Sam Cogan's questions

We're using PowerShell DSC to automate the deployment of a number of small self contained environments, in these environments we are deploying 2 domain controllers and use DSC to setup the domain etc. This is all working fine except for the fact that once deployed and running, at some point the sysvol replication between the two DC's stops working (or it never started working). We see this error in the log:

The DFS Replication service initialized SYSVOL at local path F:\SYSVOL\domain and is waiting to perform initial replication. The replicated folder will remain in the initial synchronization state until it has replicated with its partner . If the server was in the process of being promoted to a domain controller, the domain controller will not advertise and function as a domain controller until this issue is resolved. This can occur if the specified partner is also in the initial synchronization state, or if sharing violations are encountered on this server or the sync partner. If this event occurred during the migration of SYSVOL from File Replication service (FRS) to DFS Replication, changes will not replicate out until this issue is resolved. This can cause the SYSVOL folder on this server to become out of sync with other domain controllers.

Now I know how to fix this using ADSIEdit, that's not the issue. We're autoamting the deployment of these environments because we need to deploy lots of them and configure them identically, so I don't really want to have to go into each environment after deployment to fix this. We see this issue in every environment we deploy this way, so obviously something is amiss in how it's getting configured. So what I am really asking is if anyone has any ideas what could cause this, or where to start looking to try and find the root cause.

The AD deployment is pretty straight forward, we configure DC1 first, add some DNS entries, some group policy items, some user, groups and OU's, we then add in the second DC. The second DC does get all these objects, so the initial copy of the domain does work, but after that nothing in SYSVOL get's replicated.

Edit

We also see a single instance of the error below, ID 1202, at deployment time, which is odd given that DC prom succeeds and it is able to get teh inital copy of the domain;

The DFS Replication service failed to contact domain controller to access configuration information. Replication is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.
Additional Information: Error: 1355 (The specified domain either does not exist or could not be contacted.)

I have a set of Azure Resource Manager and DSC scripts that I use to deploy a new VM to Azure and then make it a domain controller for a new domain, these have worked fine for some time, but it's now failing the DSC part.

I believe the issue is down to the alias assigned to the VM's network interface. My DSC script has the following section to change the VM's to point to its self for DNS:

  xDnsServerAddress DnsServerAddress 
        { 
            Address        = '127.0.0.1' 
            InterfaceAlias = 'Ethernet'
            AddressFamily  = 'IPv4'
        }

The problem seems to occur because the virtual machines network interface is actually created with an Alias of "Ethernet 2" or "Ethernet 3", and the alias needs to match. There are no other network cards in the VM, and at no point have I added any. The thing that makes it more odd is that if I try and rename this network interface to "Ethernet" it tells me there is already a network interface with that name, even though I can find no reference to this.

So, to get this work to work I need to either find out why the interface is not just being named "Ethernet" or a way to write the DSC script so that it it can set the DNS for the only network interface on the machine. Any ideas.

Edit:

This seems to be related to the fact that device manager has labled the NIC as network adapter #2, but there is no adapter #1 nor can I see any reason why any would have been added during the deployment process. This seems to occur on all the VM's in this deployment (but it only breaks the DC).

I have included the ARM script I use to create this below as well, its pretty much take straight from the MS Github templates.

{
      "apiVersion": "2015-05-01-preview",
      "type": "Microsoft.Network/networkInterfaces",
      "name": "dc-nif",
      "location": "[resourceGroup().location]",
      "dependsOn": [
        "Microsoft.Network/virtualNetworks/vnet"
      ],
      "properties": {
        "ipConfigurations": [
          {
            "name": "ipconfig",
            "properties": {
              "privateIPAllocationMethod": "Static",
              "privateIPAddress": "[variables('dnsServerPrivateIp')]",
              "subnet": {
                "id": "[variables('BackEndSubnet-id')]"
              }
            }
          }
        ]
      }
    },

    {
      "apiVersion": "2015-05-01-preview",
      "type": "Microsoft.Compute/virtualMachines",
      "name": "dc-vm",
      "location": "[resourceGroup().location]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts',parameters('newStorageAccountName'))]",
        "[resourceId('Microsoft.Network/networkInterfaces','dc-nif')]"
      ],
      "properties": {
        "hardwareProfile": {
          "vmSize": "Standard_A2"
        },
        "osProfile": {
          "computername": "dc",
          "adminUsername": "[parameters('adminUsername')]",
          "adminPassword": "[parameters('adminPassword')]"
        },
        "storageProfile": {
          "imageReference": {
            "publisher": "[variables('imagePublisher')]",
            "offer": "[variables('imageOffer')]",
            "sku": "[variables('imageSku')]",
            "version": "latest"
          },
          "osDisk": {
            "name": "osdisk",
            "vhd": {
              "uri": "[concat('http://',parameters('newStorageAccountName'),'.blob.core.windows.net/vhds/dc-vm-os-disk.vhd')]"
            },
            "caching": "ReadWrite",
            "createOption": "FromImage"
          },
          "dataDisks": [
            {
              "name": "dc-vm-data-disk",
              "vhd": {
                "Uri": "[concat('http://',parameters('newStorageAccountName'),'.blob.core.windows.net/vhds/dc-vm-data-disk.vhd')]"
              },
              "caching": "None",
              "createOption": "Empty",
              "diskSizeGB": "100",
              "lun": 0
            }
          ]
        },
        "networkProfile": {
          "networkInterfaces": [
            {
              "id": "[resourceId('Microsoft.Network/networkInterfaces','dc-nif')]"
            }
          ]
        }
      },
      "resources": [
        {
          "type": "Microsoft.Compute/virtualMachines/extensions",
          "name": "dc-vm/createadforest",
          "apiVersion": "2015-05-01-preview",
          "location": "[resourceGroup().location]",
          "dependsOn": [
            "[resourceId('Microsoft.Compute/virtualMachines', 'dc-vm')]"
          ],
          "properties": {
            "publisher": "Microsoft.Powershell",
            "type": "DSC",
            "typeHandlerVersion": "1.10",
            "settings": {
              "ModulesUrl": "https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/active-directory-new-domain/CreateADPDC.ps1.zip",
              "ConfigurationFunction": "CreateADPDC.ps1\\CreateADPDC",
              "Properties": {
                "DomainName": "[parameters('domainName')]",
                "AdminCreds": {
                  "UserName": "[parameters('adminUsername')]",
                  "Password": "PrivateSettingsRef:AdminPassword"
                }
              }
            },
            "protectedSettings": {
              "Items": {
                "AdminPassword": "[parameters('adminPassword')]"
              }
            }
          }
        }
      ]
    },

Does anyone know what controls the outbound ip address of a VM in an ARM deployment? The deployment I am working on has only a single public ip which is assigned to a load balancer. Some VM's are using this public ip as their outbound ip and some are not and there does not seem to be any logic in why. Ideally I want all vm's (which are a mixture of A nd D series) to use the same outbound ip, is this possible?

I'm using the DSC Extension in Azure to configure the VM's and on first deployment that works fine. However, if I've made an error in the DSC script or need to amend it I am having trouble understanding how to force the VM to download the new configuration.

My DSC files are stored in Azure blob storage as required by the extensions, so I am uploading a new version of the zip here. Should this automatically trigger the VM to download the new file, or do I need to run a command to do so?

I'm trying to script the setup of a remote desktop deployment into Azure. I'm using Powershell remoting to connect to the WinRM endpoint on the VM's and execute remote Powershell. For the most part this works fine and has allowed me to configure teh servers, install applicaitons etc.

However, when I come to actually install the Remote desktop components using the New-RDSessionDeployment command I run into problems. There are 2 servers in this deployment:

• RD-GTW, that will host the remote desktop gateway and web access services
• RD-RDS, that will host a session host and connection broker

I am running the New-RDSessionDeployment command against the RD-GTW server (using invoke-command) as follows

New-RDSessionDeployment -ConnectionBroker RD-RDS.domain.local  -WebAccessServer RD-GTW.domain.local   -SessionHost RD-RDS.domain.local

This then comes back with an error:

Validation failed for the "RD Connection Broker" parameter.
RD-RDS1.domain.local      Unable to connect to the server by using Windows PowerShell remoting. Verify that you
can connect to the server.
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,New-RDSessionDeployment
    + PSComputerName        : ServiceName-svc1.cloudapp.net

Now what I believe is happening here is a problem with the fact that New-RDSessionDeployment its self makes a remote powershell connection that that server, so I have a remote connection making a remote connection, and so see a double hop issue. I have tried setting up CREDSSP authentication to allow for a double hope of credentials between the two, however I don't seem to be able to get this configuration working, as I am running the scripts from a desktop (on my corporate domain) and connecting to servers in Azure, so I think I am missing an SPN or similar, but not sure where.

Any suggestions on whether my assumptions are correct, and what to do about the issue are appreciated.

I've been banging my head against this for the last few days. I have a server 2012 remote desktop setup as follows:

• 1 Gateway Server
• 1 RD Web Access Serve
• 1 Session Broker, which is also a session host
• 1 Additional Session host

I'm using remote app to publish applications rather than desktops. I've got a wildcard certificate for the external domain, which works fine for the gateway and web access server, the problem comes with the session hosts, which are giving me a certificate mismatch error because connections are made to the internal name (which is a .local address) which obviously does not match the external certificate.

I have a DNS zone for the external name setup on this domain, so that machines can be resolved by internal or external names.

I've made some progress by following the steps here, and things now work fine if I only have the session host that is also the broker enabled. Once I add the second session host, any requests that go to that get the certificate error. Connections to the first session host still work fine.

Does anyone know a way to have requests be made to the external name of the session host?

I'm trying to restrict who can access our RD Gateway based on both their group membership and IP address (so people in group A can only access the system from IP address X). The Network Policy Server installed by the RD Gateway seems to imply that this can be done, there is a setting to restrict access based on Client IP Address, however this does not seem to work correctly.

If I add an IP address restriction, the users cannot connect even if they have the right IP, removing that restriction means they can then connect. Looking at the audit log, it appears that the IP address isn't present there.

Does anyone know how to make this work?

I'm trying to install the remote desktop web access role in server 2012, a simple task you might think, however whenever I try to do this, I get this error:

add-windowsfeature : The request to add or remove features on the specified server failed.
Installation of one or more roles, role services, or features failed.
The specified module could not be found. Error: 0x8007007e
At line:1 char:1
+ add-windowsfeature rds-web-access
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (@{Vhd=; Credent...Name=localhost}:PSObject) [Install-WindowsFeature],
    Exception
    + FullyQualifiedErrorId : DISMAPI_Error__Failed_To_Enable_Updates,Microsoft.Windows.ServerManager.Commands.AddWind
   owsFeatureCommand

This is from trying to install via powershell, but I get the same error via the GUI and using DISM.

This is a fresh out of the box server 2012 server. I have wiped and re-installed windows to no avail. I have tried using Dism with the sources switch to point to the 2012 media, same issue. The server is connected to a WSUS server for updates, but I have added the registry keys so that it can use Windows Update for any feature content it needs, I have also moved it to not use the WSUS server and go straight to Windows update, same issue.

Other features install fine (RD gateway for example) but I cannot get RD web access to install. I have also manually installed all the pre-req components (iis, asp.net 4.5 etc) and the error still occurs.

Any suggestions greatly appreciated.

Is anyone aware of a way to limit the number of hosts allowed on single Hyper-V host? Either by quantity or resource usage?

We are planning on using SCVMM and MS Lab Manager for a development lab setup. This is for testing a distributed application that requires lots of worker nodes. These worker nodes are likely to be (pretty high spec) workstations, so I am trying to avoid some one using the lab management console to deploy an environment and overloading these nodes.

I've got an issue with receiving an access denied error when trying to access a folder via UNC on another machine, from a web application running in IIS. Now i'm sure your thinking, as I did, this is surely just a permissions problem, however the following has happened:

• The application is using impersonation and the user it is impersonating has full access to that folder.
• Permission for that folder has been set to allow full control for everyone, in case impersonation was not working, same issue.
• The application can quite happily view other folders and files in this share

Procmon is showing an access denied error when accessing this file, details of what it is asking is below:

Operation: Create File
Result: ACCESS DENIED
Desired Access: Generic Read
Disposition:    Open
Options:    Synchronous IO Non-Alert
Attributes: N
ShareMode:  Read, Write, Delete
AllocationSize: n/a
Impersonating:  domain\user

The application is essentially just trying to read from that folder, nothing more (the create file operation is actually only creating a handle to that file).

There are no events in the security log of the file server indicating an access denied error.

Edit

Delegation has been setup for UNC access (allowing the App pool user to delegate to the HOST and CIFS service on the file server) and using Deleconfig confirms this should work, it does not. However setting the App Pool user to be allowed to delegate to any service (Kerberos) only does work. As far as I was aware HOSTS and CIFS were the only services required to delegate file server access, so I'm not sure what extra service it needs access to.

I have a problem when trying to bulk insert to SQL under the following situation:

• Running management studio on Workstation A
• SQL Running on Server B
• File to bulk upload from located on Server C

When ever I try and bulk upload I get the error

Cannot bulk load because the file <filename> could not be opened. Operating system error code 5(Access is denied.).

Now I am aware we have a double hop issue here and need to sort out delegation. SPN's have been setup for SQL as follows (SQL is running on a different port). SQL is running as a domain user and the SPN's are on that account.

command: setspn -l domain\sqluser

result:
MSSQLSvc/WIN-D04V1IOTESN
MSSQLSvc/WIN-D04V1IOTESN.domain.local
MSSQLSvc/win-d04v1iotesn.domain.local:55037
MSSQLSvc/WIN-D04V1IOTESN:55037

I have also setup a delegation from teh SQL user account to the file server for Cifs and HOST, but to no avail.

I have enabled Kerberos logging and am seeing the following event in event viewer:

 A Kerberos Error Message was received:
     on logon session 
     Client Time: 
     Server Time: 14:44:10.0000 8/9/2011 Z
     Error Code: 0xe KDC_ERR_ETYPE_NOTSUPP
     Extended Error: 
     Client Realm: 
     Client Name: 
     Server Realm: domain.LOCAL
     Server Name: krbtgt/domain.LOCAL
     Target Name: krbtgt/[email protected]
     Error Text: 
     File: 9
     Line: efb
     Error Data is in record data.

So, any thoughts on what I am missing here? I have had this sort of delegation working before but always with SQL on the default port, could that have an impact?

Edit

I am also now seeing this Kerbors error alongside the first one:

A Kerberos Error Message was received:
 on logon session 
 Client Time: 
 Server Time: 15:4:10.0000 8/9/2011 Z
 Error Code: 0xe KDC_ERR_ETYPE_NOTSUPP
 Extended Error: 
 Client Realm: 
 Client Name: 
 Server Realm: domain.LOCAL
 Server Name: krbtgt/domain.LOCAL
 Target Name: krbtgt/[email protected]
 Error Text: 
 File: 9
 Line: efb
 Error Data is in record data.

Is anyone aware of a plugin for Nagios that will report on the status of the RAID controller on dell Workstations, primarily Dell Precision Workstations, T3400 & T3500?

I'm currently using this plugin, which works fine with Servers, but not workstations, which report unknown for disk status (along with a number of other things). It does pick up something, like Chassis intrusion.

Alternatively, I can probably adapt this script if I can get the OID's for the Dell arrays in these machines, however I'm having a hard time locating these.

I have a typical double hop scenario, User ->IIS->SQL.

I am using IIS 7.5, which is using Kernal Model Authentication, so I am setting up the IIS server account for delegation.

If I set this to "Trust this computer for delegation to any service"

Then it works fine. However, I would like to use constrained delegation to work. I have setup SPN's for the SQL server (for both SQLServer and SQLServer.domain.com) and tested the setup using DelegConfig, which says it is fine, but it does not work.

Does anyone know of a way to see what SPN is being used when I run this with Unconstrained delegation, so I can set this up for constrained? Or any other solutions?

I've got a problem getting Windows Authentication (Kerberos) to work when passing credentials from the user, to IIS then from IIS to SQL. I have setup SPN's for SQL, and set the IIS server account up to allow delegation.

If I set the IIS computer account to allow Delegation for any service, it works:

However if I set it up for specific services, the credentials are not passed and I get an error about connecting with the anonymous user:

As you can see, I'm connecting to SQL Express Instance, and I've set up a number of SPN's to try and resolve this, no luck with any of them. Obviously the fact that it works when allowing any service, says to me that something else is missing from this list of services, but I don't know what!

I've got a strange problem with an Exchange 2007 server running on SBS 2008. It's been working fine for users for the last 5 months, then 5 days ago they started getting a problem where Outlook would popup a window asking for credentials. If the user enters there credentials it pops up again and again, however if the user cancels the box it goes away and outlook continues to work fine. These clients all connect using Outlook Anywhere, and OWA access is also working fine.

I had thought this message box may have been to do with other POP or IMAP accounts being configured in Outlook, but it's not the case. I have re-configured Outlook Anywhere on the server but to no avail. Using the RPC diagnostic tool in Outlook shows no problems.

There are no errors showing in the event log. The server seems to be running fine, so to me this seems like either a client, or an RPC over HTTP issue, but I'm not getting anywhere finding the cause, any help is appreciated!

I have a an access DB that is to be eventually be replaced by a SQL DB with a web front end. The web application is currently in development. I have copied the Access DB to SQL using the Migration Assistant, unfortunately we can't just link the Access front-end to the SQL DB and use only the SQL DB, they must remain separate until we can switch from one to the other. Therefore there is data being added to the Access DB that I need to regularly copy to the SQL db.

Is there a script or easy process that will copy just the data from the Access tables to the SQL ones, that I can run as a scheduled task once a week?

I've just installed Server 2008 r2, standard core edition on a server, and enabled hyperv. I cannot get the Hyperv console to connect to the machine, I get the message saying

Connecting to the virtual machine management interface

followed by

You might not have permission to perform this task

I have used HVRemote tool to ensure all user and firewall permissions are ok, all the services have started correctly, I've even turned of the firewall to see if that helps, all to no avail. Any ideas?

I have a client with an existing Exchange 2007 organisation with approximately 200 users, all with reasonable size mailboxes. They wish to move to a new Exchange organisation in a completely new AD forest, on new hardware, in a different physical location. This new network is allready setup and waiting for use.

My question is, what is the best way to move these mailboxes to the new organisation? I fear I may need to use Export-Mailbox to export all these mailboxes to PST files, FTP them to the new location, create Mailboxes for every user and then re-import the data, which will be a very time consuming job, so if anyone has any better strategies, or tools to help they would be very much appreciated.

Even if there is no easy way to move the mailbox, do you have any recommendations to easily move AD accounts, even if the data has to be imported separately.

One of the most frequent requests I get from users with Exchange, is to be able to send from one of their alternative email addresses, that is one of the addreses there account is configured with in Exchange, but that is not their primary address. Unfortuantely as far as I am aware Microsoft have not yet come up with a solution to this.

I've used a number of hacks to get round this, sepearate accounts with POP3 access, Using the from field in outlook, but each have there draw back. What have you used in these situations to allow the use of these alternative addresses?

What Backup solutions do people use for Exchange 2007? In particular i'm interested in those that allow a mailbox level backup, so that individual mailboxes can be restored.