Jacob's questions

I am trying to configure security settings under the Local Intranet zone for IE 10 on Windows Server 2008 R2. I am also trying to add an IP address to the allow list for IE's popup blocker. I am configuring this under

User Configuration-> Policies-> Administrative Templates-> Windows Components-> Internet Explorer-> Popup allow list

User Configuration-> Policies-> Administrative Templates-> Windows Components-> Internet Explorer-> Internet Control Panel-> Security Page

When I first logon to the server and check the IE settings, none of them are working. The Security tab looks like this:

The only way I can get the security settings to apply is go to Advanced->Reset. After I do this, the policies are applied and the security tab looks like this:

What am I doing wrong and how can I prevent this from happening? Also, the popup allow list never adds the IP address.

When I am looking at the security tab of my event viewer on a Windows Server 2008 R2, I am showing a ton of Audit Failures with Event ID 4776.

The computer attempted to validate the credentials for an account.

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:  randy
Source Workstation: HPDB1
Error Code: 0xc0000064

I verified the account "randy" exist in my Active Directory. From my understanding, there has not been any recent password changes. Is there any way to get detailed information on this error? I am wondering what program is requesting this information.

Also, is there any way to clear this error up? I was thinking about resetting the password and changing it back to the original.

I am planning on replacing a server in the next few weeks, and I was checking through our Active Directory Sites and Services and I noticed the server I am replacing is listed as the "Inter-Site Topology Generator". If I replace the server without changing this, what will happen?

Is it possible to change this entry to our current Domain naming operations master?

I'm not sure how in depth I need to go with this question, but currently I have a site-to-site VPN setup and we are having major connection issues between the two sites. I did a tracert and received an odd result:

    Tracing route to 192.168.251.209 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.5.1.254
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4   102 ms   101 ms   103 ms  192.168.251.209

Does anyone know why the request timed out twice before finding 192.168.251.209? We have had the site-to-site VPN up for over a year now, and we have never experienced any issues. I never had a reason to run a constant ping to check the packet loss before, but when I did today the packet loss is about 13%. I can ping other VPN groups and websites (google.com/shop.com) with 0% packet loss.

When I am trying to access WMI from a remote domain controller using WMIMGMT.MSC, I keep getting "Failed to connect to \(remote server) because 'Win32: Access is denied.'. Does anyone have any ideas on what could be causing this?

I have tried many of the different howtos I found through google and none of them worked. I renamed the logs and repository folder under C:\system32\wbem and rebuilt the repository. After this didn't work, I went into the security tab under WMI Control and allowed 'Everyone' all rights. This did not fix the problem. I believe it has something to do with impersonation, but when I tried a few google searches for this, it brought up scripting and programming help.

I can access WMI locally on the remote computer with no issues

I have two domain controllers that act as a Primary and Secondary DNS servers. Server2 is the primary and server1 is the secondary. If I open dnsmgnt on server2 and look at the Reverse Lookup Zones, it looks like this:

If I look at the Reverse Lookup Zones on server1, it looks like this:

What is causing this to be different? On a side note, does every domain controller with a global catalog need to have itself as a DNS server?

I have a few Windows XP machines where the users logon to the domain as "temp1", "temp2", "temp3". Can I use Remote desktop to view their screen using my admin login information? The only way I have found to do this is remote desktop to their computer, and type their username (which locks them out). Is it possible to remote desktop to another user's session using my username and password? Another reason I don't want to use their login information is because I want to limit this to administrators only.

I could use VNC but this is last resort. I want to try to keep the amount of software installed on these PCs to a minimum.

Recently we received (2) Poweredge 6850 and (2) PowerVault 220s from our managed server company. These two servers hosted SQL Server 2005 with our SQL database on it. The cluster was dependent on their domain. I did not have any of their passwords, and they were not sharing them, so I cleared the local administrator's password and logged onto the server. I see all the different drive names, but none of them are showing how much space they have. I am assuming because the cluster service is failing to load. I changed the services' accounts to the local system so they can run, but it is still failing to load.

Should I be able to see the drives without the servers clustered together? Am I going to have to re-cluster the servers? If I do, will I lose all the information?

Recently we had a power outage that was greater than 2 hours. We had to shutdown 8 out of 9 servers. I left 1 server, server6, running because it hosts web services we need 24/7. Once the power was back on, I tried to boot server1 and server2 first, considering server1 is the main operations master and server2 is our DNS server. Both of the systems were stuck at "Loading Network Connections" for about 10-20 minutes. Once the systems were booted, I logged in and the Event Viewer was filled with errors.

Server1 had:

The Security System detected an authentication error for the server LDAP/SERVER1.  The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request.

(0xc000005e)".

and

Dynamic registration or deletion of one or more DNS records associated with DNS domain 'DomainDnsZones.JVS.' failed. These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).

Server2 had:

Dynamic registration or deletion of one or more DNS records associated with DNS domain 'JVS.' failed.  These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).  

and

The Security System detected an authentication error for the server ldap/server2.JVS.  The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request.

(0xc000005e)".

I went into Active Directory Sites and Services and tried to connect to the JVS forest numerous times with failed attempts. Finally after about the 8th try, it found the forest and everything went back to normal. This gives me the feeling something is wrong with our domain. Is there any tests I can run to see what is wrong with our domain? Has anyone ever heard of this happening?

I have recently been trying to find software to monitor users' activities on our terminal server. After a quick search, I found http://www.softactivity.com/tsm.aspx. Has anyone ever heard of or used this program? I just want to make sure this company is legit and the software runs efficiently. The server I would be installing it on has about 40-50 users on it. I am hoping the software has some type of setting to only monitor certain users, because i would hate to waste resources.

If this is not good software, does anyone have any recommendations?

I'm going to replace a Sonicwall TZ 190 with a NSA 3500. Currently I have a Site to Site VPN setup on the TZ 190. I entered the exact information for the site-to-site VPN on the new NSA 3500, but I have not changed the "Unique Firewall Identifier" on the new device. Will this effect the Site to Site connection? Do I need to change the Unique Firewall Identifier on the NSA 3500 to the TZ 190 or is it OK if I leave this alone? What does the Unique Firewall Identifier effect?

What is the best way to monitor a terminal server session that is being shadowed? I believe I have an admin shadowing one of our users and talking in notepad. Does anyone have any suggestions on the easiest way to find this?

We have a database server with U2 installed on a windows 2003 server with RAID5 setup. I'm wanting to use Diskkeeper to defragment the different partitions. Has anyone ever ran into any issues or data loss when defragmenting a drive? Are there any dangers when defragging?

Our Windows 2003 terminal server is running extremely slow today, so I checked task manager to see what is going on. lsass.exe is using as much free CPU as it can. The CPU Usage is staying at 100% because of this. Today is one of our slowest days, so I'm confused about why it is running so high. The only application the users are running is iexplore.exe, and the only other running services on the computer is Veritas Backupexec agents (other than the normal microsoft products). Other than a reboot, is there any way to fix this? Is there any troubleshooting tasks I can do to see what's going on?

I have a Summit extreme router and I've recently been receiving the following error:

<WARN:ESRP> edp.c 2892: PREMASTER-->Master : VLAN=Buyers1 [HIGHER Priority]
<WARN:ESRP> edp.c 2780: MASTER-->slave : VLAN=Buyers1 [Master PDU in master state]
<WARN:RIP > ripDeleteRt: SIOCDELRT (S_objLib_OBJ_TIMEOUT) 

It's giving the first two errors on every vlan I have.

My entire network usually starts to lose connectivity. The only thing that has changed lately is someone put a NAT policy on our firewall to point to a 192.168.225.x IP address. Would this cause this error? Also, what does the error mean?

OK, I finally broke down and approved the IE 8 update on my WSUS update. It installed fine on about 50 computers but one computer is having a major problem installing. It installs with no errors and ask for a reboot. Once I reboot I try to open IE, and it still opens IE6. I had to delay the IE 7 update on this computer because our bank was not compatible with IE 7 when it was released. Also, The Internet link in the start menu is broken. It has no IE icon and when i click it, it says Access Denied. Also, when I try to navigate to another page when IE 6 is open it's saying the file extension needs to be registered, but it does go to the website. I tried to uninstall and install IE 7 and got the same problem. I went to Microsoft's website and did their 8 step process and nothing worked. I'm going to include a screenshot. It's weird how the browser is IE 6, but the settings are IE 8 settings. (notice the tab settings).

Is there a large need for antivirus/antispyware within a firewall? For example, most sonicwalls come with a gateway antivirus/antispyware. I'm not running a public HTTP server or any type of public service. We do not run a mail server here either, so would there be any reason to have these features?

I recently installed a TZ 190 firewall and it is extremely slow when the security services are activated on the LAN zone. The firmware is SonicOS Enhanced 3.9.0.1-6e. It seems to load webpages extremely slow and the ping is around 40 ms. Other than updating the firmware and disabling the security services, has anyone had any luck speeding the TZ 190s up? I'm going to update the firmware tonight.

I recently downgraded a few machines from Office 2007 to Office 2003. All of the machines are doing great except one. One has an update for Powerpoint 2007 that is stuck trying to install constantly. The update is KB 957789 and the error code is 0x80070643

I'm trying to figure out how to add a local printer on the HP Thin Client t5145 so I can use it for LPD printing. The local OS on the thin client is linux. I'm trying to print from a RDP session on win2003server. On the older model thin clients there was a check box for "enable LPD printing" for the printer. I cannot find this option anywhere on the thin client. Does anyone have any ideas?