Andrew J. Brehm's questions

I appear to have the problem described here:

"After cloning and syspreping [...] VMs running Windows [...], I was not able to connect to the cloned servers by Remote Desktop. After troubleshooting the steps below, I noticed the the RDP-TCP listener was not listening on a network adapter. (I am certain it occurred while cloning /VMTools update)"

enter link description here

Alas, I cannot use the proposed solution:

"Open Remote Desktop Session Host Configuration[...]"

The VM in question is running Server Core.

Is there a way to force Remote Desktop to listen on an adapter using the command line interface? Disabling and enabling Remote Desktop in sconfig.exe doesn't do it.

I can modify page file settings via WMI like this

PS D:\> gwmi win32_pagefilesetting

                            MaximumSize Name                                    Caption
                            ----------- ----                                    -------
                                   8192 c:\pagefile.sys                         c:\ 'pagefile.sys'
                                   8192 d:\pagefile.sys                         d:\ 'pagefile.sys'


PS D:\> $pf=gwmi win32_pagefilesetting
PS D:\> $pf.gettype()

IsPublic IsSerial Name                                     BaseType
-------- -------- ----                                     --------
True     True     Object[]                                 System.Array

PS D:\> $pf[0].InitialSize=4096;$pf[0].MaximumSize=4096
PS D:\> $pf[0].Put()
PS D:\> gwmi win32_pagefilesetting

                            MaximumSize Name                                    Caption
                            ----------- ----                                    -------
                                   4096 c:\pagefile.sys                         c:\ 'pagefile.sys'
                                   8192 d:\pagefile.sys                         d:\ 'pagefile.sys'

But how can I remove a page file setting, e.g. in this remove the page file on D:?

I have a group of servers which all show these symptoms. Every 2-7 days twice in a row, the following error shows up in the Application event log:

Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

The first four bytes are 34 00 00 C0. Event ID is 2004.

Googling for this always leads to this document on the Microsoft site:

http://technet.microsoft.com/en-us/library/cc727117(WS.10).aspx

However, it claims that to resolve the issue one has to "Restart the Server service".

The "Server" service is always running and to my knowledge has never ever not worked on any of those servers.

Any ideas?

In vSphere Client on a VM host in the Alarms tab there is a view of Triggered Alarms.

How can I get those alarms using PowerCLI?

I have an Exchange Server 2013 and I am trying to connect using Outlook 2010. Both are running on the same server. The Outlook installation is just for testing mailboxes.

Outlook first refused to connect because the network adapter didn't have a default gateway and apparently Outlook requires a default gateway to connect to 127.0.0.1.

Now the network adapter has a default gateway and Outlook continues to pretend that it cannot find the Exchange server.

The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action.

This happens regardless of whether I use the Exchange server's name ("exchange") or its (fixed) IP address or "localhost" or 127.0.0.1.

What am I doing wrong?

Update:

After that error message, this small window appears with a slightly different error message.

For some reason Outlook cannot "resolve" the name 127.0.0.1. The same message appears when I try any other name or IP address that points to this same local server including localhost and the server's name and the server's IP address in 192.168.0.0/24.

I have a domain ludwig.example.com and am trying to create a domain amadeus.example.com using install-addsdomain.

I am running this command:

install-addsdomain -newdomainname amadeus.example.com -parentdomainname ludwig.example.com -domaintype treedomain

I am running this as a local administrator and was a bit surprised I didn't get any errors regarding access denied on the ludwig domain I thought the command would have to contact.

In fact the command just tells me that there are a few DNS-related warnings and never terminates. The server remains outside any domains.

What am I doing wrong?

I have a scheduled task, a batch file, that uses an environment variables which is set system-wide.

On server 1, the scheduled task runs under a domain account and the environment variable works. The environment variable also exists in my session and when I runas as the service account.

On server 2, the scheduled task runs under a different domain account and the environment variable DOES NOT work. However, the environment variable does exist in my session and when I runas as the service account.

On both servers the environment variable has been set system-wide by the same script originally. The script runs again every now and then and as far as I can see noone has tempered with the environment variable.

The scheduled tasks are set up identically on the two servers (using the same XML file) and the two service accounts are identically configured (as far as I know).

What am I doing wrong?

When I configure IIS to run a Web site on Port 1414, I get the following error:

--------------------------- Internet Information Services (IIS) Manager
--------------------------- The process cannot access the file because it is being used by another process. (Exception from HRESULT: 0x80070020)

However, as according to netstat the port is not in use.

Completely aside from IIS, I wrote a test program (just to open the port and test it):

TcpListener tcpListener;
tcpListener = new TcpListener(IPAddress.Any, port);
try
{
     tcpListener.Start();
     Console.WriteLine("Press \"q\" key to quit.");
     ConsoleKeyInfo key;
     do
     {
          key = Console.ReadKey();
     } while (key.KeyChar != 'q');
 }
 catch (Exception ex)
 {
     Console.WriteLine(ex.Message);
 }
 tcpListener.Stop();

The result was an exception and the following ex.Message:

An attempt was made to access a socket in a way forbidden by its access permissions

The port was available but its "access permissions" are not allowing me access. This remains after several restarts.

The port is not reserved or in use as far as I know and while IIS says it is in use, netstat and my test program say it is not and my test program receives the error that I am not allowed to access the port. The test program ran elevated. The IIS Site is running MQSeries, but the MQ listener also cannot start on port 1414 because of this issue. A quick search of my registry found nothing interesting for port 1414.

What are socket access permissions and how can I correct mine to allow access?

Update: Output of netstat for port 1414.

C:\Windows\system32>netstat -ban|findstr 1414

C:\Windows\system32>

Windows Server 2008 Cluster Service appears to store settings for its resources somewhere that allow them to travel from node to node. Where is that information stored?

I have a cluster resource of type "file share" but when I try to configure the "security" parameter I get the following error (excerpt):

Set-ClusterParameter : Parameter 'security' does not exist on the cluster object

Using cluster.exe I get a better result, namely the usual nothing when the command worked. But when I check in Failover Cluster Manager the permissions have not changed. In Server 2003 the cluster.exe method worked.

Any ideas?

Update:

Entire command and error.

PS C:\> $resource=get-clusterresource testshare
PS C:\> $resource

Name                          State                         Group                         ResourceType
----                          -----                         -----                         ------------
testshare                     Offline                       Test                          File Share


PS C:\> $resource|set-clusterparameter security "domain\account,grant,f"
Set-ClusterParameter : Parameter 'security' does not exist on the cluster object 'testshare'. If you are trying to upda
te an existing parameter, please make sure the parameter name is specified correctly. You can check for the current par
ameters by passing the .NET object received from the appropriate Get-Cluster* cmdlet to "| Get-ClusterParameter". If yo
u are trying to update a common property on the cluster object, you should set the property directly on the .NET object
 received by the appropriate Get-Cluster* cmdlet. You can check for the current common properties by passing the .NET o
bject received from the appropriate Get-Cluster* cmdlet to "| fl *". If you are trying to create a new unknown paramete
r, please use -Create with this Set-ClusterParameter cmdlet.
At line:1 char:31
+ $resource|set-clusterparameter <<<<  security "domain\account,grant,f"
    + CategoryInfo          : NotSpecified: (:) [Set-ClusterParameter], ClusterCmdletException
    + FullyQualifiedErrorId : Set-ClusterParameter,Microsoft.FailoverClusters.PowerShell.SetClusterParameterCommand

We have a (rather old) Windows Server 2003 which since last week shows some odd behaviour.

It decided that all local administrators and local system are no longer allowed to do anything, including creating event triggers or killing tasks (except via Task Manager).

The problem goes away after a reboot.

What could cause such behaviour?

Update:

This also affects VBS scripts, like the clusweb.vbs script used to control IIS from Cluster Services.

This line:

set objWmiProvider = GetObject("winmgmts:/root/cimv2")

causes this error:

Generic Script <IIS>: Script Error: Line=50, Character = 4 
Generic Script <IIS>: Source: SWbemServicesEx 
Generic Script <IIS>: Description: Access denied 
Generic Script <IIS>: Error: 2147749891 (0x80041003) - Description: Access denied  (Source: SWbemServicesEx) 

On a test server the line works, whether run by an administrator or non-administrator.

Update:

It appears the problem also causes cluster resources to become degraded and fail over. I experimented a bit with leaking memory in the nonpaged pool in a test system to see if I would get the same (catastrophic) results, but they are not quite the same (there is no "access denied" at any point, programs just don't start).

Any ideas what could cause all this?

I have two servers A and B. B is a database server, A is (here) a client to the database server. A tool running on server A connects to SQL Server on server B and ultimately triggers a bulk import from a share on server A (\\servera\fileshare).

The tool on server A runs as localsystem. domain\servera$ has the required access to the SQL Server on server B.

The problem is SQL Server on server B cannot access \\servera\fileshare despite the SQL service account having all permissions to do so (on server A). I found out that this is because SQL Server tries to delegate the connection to the account that the utility uses to connect to SQL Server and that fails because the SQL Server service account does not have the right to delegate (and that setting cannot be changed by me).

I also found that if I connect using a SQL account (i.e. not an Active Directory account) using SQL authentication (and not Windows authentication), SQL Server connects to the fileshare using the SQL Server service account and everything works. The tool luckily supports using a SQL account. Unfortunately the password is given in plain text as a command line parameter and then appears in the process list among all other parameters. This is not good.

Is there a way to make SQL Server use its own service account when connecting to the fileshare without using a SQL account to connect to SQL Server?

This is SQL Server 2008 on Windows Server 2003.

Is there a way to query from SQL Server in TSQL which node is active in another cluster group in the same cluster?

I have a cluster with two cluster groups, one with resources for SQL Server, one with resources for the application connecting to SQL Server. In order to send alerts from SQL Server I need to find out which node is active in the application group. Is there a way to do that in TSQL? I can find out the name of the active SQL node.

When I read a file into a variable

$file = Get-Content myfile.utf8

and then write this same content into a new file

Set-Content -Encoding utf8 mynewfile.txt $file

Powershell automatically adds a return and linefeed to the end of the file.

How can I get the content of a file and write it back without Powershell adding anything?

When I create a VM in Virtual Machine Manager (VMM) I have an option to set a local administrator password for it. But when I use the "View Script" feature on the last screen of the wizard, I get a PowerShell script that creates a VM without setting a password.

How can I make the PowerShell script set the password for the local administrator account for the VM it creates?

I have a SQL job that runs a VB script that uses an object provided by the Microsoft Excel DCOM application. Excel 2003 is installed and working. Both SQL Server and SQL agent run under mydomain\thataccount.

The error is:

The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {00024500-0000-0000-C000-000000000046} to the user mydomain\thataccount SID from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

The following findings make this difficult.

1. mydomain\thataccount has full Launch and Activation Permissions, Access Permissions, and Configuration Permissions on the DCOM application in Component Services DOC Config.

2. The error (above) claims that it doesn't.

3. If I grant "everyone" full access of all types, the error doesn't change.

4. If I make the SQL agent run under another account (mydomain\otheraccount), the error still complains about mydomain\thataccount not having permissions. Apparently the job runs under SQL Server credentials rather than SQL Agent credentials.

5. I did not change the account SQL Server runs under because when starting SQL Configuration Manager I got this error (which might or might not be related):

   Cannot connect to WMI provider. You do not have permission or the server is unreachable. Note that you can only manage SQL Server 2005 and later servers with SQL Server Configuration Manager. Invalid class [0x80041010]

6. If I add mydomain\thataccount to the local Administrators group and restart SQL Server, the job works. This means that an administrator has permission to use the DCOM application but a non-admin user does not, despite being given permissions.

7. To reiterate: even when "everyone" was given full access to the DCOM application, the error said that mydomain\thataccount doesn't have permissions to access the DCOM application.

Any ideas?

(I am starting to believe that something is wrong with the Windows/SQL installation.)

Microsoft® Windows Server® 2008 Enterprise Version: 6.0.6002 Architecture: 64-bit Status: OK Total Visible Physical Memory: 3,927 MB Windows Service Pack: Service Pack 2

Microsoft SQL Server 2008 (SP1) - 10.0.2531.0 (X64) Mar 29 2009 10:11:52 Copyright (c) 1988-2008 Microsoft Corporation Enterprise Edition (64-bit) on Windows NT 6.0 (Build 6002: Service Pack 2)

We have a test environment which is pretty much a copy of the production environment for our Web applications.

In the past email addresses of customer data were scrubbed to avoid emails from test systems getting out into the wild. But our testers tell us that they would want to keep those email address unique, i.e. perfectly mapped to the real ones.

I thought that a usable method to scrub without losing information would be to remove all dots in the email address and then attach ".somewordlongerthanfourcharacters" to the computer part of the address. That would allow testers to know the real address of the customer ("[email protected] -> [email protected]") plus we could set up an internal server named "someword" and have it receive emails for all subdomains of "someword".

Is that a useful idea or are there better methods to achieve this? Should I use a reserved test domain or something like that?

How do I find out (in Powershell) what process/whatever uses the most memory?

Edit: I am trying to figure out how to use Powershell to find out what's using all the physical memory in case Task Manager etc. fail to explain why all the physical RAM is used up. I.e. I need to identify memory used by caches etc.

I have heard the old advice for Windows NT 4 which, if memory serves, was a rule of thumb "memory size plus 12 MB" (so that a complete dump could be written to disk).

Does anybody have any recommendations for Windows Server 2003 and 2008?

(Also, while we are at it, what is a good swap file setting for a VM? Like physical machine or should I give more memory to the VM and let the host do the swapping?)

What is the difference between t1 and t2 hypervisors?

The Wikipedia article explains it, but I am not quite getting it. Apparently both require some sort of host system to run in. Does anybody know of a good explanation of the differences?