duct_tape_coder's questions

We attempted to configure the permissions of a Registry key (HKLM\Software) via GPO. (https://www.stigviewer.com/stig/windows_server_2019/2019-12-12/finding/V-93025)

However this resulted in a necessary "Capability SID" (https://answers.microsoft.com/en-us/windows/forum/all/what-the-heck-account-unknowns-1-15-3-1024/65852c0e-d185-4eef-abfb-967263519cc0?page=2) being removed from the permissions.

Unfortunately there's no way to manually add a SID via the GPMC GP Editor. You must search for an existing user but "Capability SIDs" have no user mapping by design.

Is there a way to get this SID back in the registry permissions via Domain GPO?

I would like to have workstations automatically log-off after a set period of inactivity. There are many solutions to lock a workstation after a timeout and a few hacks to log off a workstation when the user becomes inactive. However, when the workstation is locked but not disconnected, the query user command shows 'Active' for the user and those hacks do not work. (https://superuser.com/questions/269574/how-can-i-automatically-log-out-users-from-a-windows-machine?rq=1)

I would like to set a policy that would automatically log a user off after ~5 days of inactivity. Unfortunately this means using logon hours is not feasible as I cannot set certain hours or certain days for this logoff requirement.

The "idle" trigger for task scheduler also seems to not be ideal as any CPU activity blocks it rather than just user activity.

Unfortunately I also cannot justify a third-party utility or cost associated with this configuration.

I'm currently researching ways to provide stateful storage to docker containers in Docker Swarm. I've come across the vsphere storage for docker volume plugin (https://storagehub.vmware.com/t/vsphere-docker-volume-service/installation-6/) (https://github.com/vmware-archive/vsphere-storage-for-docker) which looks ideal for my purposes as I'm running my hosts as VMs in vSphere.

The installation process seems to involve the command docker plugin install --grant-all-permissions --alias vsphere vmware/docker-volume-vsphere:latest on each docker host. From what I can tell, this is starting a new container on the host which grants the plugin to the host.

However, if there is a need to run a container on all the hosts in the swarm, is there a way to run the plugin container as a Global Service (like a daemonset in K8s) rather than having to install the plugin on each host?

Certainly it would be advantageous to have Docker Swarm automatically run the container on all hosts in the event of new hosts being added. On the other hand, I could see a catch-22 issue where a plugin would be needed for a Global Service to even exist (such as with a network plugin).

I'm working on creating a 3 manager Docker Swarm using Docker CE 19.03 and three CentOS 7 machines.

I've installed docker via yum, enabled the service and started it.

I've created a firewalld 'service' and allowed (per docker docs):

• TCP port 2377 for cluster management communications
• TCP and UDP port 7946 for communication among nodes
• UDP port 4789 for overlay network traffic

I was able to init the swarm and join a worker. The third server I tried to join as a manager however and it failed with

Error response from daemon: manager stopped: can't initialize raft node: rpc error: code = Unknown desc = could not connect to the prospective new cluster member using its advertised address: rpc error: code = DeadlineExceeded desc = context deadline exceeded

So I backed out with docker swarm leave and tried to join as a worker. It succeeded no problem. Now why would I be failing to join as a manager but successfully joining as a worker?

I tried allowing 2376/tcp (per https://www.digitalocean.com/community/tutorials/how-to-configure-the-linux-firewall-for-docker-swarm-on-centos-7) and disabling firewalld on the one manager to see if it was a firewall issue but I got the same error.

TL;DR in bold

Hello, I have set up a new DFS Namespace and Replication for a software and user share from an older 2012R2 server to a newer 2019 server that we wish to migrate to. I've left the servers running for several days now but there does not appear to be any progress in the replication.

Running dfsrdiag backlog shows "No Backlog member x is in sync with partner y" but that's clearly not the case. Running a DFS replication report shows that no files or folders have been copied and the drives on the new server have not changed size since the initial 753MB consumed when the replication was set up.

In the DFS Replication event log on the old server, I have a rolling log of approximately 25000 events per minute, all indicating event 4308: "The DFS Replication service has successfully recovered from sharing violations encountered on a file." It appears to be triggering the event for every file in the share one by one.

At one point it reached a folder which is corrupted and just spammed the name of the folder continuously. I stopped and restarted the DFS service and it seems to restart the whole spam process on files I've already seen go by. I've scheduled a chkdsk /f on reboot to handle the corruption this evening. However, it would seem logical to me that the system could replicate the non-corrupted files in the meantime.

Why am I getting so many 4308 events in the log? It's rolling over the 15MB log basically every minute and there's nothing in the logging other than 4308 events. I don't want to make the log larger or force it to archive as that's just going to fill up my system with more useless events. Meanwhile, I'm seeing all these recoveries and no initial errors. There's no visible progress whatsoever.

More details (probably not relevant): the old server is in a Hyper-V Failover cluster using iSCSI cluster disks for the drives. The shares are hosted from direct iSCSI mounts inside the server. The new server is VMware with drives provided from vSAN (virtual datastore replicated across local hosts). Both servers have Windows Backup set up, the old server backup takes about 18 hours and leaves only 6 hours a day for replication (Windows Backup appears to pause DFS-Replication). No progress is made during those 6 hours however, so I do not think the backup is the main culprit. I have done dfsrdiag pollad for both machines which changes nothing. The recipient mostly sits there doing thing in the logs except occasionally complaining daily about windows backup taking the replication offline for ~30 minutes. The old server does the above spam.

I'm currently investigating the use of HAProxy as a Load Balancer. I've found that the recommended configuration for HA of the HAProxy itself (not the backends) involves using keepalived to establish a VIP that both systems respond to. This means that when the primary stops being active on the network, the passive HAProxy sends a gratuitous ARP message and instructs the network to send all traffic for that VIP to it instead.

This looks to be a good solution but it prevents an Active-Active Load Balancing setup for the HAProxies. I'm curious as to any methods that allow both HAProxies to respond to traffic and maintain reasonable uptime in case of a failure on one of them. DNS Round robin between two VIPs managed by the HAProxies, with opposite masters, seems like a reasonable solution but I haven't found any guidance on whether keepalived can support two VIPs on one system simultaneously.

Terrible MSPaint diagram to illustrate:

Is this possible? Is this a reasonable solution? Have you seen any alternate solutions which are viable?

Edit: I found the following after posting which suggests it's possible but suggests using CLUSTERIP as an alternative. I'm not certain about the compatibility between CLUSTERIP and HAProxy.

• Multimaster Keepalived Configuration (Virtual IP with Load Balancing)
• iptable CLUSTERIP doesn't work

We utilize Dell Compellent storage and I'm in the process of developing a script to provision new iSCSI volumes to Windows servers using the Dell PowerShell SDK.

I've successfully provisioned a volume to a server using the Cookbook commands (https://downloads.dell.com/solutions/storage-solution-resources/Dell-Storage-PowerShell-SDK-Cookbook-%282095-WP-PS%29.pdf)

I'm now querying the provisioned disks on the server with get-disk -CimSession $cimsession and I noticed odd output. The newly provisioned disk is indicating a HealthStatus of Warning and an OperationalStatus of Stressed. I feel like this may be a red herring since I haven't formatted or assigned the disk yet. However, the other disks which are all online and functioning normally indicate the same Warning with an operational status of "Other".

I took a look at the MSDN (https://msdn.microsoft.com/en-us/library/windows/desktop/hh830493(v=vs.85).aspx) and it indicates

Other, 1, A vendor-specific OperationalStatus has been specified by setting the OtherOperationalStatusDescription property.

This is not terribly helpful as OtherOperationalStatusDescription isn't actually a property of the MSFT_Disk object but instead for MSFT_StorageSubSystem class and I have no idea how to query that info. I've tried various ways to call that and the GetDiagnosticInfo method it contains but no dice.

I tried googling for "Stressed" and "Other" along with various dell, disk, get-disk, and keywords but I'm not coming back with anything providing any reasons or suggestions on these statuses.

EDIT 1: Tried the following suggestions but didn't get what I need:

Get-WmiObject -Class MSFT_VirtualDisk -Namespace "ROOT\Microsoft\Windows\Storage"
Get-WmiObject -Class MSFT_TargetPort -Namespace "ROOT\Microsoft\Windows\Storage"
Get-WmiObject -Class MSFT_StorageSubSystem -Namespace "ROOT\Microsoft\Windows\Storage"
Get-WmiObject -Class MSFT_StoragePool -Namespace "ROOT\Microsoft\Windows\Storage"
Get-WmiObject -Class MSFT_FileServer -Namespace "ROOT\Microsoft\Windows\Storage"

Get-WmiObject -Class MSFT_VirtualDisk -Namespace "ROOT\Microsoft\Windows\Storage\Providers_v2"
Get-WmiObject -Class MSFT_TargetPort -Namespace "ROOT\Microsoft\Windows\Storage\Providers_v2"
Get-WmiObject -Class MSFT_StorageSubSystem -Namespace "ROOT\Microsoft\Windows\Storage\Providers_v2"
Get-WmiObject -Class MSFT_StoragePool -Namespace "ROOT\Microsoft\Windows\Storage\Providers_v2"
Get-WmiObject -Class MSFT_FileServer -Namespace "ROOT\Microsoft\Windows\Storage\Providers_v2"

Get-WmiObject -Class SPACES_StoragePool -Namespace "ROOT\Microsoft\Windows\Storage\Providers_v2"
Get-WmiObject -Class SPACES_StorageSubSystem -Namespace "ROOT\Microsoft\Windows\Storage\Providers_v2"
Get-WmiObject -Class SPACES_VirtualDisk -Namespace "ROOT\Microsoft\Windows\Storage\Providers_v2"
Get-WmiObject -Class WSP_FileServer -Namespace "ROOT\Microsoft\Windows\Storage\Providers_v2"

Some of these return objects with OtherOperationalStatusDescription but the value is blank. None of the objects seem to be for a specific disk however. MSFT_StorageSubSystem returned a "Storage Spaces" object which seems to abstract the disk statuses into an overall status of "Healthy".