tresstylez's questions

We are implementing a service that will encrypt email for our O365 mail tenant.

• RULE 1: If a specific pattern is found in the email SUBJECT, mail is sent to our mail encryption server and encrypted. Encrypted message is sent BACK to O365 with a Inbound/Receive Connector.
• RULE 2: It sends outgoing mail from specific senders through a particular smarthost.

The desired behavior is that when RULE 1 applies, the mail will be sent to the mail encryption server, which encrypts the mail and sends it BACK to O365 (via its configuration) -- then RULE 2 will kick in and send the encrypted mail outbound per usual.

Problem is that when both rules are turned on the new encryption rule (RULE 1) is being 'hit' in the message trace, but the message is still being sent outbound through the existing smarthost rule (RULE 2).

Its almost like O365 is choosing Rule 1 OR Rule 2 instead of processing Rule 1 AND Rule 2.

Is this the expected behavior of transport rules or am I missing something?

Originally, all of our users were on a single domain (ie. domain1.com) . After merging with a 2nd company, it was decided that we would use the 2nd domain (ie. domain2.com) as the primary company domain.

To transition, all users in domain1.com had mailboxes created on the domain2.com Exchange server, and we put forwarding in place back to domain1.com so users would be able to receive emails on both email addresses: [email protected] and [email protected].

PROBLEM: As part of the transition, it was decided that BY DEFAULT our users should send email as [email protected]. So, on the domain1.com Exchange server, each user has '[email protected]' as the primary email address. Immediately after this, multiple users were having issues logging into their Outlook clients, several reports of users being locked out of their PC's (which use domain1.com credentials) and other services.

The theorie we have -- 1) changing the default address causes the Outlook client to authenticate (autodiscover) the domain2.com Exchange server -- the authentication fails, and somehow the user gets sent back to the domain1.com Exchange server (maybe as fail back?) and in that case the authentication fails because the [email protected] user does not exist on the domain controller.

How can we find out WHY the accounts are getting locked out after a change in Exchange?

We have a security/compliance audit that we are preparing for and since we deal with financial institutions, one of the potential flags mentioned was how we track/monitor files that are transferred between our Production and Non-Production environments.

We run a Windows shop. Our IT dept. (the Domain Admins) have access to both our PROD and Non-Prod (Corporate) domains. When builds or files need to be pushed to production, IT is required to perform any file transfers.

To satisfy this requirement we were asked to look at a number of DLP solutions which are turning out to be relatively costly.

We have also explored potentially requiring the IT team to use some sort of FTP or Managed File Transfer system in order to move files between the environments, but that just seems cumbersome.

Are there any other potential solutions we can explore here? The main requirement is that we have some sort of TRACKING or LOGGING of any files copied between the environments. Aside from doing a giant "DIFF" of the environments at the end of each day, not sure what we can do.

I have client-side targeting setup to handle some remote workstations on our network. They VPN in from time to time -- so they can hit the internal WSUS server when they are connected.

I essentially want to set their Windows Update configuration via GPO to use internal WSUS, but to download the updates from the internet (Microsoft). I'm assuming this is a very standard configuration, but my clients are still trying to download from the WSUS server. Can I control this?

We use an EMC SAN appliance. There are 2 'paths' from the cluster to the SAN. Today we experienced that one of the LUN paths was 'dead' (as reported in the windows event logs). Presumably the multipath LUN was down to a single path. At this time we saw I/O errors on the SQL Server that "I/O requests taking longer than 15 seconds to complete...". After we failed to the passive node in the cluster, the problem went away.

QUESTION: If the primary cluster node could no longer communicate along one of the 2 configured paths -- does that effectively mean that bandwidth to the LUN was split in half?? Also, could a job that used that SAN drive heavily for reads/writes (our TempDB is on this drive) cause a LUN path to appear 'down'?

This may be a known issue - but I'm serving 50+ IIS websites using a single IP and multiple unique host headers on an IIS6/Windows 2003 Server.

Problem is with monitoring. If a particular site goes down or is STOPPED, the HTTP monitor still reports the site is UP -- I'm assuming because the request just falls to the next site 'in line' or maybe the first site that can serve the request. So site A will see site B's content.

This not only affect monitoring, but can allow one customer to see another customer's login screen! Is there any way -- aside from giving each site a unique IP address that I can stop this from happening? I read this related question, and still don't know how to resolve. I want Site A to actually be DOWN when I stop the site -- not just fall back to another site.

UPDATE: Site also uses SSL, but no host header shows in the UI.

We have a monitoring tool (Solarwinds Orion) that needs to connect to a 2-node failover SQL Server Cluster. For reasons outside of our control -- we cannot monitor the CLUSTER IP directly at this time, so we have fallen back to monitoring each cluster node IP directly. This is not working. Upon troubleshooting, we tried to test that the cluster node was listening on the proper (fixed) port by using telnet to the cluster node IP/port -- and the telnet failed. However, telnet'ing to the Cluster IP/Port was SUCCESSFUL!

• Each node has its own IP.
• Each node is listening on the identical FIXED port.
• Each node has Dynamic Ports disabled.
• Each node can be PINGED successfully from the monitoring tool.
• Windows Firewall is DISABLED.

How can I troubleshoot why I cannot telnet to the listening port on the cluster nodes?

We have a SQL Server with multiple interfaces and a previous admin wanted to enable TCP/IP protocol to listen on a specific port. I believe that wherever he saw a specific IP address, he replaced it with an alternative value and the custom TCP port we wanted to listen on for connections.

We are trying to troubleshoot an issue with a specific server not being able to connect remotely, and we THINK the issue may be with this SQL Server settings themselves. We specifically want to attempt RESETTING the Protocol configuration so we can start from scratch.

Is there an easy way to do this within SQL Configuration manager or via query? We do not want to reinstall SQL Server if at all possible.

We are troubleshooting a weird issue with our SQL Server 2008 server. The application server runs a windows service that makes a DB connection via a connection string in its config file, and we end up with tons of the standard 'A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible.' errors in the event log.

1. We have tried installing SSMS on the application server and connecting to the particular DB with those particular credentials works FINE.
2. Firewall is off on both sides.
3. TCP/IP protocol is enabled (and we use IP and custom port to force tcp).

We are stumped why it doesn't work via the app and need some pointers!

We have many SQL servers setup in our development and production environments and this particular setup doesnt appear to be any different.

CONNECTION STRING:

<add name="myConnectionString" connectionString="Server=MYSERVERDB1; Database=MYDB; Network=DBMSSOCN; Address=192.168.20.161,2061; User Id=MYDBusr_vn;Password=blue123;Asynchronous Processing=True;Application Name=MYService;" providerName="System.Data.SqlClient" />

We have a web application that we host that is customized for multiple customers. Each customer accesses their version of the site via their own custom subdomain. We are running into an issue where ONE customer makes a claim that there is an issue with their site -- site unavailable, certain functions timing out, or generically just 'slow'.

Our support representatives get a report/email/call from the customer when this happens -- and try to reproduce the issues. More times than not, they cannot. If the issue still persists, they end up engaging our IT group, and setting up a troubleshooting call with the customer's IT group.

The customers are usually on their own corporate networks, although their sites can be accessed via internet as well. Once our support rep CANNOT reproduce the issue AND no other customers are reporting issues, we assume the issues are not systemic and have a high probability of being within the customer's network.

Since we cannot ping/traceroute to/from the clients making the request and see all hops, it turns into pointing the finger at each other with seemingly no way to PROVE where the issue is.

1. What can we do to provide EVIDENCE that our service and network are not the issue?
2. What is the best way to show that from our webserver to our ISP (in both directions) is OK?
3. Are there any recommended tools we can put in place to monitor #2?

We have a reverse proxy server setup (IIS + URLRewrite) that forwards external requests to an internal web application. The reverse proxy simply rewrites the external request and forwards it to the internal server which does its work -- rewrites the response and sends the response back to the client.

Problem is -- we're seeing a 5 second delay introduced on pretty much ALL requests. Without the reverse proxy -- the same request direct to the internal web application work fine (testing from internal clients).

This leads me to think this is a DNS related issue.

The lookups from the internal server must be timing out -- then the DNS server has to go out to the internet to ultimately get a response. How can I confirm this? What is the typical way to handle this issue if this is the problem?!

We are required to use encryption with SQL Server, so we have enabled ForceEncryption. According to the documentation, if a certificate is not provided, SQL Server will generate its own internal certificate to do the encrypting.

We need to understand what level of encryption this is providing. I think we generally use 2048bit certs.

Which certificate store is the internal/fallback certificate located? And how can we get the encryption level?

We host a SAAS application specially customized for multiple clients. For one customer in particular -- they are reporting sporadic performance issues from various locations on their network, in particular UPLOADING documents through a form on our website.

The client claims they have "bandwidth to spare" and that utilization of their "pipe" is so low that it MUST be our application, but our application has MANY clients and all features are working fine for all other clients.

Interestingly enough --

• DOWNLOADS (ie. just accessing the website, or downloading documents) is working fine.
• Speed test shows that they should get 1.2Mbps UP. So, a 3MB file should take 20 secs to upload. It takes 60+ seconds on their network. Sometimes even small files take OVER 10 minutes to upload or they timeout.
• Pings and Traceroutes don't show any abnormally long hops or response times.
• They claim other SAAS applications they use allow them to upload just fine.

Both IT teams are working together to resolve this issue. What kind of data can I request from the clients to begin ruling things out.

Seems like we need to somehow measure LATENCY of the networks involved or even at the switch level, we need to understand if packets are getting dropped somewhere and why.

Where should I start? Any help is appreciated. I'll provide more info upon requests

I am trying to setup Perfmon/Logman to collect some performance counters to monitor my IIS6 installation.

There are multiple w3wp instances on this host, and I can successfully collect data for the specific instance I want by passing (w3wp_1234) to the counter (where 1234 is the PID of that particular sites worker process:

Process(w3wp_1234)\Private Bytes

Problem arises when I want to collect a performance counter like Thread:Context Switches/sec, that shows the Thread # as part of the instance:

Thread(w3wp_1234/1)\Context Switches/sec
Thread(w3wp_1234/2)\Context Switches/sec
Thread(w3wp_1234/3)\Context Switches/sec
Thread(w3wp_1234/43)\Context Switches/sec

I assumed I could collect all thread instances of that process by using a wildcard:

Thread(w3wp_1234*)\Context Switches/sec

However, this did not work! Using the GLOBAL wildcard (Thread(*)\Context Switches/sec) gives me all threads for ALL processes, which is TOO MUCH information!!

What is the best way to collect the performance counters only for the particular site I'm interested in? Thanks!

We've been having Out of Memory issues with our mixed classic ASP/.NET site for quite some time. Basically, we see a couple of different cases:

1. Some request (SQL query that returns a LARGE recordset) happens that causes memory to drastically spike (Private and Virtual Bytes), and the IIS worker process crashes, and the application pool recycles.
2. Private Bytes remain 'normal', but Virtual Bytes is at its max (~2GB), and the IIS worker process crashes, app pool recycles.

Crashes have the EventID's: 1009, 1011, & 1013.

In both cases, ASP reports Out of Memory messages in our application log.

If we truly are 'out of memory', why is that users ALREADY in the application can still work and new users are blocked from even logging in? Wouldn't that mean that NO requests could be served?

Obviously, IIS can still serve some requests -- so the answer is probably that it depends on the specific request. Maybe one is more 'expensive' than the other?

In any case, my ultimate question is -- at what point does the application pool say enough is enough, I MUST recycle?

We ran DebugDiag and saw some heaps that were over 90% or even 100% fragmented, so does the recycle happen only when fragmentation is high AND there is no more heap space?

This is a slightly subjective question but I hope I can get some input on sort of what that threshold is!

Thanks.

I'm doing performance/load testing of my IIS6/Win2K3 server. I setup perfom by adding performance counters for the specific site I'm interested in (ie. w3wp#7).

The problem is -- I have to manually complete these steps for each test run assuming my load test causes an automatic recycle of the application pool (OR if the test server is restarted or an iisreset happens).

Is there an easier way to setup a Counter Log with the specific counters I want that will automatically monitor the process I'm interested in. Obviously the site stays the same, its just the process that sometimes changes.

Any help would be great for productivity.

Thanks!

jg

We're trying to tune our IIS farm, and I'm trying to get my head around how Windows allocates resources in our current setup.

We have a pretty standard layout. We host 30+ ASP/ASP.NET sites on our server. We give each site its own individual application pool so we can manually recycle sites without affecting any others.

Since each application pool spawns its own IIS worker process (w3wp.exe), I was under the assumption that each process was allocated its own memory (meaning desktop heap, etc..). We began running out of desktop heap, so we increased the heap size for non-interactive desktops from 512 to 1024 as suggested, but we want to go even further if we can.

Am I right in assuming that since all of our app pools use the NETWORK SERVICE account, that only a single Desktop Heap is allocated to it?

If so, are their pro's and con's to simply giving each application pool its own custom user account?

Theoretically, each site would have its own memory allocation, and would only run out in EXTREME cases.

I'd appreciate your wisdom here. Thanks.

Hope someone can help me make sense of this. I'm trying to debug some COM+ errors we see in our production environment and a few of them report that the desktop heap is exhausted, so I installed Windows Debugging Tools and DHeapmon for starters after reading the definitive Desktop Heap guide: http://blogs.msdn.com/b/ntdebugging/archive/2007/01/04/desktop-heap-overview.aspx

Basically, as I understand it -- Every IIS worker process (w3wp.exe) should be allocated a (non-interactive) desktop heap; default of 512k. We have 30+ sites on our production box, and when I run DHeapmon to report the number of desktops, it not only doesn't report 30+ desktops as I expected (1 for each process, and then the actual windows interactive desktop on the server) -- it reports a single digit # of desktops.

I verified that we are not sharing application pools or desktops, so I should see a desktop for each process, right?

One thing I had a question about was -- if an IIS work process is IDLE, it should get killed -- default is 20 minutes I believe. However, I accessed one of the idle websites, it indeed spawned a new w3wp.exe for that site, then ran DHeapmon again, and it still reported the same number of desktops.

What am I missing? Is there a better way to get the info I'm after?

Any help is appreciated!

We have a Win2K3 server that is hosting 30+ sites. Each site is configured to have its own unique application pool -- so that we can manually recycle specific sites if needed and not kill sessions for the others.

From what I've read, the consequence of this type of setup is that each application pool worker process gets allocated a Desktop Heap (normally 512 kb's) and we limit the number of app pools we can serve. http://blogs.msdn.com/b/david.wang/archive/2006/01/25/security-considerations-of-usesharedwpdesktop-on-iis6.aspx

PROBLEM:
What we're seeing is that occasionally COM+ errors get triggered, presumably by hitting our 512 kb limit of the desktop heap -- and certain sites become unresponsive (or have errors) until we manually recycle that specific app pool. I know that I can increase the desktop heap limit to 1024, and make other tweaks/tunes, but I've been tasked with finding out what exactly causes one site's heap to max out as opposed to another. It seems that when we start seeing COM+ errors, the sites it affects are random -- small sites or big sites (heavier used).

Is it based on process id? Traffic?

Any pointers on understanding this a little more would be excellent. Thanks!

jg

We are an IIS7 shop and we have our application pool set to auto recycle nightly at 1AM. During this last recycle, the site was actually brought 'down'. When the outage was reported, we manually recycled the app pool and it brought the site back up again.

The odd thing here is that the site was working FINE with no errors until our nightly recycle happened. I want to track down what happened here. Is there any way the automatic recycle can fail or maybe timeout?