Rory's questions

Our router began crashing 6 weeks ago. We put it down to our DSL provider and then to power outages that seemed to coincide. But the crashes increased in regularity and then last Friday our router crashed maybe 10 times in the one day. And we still don't know why. When the router crashes it becomes unpingable (internally or externally) yet the router lights flicker on just like they should. Since black Friday we have

• updated router firmware to latest version
• swapped the router for an identical model
• rolled back all recent edits to router configuration to a happier time
• eliminated the DSL lines as the issue
• ensured that our AV Eset Nod32 is up to date on all clients
• removed wireless access for all

The crashes have stabilized somewhat in that they now happen every 48 hours or so. We are syslogging router output but have found nothing, so far.

The router is a Zyxel P600 series, model: P-661HW-D1. We have a vpn with port forwarding and some firewall rules. Clients are xp, vista & win 7. Why are these crashes happening and how can we get to the bottom of it?

Our Terminal Services Server is Win 2003 running Microsoft RDP 5.2. The RDP connections from outside of the network used to be smooth but they are now choppy and unreliable because the user is regularly interrupted by timeouts irrespective of what OS they are running. This has been happening for about 6 weeks or so .... around about the time that the server was demoted as a DC. Coincidence? No settings were changed on the Terminal Services Server. I feel the router is at fault but could it be related to the DC demotion?

I ran dcpromo to demote a W2K3 dc. The wizard completed without a hitch. However, there are now a few anomalies:

Launching nslookup from the remaining dc (W2K8 R2) gives the result- Default Server: Unknown

nslookup from a client pc gives - Server Unknown, Address: ip address of the demoted server and the message "Unknown can't find computername: no response from server"

The DNS Role has been removed from the old dc but DNS on the new dc is still showing entries for the old dc (eg under DomainDNSZones & ForestDNSZones). This article http://support.microsoft.com/kb/216498 suggests running ntdsutil to clean up metadata but the article is written for W2K3 SP1 or lower and the new dc is W2K8. And the first section of the article also suggests that removing the old dc from Servers in AD Sites and Services will do the same thing on W2K8 anyway.

Can I remove the old dc from Sites and Services and remove the old dc entries from DNS? Or should I run metadata cleanup from ntdsutil? And most importantly I suppose, will this resolve the issues I am having?

Our existing print server for our 8 printers is a Win 2003 server that is slowly being decommissioned. We want to move print services off this server but we want to move them to the right place. I don't want to make the domain controller a print server, nor do I want to use any of the other existing Windows Server 2008 R2 application servers. There are 2 other Windows Server 2003 machines that could be used.

Would a dedicated Hyper-V instance running Windows Server 2008 R2 be a waste of a Windows Server 2008 R2 license?

It seems to me that a lot of companies in our position run print services on the nearest piece of scrap instead. What are the main advantages to putting the services on Windows Server 2008 R2?

I have one Windows XP SP3 pc on the domain that I cannot rdp into. The xp pc is enabled for rdp sessions. Port 3389 is open in the firewall. There are no errors in the event logs. I have tried to rdp from from a number of different machines running different versions of rdp client (5.1 & 7). When I try to rdp from an xp machine it fails without an error message, the connect button simply becomes disabled for a second and then becomes enabled again.

How can I troubleshoot this issue to find out the root cause?

Epilogue: I never did find the root cause....the pc had other faults and was removed offsite.

When connecting android mobile devices to Exchange ActiveSync some require granting device administrator privileges which permit an exchange administrator to remotely wipe the phone. The warning messages are scaring some mobile users and turning them away from using Exchange ActiveSync altogether.

How can I disable his functionality on Exchange Server 2010? [security breaches are not an issue here]

I am using https://www.testexchangeconnectivity.com to test outbound smtp connectivity. I am getting this message at the last stage:

Attempting to find the SPF record using a DNS TEXT record query.
ExRCA wasn't able to find the SPF record.

Additional Details
No records were found.

We have Exchange 2010. The test was working until I rebooted our AD (Windows Server 2003). Can someone help me with this?

Up to now we have been pushing mails to personal gmail/yahoo accounts so that users could access their email on mobile devices. We have been using the Forward-To Delivery Option.

Now we have ActiveSync working in Exchange Server 2010 so users can take advantage of it for mobile devices. ActiveSync will be a much better experience for the users but is there any IT benefit in getting users off push-email? (apart from a relatively minor saving in server storage space)

Our company had a bad virus experience several years ago. Probably as a result, every pc has Eset Nod & SuperAntiSpyware installed. I think this is excessive and that Eset should allow sufficient protection by itself. Is there any good reason to have both installed on all pcs?

I need to create security groups in AD. I can identify the groups that I need, let's say they are: Management,Finance,Sales & Engineering. And I can identify the resources that each group requires access to (though this could be a tedious task). And I can identify levels of access required.

Most companies add security groups as needed. But this is a situation where the company is already mature but has never used security groups before. Are there best practices for implementing security groups? Are there any tips? Or pitfalls to avoid? And does anyone know of any tool that could speed up the group->resource mapping process?

Possible Duplicate:
Can you help me with my software licensing question?

Our company has maybe 10 users who require Visio and Project but only on an occassional basis. It would seem like overkill to purchase 10 separate copies of each. But the only alternative that I can see is to put the software on a server and allow access through rdp (with a volume license agreement apparently). As a user I wouldn't like to have to use the app via rdp. Are there any alternatives?

[Our users don't want to move away from Visio or project]

We have an upcoming scheduled power outage for maintenance.

UPS protects our servers. But it has been suggested that all PCs should be unplugged to prevent damage from power surges when power is restored. Is this precaution really necessary?

I have a Fujitsu Primergy TX200 S3 server running Win Server 2003 R2 SP2. It has hardware-RAID using an LSI Logic MegaRAID SAS 8300XLP RAID Controller.

I simply want to find the size of each disk in the RAID array. How can I find this information?

Update: I should have mentioned that the RAID manager tool is not working for me right now.

We are migrating from a DC and Exchange 2003 on an old Win 2003 server to Win 2008 R2 and Exchange 2010 in a virtual env.

We are worried hardware failure in our old server when we install adprep and other migration prep stuff on it (it has trouble rebooting). All we have are tape backups of server data.

What are our options to implement temporary disaster recovery for the duration of the migration with minimal impact on our old server?

Some downtime is not a big deal. But we couldn't cope with 1 week downtime while we rebuild the DC and exchange from scratch. At the moment we are considering renting a server for several weeks to use as a hot spare.

We are migrating Active Directory from from Windows Server 2003 to 2008 shortly. With 2008 we would like to be able to use a separate password policy for a particular group of PCs. One suggested password policy would force users to choose a new password from a predefined list when a password expires. So we would then effectively be rotating between 3 passwords. I know this doesn't seem like a good idea and I am proposing a different solution. But can this be done? Can we use Active Directory to store the viable passwords for a particular PC?

We are a small business (~100 emp) with a creaking server running AD, Exchange 2003 and more. We need to upgrade the hardware and it has been proposed to put Win Svr Std 2008 on one new server with AD on the physical server and Exchange 2010 on virtual server. But from what I see this is not a recommended configuration.

I can see two options: 1) use Win Svr Ent 2008 and put AD on one virtual server and exchange 2010 on another (the extra virtual servers for Ent edition will always come in useful) 2) buy 2 independent servers and put AD on one and exchange 2010 on the other

There must be many many small businesses running AD & Exchange. Can anybody tell me what is an optimum configuration in terms of performance and cost?