best's questions

Windows 2012 std host with Hyper-V. Hyper-V guest VM is Windows server 2019 std

Both the host and the VM are setup as separate SQL & IIS application platforms with some light add-on tools such as FTP server, and backup agent.

Today, without any changes to either Host or VM since the last Windows update on the VM 18th March 2021 (posting this on the 25th March 2021) the VM exhibits near 100% CPU usage from seemingly lightweight processes such as task manager! (see pic)

The VM and Host are so slow I've had to emergency failover to warm standby machines.

Previously this problem had occurred with with the VM running Windows 2016 std. We thought because the issue came and went randomly it was a Windows update issue and replaced and re-created a brand new VM, new VHDX files with the current 2019 OS.

Attempts so far

• reboots of both the VM and Host or just the VM have no effect

• Stopping services such as SQL do lower the CPU usage percentage, but do not improve the responsiveness of the system performance, the UI or it's ability to serve IIS pages.

• Stopping the Windows Update service has no real effect either.

• Process monitor gives no real enhanced view of what is causing the high usage and slow performance.

What else can I try?

I’m looking to setup a permanent VPN connection from our office to a Windows Server provided by 1and1.

We’re looking to get SQL log shipping setup between the hosted 1and1 server and our office. I’m familiar with setting up a VPN point on our office router (Draytek 2820) so that users can VPN in to the office.

I’m looking for advice to specifically have a VPN setup running as a service on the hosted server so that it has a permanent tunnel back to our office.

What should I be searching for or reading up on to get this working?

1and1 now offer Server 2012 so if that has any benefit we can take advantage of it but cannot add a VPN capable router to the 1and1 end of the connection or else I would do that. Also the 1and1 server only has 1 network interface and I cannot add more.

We will be running a job soon where we want users to connect to a Internet based server but connect to a local server when on site due to slow network links. We will be subcontractors at the site and the infrastructure will be provided by the main client.

We'd like our application to try and connect to the local server first and if it fails or cannont find it then try the global server out on the Internet. I was thinking of using our domain registrar to create a project subdomain for each of the servers localproject.domain.com and project.domain.com as opposed to the devs having to use raw IP addresses in the app config.

I'm happy enough to give the project.domain.com the public Internet IP of the web server but can I give localproject.domain.com and internal 192.168.x.x address?

As for best practice should I instead be asking the client to add a DNS entry for localproject.domain.com to their LAN based DNS that we will be piggybacking off rather than having to make a trip to the Internet based DNS servers?

I need to be able to monitor two sets of Windows Server 2008 machines with System Center Essentials 2010.

1. One physical and 3 virtual (Hyper-V) servers in a domain configuration.
2. On the same LAN, but not in a domain configuration two physical and 3 virtual (Hyper-V) machines in a workgroup.

The non domain machines are public facing client web and database servers.

If I set-up a new VM inside the domain with System Center Essentials 2010 can I monitor the non domain servers?

If this isn't possible is there a Windows solution similar to System Center Essentials that can monitor domain and non domain machines in the same set up?

On one of our public facing servers the Administrator account logged in at 6:45am GMT. It wasn't a member of staff.

Details from the event logs

1st event
        Logon attempt by:   MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
        Logon account:  Administrator

2nd event
        Logon attempt using explicit credentials:
        Logged on user:
            User Name:  S15252541$
            Domain:     WGS15252973
            Logon ID:       (0x0,0x3E7)
            Logon GUID: -
        User whose credentials were used:
            Target User Name:   Administrator
            Target Domain:  S15252541
            Target Logon GUID: -

        Target Server Name: localhost

3rd event
Successful Logon:
    User Name:  Administrator
    Domain:     S15252541
    Logon ID:       (0x0,0x73837CF)
    Logon Type: 4
    Logon Process:  Advapi  
    Authentication Package: Negotiate
    Workstation Name:   S15252541
    Logon GUID: -
    Caller User Name:   S15252541$
    Caller Domain:  WGS15252541

4th event
Special privileges assigned to new logon:
    User Name:  Administrator
    Domain:     S15252541
    Logon ID:       (0x0,0x73837CF)
    Privileges: SeSecurityPrivilege
            SeBackupPrivilege
            SeRestorePrivilege
            SeTakeOwnershipPrivilege
            SeDebugPrivilege
            SeSystemEnvironmentPrivilege
            SeLoadDriverPrivilege
            SeImpersonatePrivilege

5th event
User Logoff:
    User Name:  Administrator
    Domain:     S15252541
    Logon ID:       (0x0,0x73837CF)
    Logon Type: 4

I've changed the Administrator password as a precaution, should I do anything else or am I worrying unceasingly?

p.s. This isn't an April fools

I’ve been asked by our SIP trunk provider to run a Wireshark trace on the network when we receive calls.

The issue I’m having is that if I run Wireshark from a laptop plugged into the main switch I only see the broadcast traffic from the switch and cannot see the detail of calls I need to pass to our VoIP provider. Our switch is a Netgear FS728TP

I am running Wireshark capture in promiscuous mode but I’m guessing this setup isn’t the correct way to watch VoIP traffic on our LAN. Which of these options would be best to monitor the VoIP traffic?

1. Connect the monitoring laptop and phones to a Hub

This seems the easiest option, but where do you get a hub from these days, plus our handsets are Power Over Ethernet? Can I force our Netgear FS728TP switch to behave like a Hub or do I need to setup Wireshark differently to collect all packets?

2. Use a dual nic machine inline between our PBX and the phones on the switch

I was thinking of using an old Shuttle PC with dual network cards inline to watch all packets and do the trace that way, plus it would be useful in the future if we need to watch network traffic.

3. Buy a dedicated LAN monitoring device

This is obviously the faster method of the home baked Shuttle method but I have no idea what to look for in this area.

I've inherited the backup support of some Windows server 2003 machines that used Yosemite Server backup 8.1

The company has joined the BizSpark program and want to use the license of Windows Server 2008 R2 and Exchange 2010.

I've tried to email barracuda who took over Yosemite to ask this but with no success. (do you need a support contract?)

I don't have a spare machine or even space for a VM to test it on, does anybody know it it will work?

We have FileZilla server 0.9.37 running on Windows server 2008 R2

Active mode works OK, The Windows firewall on the server is off.

Our Router is a DrayTek vigor 2820. Under NAT, Open Ports, I have opened the following ports for the servers local IP

TCP 20-22, TCP 45100-65535

In FileZilla server, under passive mode settings (I can't post an image so...)

Use the following IP: 213.106.150.123
Don't use external IP from local connections: Checked
Use custom port range: 45100-65535

From a remote server in Germany which I RDP into I try connecting back to the FileZilla server.

Status: Connecting to 213.106.150.123:21...
Status: Connection established, waiting for welcome message...
Response:   220 --
Command:    USER ftp_001471
Response:   331 Password required for ftp_001471
Command:    PASS ********
Response:   230 Logged on
Status: Connected
Status: Retrieving directory listing...
Command:    CWD /
Response:   250 CWD successful. "/" is current directory.
Command:    TYPE I
Response:   200 Type set to I
Command:    PASV
Response:   227 Entering Passive Mode (213,106,150,123,238,133)
Command:    MLSD
Response:   425 Can't open data connection.
Error:  Failed to retrieve directory listing

The status window on FileZilla server reports the following

(not logged in) (87.106.131.22)> Connected, sending welcome message...
(not logged in) (87.106.131.22)> 220 --
(not logged in) (87.106.131.22)> USER ftp_001471
(not logged in) (87.106.131.22)> 331 Password required for ftp_001471
(not logged in) (87.106.131.22)> PASS ********
ftp_001471 (87.106.131.22)> 230 Logged on
ftp_001471 (87.106.131.22)> CWD /
ftp_001471 (87.106.131.22)> 250 CWD successful. "/" is current directory.
ftp_001471 (87.106.131.22)> TYPE I
ftp_001471 (87.106.131.22)> 200 Type set to I
ftp_001471 (87.106.131.22)> PASV
ftp_001471 (87.106.131.22)> 227 Entering Passive Mode (213,106,150,123,195,197)
ftp_001471 (87.106.131.22)> MLSD
ftp_001471 (87.106.131.22)> 425 Can't open data connection.

If I change the FileZilla passive mode setting from our external IP to Default, I get the following details from the client in Germany trying to connect.

Status: Connecting to 213.106.150.123:21...
Status: Connection established, waiting for welcome message...
Response:   220 --
Command:    USER ftp_001471
Response:   331 Password required for ftp_001471
Command:    PASS ********
Response:   230 Logged on
Status: Connected
Status: Retrieving directory listing...
Command:    CWD /
Response:   250 CWD successful. "/" is current directory.
Command:    TYPE I
Response:   200 Type set to I
Command:    PASV
Response:   227 Entering Passive Mode (213,106,150,123,196,198)
Command:    MLSD
Response:   425 Can't open data connection.
Error:  Failed to retrieve directory listing

And the details on the server.

(not logged in) (87.106.131.22)> Connected, sending welcome message...
(not logged in) (87.106.131.22)> 220 --
(not logged in) (87.106.131.22)> USER ftp_001471
(not logged in) (87.106.131.22)> 331 Password required for ftp_001471
(not logged in) (87.106.131.22)> PASS ********
ftp_001471 (87.106.131.22)> 230 Logged on
ftp_001471 (87.106.131.22)> CWD /
ftp_001471 (87.106.131.22)> 250 CWD successful. "/" is current directory.
ftp_001471 (87.106.131.22)> TYPE I
ftp_001471 (87.106.131.22)> 200 Type set to I
ftp_001471 (87.106.131.22)> PASV
ftp_001471 (87.106.131.22)> 227 Entering Passive Mode (192,168,1,4,195,198)
ftp_001471 (87.106.131.22)> MLSD
ftp_001471 (87.106.131.22)> 425 Can't open data connection.

What am I doing wrong?

When I specify the external IP the client and server report the same, but the ports get screwed up and when I run with default the server uses its internal IP but the port assignment looks better.

Edit: more testing and its working.

So I installed the FTP server in IIS 7.5, disabled FileZilla and it worked! I then tried re-enabling FileZilla and that too worked! This was all from my home ADSL connection.

I then tried again from our remote server in Germany and it failed, hangs on the directory listing in passive mode for both IIS FTP and FileZilla.

I guess there is something up with the Firewall / router at the data centre in Germany. I don't really want to mess with the remote server router(I'm not even sure I can alter firewall rules as its hosted) I'm worried about corporate customers suffering the same fate when trying to access our FTP sites.