I am trying to add DKIM to an existing windows server which is currently using IIS SMTP for outgoing mail.
It seems like this could be done by using E-Mailrelay. Unfortunately I could not find any reference on how exactly to configure DKIM in E-Mailrelay.
Is there something I missed in the docs or perhaps some third party tutorial that describes how to do this?
I have set up an SQL Server 2016 Availability Group inside a Domainless Windows Server 2019 Failover Cluster.
Everything runs fine at the moment, but now I am wondering what might happen if cluster nodes are installing new updates at slightly different times. For instance what happens if Server A updates at 3:00 and Server B applies the same set of updates an hour later.
Will the cluster break? Will there be outages or will this only cause the Availability group to stop synchronizing to the secondary node until both servers are again at the same update level? My first test suggest the latter option, but it was just one test...
Apparently the best practice is to use Cluster-Aware Updating, but that only works with Active Directory. Since my cluster runs without any domain, I am wondering what the best practice regarding the installation of new updates is in my scenario.
I am trying to configure a VPN server completely using Powershell. I have completed everything except the last step: Granting a local user account Dial-In / Network Access Permissions so that this user can access the VPN.
Via GUI it's easy to complete this step with the "Computer Management" app in the user properties / Dial In / Network Access Permission:
But how can I do this via Powershell? As an alternative, how can I grant the user permission to use the VPN by setting a NPS Network Policy via command line?
I'm trying to use IIS administration commandlets such as Get-IISSite on a Windows Server 2012 R2 computer.
I've already installed IIS Server and all IIS Management Tools roles and rebooted the server.
However, when I open a PS commandline as administrator, the commandlets are still missing:
PS C:\Users\Administrator> get-command *iis*
CommandType Name ModuleName
----------- ---- ----------
Function IIS: WebAdministration
Application iisreset.exe
PS C:\Users\Administrator>
What am I doing wrong?
Edit: One thing I've also already tried (without any luck):
PS C:\Users\Administrator> Import-Module webadministration
PS C:\Users\Administrator> get-command *iis*
CommandType Name ModuleName
----------- ---- ----------
Function IIS: webadministration
Application iisreset.exe
PS C:\Users\Administrator>
I currently have several dedicated Windows web servers which are hosted in different regions. Until now, I have been managing them without Active Directory, but I feels that it adds a lot of unnecessary administration overhead and restrictions.
Now I am wondering how the DCs would have to be secured. I do not have my own datacenter at my disposal, but I could rent two more dedicated servers and use those as DCs. I know that a DC should ideally be placed behind a dedicated firewall, but this would make renting the DCs a lot more expensive.
Would it be OK to use the Windows Firewall on the DCs instead of a separate firewall appliance? It might not be a textbook solution, but it seems like everything should be secure if I restrict access to the DC's incoming ports to the IP addresses of my own web servers. After all, it's the same thing I would do with a separate firewall appliance.
I am hosting an ASP.NET website with wildcard ssl certificate on IIS / Windows 2008R2. While Chrome works fine with my website and shows a green lock the https connection, the https details mention "obsolete cryptography":
I assume that this is due to SHA1, which is also being mentioned by chrome in the same window.
However, according to Digicert's SSL Certificate Checker, SHA256 should be used:
Now I am not sure what is going on and how to fix this problem. It appears that this blog post describes a workaround for this problem, but the workaround seems so obscure (1. Step: Install OpenSSL?), that I can't imagine this is the offical way to do it on Windows 2008 R2.
How should I proceed to get rid of the ssl certificate warning?
Edit: After applying the script recommended by Grant, my SSLabs has been improved from C to A and Chrome is using TLS 1.2 instead of 1.0. However, the "obsolete cryptography" warning is still there.
We are running an Read-Write DC at our home office which we are using for authentication when were are working there. It works fine as long as we are at the office, but we are going to be on the road for a few months, and and IT infrastructure at our office will have to stay offline during this time.
I read several times that it's not a good idea to expose a DC to the internet, so I was thinking of setting up RODC on a cloud server instead and caching some credentials there.
Would I be able to authenticate against the RODC if the writeable DC was offline for several months? I'm worried that my credentials might be cached at first but expire at a later time.
I have a server which is idling below 5% cpu load most of the time, except from a few times a day where I can see some minor cpu spikes. I found out about this by using PRTG.
How can I find out what process is causing the cpu spikes? It's easy to monitor WMI CPU load with PRTG, but what I would also really need is a way to log the most CPU-Intensive processes in regular intervals.
I guess this can be done with perfmon, but which performance counters do I need for this job?
Thanks,
Adrian
I'm trying to set up mirroring with a witness using my 3 dedicated servers running SQL Server 2008 R2. I've set up everything as described at this blog post
Mirroring seems to work fine between the principal and secondary server. But when I run the very last command to add the witness
alter database citec_vc_prod set witness = 'TCP://witness_address:witness_port';
I get the following error after a few seconds:
Msg 1456, Level 16, State 3, Line 1 The ALTER DATABASE command could not be sent to the remote server instance 'TCP://witness_address:witness_port'. The database mirroring configuration was not changed. Verify that the server is connected, and try again.
Also, the event log on the principal shows the following error:
The ALTER DATABASE command could not be sent to the remote server instance 'TCP://witness_address:witness_port'. The database mirroring configuration was not changed. Verify that the server is connected, and try again.
I've already shut down the firewall on the witness, and I've successfully telnetted from the principal into the mirroring endpoint of the witness server to make sure there is no connectivity problem. Yet, I still get this error.
My setup is as follows:
Principal: SQL Server 2008 R2 Standard 10.50.1617
Mirror: SQL Server 2008 R2 Standard 10.50.1617
Witness: SQL Server 2008 R2 Express 10.50.2500
Each of the servers is in a different workgroup.
Please help me SQL server gurus, you're my only hope!
Edit: Here's a complete log of the T-SQL commands I used to set up mirroring. Once the first attempt failed with the problem described above, I deleted everything and started from scratch. The same problem reoccurred though.
-- PRINCIPAL
create master key encryption by password = 'mypassword';
GO
create certificate "server1.ourdomain.com_cert" with subject = 'server1.ourdomain.com certificate', start_date = '2007/11/01', expiry_date = '2020/11/01';
GO
Create endpoint endpoint_mirroring state = started
as tcp(listener_port = 5022, listener_ip = all)
for database_mirroring (authentication = certificate "server1.ourdomain.com_cert", encryption = disabled, role = all);
GO
Backup certificate "server1.ourdomain.com_cert" to file = 'f:\cert\server1.ourdomain.com_cert.cer';
GO
-- MIRROR
create master key encryption by password = 'mypassword';
GO
create certificate "server2.ourdomain.com_cert" with subject = 'server2.ourdomain.com certificate', start_date = '2007/11/01', expiry_date = '2020/11/01';
GO
Create endpoint endpoint_mirroring state = started
as tcp(listener_port = 5022, listener_ip = all)
for database_mirroring (authentication = certificate "server2.ourdomain.com_cert", encryption = disabled, role = all);
GO
Backup certificate "server2.ourdomain.com_cert" to file = 'f:\cert\server2.ourdomain.com_cert.cer';
GO
-- WITNESS
create master key encryption by password = 'mypassword';
GO
create certificate "witness.ourdomain.com_cert" with subject = 'witness.ourdomain.com certificate', start_date = '2007/11/01', expiry_date = '2020/11/01';
GO
Create endpoint endpoint_mirroring state = started
as tcp(listener_port = 5022, listener_ip = all)
for database_mirroring (authentication = certificate "witness.ourdomain.com_cert", encryption = disabled,role = witness);
GO
Backup certificate "witness.ourdomain.com_cert" to file = 'd:\cert\witness.ourdomain.com_cert.cer';
GO
-- PRINCIPAL again
create login "server2.ourdomain.com_login" with PASSWORD = 'mypassword';
GO
create user "server2.ourdomain.com_user" from login "server2.ourdomain.com_login";
GO
select * from sys.certificates
Create certificate "server2.ourdomain.com_cert"
Authorization "server2.ourdomain.com_user"
From file = 'f:\cert\server2.ourdomain.com_cert.cer';
GO
Grant CONNECT ON Endpoint::endpoint_mirroring to [server2.ourdomain.com_login];
GO
------
create login "witness.ourdomain.com_login" with PASSWORD = 'mypassword';
GO
create user "witness.ourdomain.com_user" from login "witness.ourdomain.com_login";
GO
Create certificate "witness.ourdomain.com_cert"
Authorization "witness.ourdomain.com_user"
From file = 'f:\cert\witness.ourdomain.com_cert.cer';
GO
Grant CONNECT ON Endpoint::endpoint_mirroring to [witness.ourdomain.com_login];
GO
-- MIRROR again
create login "server1.ourdomain.com_login" with PASSWORD = 'mypassword';
GO
create user "server1.ourdomain.com_user" from login "server1.ourdomain.com_login";
GO
Create certificate "server1.ourdomain.com_cert"
Authorization "server1.ourdomain.com_user"
From file = 'f:\cert\server1.ourdomain.com_cert.cer';
GO
Grant CONNECT ON Endpoint::Endpoint_mirroring to [server1.ourdomain.com_login];
GO
-------
create login "witness.ourdomain.com_login" with PASSWORD = 'mypassword';
GO
create user "witness.ourdomain.com_user" from login "witness.ourdomain.com_login";
GO
Create certificate "witness.ourdomain.com_cert"
Authorization "witness.ourdomain.com_user"
From file = 'f:\cert\witness.ourdomain.com_cert.cer';
GO
Grant CONNECT ON Endpoint::Endpoint_mirroring to [witness.ourdomain.com_login];
GO
-- WITNESS again
create login "server1.ourdomain.com_login" with PASSWORD = 'mypassword';
GO
create user "server1.ourdomain.com_user" from login "server1.ourdomain.com_login";
GO
Create certificate "server1.ourdomain.com_cert"
Authorization "server1.ourdomain.com_user"
From file = 'd:\cert\server1.ourdomain.com_cert.cer';
GO
Grant CONNECT ON Endpoint::Endpoint_mirroring to [server1.ourdomain.com_login];
GO
-------
create login "server2.ourdomain.com_login" with PASSWORD = 'mypassword';
GO
create user "server2.ourdomain.com_user" from login "server2.ourdomain.com_login";
GO
Create certificate "server2.ourdomain.com_cert"
Authorization "server2.ourdomain.com_user"
From file = 'd:\cert\server2.ourdomain.com_cert.cer';
GO
Grant CONNECT ON Endpoint::endpoint_mirroring to [server2.ourdomain.com_login];
GO
-- MIRROR again
alter database MyDBName set partner OFF
alter database MyDBName set partner = 'TCP://server1.ourdomain.com:5022';
GO
-- PRINCIPAL again
alter database MyDBName set partner OFF
alter database MyDBName set partner = 'TCP://server2.ourdomain.com:5022';
GO
alter database MyDBName set witness OFF
alter database MyDBName set witness = 'TCP://witness.ourdomain.com:5022';
GO
Edit 2: As requested by Remus, I have attached a profiler to my three server instances while trying to add the witness. I looked for :
Database Mirroring State Change
Broker:Connection Event
I could not monitor "Audit Database Mirroring Login" since I could not find this in the "Events List" in the profiler. It's not in the "Security Audit" section, is it?
Anyway, I could not monitor any such events on the witness or the mirror. I tried, but there were simply no events. There were some of these events on the principal:
Database Mirroring Connection 32 2011-12-09 20:04:07.983 1 39796 2 - Connected c6b6054d-56c0-4589-922a-29a40fdd9d96 1 0X01 tcp://<MyWitnessIP>:5022 principal.mytopleveldomain.com,3809
Audit Database Mirroring Login 30 2011-12-09 20:04:08.133 1 39797 1 - Login Success 1 0X01 tcp://<MyWitnessIP>:5022 principal.mytopleveldomain.com,3809 1 witness.mytopleveldomain.com_login CERTIFICATE Microsoft Unified Security Protocol Provider Initiator
Database Mirroring State Change DBM: Synchronized Principal without Witness -> DBM: Synchronizing Principal 27 2011-12-09 20:04:27.980 9 39798 2 1 0X01 principal.mytopleveldomain.com,3809 Zeiterfassung-Staging 0 13
Database Mirroring State Change DBM: Synchronizing Principal -> DBM: Synchronized Principal without Witness 27 2011-12-09 20:04:28.237 9 39799 13 1 0X01 principal.mytopleveldomain.com,3809 Zeiterfassung-Staging 0 2
Database Mirroring Connection An error occurred while receiving data: '64(failed to retrieve text for this error. Reason: 15105)'. 30 2011-12-09 20:05:42.530 1 39803 4 - Closing c6b6054d-56c0-4589-922a-29a40fdd9d96 1 0X01 tcp://<MyWitnessIP>:5022 principal.mytopleveldomain.com,3809
Database Mirroring Connection 30 2011-12-09 20:05:42.533 1 39804 5 - Closed c6b6054d-56c0-4589-922a-29a40fdd9d96 1 0X01 tcp://<MyWitnessIP>:5022 principal.mytopleveldomain.com,3809
Database Mirroring Connection 32 2011-12-09 20:04:07.983 1 39796 2 - Connected c6b6054d-56c0-4589-922a-29a40fdd9d96 1 0X01 tcp://85.214.251.151:5022 srv1.logmytime.de,3809
Audit Database Mirroring Login 30 2011-12-09 20:04:08.133 1 39797 1 - Login Success 1 0X01 tcp://85.214.251.151:5022 srv1.logmytime.de,3809 1 wtn.logmytime.de_login CERTIFICATE Microsoft Unified Security Protocol Provider Initiator
Database Mirroring State Change DBM: Synchronized Principal without Witness -> DBM: Synchronizing Principal 27 2011-12-09 20:04:27.980 9 39798 2 1 0X01 srv1.logmytime.de,3809 Zeiterfassung-Staging 0 13
Database Mirroring State Change DBM: Synchronizing Principal -> DBM: Synchronized Principal without Witness 27 2011-12-09 20:04:28.237 9 39799 13 1 0X01 srv1.logmytime.de,3809 Zeiterfassung-Staging 0 2
Database Mirroring Connection An error occurred while receiving data: '64(failed to retrieve text for this error. Reason: 15105)'. 30 2011-12-09 20:05:42.530 1 39803 4 - Closing c6b6054d-56c0-4589-922a-29a40fdd9d96 1 0X01 tcp://85.214.251.151:5022 srv1.logmytime.de,3809
Database Mirroring Connection 30 2011-12-09 20:05:42.533 1 39804 5 - Closed c6b6054d-56c0-4589-922a-29a40fdd9d96 1 0X01 tcp://85.214.251.151:5022 srv1.logmytime.de,3809
I'll gladly mirror other events as well, but please let me know which event section I can find them in when adjusting the profiler.
Edit 3: I had another attempt at profiling the witness, this time with almost every event type there is. And I finally got some data:
Trace Start 2011-12-10 01:24:08.180
ErrorLog 2011-12-10 01:24:40.40 Logon Database Mirroring Login succeeded for user 'principal.ourdomain.com_login'. Authentication mode: CERTIFICATE. [CLIENT: <principalip>]
29 2011-12-10 01:24:40.400 1 28046 1428 1 0X01 witness.ourdomain.com,3809 master 0 sa
EventLog Database Mirroring Login succeeded for user 'principal.ourdomain.com_login'. Authentication mode: CERTIFICATE. [CLIENT: <principalip>] 29 2011-12-10 01:24:40.400 1 28046 1429 1 0X01 witness.ourdomain.com,3809 master 0 sa
Next, I did the same on the mirror, but I got only these two rather unimportant events:
ErrorLog 2011-12-10 01:38:02.14 spid29s Database mirroring is inactive for database 'DatabaseName'. This is an informational message only. No user action is required.
sa 29 2011-12-10 01:38:02.143
EventLog Database mirroring is inactive for database 'DatabaseName'. This is an informational message only. No user action is required. sa 29 2011-12-10 01:38:02.143 0XA20500000A0000000F000000570049004E003600360036004800520054004B003700540032004800000000000000
ErrorLog 2011-12-10 01:38:22.40 spid29s Database mirroring is active with database 'DatabaseName' as the mirror copy. This is an informational message only. No user action is required.
sa 29 2011-12-10 01:38:22.407
EventLog Database mirroring is active with database 'DatabaseName' as the mirror copy. This is an informational message only. No user action is required. sa 29 2011-12-10 01:38:22.407 0XA10500000A0000000F000000570049004E003600360036004800520054004B003700540032004800000000000000
I still don't see any information on why adding the witness fails though.
If I backup my SQL Server 2008 R2 database with the following command
set @BackupFileName = N'C:\backup\Production-db.BAK' BACKUP DATABASE
[Production-db] TO DISK = @BackupFileName
and run the command twice, the backup file grows to twice the current database size. With every new run, additional data is appended.
How can I create a full backup without appending, but by replacing the previous backup file?
Thanks,
Adrian
I have three remote dedicated web servers at different webhosts. Adding them to a common domain would make a lot of administration tasks much easier. Since two of the servers are running Windows 2008 R2 Standard, I thought about promoting them to Domain Controllers in order to set up the windows domain. There's another thread at Serverfault that recommends this.
At the same time I've read a lot of times on different websites that this is not a good idea because an domain controller should always be behind a firewall LAN. But I can't set up something like this because I don't have a LAN with a static IP accessible from the internet. In fact I don't even have a windows server in my LAN.
What I have not found out is why exposing a DC to the Internet would be bad idea.
The only risk I can see is that if someone penetrates one of my webservers, it should be much easier to penetrate the others as well. But as far as I can see that's the worst case scenario since I am only going my web servers to that domain, not any computers from my local network.
Is this the only downside or does it also make it easier to penetrate one of my web servers in the first place?
Edit: What if I added a firewall rule to the DC so that incoming connections to the AD Server are only accepted if originating from the other two webservers? I mean a setup similar to the one described at http://support.microsoft.com/kb/555381/en-us but with additional ip-based rules to ensure that the DC is only reachable for the other webservers in my domain on the relevant ports.
I have two dedicated with Windows 2008 R2 servers which I am using for Web hosting. One Server A is a domain controller, Server B should simply be added to the domain controlled by Server A.
So I RDP'd into Server B and changed the system settings so that Server B is part of that domain. I entered my domain admin credentials, was welcomed to the domain and asked to reboot the server. So far everything seemed to work smoothly
After rebooting, I could not open an RDP connection to Server B anymore:
Remote Desktop can’t connect to the remote computer for one of these reasons:
1) Remote access to the server is not enabled 2) The remote computer is turned off 3) The remote computer is not available on the network
Make sure the remote computer is turned on and connected to the network, and that remote access is enabled.
I restored an older backup of Server B and switched off the firewall before adding the server to my domain. But the problem reoccurred just the same.
What could be the reason for this? The domain is brandnew and I did not change any of the default settings. Could this be some kind of domain-wide default policy that shuts down RDP on any domain clients? Or perhaps it has to do with the fact that Server B is virtual?
Thanks for your help,
Adrian
I am trying to implement automatic failover for an ASP.NET MVC website running on Windows 2008 R2 Web Edition / SQL Server 2008 R2 Web Edition. I know that this is not supported out of the box, but I have to make do with the software licenses which are currently at my disposal.
By automatic failover I mean that in event of desaster the secondary server should kick in with all data from the primary server's database. If that's not an option, I'm also happy with "all data less whatever has been written to DB during the last 5 minutes".
I'm happy to do the switch back to the primary server if necessary.
Here's what I've come up with so far:
Setup log shipping from the primary server's DB to the secondary server with a very small time interval (5 minutes). The DB is not too big (<50 MB) and there are few writes, so hopefully this won't have a big performance impact. I'd prefer mirroring, but that is not supported by SQL Server Web Edition
Always deploy the web site to both servers
Use DnsMadeEasy (dnsmadeeasy.com) to monitor the primary server and dynamically switch to secondary if primary goes down
Run a service task on secondary that monitors the dns entry every minute. If it points to secondary, then try to trigger one more log shipping run (in case the primary web server is down, but the primary DB is still running). Last but not least deactivate log shipping.
What do you think? Is there any easier way to do this (short of using a different DB or a cloud solution)?
Thanks,
Adrian
My webhost offers two different types of high availability options for dedicated servers:
Redundant hard disks (RAID1)
Redundant hard disks (RAID1) plus redundant power supply
How common is a power supply failure in comparison to hard disk failure? I know it's not possible to know the exact figures without knowing the exact hardware, but ballpark figures are good enough for me at the moment.
Thanks,
Adrian
Are there any compelling reasons to protect a dedicated server (Windows 2008 R2 in my case) with a hardware firewall? What security concerns would a hardware firewall cover better than the built-in software firwall?
Thanks,
Adrian
Edit: To clarify: I am referring to a server running an SaaS website run by a Micro-ISV that are used by clients on a regular basis. I am not referring to a multi-million business.
2nd Edit:: Server load is not an issue in my case. The server is never running at more than 20% CPU or more than 50% memory load. Nor is centralized administration - there is only one windows server.
We are developing a SaaS website application that lets users send invoices to their clients. Ideally, these e-mails should appear to be originating from our customers, so the sender e-mail address domain will not match the reverse IP entry for our server. In effect we would be forging their e-mail address, but of course with their consent.
Will that result in a higher probability of being marked as a spammer / their e-mails being marked as spam?
If yes, how bad is the penalty?
And what about people who have an e-mail address originating form an SPF-enabled domain? I guess it should be the majority of the big e-mail providers.
After rebooting my server Windows 2008 R2 server, I can't log into the remote desktop anymore. When I try to connect, the remote desktop zooms through different status messages, the last of them being "Configuring remote session" and then reverts to the initial Connection dialog again without giving me any error message.
The server is seems to be up, since it's still deliverying web pages. Also, it does seem to be accepting my credentials.
Is there any way to see why the connection fails? I've browsed through my system's even logs, but could not find anything related to remote desktop. Perhaps there's some hidden troubleshooting mode?
Thanks,
Adrian
Edit: In the meantime the server has come back online. I'm not sure if it did so on it's own or if tech support did because I have not heard from them so far, but the problem is solved for the moment. It's a bit disappointing not to know the cause of thep problem though.
I'm looking for an inexpensive way of backing up my Windows 2008 R2 dedicated server to an FTP server.
To be any useful, the software should also be able to restore the server by using a bootable CD and the backup set stored on the FTP server. So Windows server backup seems to be out of the question.
Can anyone recommend any suitable products? Preferably some you have actually tried yourself?
Thanks,
Adrian
Edit: Just to clarify, by inexpensive I mean something that costs 250 EUR or less...
After a clean re-installation of my Windows 7 system, I can't get IIS 7 to properly deliver any static content. Dynmic content (ASPX pages and content served by ASP.NET MVC controllers) works fine, but static files such as CSS, Javascript and Images give me a 200 OK status code and a Content-Length of 0.
The problem occurs with all web sites on my server, even a brandnew ASP:NET MVC template project with no changes. It also occurs with both Firefox and IE 8.
What could possibly be the problem?
Note that I also installed the latest Windows Azure SDK, perhaps that messed up some settings. But I don't know how to proceed with for troubleshooting this.
I have an ASP.NET MVC app which offers wildcard domains to my users to personalize their login urls.
I'd like to host this on Windows Azure. But is it possible to keep the wildcard domains?
I've already found a blog article showing how to do this with CNAME aliases, but that does not seem to work with wildcard subdomains.
Is there some other way? Preferably one that does not require a redirection for each and every request to the server?
Also, what about the root domain (mydomain.com)?
Thanks,
Adrian