ThatGraemeGuy's questions

WSUS 3.0 SP2 on Windows Server 2008 R2.

I built a new box to replace my old WSUS box which was still on Server 2003.

All clients using the WSUS server can't find updates and don't report status.

C:\Windows\WindowsUpdate.log on one of the clients:

2013-05-09  10:04:48:629     764    494 AU  Triggering AU detection through DetectNow API
2013-05-09  10:04:48:629     764    494 AU  Triggering Online detection (non-interactive)
2013-05-09  10:04:48:630     764    7b0 AU  #############
2013-05-09  10:04:48:630     764    7b0 AU  ## START ##  AU: Search for updates
2013-05-09  10:04:48:630     764    7b0 AU  #########
2013-05-09  10:04:48:630     764    7b0 AU  <<## SUBMITTED ## AU: Search for updates [CallId = {E7AC5D1F-612A-4879-9B77-83C692868D11}]
2013-05-09  10:04:48:630     764    64c Agent   *************
2013-05-09  10:04:48:630     764    64c Agent   ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
2013-05-09  10:04:48:630     764    64c Agent   *********
2013-05-09  10:04:48:630     764    64c Agent     * Online = Yes; Ignore download priority = No
2013-05-09  10:04:48:630     764    64c Agent     * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
2013-05-09  10:04:48:630     764    64c Agent     * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2013-05-09  10:04:48:630     764    64c Agent     * Search Scope = {Machine}
2013-05-09  10:04:48:630     764    64c Setup   Checking for agent SelfUpdate
2013-05-09  10:04:48:630     764    64c Setup   Client version: Core: 7.6.7600.256  Aux: 7.6.7600.256
2013-05-09  10:04:48:630     764    64c Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2013-05-09  10:04:48:637     764    64c Misc     Microsoft signed: Yes
2013-05-09  10:04:50:897     764    64c Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2013-05-09  10:04:50:901     764    64c Misc     Microsoft signed: Yes
2013-05-09  10:04:50:902     764    64c Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2013-05-09  10:04:50:907     764    64c Misc     Microsoft signed: Yes
2013-05-09  10:04:50:909     764    64c Misc    Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2013-05-09  10:04:50:913     764    64c Misc     Microsoft signed: Yes
2013-05-09  10:04:50:927     764    64c Setup   Determining whether a new setup handler needs to be downloaded
2013-05-09  10:04:50:927     764    64c Setup   SelfUpdate handler is not found.  It will be downloaded
2013-05-09  10:04:50:928     764    64c Setup   Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.256"
2013-05-09  10:04:50:931     764    64c Setup   Setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
2013-05-09  10:04:50:931     764    64c Setup   Evaluating applicability of setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256"
2013-05-09  10:04:50:955     764    64c Setup   Setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
2013-05-09  10:04:50:955     764    64c Setup   Evaluating applicability of setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256"
2013-05-09  10:04:50:990     764    64c Setup   Setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
2013-05-09  10:04:50:990     764    64c Setup   SelfUpdate check completed.  SelfUpdate is NOT required.
2013-05-09  10:04:51:205     764    64c PT  +++++++++++  PT: Synchronizing server updates  +++++++++++
2013-05-09  10:04:51:205     764    64c PT    + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://wsus-server.company.local/ClientWebService/client.asmx
2013-05-09  10:04:51:266     764    64c PT  WARNING: Cached cookie has expired or new PID is available
2013-05-09  10:04:51:266     764    64c PT  Initializing simple targeting cookie, clientId = 9f4df40d-f61e-41d5-9fd2-3cdce1823f45, target group = Servers, DNS name = wsus-server.company.local
2013-05-09  10:04:51:266     764    64c PT    Server URL = http://wsus-server.company.local/SimpleAuthWebService/SimpleAuth.asmx
2013-05-09  10:04:51:286     764    64c PT  WARNING: GetCookie failure, error = 0x8024400D, soap client error = 7, soap error code = 300, HTTP status code = 200
2013-05-09  10:04:51:286     764    64c PT  WARNING: SOAP Fault: 0x00012c
2013-05-09  10:04:51:286     764    64c PT  WARNING:     faultstring:System.Web.Services.Protocols.SoapException: Fault occurred
   at Microsoft.UpdateServices.Internal.SoapUtilities.ThrowException(ErrorCode errorCode, String message, String[] clientIds)
   at Microsoft.UpdateServices.Internal.ClientImplementation.GetCookie(AuthorizationCookie[] authCookies, Cookie oldCookie, DateTime lastChange, DateTime currentClientTime, String protocolVersion)
2013-05-09  10:04:51:286     764    64c PT  WARNING:     ErrorCode:ConfigChanged(2)
2013-05-09  10:04:51:286     764    64c PT  WARNING:     Message:(null)
2013-05-09  10:04:51:286     764    64c PT  WARNING:     Method:"http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
2013-05-09  10:04:51:286     764    64c PT  WARNING:     ID:f50afcf7-2117-495c-9123-9aa4bf683520
2013-05-09  10:04:51:296     764    64c PT  WARNING: Cached cookie has expired or new PID is available
2013-05-09  10:04:51:296     764    64c PT  Initializing simple targeting cookie, clientId = 9f4df40d-f61e-41d5-9fd2-3cdce1823f45, target group = Servers, DNS name = wsus-server.company.local
2013-05-09  10:04:51:296     764    64c PT    Server URL = http://wsus-server.company.local/SimpleAuthWebService/SimpleAuth.asmx
2013-05-09  10:04:55:116     764    64c PT  +++++++++++  PT: Synchronizing extended update info  +++++++++++
2013-05-09  10:04:55:116     764    64c PT    + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://wsus-server.company.local/ClientWebService/client.asmx
2013-05-09  10:04:55:170     764    64c PT  WARNING: GetExtendedUpdateInfo failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200
2013-05-09  10:04:55:170     764    64c PT  WARNING: SOAP Fault: 0x000190
2013-05-09  10:04:55:170     764    64c PT  WARNING:     faultstring:System.Web.Services.Protocols.SoapException: Fault occurred
   at Microsoft.UpdateServices.Internal.SoapUtilities.ThrowException(ErrorCode errorCode, Exception e, Int32 eventLogEntryId, String[] clientIds, Boolean logToEventLog)
   at Microsoft.UpdateServices.Internal.ClientImplementation.GetExtendedUpdateInfo(Cookie cookie, Int32[] revisionIds, XmlUpdateFragmentType[] fragmentTypes, String[] locales)
2013-05-09  10:04:55:170     764    64c PT  WARNING:     ErrorCode:InternalServerError(5)
2013-05-09  10:04:55:170     764    64c PT  WARNING:     Message:(null)
2013-05-09  10:04:55:170     764    64c PT  WARNING:     Method:"http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetExtendedUpdateInfo"
2013-05-09  10:04:55:170     764    64c PT  WARNING:     ID:37740867-4b9f-4394-b58b-12aad48d7b97
2013-05-09  10:04:55:170     764    64c PT  WARNING: PTError: 0x8024400e
2013-05-09  10:04:55:170     764    64c PT  WARNING: GetExtendedUpdateInfo_WithRecovery: 0x8024400e
2013-05-09  10:04:55:170     764    64c PT  WARNING: Sync of Extended Info: 0x8024400e
2013-05-09  10:04:55:170     764    64c PT  WARNING: SyncServerUpdatesInternal failed : 0x8024400e
2013-05-09  10:04:55:171     764    64c Agent     * WARNING: Exit code = 0x8024400E
2013-05-09  10:04:55:171     764    64c Agent   *********
2013-05-09  10:04:55:171     764    64c Agent   **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
2013-05-09  10:04:55:171     764    64c Agent   *************
2013-05-09  10:04:55:171     764    64c Agent   WARNING: WU client failed Searching for update with error 0x8024400e
2013-05-09  10:04:55:180     764    bf4 AU  >>##  RESUMED  ## AU: Search for updates [CallId = {E7AC5D1F-612A-4879-9B77-83C692868D11}]
2013-05-09  10:04:55:180     764    bf4 AU    # WARNING: Search callback failed, result = 0x8024400E
2013-05-09  10:04:55:180     764    bf4 AU    # WARNING: Failed to find updates with error code 8024400E
2013-05-09  10:04:55:180     764    bf4 AU  #########
2013-05-09  10:04:55:180     764    bf4 AU  ##  END  ##  AU: Search for updates [CallId = {E7AC5D1F-612A-4879-9B77-83C692868D11}]
2013-05-09  10:04:55:180     764    bf4 AU  #############
2013-05-09  10:04:55:180     764    bf4 AU  Successfully wrote event for AU health state:0
2013-05-09  10:04:55:180     764    bf4 AU  AU setting next detection timeout to 2013-05-09 13:04:55
2013-05-09  10:04:55:181     764    bf4 AU  Successfully wrote event for AU health state:0
2013-05-09  10:04:55:181     764    bf4 AU  Successfully wrote event for AU health state:0
2013-05-09  10:05:00:171     764    64c Report  REPORT EVENT: {1C2D6590-41BD-464D-AE18-289CB7D6E254}    2013-05-09 10:04:55:171+0200    1   148 101 {00000000-0000-0000-0000-000000000000}  0   8024400e    AutomaticUpdates    Failure Software Synchronization    Windows Update Client failed to detect with error 0x8024400e.
2013-05-09  10:05:00:191     764    64c Report  CWERReporter::HandleEvents - WER report upload completed with status 0x8
2013-05-09  10:05:00:191     764    64c Report  WER Report sent: 7.6.7600.256 0x8024400e 00000000-0000-0000-0000-000000000000 Scan 101 Managed
2013-05-09  10:05:00:191     764    64c Report  CWERReporter finishing event handling. (00000000)

I found several old blogs and forum entries that link this to a fault in Office 2003 SP1, with the fix being to decline/approve/decline that update, but this hasn't fixed it for me.

The Microsoft WSUS client & server diagnostic tools don't run on x64 systems.

Anybody had any luck with this before?

update: I find this in C:\Program Files\UpdateServices\LogFiles\SoftwareDistribution.log:

2013-05-13 14:02:46.437 UTC Warning w3wp.6  SoapUtilities.CreateException   ThrowException: actor = http://wsus-server.company.local/ClientWebService/client.asmx, ID=4db89865-40da-4520-a126-d196e3db07b6, ErrorCode=ConfigChanged, Message=, Client=d9ce7281-379b-49b8-8944-7f593c32397b
2013-05-13 14:02:50.867 UTC Error   w3wp.6  ClientImplementation.GetExtendedUpdateInfo  System.ArgumentException: The database does not contain a URL for the file 3F7E7915F44A6133B990A22A87604854C34BDF4E.

Google fails me completely if I search for "3F7E7915F44A6133B990A22A87604854C34BDF4E", so I'm not sure exactly what that is, but it seems that its DB entry is somehow incomplete. Sync logs with the upstream WSUS show no errors.

update 2: So it seems as if there's something weird with my upstream. I've found that if I install a new WSUS instance & sync it from Microsoft, all works perfectly well. If I make it a downstream replica of my existing WSUS server, either during the configuration, or afterwards, it breaks. Even more strange, my upstream itself and another existing replica appear to be functioning just fine. It looks as if I'm just going to build new WSUS instances in all 3 sites and start fresh, ignoring the existing upstream.

update 3: I built a new WSUS upstream server, started clean so as to not bring over whatever weirdness was going on in the original upstream's DB. Pointed my 2 replicas at my new upstream. Everything was fine for several days. 5 days ago the replicas stopped getting status updates from clients again. WTF?!?!

update 4: I have logged a support request with Microsoft on this, hopefully some good will come out of it.

update 5: After Microsoft product support spent countless hours checking and re-checking all the same stuff I'd already checked, I suspect I have stumbled upon the cause. Our Junior sysadmin recently discovered Local Update Publisher and started using it to push Adobe & Java updates to workstations. The time of Local Update Publisher's installation coincides perfectly with the time the downstream clients last reported status. I am going through the product documentation to determine what I need to do to fix this.

I have an oldish (physical) Windows Server 2003 R2 box, which is a file/print server. I suspect the RAID card has gone bye-bye, after a reboot Windows is checking the data volume, its been 1.5 hours or so. I'm starting to prep for the worst and I have a few questions.

First up, I have extensive experience running Windows shops up until the 2003 R2 sort of time period. At my current job we're mostly running Ubuntu for applications, with Windows servers fulfilling background roles like AD, file & print, DNS, DHCP, etc. As a result, I have not kept pace with the finer details of Windows Server 2008 and above.

Some config and other info that's relevant:

• This server had its RAID volume split into 2 partitions, C: = the OS, D: = the data.
• Only the data (D:) volume is backed up. We use Bacula for this. The last backup was 24 hours ago, so the worst case is that I lose 1 day of changes to data.
• There's as near as makes no difference 1TB of data.
• Our MS licensing is all good, such that I can install the very latest server OS if I want.
• I have a VMware cluster in this site, I'll be building a new VM to be the replacement file server.
• This file server was involved in some domain DFS-related stuff, namely:
  • It did not host any DFS namespaces, only targets
  • It hosted 2 folder targets under DFS namespace A. Neither of these targets were replicated to other server.
  • It hosted 2 folder targets under DFS namespace B. Both of these are replicated *using DFS-R, not NTFRS) to a server at a remote site, which is still fully operational.

First, I'm planning to use Windows Server 2008 R2 for the replacement file server, as I think 2012 is still a bit too new, especially for someone who hasn't kept up with the finer details of the newer releases. Are there any gotchas I should look out for when adding the new 2008 R2 server to the existing DFS setup?

Second, my VMware datastores support a maximum virtual disk size of 512GB. Since I need at least 1TB, what's the typical way to do this? Create multiple virtual disks and create a Windows striped volume on top of them?

Third, how do I go about restoring data and joining the existing DFS-R setup without generating a massive amount of replication traffic between here and the remote site?

I'm looking to replace 2x aging servers in a small branch office. 1 is a DC and 1 a file server.

I'd like to do high availability on a small budget, and in my mind I have 2 scenarios:

• Run ESXi on both, with vSphere Storage Appliance. Have 1x DC VM and 1x file server VM.
• Run ESXi free on both, no vSphere Storage Appliance. Have a DC and file server on each, and use DFS on all file server data for high availability.

VSA seems easy enough, and I have tons of experience with DFS, so from a technical point of view I don't really have strong leanings either way. When you boil it down the difference between these setups is the additional licensing cost to run vSphere Storage Appliance.

My real question is therefore this: is there any compelling technical reason that the solution involving VSA would be better in this instance?

We have Exchange 2010 with a number of resource mailboxes for various rooms. When user's view the room's calendar via the scheduling assistant they can only see if the room is busy or not, they can't see the meeting organiser or subject.

We want to make full details available for some rooms. For a normal user's calendar you just change the "Permissions" tab of the calendar's properties dialog. Would we need to do the same thing for a room's calendar, i.e. log on to a Windows PC, set up Outlook and then adjust the permissions? Or is there some PowerShell magic command I have not discovered?

Lets say we have 2 domains, domain1.co.za and domain2.co.za. Both point to the same MX records with the same priority, mx1.isp.co.za and mx2.isp.co.za, both of which send the mail through our ISP's filtering/scanning service. From there, mail for both domains is delivered to our on-premises Exchange server using SMTP. In other words, the routing for messages sent to both domains is exactly the same.

• We are seeing consistent failed delivery of messages sent from Gmail to domain1.co.za, but only for some Gmail users. For some Gmail users, messages are consistently delivered to domain1.co.za.
• On the other hand, messages sent to domain2.co.za are delivered consistently, even when sent by Gmail users whose mail is failing to domain2.co.za.

A bounce message for messages sent to domain1.co.za looks like this:

Delivery to the following recipient failed permanently:

     [email protected]

Technical details of permanent failure:=20
Google tried to deliver your message, but it was rejected by the recipient =
domain. We recommend contacting the other email provider for further inform=
ation about the cause of this error. The error that the other server return=
ed was: 571 571 Server listed in SpamCop RBL (state 14).

----- Original message -----

Received: by 10.182.75.65 with SMTP id a1mr18153847obw.32.1326873881149; We=
d,
 18 Jan 2012 00:04:41 -0800 (PST)
MIME-Version: 1.0
Received: by 10.60.8.3 with HTTP; Wed, 18 Jan 2012 00:04:00 -0800 (PST)
X-Originating-IP: [41.134.138.227]
From: Graeme Donaldson <[email protected]>
Date: Wed, 18 Jan 2012 10:04:00 +0200
Message-ID: <[email protected]=
il.com>
Subject: test
To: [email protected]
Content-Type: text/plain; charset=3DISO-8859-1

By contrast, the SMTP headers from a successfully delivered email look like this:

Received: from mx2.isp.co.za (196.x.y.z) by mail.domain1.co.za
 (172.x.y.z) with Microsoft SMTP Server id 14.1.323.3; Wed, 18 Jan 2012
 10:23:23 +0200
Received: from mail-qy0-f175.google.com (Not Verified[209.85.216.175]) by
 mx2.isp.co.za with MailMarshal (v6,8,4,9558)   id <B4f16817a0000>; Wed,
 18 Jan 2012 10:23:22 +0200
Received: by qcsp14 with SMTP id p14so2850129qcs.34        for
 <[email protected]>; Wed, 18 Jan 2012 00:23:21 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
        h=mime-version:date:message-id:subject:from:to:content-type;
        bh=oC4vJzzjAUASBEWdam7JzvNUOB1qoyAUm0ztpK7fjwA=;
        b=I/A2jur39kdKCzu57CHzHzeJNbVqcb/e7WV8SDyulEJTKd942OrM+QYkvF8G5Xwkz4
         ssZ/p/geoqop0dgTAvoCMcdE1escL3UH3ob3k3Vgs4FqH2aKWYT7LqG3Eb53Z4Kl++K8
         D3sD0I8Eb2nZEPLR2pR0K7s8WAtnGb/XgJAws=
MIME-Version: 1.0
Received: by 10.229.76.91 with SMTP id b27mr8321239qck.124.1326875001168; Wed,
 18 Jan 2012 00:23:21 -0800 (PST)
Received: by 10.229.250.66 with HTTP; Wed, 18 Jan 2012 00:23:21 -0800 (PST)
Date: Wed, 18 Jan 2012 10:23:21 +0200
Message-ID: <CANFFNku=7OMQZxXd18LtiA7x7V+uj=wiQkKKdA8F_LhwFwiLVw@mail.gmail.com>
Subject: test
From: User <[email protected]>
To: <[email protected]>
Content-Type: multipart/alternative; boundary="001d605b95931b230b04b6c92924"
Return-Path: [email protected]
X-MS-Exchange-Organization-AuthSource: exch.ad.local
X-MS-Exchange-Organization-AuthAs: Anonymous

Comparing the SMTP headers, I note that there are 3 "Received:" headers that seem to be entirely within Google's network, with the 4th "Received:" header being the first time it breaks out of Google's network. Looking at the bounce message, it only has 2 "Received:" headers, which makes me think this failure is within Google's network.

Google is notoriously uncontactable for stuff like this so I'm hoping someone else has seen something similar. Has anyone had a similar issue?

I've never seen this before, neither have a colleague and an ex-colleague, both with a reasonably strong background in smallish ISP operations.

What causes so many duplicate ICMP ECHO responses?

$ ping -n x.com
PING x.com (196.x.y.z) 56(84) bytes of data.
64 bytes from 196.x.y.z: icmp_req=1 ttl=120 time=51.8 ms
64 bytes from 196.x.y.z: icmp_req=1 ttl=120 time=51.8 ms (DUP!)
64 bytes from 196.x.y.z: icmp_req=1 ttl=120 time=52.3 ms (DUP!)
64 bytes from 196.x.y.z: icmp_req=1 ttl=120 time=52.7 ms (DUP!)
64 bytes from 196.x.y.z: icmp_req=1 ttl=120 time=53.6 ms (DUP!)
64 bytes from 196.x.y.z: icmp_req=2 ttl=120 time=92.2 ms
64 bytes from 196.x.y.z: icmp_req=2 ttl=120 time=92.6 ms (DUP!)
64 bytes from 196.x.y.z: icmp_req=2 ttl=120 time=93.0 ms (DUP!)
64 bytes from 196.x.y.z: icmp_req=2 ttl=120 time=93.4 ms (DUP!)
64 bytes from 196.x.y.z: icmp_req=2 ttl=120 time=93.8 ms (DUP!)

With VMFS5 no longer having the 2TB limit for a VMFS volume, I'm considering which scenario would be more beneficial overall:-

• Less LUNs of larger size, or
• More LUNs of smaller size.

In my case, I have a new 24-disk storage array with 600GB disks. I'll be using RAID10, so roughly 7.2TB, and trying to decide whether to go with 1 big 7TB datastore, or multiple stores of 1TB each.

What are the pros and cons of each approach?

Update: Of course, I neglected to include hot spares in my calculation, so it'll be just under 7.2TB, but the general idea is the same. :-)

Update 2: There are 60 VMs and 3 hosts. None of our VMs are particularly I/O intensive. Most of them are web/app servers, and also things like monitoring (munin/nagios), 2 Windows DCs with minimal load, and so on. DB servers are rarely virtualised unless they have VERY low I/O requirements. Right now I think the only virtual DB server we have is an MSSQL box and the DB on that box is <1GB.

Update 3: Some more info on the array and FC connectivity. The array is an IBM DS3524, 2 controllers with 2GB cache each. 4x 8Gbit FC ports per controller. Each ESXi host has 2x 4Gbit FC HBAs.

I'm in the process of moving user mailboxes over to our newly commissioned Exchange 2010 setup.

We have:

• Exchange 2007 in Site A, accessed using mail.oldname.com internally and externally
• Exchange 2010 in Site B, accessed using mail.newname.com internally and externally

I have already moved a few mailboxes over to the 2010 server, now those who are still on the 2007 server cannot view the free/busy info of those on the 2010 server. This happens whether I use Outlook or OWA.

Users on the 2010 server can view free/busy information for anyone.

I have used Outlook's "Test Email Autoconfiguration" menu to test AutoDiscover for email addresses on both 2010 and 2007, and everything appears to be perfectly fine.

Does anyone have any more pointers?

Update: found the following event log item on the 2010 box:

Log Name:      Application
Source:        MSExchange Availability
Date:          2011/08/30 01:40:15 PM
Event ID:      4010
Task Category: Availability Service Authentication
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      exch2010.company.local
Description:
Process Microsoft.Exchange.InfoWorker.Common.Delayed`1[System.String]: Request from S-1-5-21-123456789-1234567890-1234567890-1234 failed security checks.

According to http://technet.microsoft.com/en-us/library/ff360723(EXCHG.140).aspx, MS PSS is my only hope. :-(

We have an existing Exchange 2007 server in Site A (exch07). I've installed an Exchange 2010 server in Site B (exch10). Both servers have the CAS, Mailbox and Hub roles.

Messages sent via SMTP on exch10 which are destined for mailboxes on exch07 are queued with the "Last Error" reported in Queue Viewer as '451 4.4.0 Primary target IP address responded with: "451 5.7.3 Cannot achieve Exchange Server authentication." Attempted failover to alternate host, but that did not succeed. Either there are no alternate hosts, or delivery failed to all alternate hosts.'

I've found that some people have resolved this by creating new Receive Connectors which are scoped specifically to apply to connections from the remote hub/s, but I have had no luck doing this. Specifically I created new receive connectors on both servers with the following settings:

• Remote IP = IP/s of remote server
• Authentication = "Transport Layer Security (TLS)" and "Exchange Server authentication"
• Permission Groups = "Exchange servers" and "Legacy Exchange Servers"

This made no difference, I see the same error message.

What am I missing?

Update: We noticed that the Application log had this error message from MSExchangeTransportService: Microsoft Exchange could not find a certificate that contains the domain name exch07.domain.local in the personal store on the local computer. Therefore, it is unable to support the STARTTLS SMTP verb for the connector exch10 with a FQDN parameter of exch07.domain.local. If the connector's FQDN is not specified, the computer's FQDN is used. Verify the connector configuration and the installed certificates to make sure that there is a certificate with a domain name for that FQDN. If this certificate exists, run Enable-ExchangeCertificate -Services SMTP to make sure that the Microsoft Exchange Transport service has access to the certificate key.

It turns out that the default self-signed certificate was no longer enabled for the SMTP service for some reason. After enabling the self-signed certificate for SMTP, we no longer get the error in the event logs, but delivery is still failing with the same error message.

Update 2: I put a mailbox on exch10 and attempted to deliver a message via SMTP on exch07 and I get the same error.

We currently have postfix handling emails generated by a number of apps. A number of these emails are destined for users inside the organisation, whose mail is on an Exchange server in the same site as the postfix box.

I'm looking for a way to do this, but my Google-fu is letting me down:

If the recipient domain is one of our domains, deliver the mail to host mail.example.com. All other mail is delivered by looking up the MX record/s and processing normally.

Edit: to clarify, the apps generating the emails are sending to users outside of our organisation too, postfix is not receiving mail at all.

I've read this, and I'm still not 100% on this.

If our Exchange server is hosting email for multiple authoritative domains, do I need matching SAN names on the SSL certificate for each one?

In our setup the AD domain is company.local, the email domain for most people is company.com, but we also have some people that have email addresses @othercompany.com.

So when I buy the SSL certificate, I assume I would need:

• mail.company.com
• autodiscover.company.com
• legacy.company.com
• mail.othercompany.com
• autodiscover.othercompany.com
• legacy.othercompany.com

Is that right?

Has anyone got their Linux systems authenticating against Active Directory without using Likewise Open?

We are close to implementing Likewise Open, but first we need to rename roughly 70 of 110 Linux servers so that their hostnames are not longer than 15 characters. This is required because Likewise Open actually joins the Linux computer to the domain, and it fails to do so if the hostname is too long due to some legacy NetBIOS naming limitation.

• Is there a way to authenticate via AD, using only LDAP perhaps?
• What are the advantages/disadvantages over doing it like that vs just using Likewise?

I'm in the process of putting together a puppet recipe which will install Likewise Open on Linux machines and join them to a specific OU in our AD structure.

Since the only practical way to do this involves storing the credentials of an AD user in plain text in the puppet manifest, I want to create a dedicated AD user which only has rights to join computers to a specific OU.

I recall doing something like this years ago but I'm a little rusty on the details.

I have already created an AD user and made sure it is in the Domain Guests group rather than Domain Users, but I'm not sure of the exact details I should use when I delegate rights to this user on the OU.

Can someone tell me the specific options and rights I need to use in the Delegate Control wizard?

I'm still getting to grips with puppet and starting to mess around with templating, which is based on Ruby's ERB system. I am not familiar with Ruby in general, does anyone know of a cheat sheet for ERB or will I need to get my hands dirty and learn some Ruby basics?

We have a custom file for logcheck ignore patterns. Today I decided to add another one but it isn't working as smoothly as I'm used to.

What I normally do is craft a regular expression that will match the line(s) I need to ignore using egrep, and then just put the regex in the /etc/logcheck/ignore.d.server/local file. This time it's not working and I'm stumped as to why.

These are the types of entries I want to exclude:

Oct 19 17:32:15 box sudo: pam_unix(sudo:session): session opened for user logcheck by graeme(uid=0)
Oct 19 17:32:15 box sudo: pam_unix(sudo:session): session closed for user logcheck

This is my regex pattern:

^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sudo: pam_unix\(sudo:session\): session (opened|closed) for user [a-z0-9.-]+( by [a-z0-9.-]+\(uid=[0-9]+\))?$

Nothing too hectic, and using that pattern with egrep on the /var/log/auth.log file shows me all the lines I want ignored. Anyone have any pointers as to why logcheck isn't ignoring the lines?

It's not uncommon to see entries in Windows ACLs (NTFS files/folders, registry, AD objects, etc.) with the name "Account Unknown (SID)". Obviously these are because of old AD users or groups which at some point had permissions manually configured on the relevant object and have since been deleted.

Does anyone know if it is safe to remove these "Account Unknown" ACEs?

My gut feeling is that it should be just fine, but I'm wondering if anyone has any past experiences where doing this has caused trouble?

Normally I just ignore these, but the company I'm working at now seems to have an abnormal number of these, most likely due to past admins' inexperience with AD/Windows and assigning permissions to user accounts rather than groups in all sorts of weird places.

FWIW, our environment is not complex, a single domain forest, 4 DCs in 3 sites, with all network connectivity and replication healthy, so I'm certain that these "Account Unknown" entries are really old accounts, and not just because of some failure to resolve the SID to a human-readable name.

We have an application which uses a DNS wildcard, i.e. *.app.example.com. We're using Apache 2.2 on Ubuntu Hardy. The relevant parts of the Apache config are as follows.

In /etc/apache2/httpd.conf:

LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vlog

In /etc/apache2/sites-enabled/app.example.com:

ServerName app.example.com
ServerAlias *.app.example.com
...
CustomLog "|/usr/sbin/vlogger -s access.log /var/log/apache2/vlogger" vlog

Clients access this application using their own URL, e.g. company1.app.example.com, company2.app.example.com, etc.

Previously, the %v in the LogFormat directive would match the hostname of the client request, and we'd get several subdirectories under /var/log/apache2/vlogger corresponding to the various client URLs in use.

Now, %v appears to be matching the ServerName value, so we only get one log under /var/log/apache2/vlogger/app.example.com. This breaks our logfile analysis because the log file has no indication of which client the log relates to.

I can fix this easily by changing the LogFormat to this:

LogFormat "%{Host}i %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vlog

This will use the HTTP Host: header to tell vlogger which subdirectory to create the logs in and everything will be fine.

The only concern I have is that this has worked in the past and I can't find any indication that this has changed recently.

Is anyone else using a similar config, i.e. wildcard + vlogger and using %v? Is it working fine?

Does anyone know of a way to insert holidays from a .hol file into the Outlook calendars of all our users?

I know that Outlook has holidays for all countries which just need to be manually added by the user. In South Africa, holidays which fall on a Sunday cause the following Monday to be a holiday as well, which Outlook's standard holiday list does not take into account.

We have a custom .hol file which adds these bonus Monday holidays, but I can't find a way to add these to the calendars for all users without user intervention.

The command line option outlook.exe /hol <file.hol> is the closest I've come to a solution, but it still requires user confirmation.

Clients are using Outlook 2003/2007 and the server is Exchange 2007.

Edit: To clarify, this needs to be done in the user's security context, via a login script or similar. I cannot do this server-side due to mailbox permissions which cannot be changed for non-technical reasons.

Is there a way for Ubuntu/Samba to access a DFS path on our Windows file server?

I'm primarily a Windows guy and my Ubuntu colleagues have to access the file server using regular \\server\share paths, rather than \\domain\dfsnamespace\target.

I'm trying to use Group Policy Preferences to manage user connections to shared printers.

The print server is Windows Server 2003 R2 Std edition. Several printers are installed, and I've added x64 editions of all the drivers to the print server as well.

I've created a new GPO containing the printer preference settings. Printer mappings are targeted based on AD security group membership.

I log on to a Windows XP PC with the Group Policy CSEs installed and the printer maps perfectly.

I log on to a Windows 7 x64 PC and it doesn't map. If I manually connect to the shared printer, I get a prompt which asks me to confirm if I trust the server before installing the driver, and then it works perfectly.

I have domain admin rights and my UAC settings have not been changed from the default, i.e. UAC is enabled and the default level is selected.

Is the printer mapping failing because it's unable to prompt me to install the driver, or is there something else afoot?