Gup3rSuR4c's questions

I've got a sub-domain controller I created a year ago, but never actually did anything with. I've had the server shutdown since then. It's time for the controller to be deleted, but I'm not sure how to get it out of the forest.

In AD Domains and Trusts it has a Parent-Child relationship with the primary DC, but I don't know how to remove it from the parent. If I can remove it from the parent, I'll just delete the VM and call it a day, I'm just not sure how to do that correctly from the parent.

The parent is DC-01 on Windows 2012, and the child I want to remove is DC-04 on Windows 2016. Not sure if it matters they're on different OS versions. I haven't messed with domains in years, and even then it was only enough to create a simple one, so any recommendations would be awesome. Thanks in advance!

I'm testing out upgrading to Windows 10 on our domain, which is currently based on a Windows Server 2012 DC and all Windows 7 workstations. I was never able to make it work on Windows 7 so I gave up since I didn't really need it, but with Windows 10, I do need it. I've spent hours and days trying to figure it out, but I'm out of ideas. Here's my current GPO setup, in order of inheritance (abbreviating names to keep the post shorter):

Forest Computers (Computer Configuration)

1. Policies > Windows > Security > Windows Firewall
   • Domain = Off
   • Private = Off
   • Public = Off
2. Policies > Admin Templates > Network/Network Connections/Windows Firewall
   • Domain Profile > Protect all network connections = Disabled
   • Standard Profile > Protect all network connections = Disabled
3. Policies > Admin Templates > System/Group Policy
   • Slow link detection = Disabled
   • Logon script delay = Disabled
   • Scripts policy processing = Enabled, allow across slow network = Enabled
   • Startup policy processing wait time = Disabled
4. Policies > Admin Templates > System/Logon
   • Always wait for the network at computer startup and logon = Enabled
5. Policies > Admin Templates > System/Scripts
   • Allow logon scripts when NetBIOS or WINS is disabled = Enabled
   • Run logon scripts synchronously = Enabled
   • Run startup scripts asynchronously = Disabled
   • Run Windows PowerShell scripts first at computer startup, shutdown = Enabled
   • Run Windows PowerShell scripts first at user logon, logoff = Enabled
   • Maximum wait time for GP scripts = Enabled, seconds = 0

Forest Workstations (Computer Configuration)

1. Policies > Windows > Scripts
   • Startup = %SystemDrive%\Tools\Configuration.ps1 -WorkstationStartup
2. Policies > Admin Templates > Windows Components/Windows PowerShell
   • Turn on Script Execution = Enabled, Allow all scripts
3. Preferences > Windows Settings > Registry
   • DisableDHCPMediaSense = 1
   • DependOnService = LanmanWorkstation, LanmanServer, Netman

Forest Users (User Configuration)

1. Policies > Scripts
   • Logon = %SystemDrive%\Tools\Configuration.ps1 -UserLogon
   • Logoff = %SystemDrive%\Tools\Configuration.ps1 -UserLogoff

The workstation specific portion of the script runs perfectly fine, but the user portion doesn't. As far as I can tell from the event log (the script writes to a custom event log), the user's portion isn't being called at all. I thought that it may have been because it was on a share, so I copied it to the local system drive, but that did nothing. As you can see all firewalls are disabled, but it has no effect.

The domain and forest functional level is Windows Server 2012, if it matters. I should also note that the PowerShell execution policy is set to Unrestricted.

I don't know what else to do to make the logon (and by extension logoff) scripts to run when they're supposed to. I ask for you help.

UPDATE

So, digging around more and I ran RSoP on the client where I found something peculiar, or rather, I didn't find it. There were no Logon/Logoff settings defined for the User Configuration. In fact a lot of the settings I expected to be there weren't. Instead the settings that are applied are the one's specific for the domain admins only. So it looks like the GPO inheritance is not working? The domain/OUs are configured like this:

And here's the GP inheritance:

So, for whatever reason the Forest Users policy is not being applied? I thought the GPs were applied in cascading order?

I've finally managed to deploy an SSTP VPN between my Windows 2012 (non R2) server and Windows 7 client. It's amazing how much easier it work with a real certificate and avoiding the self-signed debacle. Anyway, my client can ping the VPN server and the VPN server can ping it, but I can't ping any of the other machines on the domain, specifically the domain controller.

What do I need to do to make the machine able to access the other servers? Currently it has the Remote Access: DirectAccess and VPN role installed. I have not installed the Network Policy and Access Services nor the Remote Access: Routing roles. I'm not sure if they're needed, but I did see them being installed in the dozens of tutorials I looked at online.

I'm thinking the NPS may be needed to make the routing work, but I don't know how to proceeed. I've spent the last three weeks trying to make this work, so I kind of want to hold on to what I've managed to get working so far without exploring on my own. Recommendations would be greatly appreciated.

Today, I had a user call me with an issue. He couldn't access a Desktop shortcut that's defined by group policy. The shortcut was pointing to a shared folder on our web server (W-01). All other shortcuts on his Desktop worked fine, but all of them were pointed to the PDC (DC-01). No matter what I tried I couldn't get the shortcut to show up and the event log just said the path was inaccessible. Here's what I found out from my diagnosis:

• Could ping W-01
• Could ping DC-01
• Could NOT navigate to \\W-01
• Could navigate to \\DC-01
• Could navigate to \\192.168.0.10 (IP of W-01)
• Could navigate to \\192.168.1.10 (IP of DC-01)
• DNS cache listed W-01 and DC-01 with the correct IPs
• GUPDATE did nothing
• Server says the user has full access effective permissions
• Switching computers didn't help

In the end I cheated and manually created a shortcut using the IP and he was able to continue with his work, but that's not really a solution. I'm curious what I have to do to allow him access to the server using the host name (W-01) as he was able to up to yesterday.

For reference, the servers are Amazon EC2 instances of Windows Server 2012. The clients are Windows 7. There are three domains: CORP.LOCAL, A.CORP.LOCAL, B.CORP.LOCAL. The user is in A.CORP.LOCAL. We have three sites talking to Amazon VPC using VPNs. Everyone else in each of the sites can access the shortcut without issues.

Is there suggestions I can try to fix this?

I have a SonicWall TZ100, firmware SonicOS Enhanced 5.8.1.13, with a static subnet of 10.0.6.0/24 on X0. Ports X2-X4 are port shielded to X0. On ports X3 and X4 I have two devices that were moved from different locations and we forgot to update their settings while on site. Their IPs are 192.168.213.254 and 10.0.4.253. I'm not sure which one is connected to which port.

What do I have to do on the SonicWall to gain access to the web interfaces of those devices so I can change their IPs? I don't have physical access to the devices which is why I'm trying to do this remotely.

I tried assigning the X3 and X4 ports with static IPs of what the gateways for those devices should be, but it didn't help so I reverted it back. Help would be appreciated.

I have four Windows 7 clients that are connecting to a Server 2012 domain controller EC2 isntance. There was also a file server (also Server 2012), but I decided to merge the two together because the Amazon advising tool said we were wasting money with our setup. So, I moved the EBS volumes to the domain controller and they're all working fine, but I had to recreate the software installation policy to point to the new shares.

I simply removed and re-added the same software with the same settings except for the file path. Now, the clients are constantly spending time when booting up in "Applying Software Installation policy" mode. It takes a good 20-30 minutes to get past that step. Before the move it was taking 10 seconds or so (when the software is installed).

I tested a PC by uninstalling all of the managed software and then disjointing and rejoining to the domain. There was no effect...

How can I fix this? Also, user profiles (even recreated ones) seem to be behaving very slowly on logins or logouts...

I've got a couple of Server 2012 instances on Amazon EC2 and I'm in the process of setting up the GPOs. All of the settings of the GPOs are being applied fine, except none of the PowerShell scripts specified on computer startup are actually being executed. The scripts are sitting on a UNC share which has Authenticated Users applied to it with full permissions. I'm assuming it probably has something to do with the Execution Policy, but I'm not sure how to automatically bypass it. I could just go in each instance and bypass the Execution Policy, but that's obviously not a good idea, plus I'm eventually going to connect Windows 7 computers that will be running the same scripts.

How can I get the scripts to actually run? Google searches hasn't yielded a whole lot...

Current Permissions

Share - Authenticated Users (Full)

NTFS - Everyone (Full); CREATOR OWNER (Special); SYSTEM (Full)

I have a Dell PowerEdge R710 running Windows Server 2008 R2 Datacenter and which was part of a Hyper-V Failover Cluster. It has 8x Broadcom BCM5709C NICs and three are teamed together to be my "Virtual Machines Team". The team works fine, but I'm having an issue with Hyper-V. It refuses to create a virtual network out of the teamed adapter and errors out with a message that I don't have permissions to do so. When I check the teamed adapter's properties it is bound to the Microsoft Virtual Network Switch Protocol, Hyper-V just never went the extra step of making it into a virtual network.

As I said above, this server was part of a Hyper-V Failover Cluster with another identical machine. The other machine has the exact same settings and it's teamed adapter is working fine as a virtual network in Hyper-V.

Does anyone have any suggestions on how I can try to get this working? My other option is to reload the OS again and see if that helps. Suggestions will be highly appreciated.

I have a pair of Dell PowerEdge R710 servers (2x Xeon X5690s, 64GB, 8x BCM5709C NICs) running Windows Server 2008 R2 Datacenter. They're backed by a Dell PowerVault MD3200 with 3.6TB in RAID 10 (effectively 1.8TB) via HBA (not iSCSI!). These were setup in a Hyper-V Failover Cluster.

I'm rebuilding my cluster because of some issues that occured. As part of the rebuild I've also upgraded all firmware on the servers (not that it matters, but I'm putting it out there).

Since, I'm setting up a "fresh" cluster, I'd like to try and fine tune the network connections a little better this time around. I've spent countless days researching best practices and such for my hardware, but I'm still left with questions.

Before I get to the question(s), the NICs are all running firmware 7.4.8 and driver 7.4.14.0. They are split into three teams: Public, Private and Virtual Machines. The teams are of type Smart Load Balancing and Failover.

• Public Team (2x NICs - used for host network access)
• Private Team (2x NIcs - used for failover cluster, live migration, etc.)
• Virtual Machines Team (3x NICs - used for VM network access)

There is also one physical NIC which is bound as a separate vSwitch in Hyper-V and it's allocated to our web server only because it carries the dedicated connection for it.

All ports are split between two Dell PowerConnect 6224 switches for redundancy. Anyway, on to the question(s):

First, what settings do I need to configure on the VMs Team for best VM network performance? From what I've read, I should disable TOE (TCP Connection Offload for Broadcom?), Wake-on-LAN, Jumbo Frames, Flow Control, RSS and QoS on all NICs that will be a part of the VMs Team. The only thing I should have enabled is LSO and CSO. Is that correct?

EDIT: I've also read that I should preset the link speed rather than leaving it on auto if I know my hardware's capabilities, is that also a good thing to do?

With the new firmware and drivers I have the ability to enable VMQs, which after reading a Dell whitepaper on them I guess they're a good thing to do. However I'm also reading something about registry settings, and I'm confused. I was following a guide on a forum posting on Broadcom's site, but I'm not sure if it's a good idea to do that since it's for a different NIC model. What is the proper way of configuring VMQs to work for my hardware?

Going back to disabling Jumbo Frames from above, I have them enabled right now for all teams. Should I just disabled them entirely? I've read (after I enabled them) that it's only used in iSCSI setups, which I'm not, so I'm not sure...

On the dedicated connection for the web server, do I need to have VMQ enabled on it if it's only available to one server?

Lastly, any other recommendations for any of the connections would be appreciated. Thanks for reading this and thanks in advance for any help!

We migrated servers over the weekend to a new domain controller which had GPOs setup to deploy software. All of our clients had their OS reloaded, so they're "fresh" and most of them did get the software installed, but some are refusing to install some software. I'm getting these errors:

The assignment of application Adobe Reader XI from policy Adobe Reader failed. The error was : %%1274

The removal of the assignment of application Adobe Reader XI from policy Adobe Reader failed. The error was : %%2

It happens for Adobe Reader XI, LogMeIn and Google Chrome. It's also very random. I've read online and on SF that the issue is with the async deployment and I've already had the setting changed to wait for connectivity. In the event log I do see additional messages about not being able to contact the domain controller in time, so I'm assuming it's all related.

It's like the setting to wait for connectivity is just being randomly applied. I've already restarted the file server, the clients and ran GPUPDATE several times, but it's not doing anything except telling me that it has to install software on next reboot, which never happens.

Is there any other kind of troubleshooting I can do?

Not sure if it matters, but the servers are all Windows Server 2008 R2 and the clients are all Windows 7. Clients are also a mix of 32 and 64 bit, if that makes any difference...

We're going to be installing some new software on pretty much all of our computers and I'm trying to setup a GPO to do it. We're running a Windows Server 2008 R2 domain controller and all of our machines are Windows 7.

The GPO calls the following script which sits on a network share on our file server. The script it self calls an executable that sits on another network share on another server. The executable will imediatelly crash with an error 0x0000006. The event log just says this: Windows cannot access the file for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program Setup.exe because of this error.

Here's the script (which is stored on \\WIN2K8R2-F-01\Remote Applications):

@ECHO OFF

IF DEFINED ProgramFiles(x86) (
    ECHO DEBUG: 64-bit platform

    SET _path="C:\Program Files (x86)\Canam"
) ELSE (
    ECHO DEBUG: 32-bit platform

    SET _path="C:\Program Files\Canam"
)

IF NOT EXIST %_path% (
    ECHO DEBUG: Folder does not exist

    PUSHD \\WIN2K8R2-PSA-01\PSA Data\Client

    START "" "Setup.exe" "/q"

    POPD
) ELSE (
    ECHO DEBUG: Folder exists
)

Running the script manually as administrator also results in the same error. Setting up a shortcut with the same target and parameters works perfectly. Manually calling the executable also works.

Not sure if it matters, but the installer is based on dotNETInstaller. I don't know what version though.

I'd appreciate any suggestions on fixing this. Thanks in advance!

UPDATE

I highly doubt this matters, but the network share that the script is hosted in is a shared drive, while the network share the script references for the executable is a shared folder.

Also, both shares have Domain Computers listed with full access for the sharing and security tabs. And PUSHD works without wrapping the path in quotes.

UPDATE 2

If I manually open CMD on the client machine and enter PUSHD "\\WIN2K8R2-PSA-01\PSA Data\Client" I get the directory mounted as a drive properly. If I then enter START "" "Setup.exe" "/q" the installer kicks in exactly as it should and it actually installs the application.

UPDATE 3

While doing some debugging through ECHO statements, I started outputting TXT files to the C:\ drive on the client machine. After I called PUSHD I ECHOed %CD% to see what the current directory was. It ended up outputting C:\Windows not {?}:\Client like it should if it succesfully mounted the remote directory.

I think it has something to do with the messages I get at the very top of the screen that UNC paths are not supported, blah blah blah, even though the rest of the script actually executes.

Still looking for suggestions on getting this to work.

I have a cluster of servers that are all running either with BCM5716C NetXtreme II cards or BCM5709C NetXtreme II cards. All servers have their cards teamed by the BACS3 software as:

• Smart Load Balancing and Failover
• No standby members
• No live link
• No VLAN

All servers then connect to a pair of Dell 6224 switches. The problem I've been observing is that if one of these switches is off (or on but stuck in a diagnostic loop) then the servers loose all connectivity to anything. I was under the impression that with the above configuration they would just drop their speed and continue with the remaining switch until the one with issues is restored.

Why does all connectivity stop and how do I fix it? All servers are Windows 2008 R2 Standard or Datacenter. Some are used for a Hyper-V cluster.

I'm installing the 180 day trial of SQL Server 2012 on a virtual machine with the intent of buying a license for it later on. From past experiences with installing SQL Server I would always make specific user accounts for the SQL Server to use. Looking at the installer now, its pre-populating the accounts with specific ones of its own:

• SQL Server Agent - NT Service\SQLSERVERAGENT
• SQL Server Database Engine - NT Service\MSSQLSERVER
• SQL Server Analysis Services - NT Service\MSSQLServerOLAPService
• SQL Server Reporting Services - NT Service\ReportServer
• SQL Server Integration Services 11.0 - NT Service\MsDtsServer110
• SQL Server Distributed Replay Client - NT Service\SQL Server Distributed Replay Client
• SQL Server Distributed Replay Controller - NT Service\SQL Server Distributed Replay Controller
• SQL Full-text Filter Daemon Launcher - NT Service\MSSQLFDLauncher
• SQL Server Browser - NT AUTHORITY\LOCAL SERVICE

In the past (SQL Server 2008 R2) the Agent, Engine, Analysis Services and Reporting Services would be blank and I'd specify the accounts I made. Before I got to this screen on the installation I had already made new user accounts, as domain accounts, but I see that the installer is pre-populating with local accounts.

In the end, should I let the installer make the accounts it wants to make or should I replace them with the accounts I've made?

I have a user that was using Windows XP until yesterday. The computer ended up getting a virus (again) and so I replaced it with a spare Windows 7 machine we were preparing for somewhere else. The Windows 7 machine is freshly installed and fully updated. When the user signs in with their domain profile the Windows 7 machine just loads a temporary profile each time. Restarting and logging off and back on does not fix it. Also there's no registry key or folder created for the user.

I doubt this makes a difference, but I have Offline Files disabled. Oh, and the server hosting Active Directory is a Windows Server 2003 R2 x64.

Does anyone have any suggestions on how I can get the machine to load the user's profile?

So, I have two Dell PowerConnect 6224 switches (non-stacked). On both of the switches I've taken ports 8 and 9 and assigned them to VLAN 2. The other ends of those ports go to two Windows 2008 R2 Hyper-V host servers (Dell PowerEdge R710). Each server connects to the two switches via a teamed connection for redundancy and speed.

The servers have their IPs as 10.0.2.5 and 10.0.2.6 with a subnet mask of 255.255.255.0.

The VLAN interfaces on both switches have the IPs of 10.0.2.13 and 10.0.2.14 with a subnet mask of 255.255.255.0 as well.

Subnet 10.0.2.0/24 is bound to the VLAN. The MAC addresses of the teamed connections as well as the VLAN interfaces (from the two switches) are also bound to the VLAN.

My problem is that the two servers are unable to ping each other, or the VLAN interface IPs. The switches are also unable to ping the VLAN interface IP of their companion switch and are also unable to ping the IPs of the servers.

I'd really appreciate it if someone could tell me what I'm missing. I'm starting to get really angry with these switches...

UPDATE 1 (for Jim G.)

I removed the team from the ports and assigned them the following IPs: 10.0.2.25, 10.0.2.26, 10.0.2.35 and 10.0.2.36 with a subnet mask of 255.255.255.0. I then bound the MACs of the individual ports to the VLAN.

The servers can now ping to each other fine, but are still unable to ping to the VLAN IPs. Also, the switches are still unable to ping the servers.

The switches are connected via a single cable on ports 23 and 24. The ports are still on the default VLAN 1.

UPDATE 2 (for Jim G.)

I made ports 23 and 24 as trunks and assigned them to VLAN 2. Nothing has changed since the first update. The servers can still ping each other, but not the VLAN IPs. The switches also still can't ping the servers.

So, I'm getting a bit confused here. I have a Dell MD3200 SAN with dual controllers. Each controller has an Ethernet management port that connects to a switch. Together the two controllers connect to independent switches for redundancy.

I'm building out my failover cluster and was told that I should have the SAN management port running over the same subnet, which will isolated to a VLAN. If I just leave it at that, it makes sense, however, if I want to manage the SAN out-of-band through the network on a server that's not on the subnet/VLAN, I won't be able to.

So, the question is, if I have a 10.0.1.X subnet for my servers and a 10.0.2.X subnet for the failover cluster do I make the SAN a part of 10.0.1.X or 10.0.2.X? I personally think I should leave it on 10.0.1.X, but I figure I'd ask just in case.

UPDATE

Just to give you more info, the servers in question are Dell R710s (x2) with x8 1GbE ports. The switches are Dell 6224s (x2). I was planning on the servers having 3 teamed connections. 2 ports on a "Public" team, 2 ports on a "Private" team (for the cluster) and 4 ports for the "Virtual Machines" team.

The SAN is an MD3200, not the MD3200i. It connects to the servers with SAS via redundant HBA cables.

The cluster is going to be a Windows Server 2008 R2 Failover Cluster for Hyper-V.

I have an IIS7 server that's hosted out outside (as in a completely different location) of our HQ. It was going to be used for a new project, but it subsequently fell through and now we have a server that's not being used. I've basically converted it to a storage provider for our Salesforce account because Appirio is just priced ridiculously.

I have IP address and domain restrictions set to block all except for the ones I select, like our offices. The problem is that we have field workers that use Salesforce outside of the offices like at their homes or via mobile devices. That's where the IP restrictions become a hindrance because they'll be blocked and won't be able to do what they need to do.

So, is there a way to restrict access to the server without IP restrictions? I can't do authentication through Windows or Salesforce. I was thinking about using a token in the URL string to validate the visitor because they'll only be accessing the server through Salesforce which I can control, to a degree, but I'm not sure. I also have an available SSL certificate which I could put into use, but I'm not sure what to couple it with?

My server suddenly started crashing every time I debug a chunk of code on my laptop which accesses the database on the server remotely. It's done it twice now, and I've stopped trying to debug my code until I can read the memory dumps from the server and see what happened.

Anyway, that's where I'm having troubles. I've downloaded and installed the Windows SDK for WinDbg as well as the Server 2008 RTM & SP2 Retail & Checked symbols, but WinDbg still yells at me that it doesn't have the correct symbols.

So, what do I have to do to get it to read the memory dump?

Thanks in advance for any suggestions!

Is it possible to prevent Remote Desktop from replying when requesting for it through a domain name? In other words if I type in "www.example.com" into the Remote Desktop Connection prompt it will resolve to my server, how do I prevent that?

If it matters, the server is a Windows Server 2008 64-bit.

Thanks in advance!

Continuing my adventure of managing a Windows Server 2008 (64-bit, SP2) server for the first time ever, one thing I keep seeing is that the Cache section under Physical Memory in Task Manager continue to grow and grow and grow.

The server is not active yet as I am still loading all the apps, and the only thing it's doing is downloading a 3GB file right now. Still, the cache just keeps growing. The server has 8GB of RAM, and right now the Cache is at 6.3GB...

Is this normal? Should I worry? If it's not normal, what do I do?