Dan's questions

I can't RDP onto a Windows 2022 server.

I can see a warning that the Remote Desktop Session Host server is not configured and that a grace period for allowing this has expired. So the issue is due to RDP setup and not network/ports. When I try to RDP I get this message on successful authentication:

Your session ended because the remote PC isn't licensed to accept remote connections. Ask your admin or tech support for help.

Error code: 0x2056 Extended error code: 0x257

The server is a standalone server, not a domain controller. The RD Licensing Diagnoser says I have 0 number of licenses available for clients. How do I configure the server to accept RDP connections? I just need this to manage the server.

On our Win-2003 server we used to have a single SSL certificate installed alongside multiple domains, e.g.

ssl.our-old.com    192.168.0.10
www.example.com    192.168.0.2
www.example.co.uk  192.168.0.2

I'm just showing the server's internal IPs. It's a public facing server with a firewall performing 1to1 NAT (if I got the term right).

We let the old SSL certificate expire when we no longer needed it.

I want to install a new SSL for a new domain on the server, re-using that IP address (192.168.0.10 in the example above).

Do I need to do anything other than just remove the old website in IIS Console? Or do I need to hunt out some other config before I can re-use this IP address on the new website, make the CSR etc?

ssl.example.co.uk  192.168.0.10 
www.example.com    192.168.0.2
www.example.co.uk  192.168.0.2

We are planning to purchase and install SQL Server 2008 R2 Web edition for our live servers. The grand plan was to install a shiny new server with this SQL Server (web edition), and change the connection strings on our various web-apps on two other servers to point to the new database server.

Looking for answers to another question I stumbled upon this comment (from https://serverfault.com/a/198080/3039):

You can't install SQL Server on it and then use that SQL for other applications/servers.

So, my plan above won't work? I would have to install and run IIS on the same physical SQL Server (web edition)?

We have installed a new Juniper SRX firewall with IDP, so the firewall is inspecting the traffic for suspicious activity.

I've encountered 3 "false-positive" reports for SQL injection attacks that are just genuine usage:

• Using mDaemon's webmail, trying to forward a message was considered a SQL injection attempt
• In a .NET web-application, entering a load of text into a textarea and clicking submit triggered a SQL injection. It was 1 sentence that seemed to trip it - about an engineer travelling to Basingstoke all the way from South Wales. Remove that sentence it worked fine.
• In a classic-ASP application, trying to save a report (behind the scenes the page reads all the checkboxes selected and inserts this into a database table). The keyword that is causing the incorrect alert is "Goodmans"

With the 2nd problem above, if I pasted the text content into a different web-application (I simply copied the content into a different, unrelated classic-asp form with different objects) there were no problems at all. With the 3rd problem, the application works just fine - it's just this particular set of options that we've found causes the firewall to drop the connection.

The only way I can solve the mDaemon issue is to take the server out of the IDP policy.

I am going to submit a support request to Juniper to help find a fix, but how does everyone else handle false-positives? Is there anything else that can be done? I am worried that there are other conditions that will trigger more and this will be an endless exercise. Except we may not know about many false-positives because users assume the website went down and just give up (or don't report what they did/can't replicate it a second time).

Additional Information In the case of the third problem, it's not just "goodmans" that is causing the problem - it's much more widespread!

I'm playing with a new Win2008 R2 server installed and hosted online with a direct connection to the web (i.e. no separate firewall in front of it).

The server is supposedly locked down with just RDP enabled. It's a fresh install, no software installed or roles/features enabled (apart from RDP). But in about 30 days there were 29,000 failed login attempts, but I was surprised to see a lot of "successful" ones too.

What are the anonymous logons, example below? Should I be concerned?

The workstation name and IP address changes frequently. In the 29,000 failed attempts it looks like bots/hackers are trying to guess the Administrator password.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          28/10/2011 04:45:11
Event ID:      4624
Task Category: Logon
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      WIN-7I8SE0K3F9M
Description:
An account was successfully logged on.

Subject:
    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

New Logon:
    Security ID:        ANONYMOUS LOGON
    Account Name:       ANONYMOUS LOGON
    Account Domain:     NT AUTHORITY
    Logon ID:       0x376b6c
    Logon GUID:     {00000000-0000-0000-0000-000000000000}

Process Information:
    Process ID:     0x0
    Process Name:       -

Network Information:
    Workstation Name:   SRV001
    Source Network Address: 77.39.106.68
    Source Port:        1242

Detailed Authentication Information:
    Logon Process:      NtLmSsp 
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only):   NTLM V1
    Key Length:     0

One of our clients requires that at the end of the contract we "securely" delete all data from the server (including SQL Server).

I think I need to deal with this in two parts.

1. SQL Server Data: The client data is stored in 2 SQL Server databases, but other contracts (that are not ending) are also maintained in these databases.

Assuming that we destroy the database backup devices, if I perform TRUNCATE TABLE is the data in any way recoverable? Assuming no, if I updated every row/column in the database with 0s, then perform the truncate, does this prevent recovery?

2. Files: We receive data-files that have been transferred onto the server and then imported into the SQL Server, and the server also generates PDF reports that physically sit on the server. Plus we have the backup files.

Are there tools or steps I can take to permanently delete this data without formatting the drive (and then using a tool like DBAN)?

We have a Win2008 R2 server (64-bit) used for testing/development. This server gets shutdown at the end of most days and if there are any Windows updates then these are installed.

Last night there were 18 updates applied when the server was shutdown, but this morning the server would not start. It gets past post, trys to load Windows but then powers off and restarts all over. Next cycle it warns windows failed to load, what do I want to do, try to load windows, get so far, auto-powers off.

To resolve it I do what I've done at least half a dozen times before - remove 2 of the RAM sticks from the server and try again.

The server is nearly 2 years old, i7 with 6GB (3 x 2GB Corsair simms). When it was about 4 months old we replaced the RAM (server just would not boot, period) and didn't have any issue for about 7/8 months.

Once the server is up and running again I can shut it down, reinstall the 2 simms, and the server will boot happily. I'm 99% certain it only happens after applying windows updates, not all windows updates cause the server to fail.

What's the cause? How can I figure it out?

Looking through a log on a Cisco PIX, when it's disconnected from the network I can see this line:

%PIX-6-302010: 7 in use, 128 most used

Is there a command I can run that will give me this info? (without pulling the network cable out of the firewall!) It's useful to see the number of current, simultaneous connections and also the peak figure. Thanks.

On Windows 2003 Server, we have 2 network cards and it's easy to open different ports to the different network cards.

I'm trying to do the same on a Windows 2008 Server, I've discovered Windows Firewall with Advanced Security, but can't see where (or if) we can restrict the ports on the second network card. Is this possible?

In December our Cisco PIX 501 appeared to hang taking the webservers behind it offline. It did this 4 times in the space of a couple of weeks and the "remote hands" engineer at the data-centre (where everything is colocated) reported:

simply rebooting the box once didn't work. We had to reboot the box several times and even re-seat the port0 cable before it would come back online.

So we replaced the PIX with a spare (501), same config installed and everything looked ok. Except this PIX "hung" yesterday. The problem is with the external interface because we can connect to the PIX from an internal IP and show int returns

interface ethernet0 "outside" is up, line protocol is down
Hardware is i82559 ethernet, address is 0000.1234....
IP address x.x.x.x, subnet mask 255.255.255.0

The router that our PIX's external interface is connecting to also reports the line down:

%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/32, changed state to down
%LINK-3-UPDOWN: Interface FastEthernet0/32, changed state to down
%LINK-3-UPDOWN: Interface FastEthernet0/32, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/32, changed state to up

How do I work out what is causing the line to drop? We have replaced the physical firewall, the network cable and the ports that the cable connects to. We've got informational logging running (using Kiwi) and can also see the line going down there but no idea why:

411002: Line protocol on Interface outside, changed state to down

Last time it happened, we tried shutting down and restarting the external interface - no joy, reload the PIX, no joy, changing the interface to 100full (for some reason it shows up as half-duplex when it was on auto), no joy. The line came back up "on its own" after a few minutes, not in response to anything we were trying (I think). I'm not convinced it's the PIX, data-centre thinks it's us...

We need to replace a hardware firewall (cisco pix) and have a spare that we will use (temporarily). The firewall sits in front of a couple of web-servers colocated at a data-centre.

The replacement will be configured with identical settings (external/internal IP addresses, configured ports etc.).

When we swap the firewalls over, will this work immediately or will the old Pix's mac address be cached and the new firewall not be seen until the cache is cleared? (What is it though that is caching the address? Is it just the switch/router that our pix is connected to?)

Reason for asking is a few years ago I had a smoothwall firewall in front of a lone server (the external IP of the smoothwall was also the external IP of the web-server). When I replaced the smoothwall with a pix, the IP address of the web-server stayed the same but it now had to be reached via the new firewall on a different IP. It took about 2-4 hours before the rest of the world could see that web-server again. I'm hoping for less downtime this time!

I've just had a server outage at 4.59AM on Sunday morning, and looking through our uptime records going back to 2006 all except for 4 outages out of 20 occured between 11PM and 6AM. (Only looking at unplanned downtime on web and database servers, not app-servers on an internal LAN.)

Do others also find similar behaviour for their servers? Is this just a fluke?

Edit: It was because so many outages (these are unplanned, not scheduled maintenance, and occured on our hardware, not the ISP's network) have occured between 11pm and 6AM that made me wonder is that just us...

The servers are busiest in terms of visitors between 1PM and about 10PM, while database backups happen throughout the day and a big backup (where compression uses more of the CPU) occurs around 4.30 every morning. But the outages have occured at any time during this window (also these 20 outages are events occuring on 1 of 5 servers or 2 firewalls - about a third of which were result of 2 different machines' hard-drives failing). There is nothing indicating that the server was doing anything specifically because it was the small hours of the morning.

We have a test server running Windows Server 2008 R2 that I want to put SQL Server 2008 onto. I have an MSDN subscription and thought I could install (x64 version) SQL2008 but the installation warned me this wasn't compatible with this version of windows (reporting that I am running Windows 7).

When I log onto my MSDN to download an update the only SQL Server R2 options I have are for Express edition or Enterprise evaluation (I am logged in to subscriber downloads). Is there no standard R2 edition or am I missing something?

Two weeks ago when I rebooted our Win2008 R2 Server (64-bit) it started to power up and load Windows (Windows 2008 Server) but would then suddenly turn-off and start powering up again (and then just keep suddenly turning off, restart, repeat).

I tried booting into safe mode and last known configuration - no joy. It was falling over on classpnp.sys. So I thought I might have corruption on the disk and tried to repair the server from the CD and then I was able to restore the O/S from a backup. I thought that was the end of it but then the next time the server rebooted I had the same problem. Then trying to repair from CD did not work.

I tried repartitioning the disk and installing Windows 7 instead but the installation did not even complete before the PC was powering off mid-boot. I contacted the hardware supplier and they thought it might be the RAM so they've sent me 3 replacement DIMMs, I've swapped those out and the PC isn't powering off anymore but...

The server was trying to boot from the incomplete Windows 7 install. I took the disk out and deleted the 2 volumes on that disk and now trying to install Win2008 from CD. I get the black screen:

Windows is Loading files ...

that completes, and then the grey screen appears with a cursor, but no window/dialog (I'm expecting it to prompt me what language and keyboard I want to use). The server just sits there. alt+tab, ctrl-alt-del, etc. don't have any effect.

If I try booting with no CD I get

BOOTMGR is missing

How do I get past that grey screen? Or is this a hardware failure?

I've been hosting a domain on a Win2003 server for the last 3 or 4 years, but I now need to make this domain accessible only via HTTPS.

I've installed the certificate correctly and it works fine (the server hosts several domains, but this domain is hosted on a different public IP address), but I'm struggling to get IIS to just transfer all users who go to http://www.example.com to https://www.example.com.

I've found the "require secure channel" option in IIS, but checking this results in anyone who fails to type the https:// part seeing an error message (below). What's the best way to redirect users to the HTTPS site (without the user having to worry about it)?

The page must be viewed over a secure channel The page you are trying to access is secured with Secure Sockets Layer (SSL).

Please try the following:

Type https:// at the beginning of the address you are attempting to reach and press ENTER.

HTTP Error 403.4 - Forbidden: SSL is required to view this resource.

A Chinese IP address shows up in our logs as accessing one of our surveys but it stands out because the user tried adding a string to the end of the survey's URL (as if trying to perform a SQL injection attack).

Because the whois lookup for the IP address is from China it seems practical to block the entire IP range. We do have one client in Hong Kong but their surveys are aimed at business users from Singapore, Australasia and USA more than China itself.

Is it better to block the IP address or leave it open?

A couple of days ago one of our web-servers went down in the small hours. It wasn't responding to any remote requests (to be honest I don't know if it would have responded if a USB keyboard and monitor were plugged into it) and an engineer at the data-center rebooted the server for us.

Everything came back up ok, and I then checked the event logs to see if there were any clues as to what went wrong. All I can really see is the event "the previous shutdown at 1AM was unexpected" (which is the time the server went down, not the time the engineer hit the power button).

The server has IIS - but obviously the website logs just shows the file requests leading up to the crash (or freeze) and there's no increase in the volume of traffic prior to the crash. SQL Server is also installed, but the logs just report that a dozen or so transactions were rolled forward when the server came back up.

Is there anything else I can look at to find a possible cause for the crash?

I got a brand new workstation on Friday that I am trying to install with Windows 2008 Server (64-bit) for our development box. The workstation is an Intel i7, 6GB RAM, with 3 x HDDs (SATA) and we've got an MSDN subscription (also new, although the disk I'm using is dated May 2008).

The box was already built and had a trial version of Vista installed (presumably so that the supplier could test everything). First attempt at booting the workstation returned an error about starting Vista (I honestly forget what exactly) but choosing "last known good" got me into this Vista installation. I inserted the windows 2008 DVD and ran through the setup - I didn't note this error when it failed (although after this point I started taking notes) but I presumed it was related to moving the existing Vista files into a windows.01 folder and Setup restored the Vista installation.

So I ran setup again (booted from CD) and at the point of choosing where to install Windows I created a partition on the first drive, formatted the partition and proceeded with the install.

Windows copied the files very quickly, but expanding took a few minutes while the progress meter sat on 0%, was still on 0% when the server rebooted (unexpectedly, none of the usual Windows needs to reboot. 10, 9, 8...) but then I got

Bootmgr is missing
Press ctrl-alt-del to restart

Rebooted from CD and went into Repair. It didn't acknowledge that anything was installed on the drive but from a command prompt I could see the following folders:

$WINDOWS.~BT
$WINDOWS.^LS
PerfLogs
Program Files 
Program Files (x86)
Users
Windows

Those folders had subfolders, but search for .exe or .dll files I only found the setup.exe in $WINDOWS.~BT so clearly the copying/expanding isn't working.

Formatted the drive (from the command prompt), then I ran setup. This time it completed the installation ok (the copying files to hard-drive was very quick, the expanding files task only took a couple of minutes but it showed progress) and then server rebooted gracefully. All working.

Only for some reason this time it installed 2008 Server Core! I swear I selected full installation but I thought we've got a result here - it only took 7 minutes to install (core) - so I formatted the drive again, then booted from CD, ran setup. Definitely selected Standard full installation (x-64) this time, installed onto partition 1 on disk 0. Only I got the 0% expanding and then bootmgr is missing error. Inspect the contents of C: - same as before...

I've been stuck in this loop since yesterday. Is it my MSDN DVD, or something about my hardware setup? Any suggestions?

We use 2 Cisco PIX 501's in front of a couple of our web-servers up at a data-centre (two separate installations on different IP ranges).

Touchwood they're fine but, if we had to replace them - what are our options for an equivalent replacement today? When we bought these I remember the spec saying they would comfortably support 10,000 simultaneous connections. Is the ASA5505 the equivalent today?

[edit] I'm not against other manufacturers - just that the pix is what we have and we know a CCNA(?), albeit certified in 2003, who configures and administers our pixes.

We host a couple of SQL Servers where we are planning to upgrade the environment (still classic asp). We are looking whether to move to a LAMP (or WAMP) environment instead of just following the default route to .net.

If we had a MySQL server and SQL Servers (during a transition period) - what options exist for transferring data between the two?

I don't mean doing a one-off migration - if for example data were still being captured on the SQL Server and we needed to move this data onto the MySQL daily (or ideally more frequently) for some reports process, what options are open to us? Are we limited to scripts to export to csv/txt?

And if we needed to move data the other way, what's available?