Kieran Walsh's questions

We are using SCCM 2012 SP1 CU5 (5.0.7804.1600) and on many of our Windows 7 clients updates are not installing. When I run "Machine Policy Retrieval & Evaluation Cycle" the C:\Windows\CCM\Logs\WUAHandler.log runs as expected I believe - the last few entries are:

Search Criteria is (DeploymentAction=* AND Type='Software') OR (DeploymentAction=* AND Type='Driver')
Async searching of updates using WUAgent started.
Async searching completed.
Successfully completed scan.

Then I run the "Software Updates Scan Cycle" and the C:\Windows\WindowsUpdate.log file also completes successfully:

2014-12-04  09:24:41:086    1036    3458    Report  CWERReporter finishing event handling. (00000000)
2014-12-04  09:24:41:296    2888    309c    COMAPI  - Updates found = 444
2014-12-04  09:24:41:296 2888   309c    COMAPI  ---------
2014-12-04  09:24:41:296    2888    309c    COMAPI  -- END -- COMAPI: Search [ClientId = CcmExec]
2014-12-04  09:24:41:296    2888    309c    COMAPI  -------------
2014-12-04  09:24:46:039    1036    3458    Report  CWERReporter finishing event handling. (00000000)

When the "Software Updates Deployment Evaluation Cycle" is run there are errors in C:\Windows\CCM\Logs \UpdatesDeployment.log:

Detection job ({47813475-0491-46E5-8CD1-B84B806B9844}) started for assignment ({a3c79c96-1ed1-456d-98e7-7b8a2b381775})
Started evaluation for assignment ({a3c79c96-1ed1-456d-98e7-7b8a2b381775})
Evaluation initiated for (12) assignments.
Job error (0x87d00244) received for assignment ({a3c79c96-1ed1-456d-98e7-7b8a2b381775}) action
Updates will not be made available

These errors show for each job. Any idea how to resolve it? Thanks

We have a site where one of our team of techies installed SQL Server 2012. They forgot to add our administrators group as sysadmins so only they can access SQL - everyone else gets "Access Denied"

How can we find out who installed SQL, or who is a SQL Administrator so we can ask them to correct their fault?

I have domain admin rights to the server.

I've got a DPM 2012 SP1 installation running on Server 2012 with a locally installed SQL Server 2008 R2 10.50.4000.0. DPM was an upgrade from DPM 2012 RTM, via an intermediary upgrade to DPM 2012 CU3, but since the upgrade I can't open the console. I get this message: "Unable to connect to DPMNAME.domain.tld (ID: 948) Verify that the DPM service is running on this computer"

There is a "more information" link (http://technet.microsoft.com/en-us/library/ee958049.aspx), which as usual goes to a Microsoft "page cannot be found" URL :)

I've researched this issue quite a bit and I've followed the Microsoft page http://technet.microsoft.com/en-us/library/ff934577.aspx which asks you to make sure that these services are running:

• DPM (MSDPM)
• DPM Access Manager Service (DPMAMService)
• DPM Writer (DpmWriter)
• DPMLA (DPM Library Agent)
• DPMRA (DPM Replication Agent)

I can't get the service DPMRA to start though:

"Error 1053: the service did not respond to the start or control request in a timely fashion"

If I look in the system event there is a 7009 event saying "A timeout was reached (30000 milliseconds) while waiting for the DPMRA service to connect." but that is inaccurate - the error happens instantly and certainly not after 30 seconds.

Other event errors: Event 7023:

“The DPM service terminated with the following error: 
    %%4294967295”

Also Event 10010:

“The server {27F60283-447F-4D5F-AA84-F45D09BD06EF} did not register with DCOM within the required timeout.”

In Application there is a 3750 event but it doesn’t have all the information

“The description for Event ID 3750 from source MSDPM cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.”

It does have this text which indicates that the CU3 update didn’t complete properly though I don’t remember seeing any errors after install:

“Version 4.0.1908.0 of the DPM database, and version 4.1.3313.0 of the DPM application are not compatible.”

Any ideas about what I should try to resolve this?

Thanks

I know how to set an authoritative time server in Server 2008 R2. That's not what this question is. I want to know how I can change the time on a network where the PDC (and therefore everything) is a month out of date?

I know that a 5 minute difference in time between clients and the domain prevents logons, so just changing the time on the PDC will break everything.

What is the best way to fix this?

We have the following domain setup:

• Domain Function level: Server 2008
• 5 Server 2003 terminal servers
• 5 Server 2008 R1 terminal servers
• 150 staff who use mandatory profiles on their PCs
• Those staff do not have a terminal server profile path in AD as we found it meant for quicker logons.

Our issue is that when the staff log onto the Server 2008 terminal servers they are automatically logged off after just over 5 minutes.

In the security log of the terminal server is this event:

    User initiated logoff:

Subject:
    Security ID:        contoso\bloggsjoe
    Account Name:       bloggsjoe
    Account Domain:     contoso
    Logon ID:       0x1c66ba

This event is generated when a logoff is initiated but the token reference count is not zero and the logon session cannot be destroyed.  No further user-initiated activity can occur.  This event can be interpreted as a logoff event.

and then 10 seconds later is this:

An account was logged off.

Subject:
    Security ID:        contoso\bloggsjoe
    Account Name:       bloggsjoe
    Account Domain:     contoso
    Logon ID:       0x1c66ba

Logon Type:         10

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.

The end user gets a message that they will be logged off in 2 minutes. There is no event recorded on the client machine (all Windows XP)

I've looked through the Terminal Services Configuration but the disconnection time is set to 2 hours and the Active Session Limit is set to "Never"

We have used terminal server mandatory profiles but that made no difference. The problem does not happen for administrators.

I wonder if any of you can help?

UPDATE1: For people asking about CALs, the DC is the terminal server licensing server and always works well. At the moment on the 2008 TS it shows as 426 CALS available for clients. They are licensed in per device" mode.

UPDATE2: There is something odd about the timings in the Terminal Services Manager. Many dates show up as the time that all computer times are worked from - 01/01/1601. Here is a screenshot as the problem user is logging on:

Larger image

When the username is resolved the time is corrected also - does that make it look like the user have been loggged on for over 400 years though?

Larger image

Have any of you seen this kind of thing before and would you know how to resolve it? I've checked with another site and the 1601 year is not the same there.

UPDATE3: Forgot to say that the logoff does not happen because of 5 minutes of inactivity - it happens no matter what the user is doing.

UPDATE4: Licensing issues. It looks like there is some kind of terminal server licensing issue - though none of the servers are giving licensing errors. The licensing server is a DC which showed plenty of valid licenses available (all Per Device) it showed a lot of temporary device CALs issued however and those could not be revoked. I completely removed the licensing role and set it up again. This left me with 500 Server 2003 and 500 Server 2008 Per Device CALs free, but only a few machines are being allocated a CAL, some are being issued temporary CALs, but most seem to be not showing up at all. There are some devices being listed as "unknown" as the machine name, so I'm sure this must be at the heart of the licensing problem - though I have no idea if this is in any way connected to my logon problems. BTW, when I click on the Terminal Server Configuration page on any terminal server they report that there are no licensing issues detected.

We've got a proper DigiCert wildcard certificate which appears to be set up properly on Exchange 2007.

The Microsoft test site https://www.testexchangeconnectivity.com/ passes without any problems as does Test-OwaConnectivity & Test-OutlookWebServices internally.

Our problem is that internal Outlook users keep getting a message asking if they'd allow Autodiscover to configure Outlook and then a popup asking for credentials. If the user ticks a box to allow the autodiscover service to configure Outlook always, they still get the popup every time they open Outlook.

Any ideas?

I'm unfamiliar with Sophos Endpoint Security and have taken over a client who is using version 9.5. The Sophos server appears to be updating without issues, but the clients are unable to receive the new updates from the server.

I'd like to know when the clients last successfully received an update but the control panel just shows "Updating: failed" and the update log (alc.log) only gives one day of logs.

Anyone got any ideas about this?

I want to be able to give a group of people permission to delete all the jobs in a print queue (specifically teachers deleting pupils print jobs)

Up until now we've just made them members of the "print operators" group, but that is not ideal and it causes problems due to the whole AdminSDHolder protected groups issue: http://support.microsoft.com/kb/318180

I've gone to AD and started the delegate control wizard there but can't see a manage documents part - only add/remove printer objects.

Anyone know how to do this? Thanks Kieran.

I need to find out if a deployment of Windows 7 to a network was done with OEM, Retail, Volume or VL (VLK) media.

I need to know which product was used in case it is what is causing some licensing problems that I'm experiencing.

Where does this information exist in the registry?

I've set up KMS on a Server 2008 R2 Datacenter machine and all looks pretty good. The proper DNS entry got added and Windows 7 clients are listed on the server. They have all stayed in the "Initial Grace Period" part though.

Is that normal, and if not how do I go about resolving it?

Thanks.

Update 20111808

So, here is part of the /dli information on the KMS server:

    License Status: Licensed

Key Management Service is enabled on this machine
    Current count: 50
    Listening on Port: 1688
    DNS publishing enabled
    KMS priority: Normal

Key Management Service cumulative requests received from clients
    Total requests received: 213
    Failed requests received: 0
    Requests with License Status Unlicensed: 0
    Requests with License Status Licensed: 2
    Requests with License Status Initial grace period: 203
    Requests with License Status License expired or Hardware out of tolerance: 0

    Requests with License Status Non-genuine grace period: 0
    Requests with License Status Notification: 8

So apparently the Current Count of 50 can never get higher as only the last 50 requests are cached. That is a good sign, but I can't find anywhere if the 203 in Initial grace period is normal and where should they eventually end up? In the "Requests with License Status Licensed:" I'd presume.

Again any information gratefully received.

Cheers.

I've got some general slight network errors on a network. As part of testing I've discovered that I can't ping the netbios name of the site.

Ping mydomain

Returns:

Ping request could not find host mydomain. Please check the name and try again.

But if I ping the FQDN there is no problem.

Any idea why that would be?

I've checked DNS and that seems to be fine. We are not using WINS - but internet searching seems to indicate that is only needed when trying to ping a NETBIOS name across different subnets - we are not doing that.

BTW, pinging the NETBIOS names of individual machines - including the DCs works fine.

We've recently upgraded from Forefront Endpoint Protection 2007 to 2010 and it now needs SCCM to deploy the clients, so we are using SCCM for the first time and struggling a little bit.

SCCM is fully installed and appears to be working. The clients are XP and have the System Center clients installed on them, but the FEP client are in "pending" - never installing.

If I look at one of the XP Clients and go to "Configuration Manager Properties" from the Control Panel then I can see that the ConfigMgr Site Codes is right and the proper management point path is there.

As this is our first attempt at a SCCM 2007 install we could be missing something really basic. How can I tell why items in "pending" are not installing?

Thanks.

We have an ISA in a school that has to pass all traffic to the local authority's proxy to get to the internet. We do that in the web chaining rule. The local authority have created a website on their LAN that the school needs to get to - i.e. between the ISA and the proxy. What we need is a bypass to the web chaining rule for one site only. The exception part in the chain doesn't seem to help us.

How would we go about doing that?

Additional info: If we put a laptop on the WAN side of the ISA and configure the proxy in IE to use the proxy but with an exclusion for the Local Authority URL then we can visit the site.

Thanks.

I'm trying to give 'send-as' permissions to one user in Exchange 2010. Here is the Powershell command I'm running:

Add-ADPermission "User1" -User "Ourdomain\User2" -Extendedrights "Send As"

Powershell returns this error:

Active Directory operation failed on DC.OurDomain.pri. This error is not retriable. Additional information: Access is denied. Active directory response: 00000005: SecErr: DSID-031521D0, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0 + CategoryInfo : WriteError: (0:Int32) [Add-ADPermission], ADOperationException + FullyQualifiedErrorId : EDBB94A3,Microsoft.Exchange.Management.RecipientTasks.AddADPermission

I've tried multiple alternatives to the Powershell command - ie. using -Identity etc., but that and the EMC wizard all return the same error.

I'm not sure if the "INSUFF_ACCESS_RIGHTS" is referring to me who is running the command or the user I'm giving the send-as rights to?

I've been following the Microsoft Technet "Manage Send As Permissions for a Mailbox" web page here: http://technet.microsoft.com/en-us/library/bb676368.aspx

So have added the two permissions you need to do this:

Organization Management

Recipient Management

But that is not helping. Any ideas?

Update

If I do the following:

• open up "AD Users & Computers" with the "Advanced Features" view
• Go to the properties of User1
• Hit "Advanced" on the Security tab
• Select "Add"
• enter in "User2" and select "Send As" Allow

That works, if I close ADUaC and open it up again and re-check those new permissions they are still there. If I return about 10 minutes later those permissions are now gone - user2 does not show up in the security permissions of user1 at all.

Don't think I've ever seen this kind of AD behaviour before.

when we look at our Exchange Server and all the mailboxes we notice that some users have green arrows pointing right over their icon. This does appear to only be on older users on our system so I just want to see if this means that the users have been migrated - or that it is saying that the mailbox exists on a different exchange server? Any ideas? Thanks.

I want to know if port 139 TCP is open from a server on one domain to another. How would I do this?

I know that I can use Telnet to test port 25 to a server with Exchange installed - but that only works because Exchange answers the telnet request - is that right?

How do you test the link if there is no program on the other end that will respond to telnet for example?

We are successfully using DPM 2010 in a number of places, but in two sites we've been struggling with getting the backups to work. Both sites are backing up about 1TB of data and both from Windows Storage Server 2008 boxes. They both constantly get errors like this:

"The replica of Volume D:\ on servername.domain.tld is not consistent with the protected data source. DPM error ID = 33123. (ID 33123)"

When we perform a consistency check, that can run for nearly two days before failing.

Anyone have experience of backing up WSS with DPM and it working without problems?

Thanks.

We've noticed a drop in internet performance recently and looking through the ISA logs today I can see that servers are dropping up to 6,000 packets a day.

I presume this is not normal - is it? If not, what can I do to fault find the problem?

Thanks for any help.