Doug Luxem's questions

On a Windows 2008 R2 SP1 cluster running Hyper-V, a lost network connectivity on the primary host interface. The interface was rapidly flapping up and down, and this was later determined to be caused by a faulty switch port.

As this was a clustered server, the host interface was not fault tolerant (seeing as how the whole server was fault tolerant), so connectivity to the host was going up and down.

The Hyper-V guests were completely unaffected by the network outage as they used a dedicated trunk on the server separate from the host interface. Additionally, dedicated interfaces for the cluster and live migration networks were fine.

In order to diagnose the server, I tried to move all resources (Hyper-V Guests) to other nodes through Failover Cluster Manager. These moves failed with an error RPC Server Unavailable.

The only way to move resources was by shutting down the guests, stopping the cluster service on the Node A, allowing other nodes to take ownership of the resources, and restarting the guests.

A few other notes:

• All nodes have Client for MS Networks and File & Printer Sharing enabled on the Cluster and LM networks.
• Node A was accessible over cluster and LM networks from other nodes (these are private, cluster-only networks); pingable, CIFs, etc.
• Accessing \\NODEA is done over the Host adapters, as you would expect in this case and is the reason for the RPC Server Unavailable error with that adapter being down.

My questions here are -

1. Is there a way to still use Live Migration in a failure scenario such as this to prevent shutting down the Hyper-V guests?
2. How can the network be reconfigured in the future so that the cluster service attempts to use the cluster and/or live migration networks to issue the RPC requests?

We have an inbound email service that is very restrictive on who is allowed to send through our Sendmail gateways. The restrictions are generally controlled through the access file by marking certain servers, IPs or networks as OK -- everything else is rejected.

This method becomes difficult to control when customers are using hosted solutions like Google Apps or Office 365, where mail could come from any number of servers or networks.

In order to get around that, what I would like to add as a feature are SPF checks on certain sender domains. If their domain passes SPF, then they are allowed to send to us; otherwise the message will be rejected.

It seems there are a few milters out there to handle SPF, but documentation is sparse.

So the question...

What options do I have for SPF filtering in Sendmail which can be limited to certain sender domains?

We are in the process of ditching Cisco Unity for Exchange 2007 Unified Messaging; however, I just came to realization that Exchange doesn't seem to provide a way to upload a WAV file to be used as a voicemail greeting. This could be a problem, since we have several mailboxes that use professionally recorded greetings.

I found this article which shows how to access the data through MAPI, but it does not provide a way to upload new files.

Note, this is not for the auto attendants, but for actual voicemail greetings.

So, we had an errant program kick off about 15,000 emails to our users. I have our spam filters now blocking these on the edge until that gets resolved, but now I would like to clean our our users' mailboxes for them. Is there anyway with Exchange 2007 to remove all emails with certain text in the subject line? It would need to be a partial match because the subject changes slightly for each email.

I am trying to do this with Forefront's manual scan job + content filter, but it does not seem to like partial matches on the subject.

We have one large library (~10 GB) on SharePoint that cannot be synchronized with Outlook, even if you only attempt to synch one of the smaller sub folders in the library. Other libraries (or other library sub folders) work fine with Outlook.

This is with MOSS 2007 SP1 and Outlook 2007 SP2.

The error is:

Task 'SharePoint' reported error (0x80004005): 'An error occurred either in Outlook or SharePoint. Contact the SharePoint site administrator.'

Reproducing the error

1. Open up the large SharePoint document library in Internet Explorer
2. From the Actions menu, select Connect to Outlook
3. Select Allow on the stssync: security warning that pops up
4. Outlook automatically tries an initial sync and sync status immediately shows the above error.

Update 1: I verified the same issue occurs on Windows XP SP3 with IE 6 using Outlook 2007 SP2 and the same SharePoint library (it was originally tested on Windows 7). The issue is definitely related to the library or Outlook.

Update 2: Using stsadm I exported the site with this large document library (8.6 GB 15,000 items) and imported it on to a development system. The result is the same on the development system - multiple clients are unable to connect Outlook to the library and get the 0x80004005 error above.

We are currently using the following Group Policy to control the Internet Explorer security zones:

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page

Then setting the Site to Zone Assignment List with the various values using the following chart:

   Value    Setting
   ------------------------------
   0        My Computer
   1        Local Intranet Zone
   2        Trusted sites Zone
   3        Internet Zone
   4        Restricted Sites Zone

This works well; however, users are then unable to edit (or especially add) to their zone settings. Is there a way to lock in our custom zone settings while still giving users the ability to add their own sites to the security zones?

Yes, I do realize the slight security risk in opening this up.

We encourage our users to enable AutoArchive in Outlook 2007 as a way to manage their mailbox sizes. However, we frequently end up running in to problems with the archive.pst file that is generated. The two main problems we have are:

1. The archive.pst file is located in the user's local profile directory and is never backed up. A dead hard drive or stolen laptop could result in months or years of missing email. All other personal data is stored on network shares, but we can't do that for Outlook PST files.
2. Without some sort of manual intervention, the archive will grow to enormous sizes. Although Outlook 2007 SP2 handles the large files better than before, it still results in slow response times from Outlook and an increase likelihood of a corrupt PST file.

To mitigate these problems personally, I move the archives to a c:\Outlook folder and manually back that up to a shared drive every month or so. Additionally, I rotate archive files every year so that I have one file for each year (archive2008.pst, etc).

Obviously, asking our users to do this same wouldn't help much. We need some sort of automated solution to take care of points 1 and 2.

I have to imagine this is a common problem for Exchange organizations, so what is the best method to handle this?

I need to verify that we are still with in our licence limits for public IM connectivity in Microsoft Office Communications Server 2007. Is there a way to report on which users have the PIC enabled on their account?

I see there are some schema extensions in AD related to other OCS settings, but I do not see one for PIC (unless it is encoded in msrtcsip-optionflags).

We are trying to setup Windows 7 clients under Hyper-V for testing; however, guest services are not installing. Are there new guest services available, or is there a way to force the install on Windows 7?

When dynamic DNS is configured, I am wondering which DNS servers do the client computers attempt to register their name with. Do they only register with their configured DNS server or does the client query for NS records on its configured domain and contact those servers?

The reason I ask is that we have a dynamic zone which may need to move to new DNS servers, but I will not be able to reconfigure all clients to point at the new DNS servers. Instead, the client's DNS servers will be delegating the zone to the new servers.

This is all Windows (clients/DNS servers), but I don't know if that affects the answer.

I need to backup running Hyper-V virtual machines with minimal downtime via a command prompt. Backups should be stored on another local disk or remote share.

I need to connect to a single serial port over the network. I was wondering if there was a hardware device that I could connect to the port and then install a virtual COM port on a Windows box. The device would need some type of basic security - either IP filtering or authentication or both. Otherwise, I just need a basic 9600 8-N-1 connection.

We are migrating a large directory structure of documentation into SharePoint 2007. In our tests, SharePoint obviously sets the created and modified date to the upload time. Is there anyway to change that to the information from the file?

We are already setting various other metadata in our upload script, but it appears that we can't modify those values.

We had a rather serious outage this past week affecting several services which put us out of our SLA with customers. Now that everything has been resolved, I am conducting a post-mortem review.

From this review, I would like to come up with an internal document that describes the outage, its effects, our response and the resolution. I want to come up with a fairly standard form for future reuse. I have included my thoughts below, but what other items should be included? If this were a security-related incident, what would you add?

• Summary Executive level summary of event.
• Affected Services
• Impact What was the impact on our users and SLAs? Was there a cost in dollar terms, missed transactions, lost customers, etc?
• Outage Duration For each affected service if there were variances
• Cause Including primary and secondary causes
• Resolution
• Timeline of events Notifications, contact with external vendors, customer notifications, responses, etc.
• Problems with our response Did things not go as planned with our response to the outage? Correct people notified? Did vendors meet their contracted obligations?
• Preventative measures to take How do we prevent this outage from occurring again or reduce its impact?
• Detection Method How well did we detect this outage and how do we improve detection in the future?
• Changes to make in future outage responses

Try to keep posts down to one item and explanation, and this post can be updated with the top voted answers.

On my Windows guests running under Hyper-V in a domain environment, I noticed that the Windows Time service was having problems. Periodically, I was receiving the following three messages in the System log.

Event Type: Information
Event Source:   W32Time
Event Category: None
Event ID:   38
Date:       6/11/2009
Time:       12:26:15 PM
User:       N/A
Description:
The time provider NtpClient cannot reach or is currently receiving invalid time data from xxx.xxx.xxx (ntp.d|a.b.x.y:123->a.b.x.z:123).

Event Type: Warning
Event Source:   W32Time
Event Category: None
Event ID:   24
Date:       6/11/2009
Time:       12:42:47 PM
User:       N/A
Description:
Time Provider NtpClient: No valid response has been received from domain controller xxx.xx.xxxx after 8 attempts to contact it. This domain controller will be discarded as a time source and NtpClient will attempt to discover a  new domain controller from which to synchronize.

Event Type: Error
Event Source:   W32Time
Event Category: None
Event ID:   29
Date:       6/11/2009
Time:       12:42:47 PM
User:       N/A
Description:
The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible.  No attempt to contact a source will be made for 15 minutes. NtpClient has no source of accurate time. 

Upon restarting the Windows Time service, it would successfully synchronize with a domain controller (Event ID 37), but then I noticed the server also had another synch attempt:

Event Type: Information
Event Source:   W32Time
Event Category: None
Event ID:   35
Date:       6/11/2009
Time:       1:04:30 PM
User:       N/A
Description:
The time service is now synchronizing the system time with the time source VM IC Time Synchronization Provider.

The end result of this being that W32Time is not synchronizing correctly with the domain controllers as member servers should do by default. All other servers and workstations are correctly synchronizing with a domain controller.

We use SharePoint (MOSS 2007) for storing all of our internal documents, and it works great as a document management system. One of the problems we have though is using the Wiki feature of SharePoint. For the most part, it is lacking the general features that make using a Wiki worthwhile. As a result, we have had several departments just setup ad-hoc MediaWiki servers instead of using SharePoint's built-in functionality.

Are there any third-party add-ons to SharePoint to replace or improve the Wiki? What will SharePoint 2010 bring for improvements in this area?

Some of the features we are looking for are:

• The ability to easily insert images while editing a document
• Attach files to a page or inline
• Improved markup (similar to MediaWiki)
• Navigation and/or table of contents
• Orphaned/Requested page lists

I have tried out various network-based IDS and IPS systems throughout the years and have never been happy with the results. Either the systems were too difficult to manage, only triggered on well-known exploits based on old signatures, or were simply too chatty with the output.

In any case, I don't feel they provided real protection for our network. In some instances, they were harmful due to dropping valid connections or just plain failing.

In the past few years, I am sure things have changed, so what are the recommended IDS systems these days? Do they have heuristics that work and don't alert on legitimate traffic?

Or, is it just better to rely on good firewalls and hardened hosts?

If you recommend a system, how do you know it's doing its job?

As some have mentioned in the answers below, let's also get some feedback on host intrusion detection systems as they are closely related to network-based IDS.

For our current setup, we would need to monitor two separate networks with a total bandwidth of 50mbps. I am looking for some real-world feedback here, not a list of devices or services capable doing IDS.

We have several offices across the globe, but our datacenters are primarily housed in two central locations (North America and Europe). There is a relatively high latency between various offices, so we try to host services in the closest location to the user (i.e. Canadian employees use Exchange services in the US, not Europe.)

This setup works well for the most part. When using services like Active Directory, Exchange or DFS, clients rely on existing site information in AD to fine the closest location.

Now, we have a request to have a common DNS name to access certain web services that are hosted both NA and Europe. Previously, we have used seperate DNS names (na-service.domain.local or eu-service.domain.local) but that becomes cumbersome for our end users.

All of our internal DNS is currently hosted on Windows 2003 and 2008 servers with Microsoft DNS. Is there any way to configure Microsoft DNS services to only respond to requests with a "local" IP address? I know that configuring multiple A records will result in a round robin style response, which is not ideal. We could also use Primary zones at each location and only enter the local IP address, but we have hundreds of other DNS entries that would need to be manually replicated to each server.

If this can't be done with MS DNS, are there other low cost alternatives? I know F5 Networks has products that can handle this, but that's at a fairly high expense.

As we replacing our existing WEP infrastructure across multiple offices, we are weighing the value of upgrading to WPA versus WPA2 (both PSK). We have several different types of devices that do not support WPA2, so moving to that protocol has additional costs involved.

What I would like to know is what are the threats to WPA-PSK wireless networks? With that information, we will be able to balance the upgrade costs versus security threats.