Chadddada's questions

I seem to be getting a fairly common generic error but with possibly with a slight difference then some of the other problems/answers I have seen. Generally it looks like this is a DNS issue but I am not sure in my case.

Let me 1st describe my infrastructure and what I am trying to accomplish. We use PKI on the main MPs/DPs. I have another DP that I will use for OSD content that won’t use PKI. I am 1st attempting to use boot media, vs PXE, to image a computer. I have distributed the content to the DP, created a boot media USB and everything looks good there as far as I can tell. My boot media selects the PKI MP and we have created the client cert and I direct it to the non-http DP. The process seems to accept the certificate and the boot media creation completes. Next boot off the media on the computer and drop into Windows PE where I can manually enter the IP information. When I click next the process fails.

Error: Failed to Run Task Sequence An error occurred while retrieving policy for this computer (0x80004005).

So starting some of the troubleshooting I F8. -Can I ping the SCCM site servers? Yes, I can ping, both short and FQDN, the primary, MP, DP. Looking at the SMSTSLog I see the following lines/errors. 1)Failed to open PXE registry key. Not a PXE boot. 2)Failed to find the source drive where WinPE was booted from But then the next line is: Executing from Media WinPE These 2 are at the top of the log and the process seems to continue on with the IP and variable information. These are the lines of information later in the log with the error(s): -CLibSMSMessageWinHTTPTransport::Send:URL: (my MP) -In SSL, but with no client cert -Error. Received 0x80072ee7 from WinHttpSendRequest. -Hr,HRESULT=80072ee7 -sending with winhttp failed, 80072ee7 -m_pHttp Transport -> (etc….) -MPKeyInformation.RequestMPKeyInformationForMedia -Failed to get information of MP: https//(my MP)

So I am wondering where I start. I don’t see that unknown host line that seems to indicate that it is a DNS issue. I see some stuff about the in SSL but with no cert. Does this mean that the cert we had to create isn’t working correctly? We pretty much followed http://www.jamesbannanit.com/2012/05/how-to-build-and-capture-in-configuration-manager-2012-using-https/ I have also looked through this http://blogs.technet.com/b/configurationmgr/archive/2009/07/27/a-step-by-step-for-using-osd-through-system-center-configuration-manager-2007.aspx And I have pretty much everything done there except a network access account. Looking at my settings I am set to, “Use the computer account of the Configuration Manager client” However, my computer I am trying to image is a “WORKGROUP” and not joining the domain. But.. am I really getting that far in the process? Would I be failing to get policy because of this or does this just come into play when I try to get the OS from the DP?

I know that as of SCCM SP1 we are now able to monitor and alert on a few more things in SCCM. We can now alert if there are problems with not only AV / malware alerts but also client and database problems. However, it doesn't seem like there is the ability to monitor if a component (Monitoring > System Status > Component Status) is showing in a critical state. All of the alerts that I can see under 'All Alerts' are Endpoint Protection alerts, client health alerts, site server alerts (deployments, db rep, db drive, sideloading win 8) and site system alerts (SUP, MP).

How can I email alerts when a site system status or a component status records an error message? When SMS_STATUS_MANAGER or say SMS_MP_CONTROL_MANAGER have an error I want to know; I don't want to have to come to the site and leave a RDP session open to monitor this.

EP 4.2.223.1 is installed, version is higher than expected installer version 4.1.522.0

Has anyone see that in the EndpointProtectionAgent.log on a system they have been trying to push the SCCM client to before? We have a number of servers that haven't reported back to SCCM that their Endpoint Protection is being managed. Looking at the log noted above has that error.

A snipped from the log:

 <![LOG[Service startup notification received]LOG]!><time="16:43:43.819+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3924" file="fepsettingendpoint.cpp:291">
<![LOG[Endpoint is triggered by CCMTask Execute.]LOG]!><time="16:43:43.819+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="2804" file="fepsettingendpoint.cpp:265">
<![LOG[Deployment WMI is NOT ready.]LOG]!><time="16:43:43.835+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="2804" file="epagentimpl.cpp:725">
<![LOG[Endpoint is triggered by WMI notification.]LOG]!><time="16:43:59.482+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="fepsettingendpoint.cpp:154">
<![LOG[Failed to get EP event code under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="2" thread="3556" file="epagentimpl.cpp:1334">
<![LOG[Failed to get EP event message under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="2" thread="3556" file="epagentimpl.cpp:1339">
<![LOG[EP State and Error Code didn't get changed, skip resend state message.]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="epagentimpl.cpp:153">
<![LOG[Failed to get EP event code under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="2" thread="3556" file="epagentimpl.cpp:1334">
<![LOG[Failed to get EP event message under registry key SOFTWARE\Microsoft\CCM\EPAgent]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="2" thread="3556" file="epagentimpl.cpp:1339">
<![LOG[State 1, error code 0 and detail message are not changed, skip updating registry value]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="epagentimpl.cpp:205">
<![LOG[File C:\Windows\ccmsetup\SCEPInstall.exe version is 4.1.522.0.]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="epagentutil.cpp:519">
<![LOG[EP version 4.2.223.1 is already installed.]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="epagentutil.cpp:232">
<![LOG[EP 4.2.223.1 is installed, version is higher than expected installer version 4.1.522.0.]LOG]!><time="16:43:59.498+240" date="06-26-2013" component="EndpointProtectionAgent" context="" type="1" thread="3556" file="epagentutil.cpp:265">

A few of these systems were previously manged under a dev SCCM 2012 SP1 install, and some under FEP 2010. Now we are deploying from a new SCCM site that we have setup to these servers. Does this indicate that we need to update the EP install that we are pushing out?

I am looking to migrate my dev SCCM 2012 SP 1 install from Windows Server 2008 R2 to Windows Server 2012. I have been looking at the documentation for the Dell integration packs and want to incorporate this into my environment.

http://en.community.dell.com/dell-blogs/software/b/software/archive/2012/04/02/dellopenmanageintegrationsuiteformicrosoftsystemcenter.aspx

http://www.dell.com/support/drivers/us/en/555/DriverDetails?driverId=85VWM

http://support.dell.com/support/edocs/software/smddp/2_0/en/itg/itg.pdf

http://en.community.dell.com/techcenter/b/techcenter/archive/2012/07/31/dell-client-integration-pack-for-ms-configuration-manager-2012-is-now-available.aspx

However it doesn't look like, according to this documentation, the Dell integration packs will run on/support Windows Server 2012 yet. Has anyone tried to install any of this stuff into SCCM 2012 SP1 running on Server 2012? Is the documentation lagging behind real world or is this not supported yet?

EDIT: Updated to reflect I actually have SP1 up and running. More so asking about the Dell products.

I am setting up an iSCSI environment for a Windows Server. I will be using 2 Dell Poweconnect 7024s , 1 Dell PS6000, and a Windows Server (2008 R2). I have more experience in fiber switches and EMC VNX series SANs than I do with the Powerconnect and PS series products, so I have a few questions.

1)The PS6000 has 2 controller cards (the greens) with 4 Ethernet ports each. In this documentation, Section 4.5.1, the image shows all 4 ports of each card connected to the iSCSI network I believe. Additionally it looks like one of the preferred methods to setup these SANs is via the Remote Setup Wizard.

Question: Do people generally not have a dedicated IP/management port to each SP for remote management on these? Is the preferred method to use all 4 ports per controller for iSCSI network traffic, and then just manage the SAN via the Windows Server that will be connected to it? Or should I be able to setup 1 of those ports, possibly the last one of each card, as a separate remote management port?

2)In all diagrams of this setup it seems like I have to have the switches either stacked or LAGed. In the same document, figure 19 in section 4.3.1, shows stack or LAG.

Question: Do I have to have these switches stacked or LAGed for redundancy, or can they remain not connected?

As our client computer team is in the process of creating some Windows 8 images I have been charged with the setup of the KMS host to support this OS. I do currently run a 2003 KMS host that serves Office 2010, Server 2008, and Windows 7. However from looking at this Technet page it would seem that I cannot install Windows 8 or Server 2012 KMS host services on Server 2003. Am I reading that correctly?

EDIT: http://social.technet.microsoft.com/Forums/en-IE/winservergen/thread/476639f4-b8ac-44fa-bc8c-f8adea542bf8

Looks like you won't activating Windows 8 or Windows Server 2012 against a 2003 KMS host.

I have recently setup a development 2008 R2 Remote Desktop Host Server to test Firefox ESR 10.0.3. I can set the options to not check for updates and that works correctly. However a standard user seems to be able to go to Help>about and the application auto updates. I am slightly concerned about this being an Enterprise server. Is something setup incorrectly to not have any UAC trigger with this and disallow an update of the application?

I am trying to determine if my Syslog Collector I just set up in vCenter 5 is working correctly.

According to this VMware KB article and this VMware blog article, everything seems to be up and running but I don't see any data in the data folder.

Things I have checked:

1. The Windows firewall on vCenter has the ports set to allow inc from the Syslog Collector.
2. The service is running
3. The directories are there, the install went OK, no errors.
4. Viewing the Syslog collector in vCenter display setting I set during setup under Home>Administration>Network Syslog Collector> vCenter name. Appears to be listening.

So should I see data under \data right from the start or does something 'bad' have to happen before I see data populate in the folder that Syslog is pointed at? In vCenter there are columns for Host, Logging to, Size listed under Home>Administration>Network Syslog Collector> vCenter name, but I don't see any of my hosts in vCenter listed there.

I am trying to find some settings in GPOs that explicitly say, "Block 3rd Party cookies" in IE. I am looking under policies>admin template>windows components>IE> IE control panel>Security page. Should I look elsewhere for these? I don't really see this under individual zones either. I could possibly do this just by configuring the default user profile's privacy settings but I would rather do this with a GPO. Has anyone does this?

Thanks!

I am in the process of setting up our vSphere 5 environment. With previous version of vSphere I have used the native pathing with VMware but I now want to investigate Powerpath/VE since it now works for v5. Has anyone swapped over to using Powerpath on your hosts and if so have you seen any performance hits/increases?

We are trying to add a device (2008 SP2) to WUG v14.1. The server has the SNMP information setup correctly, the SNMP service is running, and the firewall is disabled. Adding the server to WUG works just fine however no additional information is pulled into WUG. We really want WUG to be able to monitor the trap information off the server but it appears that after WUG queries the server nothing comes back and no information is populated about the server.

Does anyone know what steps we should take next to try and get the server to return information to WUG?

Thanks.

I am working on setting up our vSphere 5 environment. With vSphere 5 you can go > the 2TB VMFS datastore size that you were capped at with in 4.x, etc. What size datastores are people using and whats a good way to determine the correct size?

My environment:

Hosts: I will be using 6 hosts (2 CPUS per w/ 6 cores per) = 72 cores. 192GB RAM per host = 1152GB RAM.

SAN:

VNX5500 with 35TB storage. This is tiered so it has a mix of SSD, SAS, NLS drives.

I saw someone use a formula someplace that looked like this:

(disk pool capacity – 10% free space) / total processors = datastore size

Does that look right? I may setup different levels of pools on the VNX, maybe gold/silver/bronze (which would basically be aimed at a SLA). So using this formula I would have a gold pool of lets say 10TB.

So thats (10TB - 10%) = 9TB (9000) / 72 = 125 so is that 1.25TB per datastore? And I would end up with ~7 datastores on 10TBs of space? Since VMware is aiming at easier managment through few objects, being able to go over 2TB per VMFs 5 DS now this doesn't look right to me?

Any help at all sizing my datastores would be much appreciated.

I am in the planning process of building a new vCenter 5 server. Currently, as a SMB, my host requirements are within range of using the SQL Express install, but my VM count has grown into the lower triple digits. In my current vCenter I have been starting to experience some slowdown while loading the inventory so I am curious if my choice of SQL Express for the vCenter 4.1 install, and the VM inventory count, is causing this. What do you think?

If I do choose to install SQL 2008 R2, vs Express, would I expect to see a more responsive client when logging into vCenter and loading the inventory? As far as growth I don't anticipate going to double digit hosts or greater than 300 VMs. Could just selecting the next radio button up for the SQL Express install, even though I won't hit that amount of hosts/VMs, give better performance?

Patch management (WSUS) hasn't been in my court until recently so I am trying to get acclimated to its functionality. So currently we are using WSUS version 3.2 for our Windows Server patch management. Something I am finding lacking with this system, and maybe because it simply isn't a feature or I am not looking in the correct place, is being notified when patches are applied via email. The only E-Mail notifications I am finding are under Update Services>(Server name) Options and then the E-Mail Notifications settings. From here you can be notified of the synchronization of patches between your WSUS sever and Microsoft and that status report of your environment (summary of the status of your computers by computer groups).

What I want for notifications are, "This computer has just had patch X applied and it was rebooted" in my inbox. Is there a way for WSUS to do this or is this outside of the functionality of WSUS to do? I am looking to do this without purchasing any additional software, just using WSUS/Powershell/etc.

I have a HP KVM Server Console Switch G2 that I am having a problem with. When I try to open up a KVM session with a server I am getting the message, "Error: All video channels in use", and the session will fail to launch. Rebooting the server console switch will then allow sessions to launch after this but inevitably it will return to this state after sitting for a couple of days with no activity... Not to mention it then takes some extra time to get onto the server. Does anyone know how to avoid this error or fix it? The manual didn't have this specific error under troubleshooting and some HP support forums have yet to yield a response.

I have a couple questions about Windows Event Logs and permissions for server 2008 best practice and what Users is in 2008.
I am trying to write EVTLogs off to another drive instead of the default drive. When I redirect the logs to another drive (via rt-click, properties, change path), instead of the default C:, they fail to write unless server\users has access to the folder the logs are writing into. Specifically users have the following permissions: Create files/write data; create folders/append data; traverse folder/execute file; list folder/read data; read attributes; read extended attributes.

If this permissioning isn’t on the folder then, even as an administrator on the server, the folder shows a lock icon on the folder and EVTLogs won’t write to this folder. In 2003 just having SYSTEM with these permissions seems to do the trick but in 2008 that doesn’t seem to be enough. So what exactly is Users break down to being and what are some best practices for writing EVTLogs off to another drive in 2008?

I am trying to get the IPv6 loopback completely disabled/disconnected. Searching the posts here I see everything that I have done so far.

1)Un-check the IPv6 on the adapter which will disable IPv6 for that LAN interface.

2)Add the DisabledComponents DWORD 000000ff

The Pre/Post reboot >netsh interface ipv6 show interface

PRE:

Idx     Met         MTU          State                Name
---  ----------  ----------  ------------  ---------------------------
  1          50  4294967295  connected     Loopback Pseudo-Interface 1
 12          50        1280  disconnected  isatap.{08551F83-B9DE-4FF1-8A21-5B988
00BEC66}
 13          10        1280  connected     6TO4 Adapter
 14          50        1280  connected     Teredo Tunneling Pseudo-Interface

POST:

Idx     Met         MTU          State                Name
---  ----------  ----------  ------------  ---------------------------
  1          50  4294967295  connected     Loopback Pseudo-Interface 1

3)Edited the hosts file to look like:

# localhost name resolution is handled within DNS itself.
    127.0.0.1       localhost
#   ::1             localhost

So is there anything else I can do to disable/disconnect the IPv6 loopback? Netsh still shows the loopback interface connected.

I have started to play around with PowerCLI and therefore created a credentials file to use when I connect to vCenter. The purpose for this will be to run scheduled tasks, such as running the vCheck daily script. I will probably setup a service account for this, that will be a vCenter sever local admin, so I am concerned about the password being in this file.

If you just view the file the password looks encrypted:

AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAF6urzz6JcEKjSIAFn/FxnQAAAAACAAAAAAADZgAAwAAAABAAAACtzPSK0kUeCGX71HGYFXhBAAAAAASAAACgAAAAEAAAAECR1XvUy3U2YgSMrr1bQ tQIAAAAzWWCyBUxfA0UAAAAAsM9vPr/nr+VP1MAekPXKp/wNgw=

After you associate the credentials with a variable ($creds) you can then just view the variable and see the password:

$creds | fl *

Host : test User : test Password : really showing your password here File : your creds file

Is there a way to encrypt this whole file and/or stop this password from being viewed?

As VMware has stated, now is the time! I have started to read up on and plan for our upgrade from vSphere ESX 4.0 to vSphere ESXi 4.1. While I know vSphere 5 should be out sometime this Fall I am pretty sure this initial planning will apply to that version as well. One of my major concerns is that I want to be able to effectively monitor the health status of our hosts. My question is two parts: 1) Should my current setup still work, 2) What are some other suggestions?

My current setup to monitor the health status of our servers, and alert on failures, is a combination of iDRAC6 alerting and WUG (Whats Up Gold) catching SNMP traps. The iDRAC6 can send to the SMTP server and send email if something physical, except for storage events, degrades or fails on the server. The servers are also configured to send SNMP traps to WUG, which does monitor storage events and is a secondary notification on other events. To get this setup I edit the SNMPD.CONF files via the service console, which of course is going away. It looks like the new method to do this, if I try to continue this, is detailed in this VMware KB. Is anyone using the SNMP traps setup to monitor their hardware and done the setup that is described?

The second part to my question is; could there be a better way to monitor the health status of my hosts? I know that there are other methods but, without being argumentative, what are other ways, that might even be better, to monitor the health status of hosts? I have been looking at CIM but I am not sure what sits on the other end and interprets what CIM is saying is wrong. What methods is everyone else using to get this data?

We have been running KMS for a while now and I am curious what clients are currently using this licensing method. I can easily pull the event logs from the server and comma delimited parse them in Excel, but you may have a client that hasn't checked in since the last log was archived. Something that may go hand in hand with this is at least figuring out how many licenses have been given out and how many are remaining in the host key.

Does anyone know if a good way to get the KMS server to tell you what, or how many unique, clients are using the KMS host licensing method?