Matty Brown's questions

We've got an intermittent problem accessing file shares on one of our Windows Server 2012 R2 domain controllers. Occasionally when I try browsing \\servername, I get:

Our other two DC's are fine - haven't had any error messages accessing them at all.

No idea what's going on... ping always succeeds, so doesn't seem to be a connectivity issue.

Static DNS A records exist for all our DC's and all the SRV records are in place. dcdiag /s:servername passes all tests, though there are some warnings:

Starting test: DFSREvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems.

Are there any free diagnostic tools available to pinpoint the problem?

We're experiencing 100% CPU usage from the process Microsoft.Identity.Health.AadSync.MonitoringAgent.Startup on our Domain Controllers that have Azure AD Connect installed, since yesterday.

According to this discussion, an official from Microsoft says that the problem is due to an incompatibility with Microsoft .NET Framework 4.7.2 .Net Framework - KB4054542 (Server 2012), KB4054566 (Server 2012 R2) and KB4054590 (Server 2016), but unfortunately for us, on our 2012 R2 servers, KB4054566 failed to install so can't be uninstalled. And a related update KB4340006 that did successfully install, which is the one I think caused our problems, cannot be uninstalled either.

I know plenty of other people are experiencing this issue... what's the best action to take before Microsoft releases a new version of Azure AD Sync Monitor?

Since 17/05/2017, all of our Windows Server 2012 R2 VM's have been reporting the following error message whilst rebooting to install Windows Updates:

Service Control Manager 7023

The Windows Modules Installer service terminated with the following error:

Indicates that the starting value for the LDT information was not an integral multiple of the selector size.

In addition, this seems to cause Domain Controllers to wait for a timeout, since they stop responding to ping requests for 1 hour +/- 1 minute each time. Member servers don't seem to experience this delay, as far as I've noticed.

None of the 2012 R2 Hyper-V hosts have logged this error, but all of the 2012 R2 VM's have.

Numerous searches haven't turned anything up - I can't believe we're the only ones seeing this?

For several months now, every time any of our 3 Windows Server 2012 R2 domain controllers reboot, they're unreachable for an hour according to our network monitoring software (PRTG).

I can see from the event logs that the Security Accounts Manager service does not start properly with event ID 7044 (The following service is taking more than 16 minutes to start and may have stopped responding: Security Accounts Manager).

Then nearly an hour later, I see event ID 7043 (The Windows Modules Installer service did not shut down properly after receiving a preshutdown control.)

We've got plenty of other 2012 R2 member servers all installing Windows Updates in a timely fashion - it's only those servers with the Active Directory and DHCP roles installed that take an hour to reboot.

I've Googled this on several occasions and haven't come across anyone else experiencing the same.

I'd like to configure the "AC Power Restored" option that's accessible in the BIOS, but I want to do it remotely, without having to shutdown the server and go into BIOS.

I've searched through the iDRAC 8 Enterprise interface and I can't find the option.

Am I seriously going to have to take the whole server down just to update this setting??

Each year, I find myself installing Windows 7 dozens of times, on both brand new PCs and before passing on a used PC from one user to the next. I'm sure a LOT of network administrators are in the same boat.

Windows Updates take a LONG time and it would save so much time being able to create an image that's up to date with all Windows Updates and deploy it using Windows Deployment Services (WDS).

Having installed a Dell OEM image onto a VM, updated it, snapshotted it, ran sysprep generalize, captured an image to WDS and deployed that image to a physical Dell OptiPlex box, I had issues activating the OEM key from the COA sticker online and had to phone up for a manual activation... which went through fine, but was a painful process of listening to an automated system and punching in loads of numbers.

• Was this just a fluke? Should this scenario normally work without the need to phone up for a manual activation?
• Can OEM media be used for imaging, or do I have to use Volume License media? And if using Volume License media, do I need to enter the OEM key found on the COA sticker?
• Moving forwards, with OEMs like Dell embedding keys into the UEFI BIOS on new PCs, does this make the process any easier?

I just spotted than my PC, running Windows 8.1 Pro on a Windows 2012 R2 domain has been querying DNS for SRV records that doesn't exist.

All of the dcdiag /dnsall tests pass, but I wonder if there's something in Group Policy that is causing clients to query for the wrong SRV record.

When running ipconfig /displaydns to check the TTL on a cached DNS record, I spotted these:

_ldap._tcp.server1.contoso.com
----------------------------------------
Name does not exist.

_ldap._tcp.site-name._sites.server1.contoso.com
----------------------------------------
Name does not exist.

(site name, domain and server name changed).

For some reason, the DNS lookup includes the name of the logon server in the FQDN. If it had looked up _ldap._tcp.server1.contoso.com and _ldap._tcp.site-name._sites.server1.contoso.com, they would have returned the right records.

Am I just being paranoid, or is there something wrong with the way I've got our Active Directory / DNS configured?

We've recently promoted 3 new 2012 R2 domain controllers and still have 1 2003 domain controller on the network, which we're planning on demoting in the next week or two.

We seem to be having a problem relating to the transition though...

Group Policy is failing with 1030 and 1058 errors on Windows XP and Windows Server 2003 computers only. After some investigation, it would appear that the cause of these failures is because those computers cannot access the DFS namespace for our domain, where Group Policy files exist.

If I try to navigate to \domain.local from one of the affected computers, I see this message:

\\domain.local is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions.

You were not connected because a duplicate name exists on the network. Go to System in Control Panel to change the computer name and try again.

I have no idea why this is broken... I used to be able to browse to \\domain.local before adding 2012 R2 servers as Domain Controllers to the domain.

I've configured the location of our automatic configuration script under "User Configuration > Preferences > Control Panel Settings > Internet Settings > Internet Explorer 8 > Connections > LAN Settings > Use automatic configuration script", but when I look at the configured settings in Internet Options, the path is not shown and the checkbox is not ticked.

Have I configured this setting in the recommended location in Group Policy? Any idea why it's having no effect?

We've migrated our email to Office 365, so I now need to remove our one and only on-premises Exchange Server (2003 Standard).

The documentation that I've read suggests that I:

1. Go to a command prompt (running as Administrator)
2. With the Exchange Server 2003 installation CD in the drive, go to the D:\Setup\i386\ directory and run Update.exe /removeorg
3. Run Setup.exe /forestprep
4. Run Setup.exe /domainprep
5. Done?

Why should I need to run setup.exe /forestprep and setup.exe /domainprep? There is no explanation of this in what I've read and when I look up what these do, it appears that they prepare for an installation of Exchange, not an uninstallation.

Instead of having separate proxy settings in Group Policy for several web browsers (Google Chrome, Internet Explorer and FrontMotion Firefox), I decided that it would be better to create a proxy.pac file and point each browser at that via Group Policy. This way, I would only have to update exclusions in one place.

My first thought was to put the proxy.pac file on the server that hosts our intranet. But this would give me no load balancing or resiliency. I tested this anyway and it worked (after adding a mime type to IIS). The URL looked like http://example.com/proxy.pac.

My second thought was to put the proxy.pac file into our SYSVOL directory. No way, no how can I get this to work. There's obviously something I've missed! The URL looks like file://\\example.com\SYSVOL\example.com\Proxy\proxy.pac. I also tried file://example.com/SYSVOL/example.com/Proxy/proxy.pac.

Where do you put yours? Any idea what I'm doing wrong?

We've used Multicasting for the first time in one of our applications and whilst I have got it working, I'd really like to fully understand how it works and what's going on behind the scenes.

In an attempt to do this, I've run Wireshark on my PC to see what IGMP packets are sent/received by my PC when acting as a source or a member/destination.

I was puzzled to find that my PC is receiving IGMP and multicast packets that have nothing to do with my PC. I have a feeling that our switches are just broadcasting multicasts, rather than sending multicast packets to only the ports that are interested in the multicast.

Having done several Google's, I found this statement which explains and backs up what I thought:

The purpose of Cisco Group Management Protocol (CGMP) and Internet Group Management Protocol (IGMP) snooping is to restrain multicast traffic in a switched network. By default, a LAN switch floods multicast traffic within the broadcast domain, and this can consume a lot of bandwidth if many multicast servers are sending streams to the segment. - Cisco

Okay... so I guess I need to enable IGMP Snooping on our LAN. But what I don't know is, do I need to enable this on all of our Cisco switches (Model SG300-28P), or just one? PS. All switches are layer 2 - our firewall routes traffic between VLAN's.

What I think I need is:

bridge multicast filtering
ip igmp snooping
ip igmp snooping vlan 1
ip igmp snooping vlan 1 querier

Also, should I do the same for each VLAN (we only have 2, for voice and data).

We've always used "Internet Explorer Maintenance" (IEM) in Group Policies to manage Internet Explorer settings. Apparently since IE 10, we need to use Internet Explorer Administration Kit (IEAK) to manage it.

Specifically, I'm looking to add favorites to the links bar via Group Policy, which I've previously been able to achieve using IEM. We're now trying out Internet Explorer 10 and 11 on Windows 7 PCs and have found that the "URLs/Favorites and Links" section of IEM is no longer working for these versions of IE.

I've read that IEAK is the current way that Microsoft recommends administrators manage IE preferences, etc (including adding favorites to IE), but having run through the Internet Explorer Customization Wizard and generated an INSTALL.INS file, I'm non the wiser how to apply this to our PCs via Group Policy.

Is there a better way of distributing/updating favorites across our PCs? Or if you agree with Microsoft that IEAK is the way forward, how do I implement this properly?

We've been experiencing this DCOM error message for the last month or two. It doesn't appear to be doing any harm, but it's worrying that it's happening so frequently.

What steps do I need to take to diagnose the cause and how can I correct this issue?

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          01/10/2013 14:04:46
Event ID:      10010
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      server.ourdomain.co.uk
Description:
The server {7D1933CB-86F6-4A98-8628-01BE94C9A575} did not register with DCOM within the required timeout.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="49152">10010</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-10-01T13:04:46.000000000Z" />
    <EventRecordID>104649</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>server.ourdomain.co.uk</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">{7D1933CB-86F6-4A98-8628-01BE94C9A575}</Data>
  </EventData>
</Event>

I've just installed two identical fax modems into a Windows Server 2003 Standard server and for whatever reason, the first one works fine and the other doesn't. They both create virtual COM ports and using SysInternals PortMon, I can see that commands are being sent to the first modem okay, but nothing is sent to the second modem (even though the application attempts to communicate with it -- and fails opening the COM port).

I've seen lots of posts about this type of issue online, but I can't find an explanation for why I can't have two identical modems working side-by-side, or whether it is, or is not possible.

The second modem's going back if I can't get it working.

We are in the process of migrating a bunch of users' home directories onto a new server running Windows Storage Server 2008 R2.

For most users, this has gone well and our group policy has done its job in redirecting users' My Documents folders to their new network path (\\server\Users\%username%\Work).

The problem is, on a small number of Windows 7 PCs, the Documents library isn't automatically adding the users' redirected My Documents path as it does on other PCs. And when I try to manually correct this by adding the path myself, I get the message "This network location can't be included because it is not indexed."

Windows Search Service is installed onto the server and the Users directory has indexing enabled, so as far as I can tell, the network location IS indexed.

Even if I manually work around the issue and get the users' home directory included in the Documents library, Windows persists in telling me that "Some library features are unavailable due to unsupported library locations".

We've just re-wired our Sales Office using Cat 6 cabling into a new data rack. The cable loops down at the base, in case we need to use that slack in the future to re-terminate it, or to cover any other eventuality. This spare cable currently sits at the bottom of the rack.

In our old data rack, we have a rack mounted APC UPS. It's proximity to our Cat 5e cabling has never concerned us before, but since we've gone to the cost and hassle of installing new cabling throughout, we're making a concerted effort to ensure that we keep electrical interference to a minimum.

If we move our UPS into our new data rack and sit our UTP Cat 6 directly on top of it, could it cause electrical/magnetic interference or is there some sort of shelf that we should install to maintain a minimum separation? Or is it advisable to keep UPS's out of data racks?

This problem is driving me NUTS!!

We take backups of all of our production databases to a network share, which are then backed up to tape nightly.

8pm Mon-Fri - Full backup, followed by log backup

7am-7pm Mon-Fri, at half-hour interval - Log backup

Our backups have been working in this manner since we migrated from SQL Server Standard 2000 to 2008, 3 years ago. Recently, the first log backup on Mondays have been failing. Not every time, but almost every time! The rest of the week, we've had no problems. I guess the issue may have something to do with the size of the log backup that's attempted after a weekend of no backups.

Now onto the issue I need a fix for...

All this week, every full backup on our biggest two databases have failed (Both backups < 1GB compressed). There's plenty of disk space on the source and destination servers. I'm guessing the issue is to do with the amount of time it takes to complete the backups of these databases, and/or the size of the backup files required to complete these backups. Changing the backup destination to local storage works fine (and very, very fast in comparison).

From the Job History, I can find a few hints as to what the problem could be...

Code: 0xC002F210 (Always this code, but a mix of the following descriptions...)

"The operating system returned the error '64(failed to retrieve text for this error. Reason: 1815)' while attempting 'SetEndOfFile' on '\drserver\SQLBackups\Database.bak'. BACKUP DATABASE is terminating abnormally.

"The operating system returned the error '64(failed to retrieve text for this error. Reason: 1815)' while attempting 'FlushFileBuffers' on '\drserver\SQLBackups\Database.bak'. BACKUP DATABASE is terminating abnormally.

Please help save my hair and sanity!!

Today, we shut down one of our Active Directory servers during office hours to check the loading on a UPS. Since all the server did was provide Active Directory in a separate building incase the main building caught fire, or whatever, we didn't think it would have any effect on our users.

Seconds after the server was shut down, we had a dozen phone calls from users experiencing this issue:- [Microsoft SQL Server Login] SQLState: '28000' [Microsoft][ODBC SQL Server Driver][SQL Server]Login failed. The login is from an untrusted domain and cannot be used with authentication.

Once we realized what had happened, we quickly rebooted the down Active Directory server. Problem solved.

But why did this happen. And what if one day a server has a breakdown and is offline for hours, or days? Shouldn't the other Active Directory servers in the domain service authentication requests without disruption to users?

We have 3 Windows Server 2003 Standard servers running Active Directory as Domain Controllers with Global Catalogs, all physically located on the same network at Gigabit speeds.

I believe the domain was originally Windows Server 2000, or maybe even NT 4.0. Could the issue be to down to old Group Policies inherited from these old server OS's, or some default setting in Active Directory that needs changing?

Possible Duplicate:
Can you help me with my software licensing question?

We have 40 PCs currently running Office XP Standard (Word, Excel, PowerPoint and Outlook).

We're finally looking to upgrade them all to Office 2010, but it seems so expensive.

The main reason for the expense seems to be Microsoft's inclusion of Publisher in the Office Standard product. Trust me, none of our users will ever use Publisher.

The Product Key Card (PKC) offering is less than half the price and gives us exactly the Office applications we want.

Office Home and Business 2010 PKC [Word, Excel, PowerPoint, OneNote, Outlook] £129.15 ex VAT

Office Standard 2010 [Word, Excel, PowerPoint, OneNote, Outlook, Publisher] £306.54 ex VAT

Obviously, we'd need to keep track of the 40 unique licence codes, not to mention having to store them somewhere, but for this big a saving, we'd be crazy not to consider it.

Are there any big disadvantages to PKC licensing? Is it within the licensing agreements for businesses to use this method on PCs not purchased at the same time?

What would you do?