neildeadman's questions

After the recent Exchange Vulnerabilities were announced, we disconnected our Exchange 2013 server in our hybrid configuration and investigated any impact. There was none, but it has been decided that we should no longer use this one and replace it with a new Exchange 2019 server. Something we were planning to do anyway.

With Exchange 2019 installed on the new server, when we run the Hybrid Configuration Wizard, we get an error HCW8045 - No TLS Certificate Name specified. We use a multi-domain certificate for Exchange as we did on our old server. We have found 1 post on Reddit with no replies and no other mention of this error that we can find.

Anyone seen this before, know what it could be?

We have shared some storage from a EMC Unity SAN to Windows Server 2012 R2 to use with Veeam. In Disk Management, there are multiple disks listed with the same size. From previous systems, this is because of Multi-Pathing.

I have enabled the MPIO Feature and added some devices, but still it lists multiple disks. EMC provide the app PowerPath, which I have installed a trial of, but surely I don't need that to get this working!

We use OpenSSL on a CentOS 6 server to monitor the certificate on servers for RDP.

To do this we use:

openssl s_client -connect SERVER01:3389 -prexit

This has worked flawlessly until 4 days ago, when it suddenly stops showing that a cert is used and instead shows the following for a single server:

CONNECTED(00000003)
140439032170136:error:140790E5:SSL routines:ssl23_write:ssl handshake failure:s23_lib.c:177:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1539710511
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 305 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1539710511
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

I have seen that older versions of OpenSSL caused this error, but since the version hasn't change (1.0.1e) and it was working, I cannot see what is wrong.

I've also tried resetting the server's RDP cert, but again no change.

We have deployed 2 Linux VMs in a Backend Pool behind an Application Gateway. Our application on the 2 Linux VMs requires that the session remain on the same backend server, but we are seeing a session use both backend servers.

We are not seeing any outages on the backend servers.

We have the CookieBasedAffinity setting enabled.

Why isn't this working as we expect and what could be the problem?

UPDATE 1: Our app is called from another website but I don't see the Application Gateway cookie session value set, only our cookie values. Starting to suspect this is the issue...

UPDATE 2: I no longer believe the issue described (badly) in Update 1 is the problem. Using Fiddler, I was able to see the cookie values in the call to my URL that was made and it contains the values for my app plus the ApplicationGatewayAffinity= value. Back to the drawing board...

I am a Windows admin who manages our AD infrastructure. Our Linux team have been building some CentOS 7 VMs and configuring them to use SSSD to join the domain.

The initial config was querying a DC in a different site (not domain as previously written), so I asked them to look into using AD Sites with SSSD.

The server now returns the 3 _ldap DC records from DNS. The first it tries is from a different site so it cannot access it. The second works and it retrieves the correct site name. For a period of time (not sure exactly how long) it will use the DC that responded and after that time has passed it will start back getting the 3 _ldap records from DNS.

This causes some delays in logging in which we have been asked to solve. If we set the site name in the config, then it works all the time, but we have to consider that we restore these VMs from a backup to the other site where the set site name would now be wrong.

I don't know much of the config in CentOS but is there a way for this to work correctly or is that what it is already doing?

We currently have a Windows vCenter for which I have written a few scripts for various monitoring with Xymon.

We are moving to a vCenter Appliance and I need to port these scripts (or write equivalent new scripts) to work on the vCenter and the ESXi hosts.

Can I get the Xymon client installed on an ESXi host (I suspect I need to add that as a plan after each upgrade too) or is there an alternative way?

I understand there are better monitoring solutions out there than Xymon, but we use this and migrating isn't an option right now.

WSUS-SrvA is running Windows Server 2008 R2 Enterprise and can sync updates.

WSUS-SrvB is running Windows Server 2012 R2 Standard and is on a detached network.

When we run wsusutil.exe export export.xml.gz logfile we receive the error: Fatal Error: The gzip stream cannot contain more than 4GB data

From my investigations on via Google, I found that .NET 2 had this issue and the issue was resolved in .NET 4.

We have installed .NET 4 on the server and I have changed the Application Pool for WSUS site in IIS, but I still receive the above error.

Do I need to do something else to switch WSUS to use .NET 4? Or is this something else?

I have installed the update for this as per http://blogs.technet.com/b/wsus/archive/2013/04/09/problem-solved-the-wsus-export-bug.aspx

We have a PFX file that when used on any other Windows system (Server 2008 R2, 7, 8) installs fine. On 2 of my servers, the import fails like so:

CertUtil: -importPFX command FAILED: 0x80090016 (-2146893802) CertUtil: Keyset does not exist

We originally imported this PFX use the MMC snap-in, which appears to work, as no errors are reported and the certificate shows that it has a Private Key when opened, but with our .NET application we were getting an error about not having the Private Key. We assumed Private Key permissions and added the correct permissions for our App Pool. This made no difference. We have imported and deleted several times trying to fix this.

We have now noticed that the size of the files added, when an import through MMC is performed, to the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder was only 79kb on the servers that are not working when they are usually showing as being 2kb on systems where they do work.

I've done MD5 checks on the files so check they are the same (they were) and I have also copied them back from the system that wasn't working (the original copied file not an export) and that still works elsewhere.

Why would this be failing?

A colleague of mine added several IP addresses to a server, but these IPs are not appearing in the list to use with bindings.

This goes for IIS7 web sites and IIS6 FTP sites.

We found this KB article, but I don't have the offending patch installed: http://support.microsoft.com/kb/2551090/en-us

I don't think the server was restarted after the IPs were added as it is a live production server, but I believe IIS (at least from IIS6) was restarted.

What must we do to be able to use these IPs? They are pingable.

UPDATE 1: I am able to RDP to the new IP addresses without issues.

UPDATE 2: I was able to make them appear by adding them to the hosts file, but I'd still like to know what the issue is?

Our Windows domain has 3 DCs. One of the DCs is replicating changes made on the other DCs but not replicating out any changes made on itself.

We have no idea which has the most up-to-date AD so we want to compare the other 2 with the 1 that isn't working.

Is it possible to export the properties on every object (OU, CN, User, Group etc.) so that I can compare them? Maybe to an xml file?

Maybe there is a PowerShell or vbScript that will do this?

On Windows 2003 it is possible via the registry to set a custom interval for updates.

This is done via the following registry key:

HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient\SpecialPollInterval

After adjusting this key and then restarting the Windows Time service, when I update the time changes to (for my setting) one day from the time I clicked the update button.

What I don't know how to do is set the exact time at which the update occurs?

We have a few folders that are set to replicate to a DR file server off-site. One of these folders contains a file that is a TrueCrypt volume container.

When this file is mounted in TrueCrypt, the file won't replicate (fair enough!).

I'm looking at alternatives to improve this situation.

One solution I currently have is to have a scheduled task to unmount the volume and then every morning as the volume is needed, have someone mount it. This is a pain slightly because the password is known by a few people (I'm not one and neither are my colleagues who would be performing the mounting operation) so we'd need to continually get them to come over and type it in.

The other I had was to have one TrueCrypt container on each server and replicate the contents when they are mounted. I wasn't able to get TrueCrypt to see the mounted volume so I guess this is a no go.

Any other solutions I have missed or a fix for the above?

Possible Duplicate:
compare the contents of two folders that are replicating by dfs

We use DFS to replicate files to a Disaster Recovery server.

We have a task where we check the DR systems are working correctly. I have been asked to write a document to confirm DFS replication is working.

Both servers are Windows 2008 64-bit.

I've used the Health Report to check backlogged files etc, but this is a little long winded and I'd ideally like a command that would compare the 2 servers and highlight which of the Replication Folders are not fully replicated.

Is there such a command?

I have a number of existing users in Active Directory that need a home directory created. They don't log directly in to Solaris but into a service running on that box.

If I login as them their home directory gets created and then they can login.

This is the same for new users too!

As there are a lot of users, I need a way to automate this so new users and existing users have it created automatically.

Is this possible??

I have 2 sites. Site1 with 2 DCs and Site2 with 1 DC.

If I create a new user on Site1 the 2 DCs replicate the user instantly.

The Site2 DC doesn't get the new user replicated to it until some time afterwards. I had a similar issue before, which I solved (on another Domain) by making the servers Preferred Bridgehead Servers.

Is this the right thing to do? Or is there another way to improve the speed of replication?

I have installed likewise-open and joined the domain succesfully on Ubuntu 12.04.

When I login with a domain user that is a member of Domain Admins I don't get administrator priveledges on the Ubuntu box.

I edited the /etc/sudoers file and added:

%HOME\\Domain^Admins ALL=(ALL) ALL

but this didn't work either. I can't run any sudo commands!

EDIT:

I've now also tried this (taken from PowerBroker docs):

On Ubuntu, you can simply add your domain account to the admin group 
in the /etc/group file by entering a line like the following as 
root:

admin:x:115:LIKEWISEDEMO\kathy

but this too didn't work!

I've just inherited (isn't it always the way!) a Windows Domain. The domain is spread across 2 sites.

Site01 has 3 DCs & Site02 has 2 DCs.

If I create a user in either site, the other DCs in that site, immediately replicate and show the new user. The new user is not shown in the other site though.

If I manually run the following command, everything syncs and the new user appears:

repadmin /syncall issdc01 /APed

In the Inter-Site Transports DEFAULTIPSITELINK the replicate every time value is set to 180 minutes. I thought this was the solution, but on another Windows Domain, this is the same, but replication takes place across sites immediately.

What can I check to resolve this issue? We are running Windows Server 2008

Results of dcdiag /test:dns show a server that is no longer part of our domain:

TEST: Delegations (Del) Error: DNS server: oldserver.win.domain.com IP: [Missing glue A record]

I've installed Apache2 on 2 ubuntu 11.10 VMs and I am trying to get a very basic Reverse Proxy working.

I have nothing but the default site setup on each. I want to go to http://server.com/app and have it return http://app.internal.server.com/.

From what I have read it should all be fairly straight forward, but I have no experience with Apache so I am probably missing something!

For example, I haven't set up anything on Apache (other than the ProxyPass directives) to tell it anything about /app.

I enabled mod_proxy with apache2ctl mod_proxy and added the following to httpd.conf then restarted apache2:

ProxyRequests Off
ProxyPreserveHost On
<Proxy *>
    Order allow,deny
    Allow from all
</Proxy>
ProxyPass /app/ http://app.internal.server.com/
ProxyPassReverse /app/ http://app.internal.server.com/

In the apache2 error.log I am seeing:

File does not exist: /var/www/app

Whilst I was on holiday, another member of staff, created a new Project in TFS2008. For some reason (I suspect they didn't have correct rights etc) when doing this a site wasn't created on Windows Sharepoint Services 3 so there is no Project Portal.

I need to resolve this so the team can use Sharepoint etc.

Initially, as the project hasn't checked anything in yet, I thought I'd just delete the bad project and create a new one with WSS setup.

Running the TFSDeleteProject command in command-prompt gives me an error:

TF30063: You are not authorized to access <tfs-server-name>

Having looked into this problem, I think it might be because there is no Project Portal so it can't access it.

How can I solve this problem? I'd like to either create the project portal manually (I need steps as I'm pretty sure its not just by clicking a create button), OR a solution to allow me to delete and re-create the Team Project.

I am an Admin in ALL areas (I have triple checked!).

Thanks Neil

We have two sites in IIS7 both on port 80. One is our actual website (MAIN) the other is a maintenance site (MAINTENANCE) that we start (and stop the other one) when we are deploying a new version of MAIN.

When we put MAINTENANCE live, if you browse to one of our subfolders (i.e. http://maintenance/product1) you'll get a 404. I want to use the URL Rewrite module to redirect to the root of the site (http://maintenance/).

I can get this working in a basic manner, but the image and css are not working. In other attempts I have ended up with a continual redirect.

Is this possible?