Tobias's questions

Our users are created and maintaned in OnPrem AD and synched to Azure with the AzureADConnect. I am trying to get an expression to work:

We have locations in different countries, so the title of the user in the "title" AD attribute is the title in the local language. We also put the title in english into the "extensionAttribute5". Now I would like to manage that the "title" attribute in AzureAD is the following:

If (ExtensionAttribute5 is empty) then (only use "title" ad attribute) else (use "title / extensionAttribute5")

It is hard to find exact documentation for the syntax of these expressions, but I read that it shoud be the same as VBA. And as far as I understand it, it should be this:

IIF(IsNullOrEmpty([extensionAttribute5]),Trim([title]),[title]&" / "&[extensionAttribute5]

But I get "sync-generic-failure" with the message:

Error in evaluation of expression: IIF(IsNullOrEmpty([extensionAttribute5]),Trim([title]),[title]&" / "&[extensionAttribute5]

Can someone help me with this expression or point me in the direction where I can get help with it?

We have multiple Exchange 2019 servers that currently still use MapiOverRpc. Connection from the internet (Mapi, ActiveSync, Owa) is through the Reverse Proxy funcitonality of a Sophos UTM gateway ("Web Application Firewall").

We now would like to switch to MapiOverHttps. The problem is that we would still like to use NTLM/Kerbersos as authentication mehtod, but our reverse proxy cannot forward these methods, only "Basic authentication". If we enable this, all users, internal and external, are asked to enter the password everytime they open outlook. The MAPI Virtual Directory is the only one where I cannot set different authentication methods for the internal and external access.

My question: is there any way to use MapiOverHttps internaly, and OutlookAnywhere for external connections? Or a way to use MapiOverHttps with Basic authentication for external access and NTLM/Kerberos for internal access?

I already tried to just block the /mapi url on the reverse proxy, hoping that this will then fall back to OutlookAnywhere. This did not work, Outlook did just not connect.

We were receiving errors on our vCenter servers that the log disk is getting low on disk space. According to VMWare KBs we checked what is consuming space. We found espiecially a lot of log files named "catalina_[DATE].log" with 11mb size, going back almost a year.

I checked the content of the log, and every 10 minutes it creates the same error message:

2021-04-12T23:59:53.056Z WARN org.apache.catalina.users.MemoryUserDatabase Failed to close [conf/tomcat-users.xml]
java.io.FileNotFoundException: /usr/lib/vmware-sso/vmware-sts/conf/tomcat-users.xml (No such file or directory)
    at java.io.FileInputStream.open0(Native Method)
    at java.io.FileInputStream.open(FileInputStream.java:195)
    at java.io.FileInputStream.<init>(FileInputStream.java:138)
    at java.io.FileInputStream.<init>(FileInputStream.java:93)
    at sun.net.www.protocol.file.FileURLConnection.connect(FileURLConnection.java:90)
    at sun.net.www.protocol.file.FileURLConnection.getInputStream(FileURLConnection.java:188)
    at org.apache.catalina.users.MemoryUserDatabase.backgroundProcess(MemoryUserDatabase.java:700)
    at org.apache.catalina.realm.UserDatabaseRealm.backgroundProcess(UserDatabaseRealm.java:160)
    at org.apache.catalina.realm.CombinedRealm.backgroundProcess(CombinedRealm.java:308)
    at org.apache.catalina.core.ContainerBase.backgroundProcess(ContainerBase.java:1145)
    at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1381)
    at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1353)
    at java.lang.Thread.run(Thread.java:748)

VMWare simply tells me to delete the files and to enlarge my log disk, which I did. But it still bugged me what is going on, and so far I did not find anthing in the web related to vCenter.

Anyone has an idea what is going on here, and how to resolve this error? I know that there are many ways to ignore it, and maybe it is safe to ignore it, but I only want to know if the error itself can be fixed.

TL;DR: Multihomed Windows Server 2012R2 seems to use both interfaces for traffic to a specific network - routing table looks good, tracert behaves like expected. When all other routes to this network are removed, traffic works like a charm, so the connection itself is fine.

We have a backup server (Veeam, Windows Server 2012R2) that is connected to 2 different subnets. The basic network schematics is below. The server has an IP in VLAN1 (Server VLAN), and an additional IP in the VMWare Management VLAN2. We added both adapters because we wanted to prevent to route traffic through our gateway that has only 1G connection. NIC on VLAN1 has a default gateway set, NIC on VLAN2 has no default gateway set.

Last week we added a new CoreSwitch to the system, and we moved the conncetions to the ESX and the Backup system to this new switch (10G Fiber and Cupper). Since then we have an odd behavior: All traffic from the Backup Server to VLAN2, not only backup, also simple network file copy traffic, is splitted over both networks - I see outgoing traffic on both nics (both about 300mbit) in task manager. Wireshark on BackupProxy shows me that there are packets from both NICs of the backup server on port 445 (file copy test). Switch monitoring shows traffic on both interfaces, and the traffic on the VLAN1 interface will also go to the firewall.

Routing Table looks good. When I do tracerts from the backup server, all looks like it should. Not traffic is routed. But the backup data (both directions) and file copys will be routed over the VLAN1 interface. I also tried setting manual permanent routes with low metric, did not help.

The connection between the two servers in VLAN2 works - if I remove the gateway on BackupProxy, all traffic goes through VLAN2 and is not routed. But then I will lose connection of the server (Windows update, monitoring...), so this is no solution.

Overview of what I tried so far:

• added a default gateway for VLAN2 nic on the backup server - did not help.
• Removed the default gateway for the nic on the BackupProxy - worked, but no solution.
• manually added permanent routes for VLAN2 traffic - did not help.
• rebooted all servers - did not help.
• double and tripple checked the VLAN configuration on the switches, everything looks good.
• disabled IPv6, LMHOSTS lookup and NetBIOS over TCP/IP on all servers (was suggested in some possible solutions) - did not help.

EDIT: Did some more testing, since we also added a new 10G card into the backup server for the VLAN1 Nic (exact same model as the 10G card already used for VLAN2 nic). So before all traffic on VLAN1 was 1G, now it is 10G. And it seems that the problem has to do with this nic or with 10G - everytime I use the new 10G card on a 10G switch port, the problems start. 10G nic on 1G switch port, 1G nic on 10G switch port, 1G nic on 1G switch port - no problems.

EDIT 2: Did some more research, and found this forum entry - the problem sound similar to mine. And after a lot of work with Windows support, a MS TCP/IP engineer confirmes the behavior "is by design, to conform with the RFC's". Microsoft suggests to create a firewall rule to block outgoing traffic going to the other subnet through the wrong interface. I tried this, and it works when starting workloads from this server. But when I copy something from another server to this server, it still gets routed, even though it shouldn't. When createing an incomming rule to block wrongly routed traffic, everything stops working at all. Any idea how to get the routing like I want it to be?

Short version: is it possible to pass multiple predefined arguments to a powershell function/commandlet?

Since I am not sure about the terms, I cannot find an answer to this. So here is the example, I am using Exchange 2013 Powershell commands:

Get-MoveRequest -MoveStatus Queued

This will give me alle mailbox move requests that are currently queued but not yet processed.

Get-MoveRequest -MoveStatus InProcess

This will give you all mailbox move requests that are processed at the moment and not yet finished.

The arguments InProcess and Queued are predefined by the function. Is there any way to use InProcess and Queued in just one command? I know that I can run two commands and concenate the output, but I am curious if it is possible to use multiple of these predefined arguments at once. So the question is not Exchange specific, I want to know if Powershell can handle multiple predefined arguments as a commandlet parameter.

The Get-MoveRequest documentation does not state if or if not the MoveStatus parameter allows multiple values as argument.

• Is this possible?
• What is the correct syntax to test this, in case that the parameter allows mutli-value arguments?

TL;DR: Emails containing a link to our company website are marked as Spam by different providers. How can I find the reason for this, and how can I stop it?

Several weeks ago, the company that wrote and maintaines our website did a PHP version update and made some changes to the code for this. We tested the website, everything seemed fine, but after the new version went productive, we could not sent mails outside. External partners could not answer us, even these mails were classified as spam (SMTP Message: '550-5.7.0 Message considered as spam or virus, rejected 550-5.7.0').

After some testing we found that every email containing the link to our company website was considered as spam - even an emtpy mail where I wrote www.company.com in it. And since the website link is added in the mail footer, we could not sent mails.

After we removed the link from the footer, we could send mails again - we had to tell external partners to remove the link from the previous messages, now they could mail us again too.

After a few weeks now we wanted to readd the link to the footer - and immediatly the spam classification restarted with multiple providers, so I disabled it again and no problem anymore.

I already checked our mailserver, our mail settings (mxtoolbox), our domain against different blacklists - nothing to report here.

My question:

• What could be the reason for our website beeing flagged as malicious?
• Is there a public black list where I can report this as false positive? Some kind of website reputation spam list? I only find black lists for SMTP servers or email domains (ours is not listed anywhere).

There are a lot of recommendations about the sizing of the windows page file. What I am looking for is the correct placement.

We are running a MS SQL server on a Server 2012R2 VM with multiple seperate virtual disks:

• Windows disk
• one disk where the SQL server application is installed
• one disk for the SQL data files (mdf/ndf)
• one disk for the transaction log file (ldf)
• one disk for manual backups and other temporary stuff.

At the moment, Windows has controll over the page file. It sized it to 38GB (Memory is 265), and placed it on the disk with the log file. For my understanding, this placement is not logical: the disk containing the SQL transaction log file is the disk with the heaviest I/O on an SQL server. Is it really the best location for the page file? As for the storage space, I could easily move the file to another drive.

I know, Windows may have a reason for placing the file there - but if so, what could this be? Or am I wrong with my thinking?

We have a strange issue in our network, which according to networkengineering.stackexchange is off-topic there, even though in my eyes it is a network problem.

We saw it the first time when we wanted to restore SQL databases to a test DB. The restore failed, in the windows log we saw iSCSI errors, the mounted iSCSI disk seems to lose the connection very often (Backup is restored with veeam - this mounts the backup file as iSCSI volume (target is physical Backup server, initiator is virtual SQL server)).

We did some testing, and it is not only a iSCSI issue, it happens when we copy files between physical servers and virtual servers. Our monitoring shows high errors during the copy process, the strange thing is that we do not see errors on the switch.

What we see on the switch port (switch is Netgear M5300) of the virtual server is "Packets Received > 1518 Octets" and "Packets Transmitted > 1518 Octets" goes through the roof when we copy large files. But "Packets RX and TX" larger then 1518 is 0. This happens only on the port of the ESX, not on the port of the other server in any test.

All ports (switch, vSwitch, portgroups, server interfaces) have the MTU set to default (1518 / 1500). We rebooted the backup server and the esx with all containing VMs, disabled and reenabled the switch ports. Wireshark on the sending server shows large packets (64kb), but according to the switch statistics this port only receives normal 1518 frames.

It seems to only happen with this one test esx, with all VMs we have on it, even if we upload files to the esx datastore.

I do not know anymore where to search. The only thing we did not yet reboot is the switch itself, since this is a core component in the network, we cannot do this during production time (and production is 24/7). We will try this on the weekend, but if anyone has a tip where to look at I would appreciate it.

EDIT: for the sake of completeness a small topology:

EDIT2: Did some more tests: the errors are only on visible on uplink ports with multiple vlans on it. If I only use a single untagged vlan, there are no errors and no packets over 1518 anywhere.

If I now think about it, a packet with VLAN tag would have 1522 as size. But some switches do not care about this, some do - MTU is default everywhere. I do not want to stop using tagged VLANs with vmware... Any idea?

Cisco Switches implement a system called "Link State Tracking" - one uplink port can be defined, and mutliple downlink ports can be defined that use the uplink port. If the uplink port goes down (failure in the next switch, faulty cable...) the downlink ports will also be disabled. HP calls this feature "Smartlink".

We are using a Netgear M7100-24x switch in our virtual environment, and for redundancy purposes, this feature would be perfect for our needs.

So the quenstion is: does Netgear use something similar, and if so, what do they call it?

EDIT: Since no one knows a feature like this, a started a thread in the netgear community - maybe they know how to realise this or maybe i can make it a feature request somewhere...

I have an internal Microsoft Windows CA (Windows Server 2012R2). I have a CodeSigning Template issued to a small number of users, valid for 6 years. Now i wanted to supersede the 6-year template with another one with a shorter validity.

I duplicated the template, changed the value of "Validity period" from 6 to 3 years, and added the 6-year template unter "Superseded Templates". Then i disabled the 6-year template and enabled the 3-year template.

When i now go to a client and try "Renew the certificate with the same key", this does not work since the 6-year template is missing.

So my questsions:

• Is it at all possible to renew a certificate with the same key when the template used for this certificate is superseded?
• Do i need to keep the superseded template enabled?

Thanks for any input

Maybe this is much simpler than i think: i am testing a SCCM deployment on a HP Compaq machine. I had problems with some drivers, so i had to repeat the installation multiple times in one day. After every deployment, there is a new entry named "Windows Boot Manager" in the Boot Device Selection. I am not able to remove them - is there a way to clean this without resetting Bios to default values?

What i tried so far is cleaning the disk with Diskpart, which did not change anything.

I am trying to do the following deployment with SCCM 2012 R2:

• Lenovo IdeaPad 500S
• Windows 8.1 Professional
• no Domain, Workgroup machine
• one local user with admin rights
• ConfigManager Client
• 8 applications installed during OSD

The TS is working, showing up in Softwarecenter as installed successfully. Except that two of the applications don't get installed during OSD - Google Chrome and Adobe InDesign.

Both applications are successfully installed after OSD through the Softwarecenter, without errors. With other Task Sequences, both applications can - without errors - be installed during OSD and with Softwarecenter.

During Task Sequence Step "Installing Application", it shows that there are 8 applications to install. But those two seem just to be skipped - there are no errors in smsts.log or appenforce.log. In the last one i can only find the apps that get installed, there is no information about Chrome or InDesign.

What i checked:

• Both apps are Deployed for the collection the Laptop is in (Required).
• The Box "Allow this application to be installed from the Install Application Task Sequence action without beeing deployed".
• i compared all the settings of the apps that work with the apps that do not work - i can not find any difference.
• Tested it multiple times - always the same. Chrome and InDesing don't get installed, but after OSD is finished, Configuration Manager is installing both applications with success.

Any ideas where i can look or where the problem could be?

EDIT:

Tested again on a VM: i installed both apps during OSD in a TS for installing Domain Clients. Both apps were there directly after OSD. Then i installed the Workgroup TS on the same machine. Chrome and InDesign are missing. AppEnforce.log does not show a sign of them... just like they did not exist...

EDIT2:

Now i know why there is nothing in the logs: i enabled the checkbox "If an application installation fails, continue installling other applications in the list". I was expecting that erros during application deployment would still be loged - this is not the case.

Now i disabled this checkbox, and i see errors for Chrome and InDesign: Error 0x80004005, in combination with Execution Status 24 (Application download failed). I still don't see the problem, since the same applications can be installed with other Task Sequences or after OSD with the CMClient. Both times no errors...

EDIT3: I can't explain why, but after i did what Omnomnomnom recommendet, Chrome is installing during OSD. InDesing is not. I now even completely deleted the application in SCCM and recreated it. Did not change anything... I think i have to go to Microsoft Support...

Enviremental information: Windows Domain with 3 2012 R2 Domain Controlers.

I am trying to build a Windows 8.1 in kiosk mode, only a browser with access to specific websites.

With the help of GPO - partially with user settings and GPO Loopback Processing enabled - i made Internet Explorer (with -k option -> fullscreen Kiosk mode) the Custom User Interface, so there will be no Windows Explorer, just IE, most Windows shortcuts won't work, windows key on keyboard is enabled. The user (Domain Account in group "Domain Guests") is loged in automaticaly. On the computer, i removed the "Domain Users" group from users, and added the kiosk user directly.

This works fine, as long as the computer is online. When i unplug the network cable, windows is booting the explorer instead of the custom user interface, and the task that should run in the background - also configured via GPO - are not started. I can see all the settings, i.e. the registry key for the Custom User Interface is set to IE Kiosk mode, so Windows should know all the settings... but they are just ignored, as long as the computer is not connected to our DC!

This is not only a problem with this kiosk computer - i always tought that GPOs are cached AND executed localy, so i.e. a laptop will get the settings from our DC while in our network, an when the Laptop leaves the building and the user is working on the train, our settings should still be applied! Am i wrong? Or what am i doing wrong?

EDIT:

Tried without Loopback Processing, without success. Disabled Loopback Processing -> no User Settings after a reboot - just as expected. created a new GPO for the USER, linked it, enabled it -> Reboot, and the user settings are applied. BUT: Reboot without network connection, and the settings are not applied.

EDIT2:

Some more tests, and it seams as if the Computer Settings are applied properly, but the User Settings are ignored. They even vanishe from the registry (i am shure that this did not happen before...).

In our Windows Domain (2008R2 and 2012R2 Servers), we are running a Domain CA. The root certificate is a self-signed certificate.

We also have a x.509 certificate from our internet provider (mostly for our websites), signed by a trusted internet CA.

What i want to do is remove the self-signed root certificate from the Windows CA and replace it with the certificate from our provider.

Two questions: 1. is this even possible? Can i use a certificate from a trusted CA as root certificate for my own CA? 2. will this be possible without rebuiliding the whole domain? I think the domain controlers need the certificates for their LDAP communication, what will happen if i just switch the root certificate they used to create their own certificates?

Thanks for your help!

We are having a strange behaviour in our ESX-cluster:

The Infrastructure:

we have 2 ESXi 5.5.0 build 2718055 in a cluster, managed by vCenter. We are using an Essentials licence, so we do not have distributed switches. Our company network has multiple vlans, from which about 10 are needed in vm servers. The hardware is HP DL380 Gen8, 8 1Gb eth-ports. The switch (Cisco 2960E and 3850E) ports connected to the servers are configured with the cisco trunk vlan - all packets arrive with their vlan tag. The physikal networking is completly redundant, one of two switches AND one of two network cards on a server can fail without crashing the VMs.

All switchports are configured the same,

I am using 2 virtual switches (on each host), each switch has assigned

The Problem

When i reboot a vm, placed on esx1 and with automatic ip address configuration, the machine won't get a DHCP connect - the network connection is available, if i set a manual ip address everything works fine, but pconfig /refresh is haning, and DHCPExplorer does not find a valid dhcp server (which i can ping if i assigne a manual ip address).

Now i have to migrate the machine to esx2 and wait for some time (or do ipconfig /renew or disable and enable the nic) the machine will get a dhcp address. After that i can move the machine back to esx1, and it will work perfectly fine. After that i even get positive results from dhcp explorer.

I was then testing if the behaviour was connected to the physical part of the network: i removed all physical nics but one from the portgroup with the affected vlan, did some reboots with a dhcp machine, and then tested it with another nic - in short i forced all the traffic from this port group to go through one physical port of the nic and the switch.

The result was: the problem only occours on two different ports on two different nics, but they are both connected to the same switch.

It seems to me as if this switch is somehow blocking access to the dhcp service. Has anyone seen a behaviour like this? I am going out of opptions - soon we want to upgrade to ESX 6, but since we do also have VMWare View Desktop Virtualisation, the upgrade process will include a lot of work and testing and can't be done quickly...

EDIT:

Since the visual config of our switches is too large for the screen, i did an export of the virtual switches and portgroups via powershell.

The problematic host is host-1002, the problematic nics i identified are vmnic4 and vmnic8, the port groups where the problem was observed are PortGroup35 and PortGroup41

 Get-Virtualswitch|select Name, ID, NumPorts, NumPortsAvailable, Nic, MTU, VMHostID

RESULT:

Name              : vSwitch0
Id                : key-vim.host.VirtualSwitch-vSwitch0
NumPorts          : 4352
NumPortsAvailable : 4309
Nic               : {vmnic7, vmnic0, vmnic2, vmnic9}
Mtu               : 1500
VMHostId          : HostSystem-host-1001

Name              : vSwitch2
Id                : key-vim.host.VirtualSwitch-vSwitch2
NumPorts          : 4352
NumPortsAvailable : 4309
Nic               : {vmnic3, vmnic1, vmnic6, vmnic8}
Mtu               : 1500
VMHostId          : HostSystem-host-1001

Name              : vSwitch5
Id                : key-vim.host.VirtualSwitch-vSwitch5
NumPorts          : 4352
NumPortsAvailable : 4309
Nic               : {vmnic4}
Mtu               : 1500
VMHostId          : HostSystem-host-1001

Name              : vSwitch0
Id                : key-vim.host.VirtualSwitch-vSwitch0
NumPorts          : 4352
NumPortsAvailable : 4304
Nic               : {vmnic7, vmnic3, vmnic5, vmnic9}
Mtu               : 1500
VMHostId          : HostSystem-host-1002

Name              : vSwitch2
Id                : key-vim.host.VirtualSwitch-vSwitch2
NumPorts          : 4352
NumPortsAvailable : 4304
Nic               : {vmnic8, vmnic4, vmnic6, vmnic2}
Mtu               : 1500
VMHostId          : HostSystem-host-1002

Name              : vSwitch5
Id                : key-vim.host.VirtualSwitch-vSwitch5
NumPorts          : 4352
NumPortsAvailable : 4304
Nic               : {vmnic1}
Mtu               : 1500
VMHostId          : HostSystem-host-1002


Get-Virtualportgroup|select Name, VirtualSwitchId, Key, VLANId, VMHostID

RESULT:

Name            : PORTGROUP82
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-PORTGROUP82
VLanId          : 82
VMHostId        : HostSystem-host-1001

Name            : PORTGROUP90
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-PORTGROUP90
VLanId          : 90
VMHostId        : HostSystem-host-1001

Name            : PORTGROUP83
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-PORTGROUP83
VLanId          : 83
VMHostId        : HostSystem-host-1001

Name            : PORTGROUP16
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-PORTGROUP16
VLanId          : 16
VMHostId        : HostSystem-host-1001

Name            : Management Network
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-Management Network
VLanId          : 41
VMHostId        : HostSystem-host-1001

Name            : PORTGROUP80
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch2
Key             : key-vim.host.PortGroup-PORTGROUP80
VLanId          : 80
VMHostId        : HostSystem-host-1001

Name            : PORTGROUP41
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch2
Key             : key-vim.host.PortGroup-PORTGROUP41
VLanId          : 41
VMHostId        : HostSystem-host-1001

Name            : PORTGROUP35
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch2
Key             : key-vim.host.PortGroup-PORTGROUP35
VLanId          : 35
VMHostId        : HostSystem-host-1001

Name            : VMkernel
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch5
Key             : key-vim.host.PortGroup-VMkernel
VLanId          : 0
VMHostId        : HostSystem-host-1001

Name            : PORTGROUP43
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-PORTGROUP43
VLanId          : 43
VMHostId        : HostSystem-host-1001

Name            : PORTGROUP82
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-PORTGROUP82
VLanId          : 82
VMHostId        : HostSystem-host-1002

Name            : PORTGROUP83
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-PORTGROUP83
VLanId          : 83
VMHostId        : HostSystem-host-1002

Name            : PORTGROUP90
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-PORTGROUP90
VLanId          : 90
VMHostId        : HostSystem-host-1002

Name            : PORTGROUP16
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-PORTGROUP16
VLanId          : 16
VMHostId        : HostSystem-host-1002

Name            : Management Network
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-Management Network
VLanId          : 41
VMHostId        : HostSystem-host-1002

Name            : PORTGROUP80
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch2
Key             : key-vim.host.PortGroup-PORTGROUP80
VLanId          : 80
VMHostId        : HostSystem-host-1002

Name            : PORTGROUP41
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch2
Key             : key-vim.host.PortGroup-PORTGROUP41
VLanId          : 41
VMHostId        : HostSystem-host-1002

Name            : PORTGROUP35
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch2
Key             : key-vim.host.PortGroup-PORTGROUP35
VLanId          : 35
VMHostId        : HostSystem-host-1002

Name            : VMkernel
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch5
Key             : key-vim.host.PortGroup-VMkernel
VLanId          : 0
VMHostId        : HostSystem-host-1002

Name            : PORTGROUP43
VirtualSwitchId : key-vim.host.VirtualSwitch-vSwitch0
Key             : key-vim.host.PortGroup-PORTGROUP43
VLanId          : 43
VMHostId        : HostSystem-host-1002

EDIT: NEW INFORMATION

Now i realised, why the problem is only happening on esx1: the dhcp server for these machines is a vm, placed on esx2. So the dhcp requests from machines on esx2 would not even have to leave the virtual switch. If i move the dhcp server to esx1, the problem is solved there and starting on esx2. Still only one switch is affected, the other one is working fine. So in my opinion the problem definitely lies in the physical switch, not the virtual one.

TL;DR: is it possible to install some kind of local kms activation proxy, so the clients could only talk to the proxy, and the proxy will forward the activation request to a kms server which can not be reached by the clients themselves?

At our university, we provide two client pools for our students: a hardware pool with 50 Win7 clients, and a virtual VMWare View pool with Win8.1 clients. VMWare View does not support MAK activation, so we have to use kms - we want to use kms activation in the hardware pool as well. These pools are using an ip address pool that can not access the outside, only ports 80 and 443 through a web proxy.

Due to a cooperation between the universities in our state there is one university who is registrated with Microsoft, and all other universities are using there licences. This university has a kms server which we could use, and they do not want us to set up our own kms server - they say microsoft does not like to have too much kms servers in the same licensed organisation.

So what we want to do: our clients in a private subnet and blocked from the outside world with the exceptions http/https want to communicate with the kms server of another institution - since they provide the kms server for different institutions, i don't think they would accept changeing their kms ports...

What i can do ist to put kind of a gateway server in the middle - one foot in the internet, one foot in the private client net, and this "proxy" could then take the activation requests from the clients and pass them to the external kms server.

Is this somehow possible? The only thing i read about proxies in combination of win licensing is a proxy activation for mak keys... But this does not help.

I am trying to build a new virtual desktop Pool in VMWare Horizon View 5 with Windows 8.1 clients. At the Moment, i am optimizing the image for best performance, including using an optimization script from Microsoft Technet. In this script there is a part where the visual effects in windows (Aero Peek...) are disabled by changeing registry keys. The problem is, these keys are placed unter "HK_Current_user", so if the script is, as proposed, run as part of the deployment, these changes do not affect new user accounts.

Now i've searched for two days to find a way to disable these visual effects for all new users - with these effects enabled, the VDI is extremely slow.

I found several pages that propose to change or create different registry entries, some under local_machines, for some i had to import the NTUSER.dat of the default user.

The Problem with all of these solution: they don't work. Maybe it is because they need another reboot to take effect. But our virtual desktops are reset after a user logged out.

tl;dr

I have VMWare Horizon View, i want to optimize an image for a new virtual Windows 8.1 Desktop, and i want to disable all the visual effects (Aero Peek...) for all new user profiles - because everytime a user is logged of, the virtual desktop is recreated, so a new user will get an unused, newly created machine.

Does anyone know a way to do this by Powershell, batch-file, GPO... But without the (not working) registry keys? Or does anyone know a way to do this with registry changes, even if the user can only log in one time - so without reboot, re-login?

EDIT: I now tried to create a whole new user profile with this manual. All steps work, but when i create a new user account, the visual effects are not disabled... is it possible that Microsoft has no way to set the default visual effects?

EDIT2: New crazy behavior: when a new user is created, the the settings in the GUI are sometimes very different. I am working with my clean installation now, befor i started to change reg keys, and now in the GUI the settings are set for best performance - but they are not realy set for best performance: all the features are still enabled, even if the GUI is telling something different. You have to change the settings, re-set it to Best performance, and then the features are realy disabled.

I have a problem in a Windows Domain. About the creation of this domain i can not tell very much - i got this job last month, without propper handover due to illness of the main admin. What i know is the following: we have one domain contoso-5.contoso-hq.old (contoso-hq is not under our control - kind of a wide area network with other companys) with two Domain Controlers, dc01 and dc02 (Windows Server 2003). My predecessor started to build a new Domain contoso.new with Domain controlers dc04, dc05 (both Windows Server 2012R2, physical servers) and dc06 (Windows Server 2008r2, virtualized on VMware esx). We configured a trust realtionship between the two domains.

dc05 is the PDC, DHCP and DNS, dc4 is infrastructure Master, also DNS and failover DHCP.

After starting a monitoring system, i saw a lot of errors on the domain controlers. One that i still can't resolve is only comming on dc04, but appearing exactly every 4 hours and 4 minutes:

This computer was not able to set up a secure session with a domain controller in domain CONTOSO.NEW due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.

ADDITIONAL INFO If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.

Running dcdiag shows two errors:

 Starting test: Advertising

     Warning: dc04 is not advertising as a time server.

     ......................... dc04 failed test Advertising

and

  Starting test: LocatorCheck

     Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355

     A Primary Domain Controller could not be located.

     The server holding the PDC role is down.

     ......................... contoso.new failed test LocatorCheck

(all other tests are passed).

to the first error: our network connection to the world is very restricted: we have a proxy server that only allowes port 80 and 443, all other ports need to be requested at Contoso HQ. so there was never a time sync with an external source. Now i have configured dc05 (PDC) to get time from Contoso HQ-NTP-Server. All other clients and servers are getting the new time from dc05, but not dc04. w32tm /query /status shows:

Leap Indicator: 3(last minute has 61 seconds)

Stratum: 0 (unspecified)

Precision: -6 (15.625ms per tick)

Root Delay: 0.0000000s

Root Dispersion: 0.0000000s

ReferenceId: 0x00000000 (unspecified)

Last Successful Sync Time: unspecified

Source: Local CMOS Clock

Poll Interval: 6 (64s)

I alredy compared the registry entries of dc4 and dc6 (who is getting time from dc05 like he should), they look the same. Also tried w32tm unregister, resync, nothing changed it.

It seems like dc04 does not even recognize dc05 as domain controler. The dns and dhcp replication is working fine, i can ping dc05 from dc04, nslookup is working from both dc's to internal and external targets. nslookup contoso.new shows the ip-adresses of dc4, dc5 and dc6 as adresses.

On dc04 i have another error, i'm not sure if this has something to do with it:

"Name resolution for the name 2.0.0.2.ip6.arpa timed out after none of the configured DNS servers responded."

DNS-Configuration on dc04 is the same as on dc05.

After hours of internet searches my only option now is to remove DC04 from the Domain an reinstall it. But i would be glad if anyone could safe me that trouble and has an idea what is going on in my system…

And by the why, if you ask yourself what happened to the dc03… i'm asking myself the same question… could an uncleanly removed DC03 cause these problems?

Thanks for helping!

EDIT

As asked by STTR, here are the results from cmd of a normal client (win7) (it's a german System, tell me if you need any translations):

"ipconfig /all"

Windows-IP-Konfiguration

Hostname . . . . . . . . . . . . : GPO-TEST-TH

Prim„res DNS-Suffix . . . . . . . : domain.com

Knotentyp . . . . . . . . . . . . : Hybrid

IP-Routing aktiviert . . . . . . : Nein

WINS-Proxy aktiviert . . . . . . : Nein

DNS-Suffixsuchliste . . . . . . . : domain.com

Ethernet-Adapter LAN-Verbindung:

Verbindungsspezifisches DNS-Suffix: domain.com

Beschreibung. . . . . . . . . . . : Intel(R) Ethernet Connection I217-LM

Physikalische Adresse . . . . . . : xx-xx-xx-xx-xx-xx

DHCP aktiviert. . . . . . . . . . : Ja

Autokonfiguration aktiviert . . . : Ja

Verbindungslokale IPv6-Adresse . : xxxx::xxxx:e24c:xxxx:xxxx%13(Bevorzugt)

IPv4-Adresse . . . . . . . . . . : xxx.xxx.43.4(Bevorzugt)

Subnetzmaske . . . . . . . . . . : 255.255.255.0

Lease erhalten. . . . . . . . . . : Dienstag, 17. Februar 2015 09:27:00

Lease l„uft ab. . . . . . . . . . : Freitag, 20. Februar 2015 09:27:00

Standardgateway . . . . . . . . . : xxx.xxx.43.254

DHCP-Server . . . . . . . . . . . : xxx.xxx.182.69

DHCPv6-IAID . . . . . . . . . . . : 277879566

DHCPv6-Client-DUID. . . . . . . . : xx-xx-xx-xx-xx-xx-xx-xx-xx-xx-xx-18-B6-30

DNS-Server . . . . . . . . . . . : xxx.xxx.182.67 xxx.xxx.182.66 xxx.xxx.80.51

NetBIOS ber TCP/IP . . . . . . . : Aktiviert

Tunneladapter isatap.domain.com:

Medienstatus. . . . . . . . . . . : Medium getrennt

Verbindungsspezifisches DNS-Suffix: domain.com

Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter

Physikalische Adresse . . . . . . : xx-xx-xx-xx-xx-xx

DHCP aktiviert. . . . . . . . . . : Nein

Autokonfiguration aktiviert . . . : Ja

Tunneladapter LAN-Verbindung* 3:

Medienstatus. . . . . . . . . . . : Medium getrennt

Verbindungsspezifisches DNS-Suffix:

Beschreibung. . . . . . . . . . . : Microsoft-6zu4-Adapter

Physikalische Adresse . . . . . . : 00-00-00-00-00-00-00-E0

DHCP aktiviert. . . . . . . . . . : Nein

Autokonfiguration aktiviert . . . : Ja

Tunneladapter LAN-Verbindung* 9:

Medienstatus. . . . . . . . . . . : Medium getrennt

Verbindungsspezifisches DNS-Suffix:

Beschreibung. . . . . . . . . . . : Microsoft-Teredo-Tunneling-Adapter

Physikalische Adresse . . . . . . : 00-00-00-00-00-00-00-E0

DHCP aktiviert. . . . . . . . . . : Nein

Autokonfiguration aktiviert . . . : Ja

"nslookup domain.com"

Server: dc04.domain.com

Address: xxx.xxx.182.67

Name: domain.com

Addresses: xxxx:xxxx:xxxx::c1c5:b648 xxxx:xxxx:xxxx::c1c5:b645 xxxx:xxxx:xxxx::c1c5:b643 xxx.xxx.182.72 xxx.xxx.182.69 xxx.xxx.182.67

"net view domain.com"
Freigegebene Ressourcen auf domain.com

Freigabename Typ Verwendet als Kommentar

---

NETLOGON Platte Logon server share

SYSVOL Platte Logon server share

Der Befehl wurde erfolgreich ausgefhrt.

"cd \domain.com\"

"cd \domain.com\SYSVOL\domain.com\"

"cd \domain.com\SYSVOL\domain.com\Policies"

"dsquery server -domain domain.com -isgc"

"nslookup gc._msdcs.domain.com"

Server: dc04.domain.com

Address: xxx.xxx.182.67

Name: gc._msdcs.domain.com

Addresses: xxxx:xxxx:xxxx::c1c5:b643 xxxx:xxxx:xxxx::c1c5:b645 xxx.xxx.182.67 xxx.xxx.182.69