledger, purchasing, payroll, student information, grades, you name it. The server has an Adaptec RAID controller with two volumes:

1. RAID 1, 2 17GB scsi disks, Seagate ST318417W
2. RAID 5, 3 4GB scsi disks, 2 Seagate ST34573W and 1 ST34572W.

We are currently in the early stages of a project to replace this system, but you don't just jump into a new system like that and so I need to keep this server running until at least November 2011.

This week we had not one but two hard drives fail. Thankfully they are from different volumes and we're able to keep running for the moment, but given the close nature of these failures I have serious doubts that I'll be able to avoid catastrophic failure from this server through the November target as is without restoring the RAID redundancy — it'll only take one more drive failure anywhere and I'm completely hosed.

We are fortunate enough to have exact match "spares" lying around for both drives, but the spares are in unknown condition. I tried swapping just them in, but the RAID controller isn't smart enough to handle this and it renders the system unbootable.

As for the RAID controller itself, there is utility I can get into during POST via a Ctrl-A shortcut, but I can't do much useful from there. To actually manage volumes I must first boot in to Netware, at which point I can use CI/O Array Management Software Version 2.0 to actually look at volume information. I suspect that the normal way to manage things is to boot from a special floppy with the controller software on it, but that floppy is long gone.

Going through the options in the RAID software, I think the only supported way to replace a disk in an existing RAID volume is to physically add the disk, boot up and configure it as a "spare" for a volume, force the volume to use the spare to replace an existing down disk (and at this point I'm only guessing) so that the down disk becomes the spare, repair the volume, remove the spare from the volume, and then shut down and remove the disk. Then start all over for the other failed disk. All this amounts to a lot of downtime, assuming I can even make it work and that my spares are any good.

As for finding reliable spares, I have no clue where to even begin looking to find a new 4GB scsi drive, or even which exact scsi system I'm looking for, as it's gone through a few different iterations over time.

Another option is to migrate this to a virtual machine (hyper-v), but all previous attempts we've made in this area have failed to get very far. When this machine was installed I was just graduating from high school, and so it requires lower level knowledge of netware and dos than I ever developed, or if I did have since forgotten (I'm not exactly a dos neophyte, either).

Part of my problem is this is a high-use server, and taking it down for a few days to figure things out isn't gonna fly very well.

As for the question, I'm looking for anything that might be helpful in this situation: a recommendation on a place to find good spares from this era, personal experience repairing RAID volumes using a similar controller or building a hyper-v vm from an old netware server, a line on a floppy with better software for the RAID controller, recommendation on a good Novell consultant in Nebraska that would be able to put things right, a whole other option I haven't considered yet, etc.

Update:
For backups, we have good (recently verified via restore) backups of the data only -- nothing for the software that actually runs things.

Update 2:
Just a progress report that I currently have a working Netware 3.12 install in VMWare Virtual Server 2.0, thanks largely to the guide I found here:
http://cerbulescubogdan.blogspot.com/2010/11/novell-netware-312-on-vmware.html

The next steps are preparing empty netware volumes to match the additional volumes on my existing server, taking a dump of everything on the C:\ drive and netware volumes on my existing server, and figuring out from that information what modules need added to netware, installing my licenses (we do still have that disk, if it's any good), and moving data over.

I have approval to bring the server down for a week after the first of the year (sadly not before), so, aside from creating empty volumes, the rest of the work will have to wait until then.

Final Update (Jan 5, 2011):
I was able to get spares working in both raid arrays without data loss this week. Both are now listed by the controller as "FAULT TOLLERANT" (yay!). I was also able to build on the progress from my last update and now have a functional "spare" server in VMWare Server 2.0. The spare can run and use our erp software, but I can't put it into production because I can't (yet) print from that box (and I have no idea why). Even so, this VM will do in a pinch if I have no other choice, and between it and the repaired RAID arrays I'm comfortable living with the situation until I can junk the machine in November.

Epilogue (Jan 16, 2012):
The project to replace this server with a whole new system did go live as planned. Hurray for no more netware! All hail Sql Server! The King is dead. Long live the King!

We still plan to keep the old server running for a while longer, until after our post-fiscal year audit completes in August. But if a failure happens between now and then, no one would complain too much.

How compatible are sfp modules between devices. For example, am I likely to be able to plug something like this into a cisco, hp, or other switch with mini gbic ports?

I have a new laptop that I intend to use both at home and at work. I happen to have a windows server setup with active directory at home, and I want to join the laptop to both domains. Is this possible?

Result: I've decided to join it to the work domain. I definitely need to be able to log in to windows using my account on that domain at times, while the home network is much simpler (mainly just file/print sharing, though there is more to it). I think I can manage at home by manually authenticating to the needed resources, and perhaps even script some of that away.

I have a few questions about wifi.

Say we have a small campus with a set of wifi access points in most buildings, one each for channels 1, 6, and 11. It's not exactly that clean, but that's the general idea anyway. However, these are mainly cheap consumer wifi routers that have been re-configured to work more like access points. They are all set up with the same SSID.

For the most part, the buildings are far enough apart that APs do not overlap. Where buildings are closer together it's usually because they're smaller or less-used buildings that won't need to use all three non-overlapping channels. Where a building is much larger we'll move the access points around to try to get good coverage throughout the building.

This configuration seems to be working, but I have some questions and concerns:

• The APs don't do any kind of load balancing or sharing connections. I'm worried about students in crowded common areas being forced to choose the closest/strongest AP even though it might be overloaded when one just a little weaker on a different channel might serve them better. We have an iPod touch program on campus, where every student has one. Those devices only list each SSID once when choosing a network, so students can't adjust for this kind of thing manually.
• The older dorms, for example, are concrete block and need a lot of work to get good coverage. It's weird how sometimes you might get a strong signal from an AP and at others almost none at all. What will happen if I start adding additional APs to provide stronger coverage in some of these sometime-covered areas where all three non-overlapping channels are in use? Should I look into getting stronger radios/antennas on existing APs near those locations instead? How would a stronger radio at the AP help if the signal sent from the laptop or iPod is too weak to reach it? And if it won't help, why do they sell them?
• There are other places where signals on the same channel (and, as mentioned earlier, the same SSID) will overlap somewhat. I'm unsure about what happens when you connect in one of these places where the signals overlap. I know from experience that I am able to use a wireless device there, but could I be creating duplicate traffic on the network if both APs that are in range pick up on the transmissions from my device? Even if it's not duplicate traffic, could my wireless device be generating interference (and collisions) on the AP that I'm not using, causing slow-downs at that location? What can I do to minimize these?
• Would changing the SSIDs to be unique everywhere even help with overlapping channels, since it's still noise on the channel?
• I'm especially worried about common areas, where students sometimes gather in numbers and there may be a lot of devices active at once. Is there anything I can do to help coverage in these spaces, especially since they tend to already be a little crowded from a channel-perspective?

Is there anything else obvious I'm overlooking that might improve things? It was a real mess when I started here and I've already done a lot of work getting things working better:

• The initial reconfiguration from router to access point so that things like dhcp and dns requests go on to our main server.
• Set up power timers so the APs restart every night (routing tables on the cheap APs fill up over time in a larger network)
• Use a wifi-analyzer app on my iPod ($2, but highly recommended) to tweak channels for less overlap and help work out new placements.
• Added a few additional APs (still cheap consumer routers) to some of the least covered locations in the dorms.

What else could I do to make these work better?

Finally, I'm unlikely to be able to get buy-in from higher up in updating these access points to nicer managed models. The college had a bad experience going that route, and they are convinced that the consumer class devices are as good or even better. Even if that weren't the case, I have more pressing needs in my budget. But we are looking at replacing a number of the existing access points with ones that are 802.11n capable in anticipation of Apple eventually releasing an 802.11n iPod, so I'd appreciate suggestions for good consumer level 802.11n routers.

I'm trying to replace an old Windows 2000 domain controller with a new Windows 2008 Server. I have the Active Directory Domain Services role installed on the new server and joined it to the domain. The next step is to promote the new server to be a domain controller in the existing domain. After that is done I can the take old server offline.

I've already run the adprep tool with /forestprep and /domainprep. When I run dcpromo it looks like it replicates everything, creates the users, groups, and computer objects, but then I get this error:

The operation failed because:

Active Directory Domain Services is missing critical information after installation and cannot continue. If this is a replica Active Directory Domain Controller, rejoin this server to the domain.

"Directory object not found."

I have tried re-joining the computer to the domain and there's nothing helpful in the event logs. I'm at a loss for how to get past this. Any help appreciated.

My own searches found this MS Knowledge Base article:
http://support.microsoft.com/kb/248079

But it's not really helpful. As far as I can tell, all four items it's looking for are present, re-creating the domain isn't a good option, and the 2000sp1 slipstreaming advice doesn't apply to my windows 2008 box.

Checking into each of the objects from the KB article, I noticed the SID for my the Administrator account is: S-1-5-21-2025429265-492894223-1708537768-1124. Note that is does not end with "500", and therefore is somehow likely wrong. The built-in Administrator account is nowhere to be found. This is the account referenced by the 2nd bullet point item under the "Causes" heading in the linked knowledge base article. Any ideas how to fix this? I'm going to make this specific part a separate question as well, but I'll be sure to keep both up to date.

Update on what might have happened. It won't help solve the problem, but in case anyone's curious I found some old notes that help explain the problem. Apparently, once upon a time this server ran an FTP service that has since been replaced with better alternatives. At the time the service was running, the then-administrator noticed that script kiddies where trying to brute-force the administrator password via that service. Now it seems that in windows 2000 you can't disable FTP access for the Administrator account short of shutting down the service. He tried re-naming the account, but they somehow followed the rename. And so after "a nasty hack" he instead "removed" the account. I think I may have to re-create the domain somehow :(

I have a few users in a very old workgroup that log directly into their local machines (Windows XP Pro). This week they're finally moving to active directory and will need to log into domain accounts instead. However, some of these users have been around a long time and are somewhat invested in the profiles they have on the local machines.

How can I move those profiles to the new Active Directory accounts, so that things like desktop backgrounds, browser bookmarks, and other potentially "hidden" settings will follow them? In one case we even have a Windows Media Player playlist we'd like to move seamlessly, though that can be easily re-created if need be.