Campo's questions

My server fails to boot. The drive is not found at boot. It's a Server 2008 R2 domain controller, there is no secondary domain controller. The hard drive was not in a RAID configuration. It is a single HDD. I got it to show up on a Windows 7 Ultimate x64 desktop once and then a second time but only after many, many retries. There is some audible clicking at initial power up but once it gets running it's fine.

Is there any way to do a USB to USB clone of a hard drive?

I tried Drive Image XML but found the two new drives I got were marginally smaller (both advertised 500GB... but not surprised by this) and also when copying to a larger drive I get some errors.

Or if I can see the data I really just care about the active directory, users, and group policy. I could live without dns and dhcp and any other things. Those will be less of a headache to rebuild.

Any suggestions on how to clone the drive? I do not want to unlplug the drive or turn off the drive again.

Weird one.

I have a domain controller with Server 2008 R2. It is a hack job but is reliable.

AMD system. AM2 6000+ Asus Crosshair MB.

The server is utilizing 5 Sata ports for Hard disks of assorted size. No raid is configured. This is mostly for random storage and backup DC

When we attempted to upgrade 1 of the drives upon reboot we got a "No Operating System Detected Insert System disk and press ENTER" error. Fiddling around enough to find out the computer would only boot if the System disk and one of the storage disks (the one we removed to upgade...) were connected on boot.

What is going on here? How do I repair this issue? I would like to be able to remove that drive.

Ran BCDEDIT

I see the issue. Recomendations on the command to best resolve it. We want everything on C:.

C:\Windows\system32>bcdedit

Windows Boot Manager -------------------- identifier {bootmgr} device
partition=H: description
Windows Boot Manager locale
en-US inherit
{globalsettings} default
{current} resumeobject
{c7cb3484-5288-11e0-a6a3-b7c0d75655a0} displayorder {current} toolsdisplayorder {memdiag} timeout 30

Windows Boot Loader ------------------- identifier {current} device
partition=C: path
\Windows\system32\winload.exe description Windows Server 2008 R2 locale en-US inherit
{bootloadersettings} recoverysequence {c7cb3486-5288-11e0-a6a3-b7c0d75655a0} recoveryenabled Yes osdevice
partition=C: systemroot
\Windows resumeobject
{c7cb3484-5288-11e0-a6a3-b7c0d75655a0} nx OptOut

C:\Windows\system32>

Here is a screenshot of the situation. Drive 7 is of no concern its external did not feel the need to grab the sceenshot a second time to fit it in.

UPDATE

Boot\BCD is not on H: any ideas Here is my output

H:\Boot>xcopy /e h:\boot c:
H:\boot\memtest.exe
H:\boot\cs-CZ\bootmgr.exe.mui
H:\boot\da-DK\bootmgr.exe.mui
H:\boot\de-DE\bootmgr.exe.mui
H:\boot\el-GR\bootmgr.exe.mui
H:\boot\en-US\bootmgr.exe.mui
H:\boot\en-US\memtest.exe.mui
H:\boot\es-ES\bootmgr.exe.mui
H:\boot\fi-FI\bootmgr.exe.mui
H:\boot\Fonts\chs_boot.ttf
H:\boot\Fonts\cht_boot.ttf
H:\boot\Fonts\jpn_boot.ttf
H:\boot\Fonts\kor_boot.ttf
H:\boot\Fonts\wgl4_boot.ttf
H:\boot\fr-FR\bootmgr.exe.mui
H:\boot\hu-HU\bootmgr.exe.mui
H:\boot\it-IT\bootmgr.exe.mui
H:\boot\ja-JP\bootmgr.exe.mui
H:\boot\ko-KR\bootmgr.exe.mui
H:\boot\nb-NO\bootmgr.exe.mui
H:\boot\nl-NL\bootmgr.exe.mui
H:\boot\pl-PL\bootmgr.exe.mui
H:\boot\pt-BR\bootmgr.exe.mui
H:\boot\pt-PT\bootmgr.exe.mui
H:\boot\ru-RU\bootmgr.exe.mui
H:\boot\sv-SE\bootmgr.exe.mui
H:\boot\tr-TR\bootmgr.exe.mui
H:\boot\zh-CN\bootmgr.exe.mui
H:\boot\zh-HK\bootmgr.exe.mui
H:\boot\zh-TW\bootmgr.exe.mui
30 File(s) copied

H:\Boot>bcdedit -store C:\boot\BCD -enum all
The boot configuration data store could not be opened.
The system cannot find the file specified.

H:\Boot>dir

 Directory of H:\Boot

03/19/2011  11:28 PM    <DIR>          cs-CZ
03/19/2011  11:28 PM    <DIR>          da-DK
03/19/2011  11:28 PM    <DIR>          de-DE
03/19/2011  11:28 PM    <DIR>          el-GR
03/19/2011  11:28 PM    <DIR>          en-US
03/19/2011  11:28 PM    <DIR>          es-ES
03/19/2011  11:28 PM    <DIR>          fi-FI
03/19/2011  11:28 PM    <DIR>          Fonts
03/19/2011  11:28 PM    <DIR>          fr-FR
03/19/2011  11:28 PM    <DIR>          hu-HU
03/19/2011  11:28 PM    <DIR>          it-IT
03/19/2011  11:28 PM    <DIR>          ja-JP
03/19/2011  11:28 PM    <DIR>          ko-KR
11/20/2010  11:24 PM           485,760 memtest.exe
03/19/2011  11:28 PM    <DIR>          nb-NO
03/19/2011  11:28 PM    <DIR>          nl-NL
03/19/2011  11:28 PM    <DIR>          pl-PL
03/19/2011  11:28 PM    <DIR>          pt-BR
03/19/2011  11:28 PM    <DIR>          pt-PT
03/19/2011  11:28 PM    <DIR>          ru-RU
03/19/2011  11:28 PM    <DIR>          sv-SE
03/19/2011  11:28 PM    <DIR>          tr-TR
03/19/2011  11:28 PM    <DIR>          zh-CN
03/19/2011  11:28 PM    <DIR>          zh-HK
03/19/2011  11:28 PM    <DIR>          zh-TW
               1 File(s)        485,760 bytes
              24 Dir(s)  177,605,242,880 bytes free

I have 3 servers 1 production 1 standby and 1 just sitting there.

I want 1 to stay production and I have been working on setting up an MSSQL automatic failover cluster between the production server and the standby server. I require a witness server and an active directory.

My question is: Can I install the MSSQL witness server on a Domain Controller? If not, WHY?

This would allow me to NOT virtualize or purchase a fourth machine. Has anyone done this in a production environment?

I am in the process of transitioning to exchange 2010.

The current exchange server is as follows Server 2003 R2 Exchange 2003 SP2 Active Directory

I would like to be able to reuse the server name for so many reasons but I must format server 2003 R2 and reinstall Server 2008 R2 as a fresh instal. This server will no longer be a DC after the transition if that makes a difference.

Is it possible to keep the same server name? I can accept if that is not possible but just need a concrete answer. Some documentation on the subject is also appreciated. Info on areas I may need to clean up the old server name prior to reinstalling Server 2008 R2 is paramount.

This office runs an active directory on windows servers. Some 2003 DCs some 2008 R2 DCs

A user (The QA analyst) requested that he is able to change his time and it not be changed back after 5-10 minutes. The reason is he needs to see different time states for our website.

First off a couple issues spring to mind...

1. What happens if he forgets to change it back?

2. Will he be able to continue to use the resources of the domain if his time and date are out of sync? Exchange, shares, even to log on....?

What are some solutions to this issue I am sure this has come up many times in the past. I can see his user account or workstation computer in it's own OU with its own GPO but I am unsure where to go from there.

I take weekly backups of exchange in full. I also take complete weekly backups of the entire server.

It is a Server 2003 R2 with AD and Exchange 2003 all on one box.

One users inbox has disappeared. She has 19000+ junk items now. It is possible the inbox got mixed into the junk. Regardless it is such a huge mess she is not going to go through all of that....

I want to restore he mailbox from the backup.

I followed this MS KB http://support.microsoft.com/kb/823176 I had to use Method 3. I have a VM of Server 2003 R2 with exchange but I am having failures on the restore from NT backup. The backup log just states to check the application log.... Application log points to backup log...

Only info Is failed to restore

Only thing different is the computer name...

The only error I can find is in the Application log.

Information Store Database not found

All others just say that the backup failed.

Any assistance is greatly appreciated.

UPDATE

I have successfully proven I can restore the DB into a recovery storage group in my VM Unfortunately due to the actual account being on a different store I am unable to do the recovery... Error is The attempt to log on to the Microsoft Exchange Server computer has failed. The MAPI provider failed. Microsoft Exchange Server Information Store ID no: 8004011d-0512-00000000

Two questions

QUESTION 1 Should I repeat my steps on the production exchange server in the recover storage group? then merge into her original account? I am just concerned with doing recovery like that on the live server....

QUESTION 2 Is there any way I can extract her .PST from my recovery VM and then import into her outlook?

On the Recovery VM:

I restored the raw DB from my full backup

repaired it with ESEUTIL

then mounted in the recovery store.

Was thinking I could just repeat and mount in the main store on the VM?

Thanks for the suggestions.

I came across an AD today where the previous admin had set it up in where every AD object is in a child OU of Domain Controllers..........

DOMAINNAME.LOCAL
     Builtin
     Computers
     Domain Controllers
           Active Users
           Computers
                      Servers
                      Workstations
           DistroGroups
.....

Tabs show that the OU is a child of the previous.

1. What should I keep in mind when moving the computers back to the proper OU?

2. What should I keep in mind when moving the other objects such as users and distrobution and security groups outside of the Domain Controller OU's child OU?

I will ensure GPO are properly applied to the correct OU but I am more concerned with effects this could have with our exchange 2003 server.....

Any one who has experience restructuring a improper AD structure please let me know your experience and issues in resolving matters such as these....

I understand in theory this may be OK but this is definitely not supported from microsoft and i have never seen ANYTHING like this....

For reference I came across this article. ITWORLD AD ARTICLE

Thanks,

This environment has one 2008 DC and two 2003 R2 DCs. They also have an Exchange 2003 Server. There are about 30 user workstations as well as a DFS system, RD Gateway, VPN, to name a few core services that may be effected by this.

Not sure if this is the best way to achieve this but here is the background and the goal.

BACKGROUND We are a small business. Sometimes myself or the other person who is capable of dealing with an email outage is not available.... Usually it is as simple as restarting the old and tired out exchange box to bring it back online... this is obviously a temporary fix till I can get to the cause of the particular outage. But the idea is to limit the downtime caused by this to our call center.

GOAL: I want to setup a one time use Admin account. OR write a scrip that allows the user to simply restart the server.

Understand this users current account is limited to just a domain user not an admin of any type.

Additional Information Idea with a one time use account is the user can use it once. Log in make changes and once they are done and logged out the account is then locked out or has its password change or is disabled. Anything to stop them from using it a second time. This way there is some accountability to the user to use it only for emergencies and for its intended purpose and not as a easy way to adjust their limited account or install software among other things.

As for the script I understand that due to the limited permission on standard users this user would be unable using their current permission to do a PSSHUTDOWN.EXE on the exchange box remotely. So we would have to come up with a good method in order to allow the user to do a restart. Should be a simple VB script which is not the issue. My issue is creating some form of security allowing them to type in just maybe a password to have the process commence. Bonus points if you can include stopping of services in the script. things like I can fill in the others once I see how you implement the first one. net stop "Microsoft Exchange Information Store"

I feel the second plan seems a lot safer. This way I can just use security by obscurity. Not tell him the RDP port and not have him actually on the system but more so just using a password to activate the restart.

So assistance in this is greatly appreciated. Or alternative suggestions are always welcome.

I am getting these two error in the DNS Event log (errors at end of question). I have confirmed I do have duplicate zones. I am wondering which ones to delete. The DomainDNSZone contains all of our DNS records but it does not have the _msdcs zone.... that is in the ForestDNSZone with the duplicates that are not in use.

3 Questions. I understand the advantages of having DNS in the ForestDNSZone.

so...

1. Why is DNS using the DomainDNSZone and is that acceptable considering _msdcs... is in the ForestDNSZone?

2. If so, should I just delete the DC=1.168.192.in-addr.arpa and DC=supernova.local from the ForestDNSZone? Or should I try to get those to be the ones in use? What are those steps? I understand how to delete. That is simple but if i must move zones some info would be appreaciated there.

3. Just to confirm. from my understanding. I can delete the two duplicates in the ForestDNSZone and leave the _msdcs.supernova.local as thats required there. This will resolve the erros I see.

Just fyi when I look in those folders from the ForestDNSZone they have just 2 and 1 entries respectively. So obviously not in use compared to the others. I am pretty sure I understand the steps to complete this. But if you would like to provide that info, bonus points!

Event Type: Warning
Event Source:   DNS
Event Category: None
Event ID:   4515
Date:       1/4/2011
Time:       2:14:18 PM
User:       N/A
Computer:   STANLEY
Description:
The zone 1.168.192.in-addr.arpa was previously loaded from the directory partition DomainDnsZones.supernova.local but another copy of the zone has been found in directory partition ForestDnsZones.supernova.local. The DNS Server will ignore this new copy of the zone. Please resolve this conflict as soon as possible. 

If an administrator has moved this zone from one directory partition to another this may be a harmless transient condition. In this case, no action is necessary. The deletion of the original copy of the zone should soon replicate to this server. 

If there are two copies of this zone in two different directory partitions but this is not a transient caused by a zone move operation then one of these copies should be deleted as soon as possible to resolve this conflict. 

To change the replication scope of an application directory partition containing DNS zones and for more details on storing DNS zones in the application directory partitions, please see Help and Support.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 89 25 00 00               %..   

AND

Event Type: Warning
Event Source:   DNS
Event Category: None
Event ID:   4515
Date:       1/4/2011
Time:       2:14:18 PM
User:       N/A
Computer:   STANLEY
Description:
The zone supernova.local was previously loaded from the directory partition DomainDnsZones.supernova.local but another copy of the zone has been found in directory partition ForestDnsZones.supernova.local. The DNS Server will ignore this new copy of the zone. Please resolve this conflict as soon as possible. 

If an administrator has moved this zone from one directory partition to another this may be a harmless transient condition. In this case, no action is necessary. The deletion of the original copy of the zone should soon replicate to this server. 

If there are two copies of this zone in two different directory partitions but this is not a transient caused by a zone move operation then one of these copies should be deleted as soon as possible to resolve this conflict. 

To change the replication scope of an application directory partition containing DNS zones and for more details on storing DNS zones in the application directory partitions, please see Help and Support.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 89 25 00 00               %..    

UPDATE: Suggestions to improve this question so I can get a response would be appreciated.

UPDATE 2:

Our AD consists of 3 DCs

Server at 192.168.1.100 is our Exchange and a DC(unfortunately) It is also our fileserver. OS:Server 2003 R2

Server Stanley.DOMAIN.LOCAL is our GC and holds the shcemas but I will be moving them to the DNS server soon. OS Server 2003 R2

The DNS Server at 192.168.1.103 is our new 2008 R2 Box. It now hosts DNS and DHCP and well is a GC and going to be the PDC once I transfer schemas over.

I wanted to get this DNS issue resolved first.

In an attempt I removed DNS from all other servers and it is only running on the new 2008 R2 box. I have not seen our 2008 R2 Server (Stanley) DNS log produce the event error since the 11th. Stanley used to be the DNS but it is now turned off. Could this be why I have not seen the error since then? Here is the net diag. It was run on the exchange server as it is still 2003 R2. NETDIAG:

....................................

    Computer Name: SERVERNAME
    DNS Host Name: SERVERNAME.DOMAINNAME.local
    System info : Microsoft Windows Server 2003 R2 (Build 3790)
    Processor : x86 Family 6 Model 15 Stepping 6, GenuineIntel
    List of installed hotfixes :
        KB2079403
        KB2115168
        KB2160329
        KB2183461-IE8
        KB2229593
        KB2286198
        KB923561
        KB924667-v2
        KB925398_WMP64
        KB925876
        KB925902-v2
        KB926122
        KB926139-v2
        KB927891
        KB929123
        KB930178
        KB932168
        KB933854
        KB936357
        KB938127
        KB941569
        KB942830
        KB942831
        KB943055
        KB943460
        KB943729
        KB944338-v2
        KB944653
        KB945553
        KB946026
        KB948496
        KB950760
        KB950762
        KB950974
        KB951066
        KB951748
        KB952004
        KB952069
        KB952954
        KB953298
        KB954155
        KB954550-v5
        KB955069
        KB955759
        KB956572
        KB956744
        KB956802
        KB956803
        KB956844
        KB958469
        KB958644
        KB958869
        KB959426
        KB960225
        KB960803
        KB960859
        KB961063
        KB961118
        KB961501
        KB967715
        KB967723
        KB968389
        KB968816
        KB969059
        KB969883
        KB969947
        KB970238
        KB970430
        KB970483
        KB971032
        KB971468
        KB971513
        KB971657
        KB971737
        KB971961
        KB971961-IE8
        KB972270
        KB973037
        KB973354
        KB973507
        KB973540
        KB973687
        KB973815
        KB973825
        KB973869
        KB973904
        KB973917-v2
        KB974112
        KB974318
        KB974392
        KB974571
        KB975025
        KB975254
        KB975467
        KB975560
        KB975562
        KB975713
        KB976323
        KB976662-IE8
        KB977165-v2
        KB977290
        KB977816
        KB977914
        KB978037
        KB978251
        KB978262
        KB978338
        KB978542
        KB978601
        KB978695
        KB978706
        KB979306
        KB979309
        KB979482
        KB979559
        KB979683
        KB979907
        KB980182
        KB980182-IE8
        KB980195
        KB980218
        KB980232
        KB980302-IE8
        KB980436
        KB981332-IE8
        KB982214
        KB982381-IE8
        KB982666
        Q147222


Netcard queries test . . . . . . . : Passed



Per interface results:

    Adapter : Local Area Connection 2

        Netcard queries test . . . : Passed

        Host Name. . . . . . . . . : SERVERNAME
        IP Address . . . . . . . . : 192.168.1.100
        Subnet Mask. . . . . . . . : 255.255.255.0
        Default Gateway. . . . . . : 192.168.1.1
        Dns Servers. . . . . . . . : 192.168.1.103


        AutoConfiguration results. . . . . . : Passed

        Default gateway test . . . : Passed

        NetBT name test. . . . . . : Passed

        WINS service test. . . . . : Skipped
            There are no WINS servers configured for this interface.


Global results:


Domain membership test . . . . . . : Passed


NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured:
        NetBT_Tcpip_{9052E7E6-EBB2-43F2-857A-8CF43C9718B3}
    1 NetBt transport currently configured.


Autonet address test . . . . . . . : Passed


IP loopback ping test. . . . . . . : Passed


Default gateway test . . . . . . . : Passed


NetBT name test. . . . . . . . . . : Passed


Winsock test . . . . . . . . . . . : Passed


DNS test . . . . . . . . . . . . . : Passed
    PASS - All the DNS entries for DC are registered on DNS server '192.168.1.103' and other DCs also have some of the names registered.


Redir and Browser test . . . . . . : Passed
    List of NetBt transports currently bound to the Redir
        NetBT_Tcpip_{9052E7E6-EBB2-43F2-857A-8CF43C9718B3}
    The redir is bound to 1 NetBt transport.

    List of NetBt transports currently bound to the browser
        NetBT_Tcpip_{9052E7E6-EBB2-43F2-857A-8CF43C9718B3}
    The browser is bound to 1 NetBt transport.


DC discovery test. . . . . . . . . : Passed


DC list test . . . . . . . . . . . : Passed


Trust relationship test. . . . . . : Passed
    Secure channel for domain 'SUPERNOVA' is to '\\stanley.DOMAINNAME.local'.


Kerberos test. . . . . . . . . . . : Passed


LDAP test. . . . . . . . . . . . . : Passed


Bindings test. . . . . . . . . . . : Passed


WAN configuration test . . . . . . : Skipped
    No active remote access connections.


Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Skipped

    Note: run "netsh ipsec dynamic show /?" for more detailed information


The command completed successfullylution.

I also just ran a DC Diag on Weir. THis is the 2008 R2 box It failed this test. Though Just looked into this a little more and realise its if I did not do adprep /rodcprep. Considering I am not planning on a RODC MS says this can be ignored.

  Starting test: NCSecDesc
     Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
        Replicating Directory Changes In Filtered Set
     access rights for the naming context:
     DC=ForestDnsZones,DC=DOMAINAME,DC=local
     Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
        Replicating Directory Changes In Filtered Set
     access rights for the naming context:
     DC=DomainDnsZones,DC=DOMAINAME,DC=local
     ......................... WEIR failed test NCSecDesc

We are a legitimate company. We have had some issues in the past with Virus attacks/ Spam bots getting our email server blacklisted.

After the most recent attack I have been tasked at coming up with a solution that would allow us to, once determined we are blocked, switch over to a clean server and IP

Here is how my superiors expect this to work... (I feel with the way email is setup and monitored by the blacklists this may not work as they expect.... though the blacklists do function on IP and not domain name....)

Determine which computer or exchange server is infected. Move to clean exchange server or remove infected computer from network Switch the company over to a functional and virus free exchange server. (a secondary is standing by) Switch the exchange server to a secondary IP address to avoid blacklisting.

The idea here is to move to a clean virus free server and an unblocked IP.

Questions:

1. Is this possible?

2. Will we just be blocked again? (let's assume we are not sending out spam on the secondary server and IP)

3. How can I accomplish moving the users from one exchange to the other. Moving mailboxes takes a LONG time. Both exchange servers are on site (physically beside each other)

4. With email reputation as heavily weighted as it is. Is it reasonable to expect email sent from the secondary IP to reach the users Inbox?

They expect this to take under 30 minutes to make the switch from (worst case) infected exchange server with blocked IP to clean exchange server with clean IP.

Server 2003 R2 Exchange 2003 SP2 Active Directory

Assistance/Advice/ or Alternatives are ALL Appreciated! Thanks everyone, Campo

EDIT: Every Machine has AVG

The Exchange Server is not an open relay and requires Authentication

I have done every step and taken every precaution and we still were infected.

EDIT: BLOCKED AGAIN

new virus name (GRUM)

This is not on our exchange server. No way, scanned with so many things. Went through the registry myself. NOTHING! Scanned all other server NOTHING scanned user computers NOTHING WTF?

Odd thing is email still goes through but we are on the CBL....

Moved SMTP to non standard port. Explicitly blocked port 25 on firewall. delisted us.

UPDATE:

I added additional IPs. Now how do I connect the users on one IP to the server on the other IP? Do I just have the Exchange server have 2 IPs (one for each internal network) or is there more to it?

UPDATE 2

This is a reply to @Madboys comment under his answer:

I have not done it yet. here is the setup. WE now have 5 IPs. I will use 2 for now. 1 for office network. 1 for exchange. Our modem contains both IPs sent to one port on the back of the machine. That LAN cable goes into a switch which then splits into 2. Each goes into our modem (dual Wan RV042) I assign the exchange to one subnet. Network to the other. Please confirm this plan. Ideally a PIX or similar FW appliance would be best. But again 0 dollars must be spent. Question is how will users on one subnet talk to the other? Should I set this up differently? Completely separate networks?

UPDATE 3

****OK I was able to do this. Modem to switch then I have 3 cables out of the switch. 1 Goes to a WRT54G for wireless and to separate outside consultants on their own network (they have no reason to be on ours). The other two cables go to my RV042 which supports Dual WAN. I setup a second sub-net. Now how to I isolate each WAN on its own sub-net? I believe the point of Daul WAN on this appliance is to maintain up time by utilizing separate ISPs.... Please assist. WE ARE SO CLOSE please advice ALSO: I do not see ANY outbound connections on PORT 25 other than from the exchange server. So that is good. And from the exchange the port 25 traffic is at a normal rate reflective of our volume.****

UPDATE 4

I have reasearched Open WRT and other solutons. I came upon PF Sense looks perfect!. Thoughts? I have an old P4 I can use. Then Just need a few compatible network cards :).

Resolved:

Modified network layout.

RV042 supports 1:1 Nat

Isolated Wifi on 1:1 Nat using WRT54G

Using 2 nics on Exchange server

1:1 IP mapped to smtp and OWA etc. Other for network traffic.

Thanks all for their help and assistance with this issue.

I have looked through a lot of these posts on the Cisco ASA5505 as well as gone online. I am looking for some straight forward step by step instructions to complete the following tasks.

I know how to get it functioning with an inside and outside interface so that's great!

I need some step by step for the following tasks

1. Configuring the firewall. There will be two servers attached to the inside interface: one is a web server so ports 80, 25, etc... The other is the DC so all standard ports for that need to be opened up. We also need RDP opened to both machines we use a non-standard port. I feel if I saw one example like for port 80 I could replicate that. Are there any other configs I should be aware of to secure the actually firewall or does it come setup pretty well out of the box?

2. Setup access to the appliance from our main office and my offsite lab. I could also RDP to the DC on the inside interface then connect if that was more secure.

Here is my current status. Right now it is just setup on my work machine for some testing. So the outside interface just goes to the office network.

Result of the command: "show running-config"

: Saved
:
ASA Version 8.2(1) 
!
hostname superasa
domain-name somedomainname
enable password /****** encrypted
passwd ******************** encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.2.1 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 192.168.1.9 255.255.255.252 
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 192.168.1.120
 domain-name somedomain
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.2.0 255.255.255.0 inside
http 192.168.2.4 255.255.255.255 inside
http 192.168.1.108 255.255.255.255 outside
http internetip 255.255.255.255 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns 192.168.1.120 208.67.222.222
dhcpd domain somedomain
dhcpd auto_config outside
!
dhcpd address 192.168.2.2-192.168.2.33 inside
dhcpd dns 192.168.1.120 interface inside
dhcpd auto_config outside interface inside
dhcpd enable inside
!
dhcpd dns 192.168.1.120 interface outside
dhcpd domain supernova interface outside
!
dhcprelay timeout 60

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
!
prompt hostname context 
Cryptochecksum:abunchofnumbersgohere
: end

I recently upgraded the company to AVG Business. It works great and really helps with spam. I noticed that our exchange server Queue about every ten minutes gets an infection. Two issues:

1. I cannot clear the infections without a restart which takes down email for about 30 minutes. (unacceptable) I understand it is because the files are not accessible but where are they all coming from?

2. Is this a BOT on our network or is this incoming mail?

Finally should I even be concerned about this? I feel this could be a spam bot on our network.

Scanned object                                                                          Infection                           State                           Detection time           Object type              Process 

c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\e0312449-cd97-45ea-8274-1b9f9a44e1eb  Virus found JS/Obfuscated   Moved to Virus Vault    2010-07-07 13:21:20     file    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\e0312449-cd97-45ea-8274-1b9f9a44e1eb  Virus found JS/Obfuscated   Object is inaccessible.     2010-07-07 13:38:19     file    C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\e0312449-cd97-45ea-8274-1b9f9a44e1eb  Virus found JS/Obfuscated   Object is inaccessible.     2010-07-07 13:38:12     file    C:\WINDOWS\Explorer.EXE
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\e59d5870-81b2-4c56-b330-ec4e9ebbe9bc  Virus found JS/Obfuscated   Moved to Virus Vault    2010-07-07 13:21:20     file    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\ebfafd55-5a91-4786-9827-9a8dfe3b8884  Virus found JS/Obfuscated   Moved to Virus Vault    2010-07-07 13:21:20     file    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\ed35ea91-f4b3-4139-8c82-81cdc14ab6ca  Virus found JS/Dropper  Moved to Virus Vault    2010-07-07 13:21:21     file    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\ef25b8d0-c327-458f-a7db-39e0579c0398  Virus found JS/Dropper  Moved to Virus Vault    2010-07-07 13:21:21     file    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\fc76582c-f1d1-483d-8a62-910e2a10e054  Virus found JS/Obfuscated   Moved to Virus Vault    2010-07-07 13:21:21     file    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_02fe480101cb1dee00000a3b.EML     Virus found JS/Obfuscated   Reboot is required to finish the action     2010-07-07 13:21:28     file    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_02fe480101cb1dee00000a3b.EML     Virus found JS/Obfuscated   Reboot is required to finish the action     2010-07-07 12:42:31     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_02fe480101cb1dee00000a3b.EML     Virus found JS/Obfuscated   Reboot is required to finish the action     2010-07-07 13:02:46     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_02fe480101cb1dee00000a3b.EML     Virus found JS/Obfuscated   Reboot is required to finish the action     2010-07-07 12:28:30     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_02fe480101cb1dee00000a3b.EML     Virus found JS/Obfuscated   Reboot is required to finish the action     2010-07-07 13:11:20     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_02fe480101cb1dee00000a3b.EML     Virus found JS/Obfuscated   Reboot is required to finish the action     2010-07-07 13:23:44     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e3ae89401cb1ddd00006f44.EML     Virus found JS/Dropper  Reboot is required to finish the action     2010-07-07 10:04:38     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e3ae89401cb1ddd00006f44.EML     Virus found JS/Dropper  Reboot is required to finish the action     2010-07-07 10:03:33     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e3ae89401cb1ddd00006f44.EML     Virus found JS/Dropper  Infected    2010-07-07 11:44:34     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 06:56:59     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 06:25:44     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-07 18:09:52     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 07:24:49     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-07 18:45:53     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-07 18:08:35     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-07 18:32:58     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 06:16:11     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 07:15:49     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 05:06:17     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 06:06:30     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-07 18:31:44     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 05:58:31     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 07:06:32     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-07 18:30:30     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 06:07:36     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-07 18:07:13     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 07:05:25     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-07 18:05:59     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 09:42:03     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 05:48:29     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 03:14:49     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 06:47:24     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-07 18:04:39     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 02:03:15     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-07 18:03:21     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 05:28:25     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 02:11:11     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 06:36:12     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 05:37:59     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 02:21:40     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 09:52:02     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 02:32:04     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 05:16:18     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 02:53:37     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 03:33:01     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 03:03:47     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 03:24:54     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 04:26:40     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 09:43:13     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 09:31:32     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 09:00:37     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 08:51:02     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 08:31:28     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 08:23:08     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 08:22:00     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 08:12:26     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 08:03:57     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 07:54:22     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 07:45:51     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe
c:\Program Files\Exchsrvr\Mailroot\vsi 1\Queue\NTFS_0e50580e01cb1e20000033eb.EML     Virus found JS/Dropper  Infected    2010-07-08 07:35:51     file    C:\WINDOWS\system32\inetsrv\inetinfo.exe

UPDATE: I have not properly Installed AVG Business Internet Security 9.0 on my Windows Server 2003 R2 with Exchange 2003. Seems like it needs to be added/Installed to the application Servers section in the admin console. Can anyone shed some light on how to do this?

**FINAL UPDATE

HERE IS AVG reply :)

Dear customer, The file that you had referenced, avg_ipw_stf_all_90_839a2960.exe, is the installation file intended for workstations and file servers.
The file you should be installing on an Exchange server would be the Email Server Edition (file name avg_msw_stf_all_90_839a2960.exe, which comes with plugins for scanning Exchange and Antispam plugins). Please download and deploy the following file to your Exchange server to have it correctly display in the Application Server group: http://download.avg.com/filedir/inst/avg_msw_stf_all_90_839a2960.exe**

We have two servers. They are both HP DL 380 G6 servers with the same hardware and specs running Windows Server 2008. Currently the second server is a warm standby for the first with an automatic fail over cluster for SQL 2008 Enterprise.

I would prefer to have both servers running and serving requests. Therefore if our staff need heavy reports generated from the database they can use the secondary server without slowing down the web requests from our users. The idea would be to have a dfs style replication for the databases files to assure symmetrical databases in real or near real time on both servers. Only one server would be serving the web requests. There are no plans for a load balancer currently.

I am familiar with fail over clustering but this sort of simultaneous clustering has eluded me.

can someone shed some light on this? Maybe I am looking at this all wrong.

Thanks!

Addition: Thanks for the responses. I find it hard to belive with 25,000 dollar software you cannot scale out to multiple servers. How do large companies deal with ever growing requirements? No one machine can handle a large site like Facebook if they used MSSQL (which I'm sure they don't but its just an example)

ADDITION2: Still looking for a little more feedback if anyone would be so kind. Remember to look in the comments too.

Any ideas what I did wrong here? I copied this script from a tutorial and get this error....

PS C:\Windows\system32> Get-Service | Where-Object ($_.status -eq "running")

Where-Object : Cannot bind parameter 'FilterScript'. Cannot convert value "False" to type "System.Management.Automation
.ScriptBlock". Error: "Invalid cast from 'System.Boolean' to 'System.Management.Automation.ScriptBlock'."
At line:1 char:27
+ Get-Service | Where-Object <<<<  ($_.status -eq "running")
    + CategoryInfo          : InvalidArgument: (:) [Where-Object], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Microsoft.PowerShell.Commands.WhereObjectCommand

I administer a Windows Server 2003 with Exchange 2003 as well as GFI installed. I am watching the GFI dashboard and every third email is spam. Not only that it goes to a non existent address then the [email protected] sends out an NDR to the sender.

Should I be worried about this? I know it is directory harvesting but we have directory harvesting turned on in GFI and I do see it is working but obviously doesn't work for emails that don't exist. My issue is I would turn off NDR but then people who legitimately mistype and email address to our domain will never know their email did not get to the recipient.

What do others do to combat spam?

Is 3 times the amount of spam to ham normal?

We filter out 90% of the spam but some does get into the users inbox.

Thanks for the suggestions and advice!

I have been asked to analyze the bandwidth usage of a company and make a recommendation for upgrading their Internet connection(s).

Here is the layout

3 DSL lines so it is 3x(6 Down, 1 Up Each) into a load balancer out to the office's network.

30 VOIP phones run on a T1 (1.5 Down, 1.5 Up)

The users at the company are heavily uploading. It is my suspicion that the issue in slowdown is being cause by multiple people uploading and others not being able to get requests out for even simple http requests.

My initial idea is to get them a fiber line with a 10 down and 10 up. What do others think on this plan? Will that be enough to host their network traffic? What do I do about the VOIP line afterward? The fiber is expensive and I know the T1 does a great job for their VOIP so I do not want to suggest a DSL line because I know it may not be sufficient. I would also like to save them some money if I can. Maybe even get a faster fiber line and forgo the T1. Though I know their load balance/switch can only handle 20MB/S throughput.

Looking for some confirmation/suggestions on my plan.

I am planning on going in to get some real diagnostic numbers. Any suggestions on software to use for that? Preferably Windows software.

I have a weird issue here.

I notice about once a week the web server restarts itself. This would be only a minor issue if we were not planning on implementing an IP failover.

I have checked the event logs. I don't see anything that indicates a reason for the restart.

I need some help diagnosing the reason the server restarts. It happened last night at 5:00AM Last even in the log was 1 hour before the unexpected shutdown.

Here is the Log for the shutdown event. Any help is much appreciated. I know there isn't much to go on yet.

    Log Name:      System

Source:        EventLog

Date:          5/5/2010 5:01:12 AM

Event ID:      6008

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      SERVERNAME

Description:

The previous system shutdown at 4:56:41 AM on 5/5/2010 was unexpected.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="EventLog" />

    <EventID Qualifiers="32768">6008</EventID>

    <Level>2</Level>

    <Task>0</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2010-05-05T09:01:12.000Z" />

    <EventRecordID>346094</EventRecordID>

    <Channel>System</Channel>

    <Computer>SERVERNAME</Computer>

    <Security />

  </System>

  <EventData>

    <Data>4:56:41 AM</Data>

    <Data>5/5/2010</Data>

    <Data>

    </Data>

    <Data>

    </Data>

    <Data>39594</Data>

    <Data>

    </Data>

    <Data>

    </Data>
    <Binary>DA070500030005000400380029008E03DA070500030005000800380029008E033C0000003C000000000
000000000000000000000000000000100000000000000</Binary>

  </EventData>

</Event>

I have a security policy question:

I want to know how other admins handle the WIFI password in the office.

1. Does everyone know it?
2. Do you enter it in for the user or guest every time and keep it a secret.

I am in camp 2.

Just want to know what others do and their reasoning behind it.

I want to create a Domain User that runs the SQL Service Accounts. The reason for this is that I have setup mirroring and MS recommends having the same user (a domain user account) running the services across all the the computers in the configuration to ensure mirroring will work properly. Right now in the test environment I just had them run under my user for simplicity. But now that I know what I am doing I would like to test the configuration more accurately.

I am also aware that it makes things much simpler if this user is an administrator.

My question is.

Should I just create a simple user SQLSERVICEUSER and make it an administrator? Seems a little insecure to me. Anyone have a more elegant solution?

I had a server die. It is gone forever.

It is still listed in the servers folder of the first administrative group in the Exchange System Manager.

When I click "all tasks > Remove Server" I get the following error:

The Server "SERVERNAME" cannot be removed because:
-One or more users currently use a mailbox on this server. 
These users must be moved to a mailbox store on a different server 
or be mail disabled before uninstalling this server.
Facility: Exchange System Manager
ID no: c103f492
Exchange System Manager

Any help would be MUCH appreciated.

I cannot access the mailbox stores anymore and I do not care about the lost mailboxes. We deleted the inactive and old users as well. So I am stumped on this one. I just need to remove the old machine.

THANKS!