Tonny's questions

I'm tasked with setting up a Windows 2019 AD environment (new domain) from scratch.
Normally we obtain our server licenses/activation from the company KMS system and we need to do that in this case as well.
Normally I would just install the Windows server without a license. Configure the KMS and get the license/activation working, before I add the AD roles...

But: In this case the new domain is behind a firewall and has no normal connection to the company network.
Due to an administrative oversight the firewall rules to allow access to the KMS were not requested in time.
There is a lengthy approval process (lots of red tape) and I will not have KMS access for the new servers until a few days, possibly weeks AFTER the installation date for the DC, but we really need to get that domain operational ASAP.

I'm hoping I can configure KMS on the Server 2019 (without having actual activation because KMS is not responding) and then can just continue with the domain setup and it will pick up the activation later.

I know that a DC setup with an evaluation license can't be upgraded to proper license, unless you first move the AD roles to another server and reduce this DC to a normal server. Then you can re-license it.

I guess the real question is if a KMS setup with unreachable KMS server is treated as an evaluation installation or not.

For the new domain we need 2 DC's anyway. So I can always postpone adding the 2nd DC until AFTER we have the KMS and then re-license the 1st DC.
But it would require some extra work and another travel to go on-site (no remote access), which I would like to avoid.

Does anyone have any experience with this ?

We got a strange issue affecting a very small number (1%) of Windows 7 clients in our domain.

These laptops are issued a Computer-certificate (X509) through AD for VPN access. We have a PowerShell script which is run daily on each of these laptops that checks the expiration date on the cert and, if this is less than X days in the future, deletes the cert form the store and calls "gpupdate /force" to re-acquire it with a fresh expiration timer.

(In our case X is larger than the 18 days that AD normally uses for automatic renewal. We have many users that are off-line for more than 18 days at the time so the default 18 days is just to short. The cert must be deleted or else "gpupdate /force" won't do anything.)

In 99% of our computers this works as expected. But we got these few machines where, after the delete of the cert, the cert is NOT automatically re-acquired, unless the computer is rebooted en re-establishes a new computer-session with the domain.
Gpupdate doesn't re-acquire the cert, the normal periodic policy check that Windows does every 90-120 minutes in the background doesn't re-acquire it either.
After a reboot the computer will pick up the new cert immediately from AD.
(Obviously: Users don't do the extra reboot before going on holiday or a lengthy business-trip, so they are in the middle of nowhere and discover their VPN doesn't work because the cert is missing.)

It almost seems as if, after the delete, the cert is kept in a "locked" or "pending" state until the next reboot. The normal update process apparently still "sees" the old cert and has no reason to acquire a new one.

By the way: Delete and subsequent gpupdate is done via this code-snippet in PowerShell.
It looks OK to me and nothing weird appears in the generated logfile.

$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("My", "LocalMachine")
$store.Open("ReadWrite")

foreach ($cert in $store.Certificates) 
{
    $subject = $cert.Subject
    send2log "Deleting certificate: $subject"
    if ($cert.Issuer -match "CN=XX-XX-XXX.*") 
    {
        $store.Remove($cert)
    }
}
$store.Close()
$out = & gpupdate.exe /force
send2log "$out"

All this leads me to the question: When is a deleted cert really gone (and can be re-acquired) ?
Or alternatively: What could prevent this re-acquiring of the cert ?

I have a number of domain local resource groups that need:

a) to be changed into Universal groups.
b) renamed.
c) have the users of their member groups collapsed into this group itself.
d) remove the (no longer needed) member-groups.

The groups currently contain a mix of member-groups (sometimes nested groups) and users.
The end result would be a Universal group with just users. (So basically it is just a collapse of the entire tree structure into a single group.)

What would be the best order:
First change the groups type and name, then re-assign the members.
Or the other way around: First the members, than the rename/type of the group ?
Or doesn't make any difference ?
I can't find a definitive source on this.

Are there any tools that can automate this ? Doing it manually is a lot of work...

P.S.
This is in preparation of a domain migration/phase out.
The Universal groups (and the users) will eventually be transferred into the new domain. The domains are functionally AD2003 with 2008 and 2012 DC's (if that makes any difference).

I have never been to heavily involved with managing AD2003 domain controllers.
Now I get a broken domain dumped in my lap.
I need some advice how to proceed.

Here is the story:

Earlier today I inherited an old, badly managed, 3 server domain from another division.
(It was operated by an outsourced service-provider that went belly-up a year ago, since then it went uncared for.)
2 Windows 2003R2 DC's and a 2003R2 server running 1 application and SQL2000 server.
During the physical transport of the hardware 1 DC broke beyond repair. There is, as you probably already guessed, no backup at all.

The remaining 2 machines booted up and on both the ip-address was changed to a new address in my own range. After that both machines were rebooted once. DC first and the application server only after the DC had fully booted.
I have Domain Admin access to this domain. I can login to both surviving servers.
Both servers take ages (DC 15 minutes, app server 10 minutes) boot to a login prompt. After login it takes ages to get to a desktop (another 5-10 minutes).

Now it is my problem: I need to get that application running again until the end of the year.

First order of business seems to get rid of the failed DC. Then start doing cleanup on these servers (there are a lot of leftovers of removed an/or partially disabled applications on both).

Thing is: I'm not sure about how to do the DC removal.
Do i need to do dcpromo first, then ntdsutil/remove server ?
Just ntdsutil/remove server ?
Has the changing of ip-addresses impact on this ? (I can temporarily put the old ip-addresses back if needed.)

This domain, by the way, had a trust-relation with our normal domain. Does this impact the DC removal ?
Does something needs to be done regarding this trust-relation because of the ip-address changes ?

Any help will be highly appreciated.

UPDATE I fixed the DNS issues on both machines. Primary DNS on DC and app-server now point to DC itself. And I updated the DNS records for both machines in the DNS.
(I can't make a proper reverse PTR for either machine. Don't know how problematic that is going to be. The new ip-range isn't in the reverse zones here and this DC isn't allowed to update reverse pointers if I add the zone as a copy.)

This seems to have cured the excessive slowness of both machines.
Remote desktop logons are functional now. Still a bit sluggish but apparantly that was already the case before everything got messed up.

I'm now waiting for user-feedback regarding the application.

I've got 2 WSUS servers:
An old W2K3, WSUS 3.0SP2 box and a brand new 2012 server with the WSUS role enabled.

The old machine works fine and pulls the updates from MS via the company proxy. (With BITS set to the default background mode.)
The new one has exactly the same configuration setup, including the proxy config en the same user-account for the proxy. The new one will synchronize fine, even imported and verified all updates that I copied over from the old server.
But the new server will NOT download anything fresh from Microsoft.
I keep getting error error 364:

Content file download failed. Reason: Value does not fall within the expected range. Source File: /msdownload/update/software/defu/2013/05/am_delta_f1860b39acfcbfcf1d701c7c19d28faa97dd9e71.exe Destination File: D:\WsusContent\71\F1860B39ACFCBFCF1D701C7C19D28FAA97DD9E71.exe.

The proxy obviously supports the Range command properly. After all the other server uses the same proxy and also downloadmanagers have no issue with it either. (Tried another proxy as well: Same issue.)
I have tried setting BITS to foreground mode. Doesn't make any difference.

I have completely removed the WSUS role (including registry keys, etc.) and re-installed. After re-install the problem is back.

There is no other logging that I can find that sheds more light on the problem.

Any ideas what can be causing this ?

Update:

After some experimenting I narrowed it down as follows:
a) BITS jobs are created by the WSUS service, but they get cancelled immediately (same second) after being created. This is visible in the Bits event log messages. (No apparent reason for the cancels.)
b) Server is member of domain X. Account used for proxy is member of domain Y (and has admin rights on the server). On the old machine everything is in domain Y. This may be part of the problem.

I'm going to get an account in X with proxy access and use that for the WSUS transfers. Unfortunately I have some red tape to wade through to get another account so I won't be able to test that today anymore.

Update 2: After getting an account in the same domain as the server itself I still got the problem. Apparently this doesn't make any difference.
I also tested this new account on th eold working server. (Thus creating the cross-domain issue there.) The other server is happy with it has no issue using the new account.

Tomorrow I'm going to take the deep plunge: Remove the WSUS & IIS server-role completely, remove all related registry keys, remove all content-files from IIS and WSUS and throw away the WID database. Reboot the server and do everything fresh.
I would like to do a full re-install of the OS too but that is not feasible. Servers are managed by another department. I can get full local admin on one, but I am not allowed to install one.

Update 3: Somehow the Windows installation itself got borked through all the experimenting.
I had to bit the bullet and request a re-install of the server.
...
Ok, I've got a fresh server-install.
Redid the WSUS setup, by the book.
Same effect: Error 364

I am at my wits end. What can possibly be causing WSUS (or BITS) to think the downloads are problematic ? (BITS just immediately cancels the downloads without actually doing anything.)
I'm guessing the real problem is something else, which isn't handled properly and leads to this misleading error 364.
Any suggestions towards a solution, or just things to try for trouble-shooting are welcome.

Proliant DL380-G4 with the onboard SmartArray 6i controller.

Raid 1+0 set consisting of 2x 72 G and 2x 300 G disks (the bigger disks got added later).

Effective capacity about 140 GB and, of course, it is full.

I can't add more disks because the remaining 2 slots are taken by another 2-disk mirror. I can replace the 72 G disks (1 at a time) by 300 G disks and (after rebuilds) grow the array. No redundancy during the disk-swap though. And that 2x :-(

Or I change the array from Raid 1+0 to Raid 5 which will just give me 70 G extra (which is sufficient), but keeps (hopefully) the redundancy intact during the change.

Backup, kill the array, replace the small disks, create new array, then restore is not an option as I need to keep this box online at all times.

I'm not worried about the performance-loss during a rebuild. (User-access to the data is luckily enough quite light in this case.)

I'm looking for recommendations how to get the disk-space quickly upgraded, if possible while maintaining redundancy.

Edit: Changed server-type into G4 (I've got both in the server-room and got them mixed up.)

As I previously ran a Cisco only shop I'm not sure if this is going to work. On paper it looks OK, but you never know.

Will it work ? Are there special considerations that I need to be concerned about ?

I've got the following situation to deal with: Cisco 4900M core-switch in server-room A. HP ProCurve 2810G in the same room/same rack. 2nd ProCurve 2810G in server-room B some 80 meters away. Got plenty of OM3 fiber between the rooms.

I need to establish to each ProCurve a 2 Gb/s trunk for 3 VLAN's, with a possible extension of capacity to 4 Gb/s later.

I'm thinking of doing the following:

For the ProCurve in the same rack: Just run 2 Cat6a patches from the UTP uplink ports on the ProCurve to a TwinG converter with 2 GLC-T SFP's placed in a X2 slot on the 4900M. Turn these 2 links in a port-channel and run dot1q over it.

For the other ProCurve: Basically the same thing but use 2 HP X121 SFP's on the ProCurve uplink ports and a TwinG with 2 GLC-SX-MM SFP's on the 4900M.

For the 4Gb/s upgrade I can just double the links to each switch and add these to the port-channels.

P.S. I'm not worried about the actual configuration of the switches and channels. I have Cisco and HP experts available to do that when those server-rooms are being build. It's just that currently the project is still in design and planning phase and the services of those experts are not ordered yet. I'm just trying to prevent a situation where, during the actual implementation, it's discovered this is not working. At that point ordering a replacement solution would be too late in the game to keep the deadline for go-live.

Does anybody know if MS-Project 2007 can be used as client to a ProjectSever 2003 installation? We have an existing setup with Project-Pro 2003 clients on XP. For our newer Win7 machines the standard Project is 2007. Will this work ? Or would we have to install Project 2003 Pro on the Win7 machines? (Rather not do that, as the rest of Office on the Win7 machines will be 2007.)

Weird situation: Redhat Enterprise 5.5 (stock install, no updates, x64) on a HP z800 workstation. (Dual Xeon 2,2 Ghz. 8 cores, 16 if you count Hyper-threading. RH sees 16 cores.)

We have an application that can utilize 1, 2 or 4 threads for heavy calculations. Somehow all these threads run on the same core at 100% load (the other 15 cores are nearly idle) so there is absolutely no benefit from the extra threads. In fact there is a slight slowdown as the threads get in each others way on the single core.

How do I get them to run on separate cores (if possible)? Application is 64 bit. Can't change anything about the software except changing the threads setting. Is there some obscure Linux setting I can try to change? (I'm a True64 and Aix guy. I use Linux, but have no in depth knowledge of the process scheduling on Linux.)

/proc/cpuinfo list al 16. top en gnome cpu-monitor both indicate only 1 core is used. I tried something similar to that perl thing as well. We can load all CPU to nearly 100% if we want to. Application vendor claims: Yes it is multi-threaded but it is not optimized yet. That will be the next version (in August).

So I think the application is doing sub-threading within it's own process-space in stead of proper real separate process threads. Really nothing I can do about it then....