IT_User's questions

So we have a non-standard setup that appears to be supported by Microsoft. Pretty much a Domain controller not hosting DNS (Using another Domains DNS server).

Delving into creating all of the records required and so far I have created the forward zone and various records I need.

When attempting to join Windows clients to this new domain, they fail stating the following record is missing:

_ldap._tcp.dc._msdcs.domain.one

So far I have only been able to create a _ldap._tcp._msdcs.domain.one record. I am unable to find a way to create the dc, domains, gc, or pdc folders that host the srv records in them giving me the full path required.

Any thoughts on how to get these sub folders created so my lookups work? Thank you.

So I have a need to expand a partition (/tmp) on a system and not understanding exactly how to proceed with this (I did not initially set the partitions up).

The following commands show:

fdisk -l
Disk /dev/sda: 4798.6 GB, 4798552211456 bytes, 9372172288 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk label type: gpt

#         Start          End    Size  Type            Name
1         2048       411647    200M  EFI System      EFI System Partition
2       411648      1435647    500M  Microsoft basic
3      1435648    395407359  187.9G  Microsoft basic
4    395407360    446607359   24.4G  Microsoft basic
5    446607360    497807359   24.4G  Microsoft basic
6    497807360    549007359   24.4G  Microsoft basic
7    549007360    569487359    9.8G  Microsoft basic
8    569487360    585871359    7.8G  Linux swap
9    585871360   6585871360    2.8T  Linux filesyste

The various partitions I have created are:

/dev/sda3 on / type xfs (rw,relatime,attr2,inode64,noquota)
/dev/sda4 on /var type xfs (rw,relatime,attr2,inode64,noquota)
/dev/sda9 on /home type ext4 (rw,relatime,data=ordered)
/dev/sda7 on /tmp type xfs (rw,relatime,attr2,inode64,noquota)
/dev/sda2 on /boot type xfs (rw,relatime,attr2,inode64,noquota)
/dev/sda1 on /boot/efi type vfat (rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=ascii,shortname=winnt,errors=remount-ro)
/dev/sda5 on /var/log type xfs     (rw,relatime,attr2,inode64,noquota)
/dev/sda6 on /var/log/audit type xfs (rw,relatime,attr2,inode64,noquota)

I see the following sizes allocated:

Filesystem   Size  Used Avail Use% Mounted on
/dev/sda3    188G  123G   66G  66% /
/dev/sda4    25G  3.8G   21G  16% /var
/dev/sda9    2.8T  224G  2.4T   9% /home
/dev/sda7    9.8G   46M  9.8G   1% /tmp
/dev/sda2    497M  161M  337M  33% /boot
/dev/sda1    200M  9.8M  191M   5% /boot/efi
/dev/sda5    25G  151M   25G   1% /var/log
/dev/sda6    25G   71M   25G   1% /var/log/audit

From what I can see, /dev/sda8 must have been deleting and recreated from an XFS to EXT4 partition.

I need to expand /dev/sda7 to have more space and from a quick tally, /dev/sda is roughly 5TB and we are only using a bit over 3TB for /dev/sda1 --> /dev/sda9. Leads me to believe I have 1-2TB left sitting on /dev/sda. I need to grow this without losing data and preferably without downtime.

I "think" I will need to create another partition (/dev/sda10) and assign this with the desired space. From there I would run "mkfs -t ext4 /dev/sda10" to assign it a filesystem. Then update /etc/fstab to point /dev/sda10 to /tmp (maybe mount /dev/sda10 first and copy all of /tmp over?).

Am I on the correct path for this? Thanks

I have a terminal server that is windows 2016. When I open sound in the botton right, it states that there are no devices that support sound (device manager doesn't show anything for sound either).

A few posts from close to 10 years ago discussed a Microsoft RDP Audio driver but I have been unable to locate this.

Are there any options to allow sound over the RDP connection without an actual audio card installed on the server? Something like a virtual sound driver of sorts?

I have found Scream but that sends the audio out over a multicast stream. I need to be able to connect to the host over RDP and hear sound. Any solutions for this problem or go buy an audio card? Thanks!

I initially had roaming profiles implemented but it turned into a massive headache of constant issues and sync failures. Decided to remove roaming profiles and remove the roaming location from each user in AD, then setup a GP to force local profiles on the hosts. This works for new users and existing users show as "local/local" when looking at user profiles in System & Security --> System --> Advanced --> User Profiles. .

When I login and type "set" into a CMD window though, it shows APPDATA as still pointing to the NFS/SMB roaming location (even though the user profile reports as a local profile).

I have verified nothing is setup in AD (User properties --> Profile --> Profile Path) is empty.

I created a GPO at the top level where I set “Only allow local user profiles” and “Prevent Roaming Profile Changes from propagating to the server” to enabled.

Users are able to login and navigate to Control Panel --> System & Security --> System --> Advanced Settings --> User Profiles. The account I login with shows Type and status of "local".

I ran gpresult /H and searched through the policies for anything "Roaming" and the only things that showed up were "Only allow local user profiles” and “Prevent Roaming Profile Changes from propagating to the server” which I implemented above to disable these roaming profiles.

Creating a new user and logging in doesn't automatically setup the user with a roaming profile (ie APPDATA point to C:\Users\etc).

How do I get the profiles to point APPDATA back to local or what could be stopping the profiles from returning back to normal?

I have various windows servers all joined to a domain controller. I have the following setup and RDP enabled:

Server A = Windows 2016
Server B = Windows 10

Server-A can RDP to Server B. Server-B cannot RDP to server A.

When I attempt a connection from server B to server A, I receive an error stating:

An authentication error has occurred. 
The function requested is not supported.

Remote Computer: 192.168.192.192
This could be due to CredSSP encryption oracle remediation. For more info... 

I went ahead and ran through instructions located :https://docs.microsoft.com/en-us/troubleshoot/azure/virtual-machines/credssp-encryption-oracle-remediation

but I am not seeing those registry values on my system (or it states Not Configured).

Server A = No option of Encryption Oracle Remediation found. 
Server B = Encryption Oracle Remediation - Not Configured

I cleared all logs from server A and attempted to log into Server-A from Server-B using a random username. This generated the failure shown above. I then logged into Server-A and checked event viewer but did not see any events containing the random user I had created.

Any thoughts on where to look next or what the issue might be? Thanks!

I have a storage system that is broken for file storage. The block storage components still work and I am able to create a pool/lun and attach to a linux host.

I created a multi-TB LUN and have it connected to a linux host automatically during reboots

/etc/fstab looks like

 /dev/sdc  /opt/exports/iscsi_drive ext4 _netdev 0 0

From here I am planning to configure NFS to export the /opt/exports/iscsi_drive folder so other systems can attach this extra space.

Outside of network slowdowns (copying to nfs server which then writes it back via iscsi to the storage unit...not the fastest solution), is this an appropriate setup?

Working to tie a server into ldap (active directory) and been struggling to get a simple bind working. The commands I have tried are:

ldapsearch -x -H ldap://192.168.10.10 -b "dc=example,dc=domain,dc=com" -D "cn=bind_user,dc=example,dc=domain,dc=com"-W
ldapsearch -x -H ldap://192.168.10.10 -b "dc=example,dc=domain,dc=com" -D "cn=bind_user,ou=Users,dc=example,dc=domain,dc=com" -W
ldapsearch -x -H ldap://192.168.10.10 -b "dc=example,dc=domain,dc=com" -D "cn=bind_user,cn=Users,dc=example,dc=domain,dc=com" -W

My LDAP server is active directory (windows 2016). My domain is example.domain.com. I do not believe I have anything special in my OU structure. Users live under the "Users" area like normal. Port 389 is opened via the firewall. Anonymous bind is blocked by default

Thoughts on why this simple bind would not be working? I have tried probably 20-ish flavors of the above with no luck.

The error I recieve is:

Enter LDAP Password:
ldap_bind: Invalid credentials (49)
    additional info: 80090308: LdapErr: DSID-0C09044E, comment: AcceptSecurityContext error, 
data 52e, v2580

Error tells me it is a bad credential or DN but can't see/comprehend what may be off. Thank you!

Have numerous different servers (primarily Dell) that we are installing through pxeboot. After the OS is installed the first time, the UEFI boot sequence is automatically changed to allow the OS to load as the first boot option.

This works fine for regular people that want to build a single host one time, but in lab environments where things are continually rebuilt, this causes a large sore. Is there anyway to disable the OS install from changing boot order in UEFI after an install.

This article talks more regarding it https://arstechnica.com/civis/viewtopic.php?f=21&t=1474353 and it is discussed that it is potetnially the uefi specification but no affirmative answer on this.

Is there a way to not allow the UEFI Boot Sequence to be modified after installing an OS?

We currently have an AD server that we are using as a time source.

Our AD server is setup to host time locally and the windows domain clients sync up to this machine fine. We have the firewall disabled entirely on the hosts and there are no firewalls in between (all machines are on the same lan).

The ntp.conf looks like:

driftfile /var/lib/ntp/drift
restrict default
restrict 127.0.0.1
restrict ::1
server 192.168.1.10 iburst prefer
includefile /etc/ntp/crypto/pw
keys /etc/ntp/keys
disable monitor
logfile /var/log/ntpd.log

I can stop the ntpd service and run:

ntpdate 192.168.1.10
16 Sep 15:12:18 ntpdate[297583]: adjust time server 192.168.1.10 offset 0.188928 sec

ntpdate -d 192.168.1.10
Looking for host 192.168.1.10 and service ntp
host found : 192.168.1.10
transmit(192.168.1.10)
receive(192.168.1.10)
transmit(192.168.1.10)
receive(192.168.1.10)
transmit(192.168.1.10)
receive(192.168.1.10)
transmit(192.168.1.10)
receive(192.168.1.10)
server 192.168.1.10, port 123
stratum 1, precision -23, leap 00, trust 000
refid [LOCL], delay 0.02579, dispersion 0.00081
transmitted 4, in filter 4
reference time:    e4eca422.d31c6b70  Wed, Sep 15 2021 16:56:02.824
originate timestamp: e4edde44.131c82ed  Thu, Sep 16 2021 15:16:20.074
transmit timestamp:  e4edde43.fbf54378  Thu, Sep 16 2021 15:16:19.984
filter delay:  0.02589  0.02580  0.02579  0.02582
         0.00000  0.00000  0.00000  0.00000
filter offset: 0.092817 0.091966 0.091143 0.090334
         0.000000 0.000000 0.000000 0.000000
delay 0.02579, dispersion 0.00081
offset 0.091143
16 Sep 15:16:19 ntpdate[298357]: adjust time server 192.168.1.10 offset 0.091143 sec

.And the system syncs without issues. I proceed to start ntpd service and monitor using ntpq -p

The offset continues to grow every poll. I run ntpstat and it continues to report unsynchronized.

ntpstat
unsynchronised
 time server re-starting
  polling server every 8 s

Can linux hosts running ntp not connect to AD in this fashion? I read through Microsoft - how windows time works but failed to get a grasp on how non-windows domain systems connecting to an AD time server using NTP work with this.

We have an NTP server that was setup with NTP keys. https://docs.ntpsec.org/latest/ntp_keys.html

We are trying to configure our domain controllers to use this NTP server as the authoritative time source. We can talk to the NTP server without keys fine but as soon as we enable keys on the NTP side, communication fails. Where can we specify a keys file/strings to allow Windows to talk to our NTP server using NTP keys? Thank you!

Upon setting up a new Dell Poweredge system with RAID 10, I see in System Setup --> Virtual Disk Management the Virtual Disk I created is performing a background initialization. From my understanding, this is setting up the various parity/mirror information on the disks and not modifying any real data.

During this background initialization, I can upgrade BIOS, install an OS, etc without issues. System reboots and keeps initializing. Am I able to power off this system and resume next week and initialization will just continue where it left off?

So I have a smb share setup using unisphere. I can login to my windows machine on the domain and my ad account. I can access the share but when creating a file on the share it shows under security that Everyone has full permissions. Nothing about my user account having permissions.

Selecting advanced shows the owner as administrators.

Is there something wrong with my configuration or what would be the reasons my account wouldn't show up under security and everyone would instead? I can edit permissions and add my user if I want.

Thanks.

So I downlaoded the latest BIOS for a Dell PowerEdge server. Attempting to update using the EXE fails. The error from the GUI states to restart the server. Restarted but still failed.

I found the log file and see that it states:

<< PACKAGE LOG >>Y entered; update was forced by user
<< PACKAGE LOG >>Executing update...
<< PACKAGE LOG >>Device does not impact TPM measurements.
FQDD Parameters are : 

Error finding file:  update.xml

<< PACKAGE LOG >>The update failed to complete; you must restart your system and try again.
<< PACKAGE LOG >>==============================> Update Result <==========================
Update was not applied

I am running the upgrade as Administrator. I have tried a couple different exe for this hardware from the Dell website with no luck. I have also tried to disable virtualization technology from the BIOS as a dell article stated. Any thoughts on what is going on?

Ran into an interesting issue. So we have a 3-node vsan cluster (all three nodes contribute computer and storage). We can call these three nodes esxi01, esxi02, and esxi03. Users reported errors and upon investigating the following was noticed:

1. vCenter was unavailable
2. Host esxi01 was completely hung
3. Was able to login to esx02/03 directly and chunk of the VM's...our vCenter VM was showing as invalid. An attempt to unregister and register now shows the name of the vm (vcenter-server).
4. Shutdown esxi01/02/03 and started the servers back up.

At this point esxi02 and 03 are formed a vsan cluster and esxi01 is in its own cluster (esxcli vsan cluster get). I attempted to leave the cluster on esxi01 (esxcli vsan cluster leave) and rejoin (esxcli vsan cluster join -u <uuid of Sub-Cluster UUID: from esxi02/03 cluster). The command does not fail but when running esxcli vsan cluster get on esxi01, it shows itself as the sub-cluster master with only itself in the cluster.

I have verified that there is not a firewall in between blocking it, all nics are online, the vmk for vsan traffic can communicate between all three hosts, and ran a tcpdump on esxi01 and can see port 12321 traffic.

Any thought on what could be causing this?

I am attempting to create a public/private key pair using ssh-keygen. I need the key to be in PKCS1 format so that it states "BEING RSA PRIVATE KEY". No matter what I try it appears to only create in PKCS8 format. Any thoughts on what the issue could be?

I am running the following command:

 ssh-keygen -m PEM -t rsa -b 2048

From my understanding specifying the -m PEM format should create it in PKCS1 format. I am expecting the header of the key to state

-----BEGIN RSA PRIVATE KEY-----

but instead it states

-----BEGIN PRIVATE KEY-----

This leads me to believe it is in PKCS8 format. Any thoughts on how to fix this? I am using openssh version 7.4p1.

So I have a vsan cluster, 4 esxi hosts all contributing to vsan as well as compute. Vcenter lives in esxi01. Esxi01 is not responding and I cannot open the web gui.

I can still ping every vm and ssh into most. I believe esxi01 is out of file descriptors.

Is it best to ssh into all vms in the environment (linux vms) and shut them down that way since vcenter isnt available or should I reboot esxi01 with everything online so vcenter is semi aware of everything's last state?

Thank you. Wasnt finding much online for this scenario.

Good morning/afternoon/evening all:

I am having an issue with a single Virtual machine when it comes to exporting an OVA/OVF. I recieve a "File not found" error that appears to be pointing in the wrong directory...My process is

• Clone Live virtual machine
• Export OVA/OVF of the Cloned Machine

I have had no issue cloning 8 different Virtual Machines this way and exporting the data. I am only experiencing this issue with a single VM and I cannot figure out where the issue lies. Exact steps are below with work-arounds that I have tried.

Virtual machine name = RHEL_TEST_SERVER

Cloned VM Name = tmp_test_server

• Clone virtual Machine
• export OVF/OVA of the cloned VM

• I receive an error immediately after I hit "OK" on the Export OVF Template screen. The error states:

  File ds:///vmfs/volumes/5876b9586-hf756475-c8193846734/RHEL_TEST_SERVER/[] was not found

It appears that when I Clone the OVA, it is setting ide1 (inside of tmp_test_server.vmx) to

ide1:0.fileName = ":///vmfs/volumes/5876b9586-hf756475-c8193846734/RHEL_TEST_SERVER/[]"

which I believe to be incorrect. It should be pointing to itself? I ssh into the ESXI/Linux server and navigate to that specific directory.

Even after I modify this file to point to itself, I still receive the same error of "File not found" (exact error as above). I cannot figure out why this is not working for this single Virtual Machine clone.

To answer the obvious question

• yes I have deleted and re-cloned the virtual machine countless times (same error everytime)

Linux environment completely, and I have full access to see all files. If someone could please enlighten me on what the possible issue is and how I can fix it, it would be greatly appreciated. Thank you.

I currently have exported an OVA of certain systems so I have a complete backup. After certain changes were made ( additional users added to LDAP for example), I created a snapshot. Would I be able to copy this snapshot to the location where my OVA is? So that I may import an OVA, and then revert to the snapshot? I am having a hard time finding a straight forward answer online or via VMwares website. Could I take the OVA, and whatever the latest snapshot of, copy to separate storage location, and then import the OVA/revert to snapshot?

I am on an entire Linux backbone and will be migrating copies/backups via command-line (bash). Not sure if that helps but gives an idea of my environment. Thank you.

Good afternoon,

When having to restore a virtual machine from a backed-up OVA file, should you select the source as the actual file itself or should you create a copy of the backed up file before importing? I am not sure if anything during the restoration process could potentially affect the OVA file itself (loss of network connection, cancelled import, etc.) or if the restoration process is simply reading from the OVA file. Ex.

OVA Location = /backup/mainServer.ova

Should you import an OVA directly from /backup/mainServer.ova or should you...

cp /backup/mainServer.ova /tmp/mainServer.ova

and THEN proceed to import the OVA from /tmp/mainServer.ova

From my understanding an OVA is made up of the files that are needed individually from VM/ESXI although it is not apparent if while importing the software is able to merely read the file and pull the necessary information or if the file is modified/opened or accessed in in any way that could have a possibility of corrupting the file based off errors or unexpected actions during the import process itself.

I have checked the file during uploading and I cannot see a way to tell if the file is modified/access or just read from. Hash sums are the same before/after so nothing is "modified". But that does not mean that the file isn't accessed in a way that could corrupt it from the actual import process.