userSteve's questions

I'm just starting to experiment with encrypting backups, I think I now understand it and have got the process working, but something strange is happening with restoring.

On Server A (SQL 2014 Standard) I have created a new master key and certificate and successfully produced an encrypted bak file and have also exported the key and cert files.

On Server B (SQL 2014 Developer) I have successfully restored the master key and certificate from Server A.

I know these are working fine as I can restore the encrypted bak file successfully to both servers using the syntax:

OPEN MASTER KEY DECRYPTION BY PASSWORD = 'xxx';
RESTORE DATABASE testDb FROM DISK = 'C:\testDb.bak' WITH STATS = 5;
CLOSE MASTER KEY;

But it's not the same story when using the Restore Database tool in SSMS.

It works fine when restoring to Server A.

But when using the UI to restore to Server B, it just gives a basic message of 'No backupset selected to be restored'.

Why would this be?

UPDATE: I've just noticed when using the commands to restore the backup, it will only work on Server B if I open the master key first otherwise it gives the message Please create a master key in the database or open the master key.
On Server A I do not need to do this, it's as though the key is always open on Server A

We are a small business using a single SQL Server 2014 instance as our main data platform.

We now need to set up a second instance (2017) to hold additional data - this is to be standalone, ie not replicated or actively linked to the main server.

Disclaimer: I am a developer not a DBA. Using a trained DBA for this task is out of our budget.

I can happily install the software and try my best at setting it up correctly but ideally it would be great if there is a way to copy the majority of the settings from the main server to the new one.

We are happy with the way the main SQL instance is set up, is it possible to export and import these settings? Is there an easy to follow guide for creating a new SQL instance based on similar configuration of an existing one?

I'm trying to choose the best Azure VM for my needs but there's so many varieties it can be very confusing.

For instance I can't see why the D11 is more expensive than the D4a, when the D11 appears to be a lower spec.

There must be more to it than the basic resources listed here?

I have sensitive data stored in both Azure DB and Azure SQL VM.
An authorised DBA can log on and query the database, but in theory could a random Microsoft employee do the same without asking permission?

I found this online which suggests the answer is 'no', but is it really?

Customer data ownership: Microsoft does not inspect, approve, or monitor applications that customers deploy to Azure. Moreover, Microsoft does not know what kind of data customers choose to store in Azure. Microsoft does not claim data ownership over the customer information that's entered into Azure.

Also found this on a site discussing the negatives of using a SQL Developer Licence:

Microsoft gets access to your data: it is mandatory with any non-commercial installation of SQL Server that all your usage data covering performance, errors, feature use, IP addresses, device identifiers and more, is sent to Microsoft. There are no exceptions. This will likely rule it out for any company that deals with particularly sensitive data.

I'm not proposing using a developer licence on Azure, but which is it - can Microsoft inspect my data or not, either legitimately or a rogue employee?

With a standard SQL Server platform (with no replication or redundancy), some downtime is to be expected for weekly/monthly patching and reboots.

Is this still the case for Azure DBs (elastic pools, serverless, managed instances, etc) ?

Or can I expect them to be operational almost 100% of the time except for unexpected disasters?

I am using IIS 10 with a variety of SSL certificates installed and bound with SNI.

I now need to renew a wildcard PFX certificate, I would normally Import the new file and manually rebind each site to use the new certificate before deleting the old one but I now have over a hundred sites.

There must be a better way?

I have looked at the Renew functions but they are only for .CER files not .PFX.

As you can see from screenshot, both certificates are imported ok but how best to apply the new one to the existing sites automatically? Is there a quick and reliable way to upgrade an inuse PFX certificate with a new PFX file?

I need to find an easy and universal way of catching any http://www.sub.example.com URLs and redirecting them to http://sub.example.com (ie stripping out the www)

I'd prefer to implement this once for the server and not for each site, maybe using IIS Rewriter?

I am adding a domain (xero.com) to our existing SPF record, to allow marketing emails to be sent from an external system and appear as if they are from us.

The SPF record for xero.com is large and including it would take our own SPF record over the 10 lookup limit, resulting in error Permanent Error: Too many DNS lookup

This is unfortunate, but what effect if any does this error actually have (for both hard and soft fail)? Will it prevent any mail being sent, or allow all, or just ignore this included domain?

In addition to this, we advise some of our clients to include our domain in their SPF records so we can send mail on their behalf.

Could increasing the included domains on our SPF record have a negative impact on theirs?

Conversely, if I get round this problem by setting our SPF record to v=spf1 +all to allow everything, could this also have an undesired effect for our clients that might use our domain in their SPF record?

We want ALL sites on our webserver (IIS 10) to enforce SSL (ie redirect HTTP to HTTPS).

We are currently 'Requiring SSL' on each site and setting up a 403 error handler to perform a 302 redirect to the https address for that specific site.

This works great. But it's a pain to do for every single site, there's plenty of room for human error.

Ideally I'd like to set up a permanent 301 redirect on all HTTP://* to HTTPS://*

Is there a simple way to do this in IIS ?

Our organisation uses the native desktop Skype for Business 2016 client.

When I want to have meetings with external users I send them the standard Outlook invitation created by the S4B add-in.

This works fine for most users, but for some external clients they are restricted by security policies and are unable to download the MSI plug-in required for web meetings.

Is there a way round this? Is it possible to host a Skype meeting and invite external users with the minimum fuss?

I came across this page which may be relevant?

I am setting up a new server (PowerEdge T130) for a small business, running Windows Server Essentials 2016. It will be used as a file server, AV, domain controller and has some SQL databases. I know usage ideally shouldn't be mixed, but it will have very little usage - only a few users occasionally accessing it.

I want to optimise it for speed as much as possible and am going through the BIOS settings. One that has caught my eye is X2Apic Mode.

What does this do, and when should I not have it enabled? I think it was Disabled by default but I have since turned it on, is that likely to cause any issues?

I need to schedule an unattended weekly out of hours download & install of windows updates and then reboot of a Windows Server 2016 box. How can I do this? Can it be done from the command line?

Similar question regarding Windows 2003 Schedule Windows Updates exclusively on a specific work day (and time)?

I was pleased to see with the latest Windows 10 and Windows Server 2016 the old 260 character restriction for folder and file names can be overcome.

I've just installed Windows 2016 on a new machine and have followed the steps to enable long paths (as detailed here), and am still getting messages telling me files cannot be copied or folders created because they would create a long path name.

What have I done wrong is there something more I need to do?

In a standard office LAN environment why would I NOT want to tick both Register this connection and Use this connection? How do they differ and in what situation would I select only one without the other?

I'm looking to maximise performance of my hard drive by enabling write caching. I understand the risks in doing this, but believe them to be insignificant for how I will use it.

On the HD Properties tab in Windows, the last two options are a bit confusing:

Enable write caching on device - ok, but how does that work in conjunction with the previous option? Does it override windows caching or work alongside it?

Turn off Windows write cache - Ok, but why would I do this. And if I tick this box then the Better Performance option is still selected, contradicting itself.

Can someone help clear up exactly what these flags do and how they affect/rely on each other.

We have a very small (5 workstation) network with one Windows Server acting as domain controller, DHCP and DNS server. All devices are connected to a standard switch which in turn is connected to a standard broadband modem.

The TCP network settings for each workstation are:

192.168.0.50 is the IP of the DNS server. 192.168.0.1 is the IP of the modem gateway 8.8.8.8 is Google's public DNS server

Is this a good plan? Is there any point including the modem's IP in that list? I've noticed that the Windows DNS server is receiving and caching requests for public websites. Should the Google DNS server be higher up the list?

I'm new to administering Windows Servers and have just been attempting to migrate AD, DHCP, DNS, roles from an old server to a new Windows Server 2016 box, and then retire the old server.

All seems to have gone ok in the end, although I may have made some mistakes along the way including not transferring the FSMO roles at the right point - I seized them at the end.

If I use NetDOM /query FSMO to see the roles, they are all assigned to the new server. So why does the Server Health Monitor screen show the warning below?

Why does it still think BS-2012 is the designated DC? (The old server has now been physically destroyed)

I'm a little inexperienced with Windows Servers and am settings up a DC and DHCP role. The local IP of the server is 192.168.0.50, it has no other network connections, so why do I see it refer to itself as 169.254.249.95 in some places?

What does this IP represent? Have I done something wrong?

Disclaimer: I am a developer not a sysadmin

I have just installed Windows Server Essentials 2016 on a small office network and noticed that it has automatically created shares called CertEnrol, Shared Folders, Users and a few others.

It has also created a folder on each volume called ServerFolders.

What are these and am I safe to remove them? I haven't seen them before on other servers.

I don't really want the users to get confused by them and if they are important then I don't want to encourage them to poke around in there.

I have a new Windows Server 2016 box with 32GB of RAM, it will be used for dev testing by one or two users max. There will be occasional use of VM/Hyper-V instances and a couple of IIS test sites running from time to time.

I also need to install all versions of SQL Server from 2008 through to 2016. These will each have many databases attached but very few will actually be active at a time unless testing calls for it.

Assuming there is no practical issue with installing several different SQL Server installations on the same box, what options do I have to configure the best use of RAM? I know that on a standard installation, SQL will try to hog all available RAM but I want to try to avoid this leaving around 12GB for other services and allocate a maximum of 24GB for ALL the SQL instances to share equally without fighting with each other over resources.

Is there a good way to achieve this?