Harry Johnston's questions

I'm unable to install updates from our WSUS server (or from Windows Update) and error 7024 appears in the System Event Log:

The Delivery Optimization service terminated with the following service-specific error:
General access denied error

Error messages like these appear in the Windows Update log:

2020/03/12 15:55:10.2967680 11116 8720  DownloadManager *FAILED* [80010108] Method failed [CAgentDownloadManager::DownloadUpdate:8538]
2020/03/12 15:55:10.2967780 11116 8720  DownloadManager *FAILED* [80010108] Got error starting update 0 in call 8. Notifying call.
2020/03/12 15:55:10.2992536 11116 7112  Handler         *FAILED* [80004004] CAppxRangeRequestJobNoBlockValidation::Run {9EA297F8-07ED-4D73-B705-7C68F2CACF7B} [d:98DED0BF]: Job shutdown
2020/03/12 15:55:10.2997565 11116 7112  Handler         *FAILED* [80004004] Method failed [CAppxStreamingDataSource::CreateRangeRequestJob:1301]
2020/03/12 15:55:10.3006678 11116 7112  Handler         *FAILED* [80240007] FindDeploymentOperationForUpdate
2020/03/12 15:55:10.4196302 11116 7112  Handler         *FAILED* [80070057] IA call to resume download for app category BBC38914-FE0A-41D6-B45F-24A64071962D [UpdateId: 9EA297F8-07ED-4D73-B705-7C68F2CACF7B]
2020/03/12 15:55:10.4196336 11116 7112  Handler         *FAILED* [80070057] CreateDataSource failed for uri 'x-windowsupdate://9EA297F8-07ED-4D73-B705-7C68F2CACF7B/BBC38914-FE0A-41D6-B45F-24A64071962D/98ded0bf9f36e0649f79c0a30c087fe2dc1f9981'
2020/03/12 15:55:10.4554179 12552 12264 ComApi          ClientId = Acquisition;explorer: Exit code = 0x00000000; Call error code = 0x80240022
2020/03/12 15:55:29.6739766 11116 15248 Misc            GetUserTickets: No user tickets found. Returning WU_E_NO_USERTOKEN.

Error messages like these appear in the Delivery Optimization log:

2020-03-04T04:43:32.4368707Z 1B78  EF8 {ServiceMain} *** Starting service ***
2020-03-04T04:43:32.4371455Z 1B78  EF8 {} (null) [onecore\enduser\deliveryoptimization\statepersistence\persistencelocation.cpp] (hr:80070005)
2020-03-04T04:43:32.4409756Z 1B78  EF8 {ServiceMain} ** Service was started due to trigger event **
2020-03-04T04:43:32.4409779Z 1B78  EF8 {CService::Run} Service starts running, with idle timeout of 300 s...
2020-03-04T04:43:32.4420184Z 1B78  EF8 {} (null) [onecore\enduser\deliveryoptimization\configmanagement\globalconfigmanager.cpp] (hr:80070005)
2020-03-04T04:43:32.4423674Z 1B78  EF8 {} onecore\enduser\deliveryoptimization\configmanagement\globalconfigmanager.cpp(57)\dosvc.dll!00007FFFA2EC07E7: (caller: 00007FFFA2E7D7D8) Exception(1) tid(ef8) 80070005 Access is denied.
 [onecore\enduser\deliveryoptimization\deliveryoptimization\globalobjects.cpp] (hr:80070005)
2020-03-04T04:43:32.4423806Z 1B78  EF8 {CDeliveryOptimizationManager::Init} Failed in initialization, hr = 80070005
2020-03-04T04:43:32.4423876Z 1B78  EF8 {CDeliveryOptimizationManager::Init} Assert (!L"DO manager failed in initialization"): Failed
2020-03-04T04:43:32.4423961Z 1B78  EF8 {CService::Run} DO manager init failed with hr = 80070005
2020-03-04T04:43:32.4423976Z 1B78  EF8 {CService::_OnStop} Received service stop notification; system shutdown: 0
2020-03-04T04:43:32.4424369Z 1B78  EF8 {CDeliveryOptimizationManager::Shutdown} DoManager shutting down, final? 0
2020-03-04T04:43:32.4428958Z 1B78  EF8 {CDeliveryOptimizationManager::Shutdown} DoManager shutting down, final? 1
2020-03-04T04:43:32.4431130Z 1B78  EF8 {CService::Run} Service shutdown complete, hr = 80070005
2020-03-04T04:43:32.4431148Z 1B78  EF8 {ServiceMain} *** Service out of Run loop. Exiting... ***
2020-03-04T04:43:32.4433721Z 1B78  EF8 {} (null) [onecore\enduser\deliveryoptimization\statepersistence\persistencelocation.cpp] (hr:80070005)
2020-03-04T04:43:32.4433792Z 1B78  EF8 {ServiceMain} Assert (0): SUCCEEDED(hr)

What might be causing this and how can it be corrected?

I am attempting to install Adobe Creative Cloud on my client computers using an installation package created using Adobe's Admin Console. Everything works except for Adobe XD, which is only installed for the administrative user account that ran the package, not for the end users.

How can I do a global installation of Adobe XD?

I have a freshly installed Windows Server 2016 Remote Desktop Server and I am attempting to generate a certificate for it. Specifically, I believe I need to configure a certificate for the "RD Connection Broker - Publishing" role service.

All the Microsoft documentation and most of the third-party content I can find seems to assume that the certificate will be either self-signed or generated in-house using the Microsoft Certificate Authority service. What I want is a certificate signed by a suitable third-party public Certificate Authority, so that it will be trusted by default on all Windows machines.

The Deployment Properties wizard does not have the ability to generate certificate requests, so you need to use the Certificates MMC snap-in (or IIS, but I don't have it installed). Unfortunately, the Certificates snap-in is not very user-friendly and it is not obvious how to proceed.

How can the Certificates snap-in be used to generate a certificate request suitable for the "RD Connection Broker - Publishing" role service?

I'm installing a new Windows 2012 R2 server, and I want to bring it up to date before putting it on the network, but neither the August 2019 cumulative update nor the latest servicing stack update will install.

What sequence of updates do you need to install to bring Windows 2012 R2 from the base install to the latest cumulative update?

I've just installed Windows 2016 and am attempting to install updates. For security reasons I am attempting to install the latest cumulative update before attaching the new server to the network.

I've downloaded KB4507459 (the July 2019 cumulative update) from the Microsoft Update Catalog but it won't install; the error message says "The update is not applicable to your computer."

Why is that? How can I install the latest cumulative update without putting the server on the network?

One of our users has a laptop running Windows 7 which cannot connect to our wireless network. When the connection attempt is made we get an error in the System event log, Schannel event 36888, which says:

The following fatal alert was generated: 48. The internal error state is 552.

This is followed by an event claiming that the certificate could not be verified, suggesting that the fatal alert occurred while trying to verify the RADIUS server certificate. The event includes a copy of the certificate in the event data but I don't know how to extract it in a useful form.

Other apparently similar Windows 7 laptops can connect, as can Windows 10 laptops.

We are using WPA2-Enterprise and Microsoft PEAP user authentication. Turning off "validate server certificate" allows the connection to succeed but is not an acceptable long-term solution. The correct certificate is selected in the certificate list, all the settings are the same as on the working laptops.

What might be wrong with this particular Windows 7 laptop and how can I fix it? What troubleshooting steps should I be taking?

I'm trying to use the group policy setting "Interactive logon: Message text for users attempting to log on" but I'm having trouble getting the formatting of the message right; my paragraph breaks (i.e., blank lines) disappear as soon as I press Apply.

I found a suggestion to use ALT-255 (non-breaking space) as an invisible character, which seemed to work at first, but resulted in the message being truncated when displayed on the clients.

I like my blank lines. How can I get them to stay put?

Windows 10 introduced a new computer group policy, "Remove access to use all Windows Update features", which blocks access to the Windows Update control panel. You can turn this on in group policy and then make the client see the change by scanning for updates.

When you turn the group policy off, however, you have a bit of a chicken and egg problem, because scanning for updates from the control panel is still blocked. With the control panel blocked, you can't start a scan, and without a scan, the control panel will remain blocked.

In v1607, after turning the setting off in group policy you could make the client see the change by running "usoclient StartScan" at the command line.

In v1809 this no longer works.

Is there another solution? I tried "usoclient RefreshSettings" but this didn't work either. The change will kick in eventually (by default, automatic scans occur every 16-20 hours) but if I'm trying to, e.g., install updates during a scheduled outage then eventually isn't really good enough. Doing a scan through the API doesn't work either.

NB: I am talking about the computer group policy setting, not the user group policy setting of the same name, which very unfortunately is no longer supported in Windows 10.

Addendum: the problem is not that the group policy hasn't been processed yet; running gpupdate or gpupdate /force does not help. All that does is make sure the registry key has been correctly modified, it has no way of forcing the Windows Update client to actually look at the registry key.

In order to run a third-party WSUS script (against the Windows Internal Database) I downloaded the x64 version of the Microsoft Command Line Utilities 14 for SQL Server, but when I attempt the installation I get the following error message:

Setup is missing an installation prerequisite: Microsoft ODBC Driver 11 for SQL Server. To continue, install Microsoft ODBC Driver 11 for SQL Server and then run the Setup operation again.

Installing the ODBC driver (downloaded from this page) as instructed has no effect, I still get the same error message when attempting to install the command line utilities.

Also, although I definitely downloaded the "Microsoft Command Line Utilities 14 for SQL Server" when I run the installer it is titled "Microsoft Command Line Utilities 13 for SQL Server".

(Emphasis mine.)

What the heck is going on here and how can I successfully install the latest version of the command line utilities?

After upgrading Java to version 8u171 the Java KVM client provided by my Dell BMC's web interface stopped working. The only error message is "Connection failed."

I'm using the BMC on a PowerEdge C6220, but other models may also be affected.

What's going on and how can I fix it?

In the Group Policy Management Console I am attempting to delegate the "Link GPOs" right, but after selecting the group to delegate the access to and the "This container and all child containers" option, I am receiving the error message "The request is not supported".

Here's a screenshot of the same error on the Microsoft Forums. In that case, the user was attempting to remove a delegation.

What causes this error and how can the problem be resolved?

In Windows 10, the Windows Update client uses event tracing rather than writing to a text file like it did in previous versions of Windows. This can make troubleshooting problems with client machines difficult.

The Get-WindowsUpdateLog cmdlet doesn't always work. In particular, it doesn't seem to work properly when run remotely, or when the target machine doesn't have direct internet access. I've also seen reports of other problems whose cause is less clear.

Is there a more reliable and flexible option?

In Windows 10, the Windows Recovery Environment (WinRE) can be launched by repeatedly cutting power to the computer during the boot sequence. This allows an attacker with physical access to a desktop machine to gain administrative command-line access, at which point they can view and modify files, reset the administrative password using various techniques, and so on.

(Note that if you launch WinRE directly, you must provide a local administrative password before it will give you command line access; this does not apply if you launch WinRE by repeatedly interrupting the boot sequence. Microsoft have confirmed that they do not consider this to be a security vulnerability.)

In most scenarios this doesn't matter, because an attacker with unrestricted physical access to the machine can usually reset the BIOS password and gain administrative access by booting from removable media. However, for kiosk machines, in teaching labs, and so on, measures are usually taken to restrict physical access by, e.g., padlocking and/or alarming the machines. It would be very inconvenient to have to also try to block user access to both the power button and the wall socket. Supervision (either in person or via surveillance cameras) might be more effective, but someone using this technique would still be far less obvious than, e.g., someone attempting to open the computer case.

How can the system administrator prevent WinRE from being used as a back door?

Addendum: if you are using BitLocker, you are already partially protected from this technique; the attacker will not be able to read or modify files on the encrypted drive. It would still be possible for the attacker to wipe the disk and install a new operating system, or to use a more sophisticated technique such as a firmware attack. (As far as I am aware firmware attack tools are not yet widely available to casual attackers, so this is probably not an immediate concern.)

I'm using the Adobe Creative Cloud Packager to build an installation package containing all or most of the available applications (as opposed to specific individual applications) for deployment on end-user workstations.

This install package runs successfully on Windows 10, but fails with error 1603 ("A fatal error occurred during installation") on Windows 7. The installer runs for a long time before failing, and appears to be installing at least some of the applications the package contains, but these installations are rolled back and when the installer finally exits none of the applications in the package are present.

The log file (PDApp.log) may contain the following messages:

The HDPIM Setup Process return code is (190).Stopping the installation process.

Product Media (ESHR, 0.3.0) installation failed ...

What's going on and is there any way of stopping it?

Symptoms:

The first time anyone logs into the Remote Desktop server after a reboot, TerminalServices-RemoteConnectionManager event ID 1130 is generated in the system log:

The Remote Desktop Session Host server does not have a Remote Desktop license server specified. To specify a license server for the Remote Desktop Session Host server, use the Remote Desktop Session Host Configuration tool.

Once the 120 day grace period expires, attempts to log on result in this error message:

The remote session was disconnected because there are no Remote Desktop client access licenses available for this computer. Please contact the server administrator.

However, the licensing server is already configured in Remote Desktop Session Host Configuration and the Licensing Diagnosis shows no problems.

Resetting the grace period as described here allows logons to succeed again but does not permanently resolve the problem; event ID 1130 continues to appear the first time someone logs in via Remote Desktop after a reboot, and after another 120 days logons will start failing again.

As described here, the failing server(s) do not have X509 Certificate entries in

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM

What are possible causes of this issue?

We have a number of Dell PowerEdge servers, ninth generation and later.

According to Using the LAN and Serial Interfaces in Ninth-Generation Dell PowerEdge Servers:

As an enhancement over previous generations of Dell PowerEdge servers, shared NIC mode enables connection to the BMC through either LOM, not just one.

We were a bit worried about that, because on several of our servers LOM1 is attached to a dedicated management network and LOM2 is attached to the LAN, and we don't want the DRAC to be accessible from the LAN.

The puzzling thing is that, experimentally, it doesn't seem to be true. (Details below.) With the DRAC configured in shared mode, the DRAC is only reachable from LOM1, not from LOM2.

Is the article wrong? If not, how do I get the DRAC to respond on LOM2? (Short of using Failover mode which according to the article requires teaming, i.e., both LOMs must be on the same network.)

Most importantly, what, if anything, do I need to do to be certain that none of our DRACs are accessible via LOM2?

Test Procedure

The machine I'm experimenting with is PowerEdge 2970 with a DRAC 5, Hardware Version A00, Firmware Version 1.60 (11.03.03). The BMC Firmware Version is 2.50.

The NIC Selection is set to Shared and the NIC is enabled.

The static IP address is 192.168.241.100 and the subnet mask is 255.255.255.0. There is no gateway on our management network so I have that set to 0.0.0.0. Auto negotiation is on. None of the other settings are configured.

With the management network connected to LOM1 (and the LAN connected to LOM2) I can both ping the DRAC and log into the DRAC web interface from a production machine with access to the management network. (IP address 192.168.241.102/255.255.255.0.) I cannot ping the DRAC from a machine on the LAN (mis)configured to use 192.168.241.29/255.255.255.0, even after clearing the ARP cache.

With the management network connected to LOM2 (and the LAN connected to LOM1) I can neither ping the DRAC from the management network machine or connect to it via the web interface. Clearing the ARP cache had no effect. I can ping the DRAC and access the web interface from the machine on the LAN.

In both cases the operating system on the 2970 has full network connectivity on both the LAN and the management network (once the network interfaces are appropriately configured).

I also tried using WinDump to look for arp replies on both the management network and the LAN. In both cases, I saw arp replies from the DRAC only on the network that LOM1 was plugged into.

If you attempt to install the Java 8u65 runtime on a Windows Server, the following error message appears:

Content within this application coming from the website listed below is being blocked by Internet Explorer Enhanced Security Configuration

When the dialog is dismissed, the installer hangs. I tried adding the file to the Trusted sites zone, but I couldn't figure out how to properly format the path.

How can I install the Java 8u65 runtime on my Windows Server?

On Windows 7 or later, attempting to use wusa.exe to install a CAB file containing a Windows update returns error 0x80070002 (-2147024894), "The System cannot find the file specified".

I've tried quoting the full path to the file, running the command in session zero, and everything else I could think of. Why won't the update install?

I have a large set of data (about nine million files of various sizes and types; mostly student home directories) and when I run chkdsk on the volume it spends a long time on a particular index. By "a long time" I mean several hours, a substantial fraction of the total time the chkdsk takes. During most of the chkdsk you can see progress every second, but at a particular index number it just stops. If I do a chkdsk again (without any changes to the data) it stops at the same number.

I've moved the data from one volume to a newly formatted one, and the same thing happens there. As I delete chunks of the data, the chkdsk time becomes shorter, but there is still a single index that takes a sizable fraction of the total time right up to the point where the disk is nearly empty. The index number in question changes sometimes when I delete a chunk of data.

Is this normal behaviour? Can anyone explain it? Is there a special index that contains all files, or something along those lines?

Note: the problem has been resolved, the admin of the parent domain managed to remove the DC object. I gather he used ADSIEdit.

I'm working with an AD forest (in an isolated test environment, luckily, so failing all else we can blow everything away) and accidentally tried to create a subdomain using a cloned machine as the new domain controller.

Naturally enough, this didn't work. But the new subdomain got created, even though AD was not successfully installed on the putative DC, and now I can't get rid of it.

I started with this article. That didn't work because there was still metadata for the DC for the orphaned domain.

So I found this. Unfortunately this doesn't work either.

I opened AD Site and Services, opened the site in question, opened the Servers container, selected the DC in question, right-clicked on NTDS Settings and selected Delete. Clicked through "Are you sure", selected "This Domain Controller is permanently offline ...", confirmed that I wanted to do this even though the DC isn't in the domain I'm connected to, and confirmed that I wanted to do this even though this was the last DC in the domain.

Then it said "Windows cannot delete object LDAP://... because: A referral was returned from the server."

Anyone seen this before? Any ideas?