Dan's questions

I'm looking to explore the technical details of a quirk I've found.

I have an authoritative DNS server, performing Global Services Load Balancing. It responds with multiple IP addresses, in the order of preference based on its Load Balancing algorithms. So, for example if all services are healthy, but x.y.z.3 is least loaded, the response may look like:

x.y.z.3
x.y.z.1
x.y.z.2

However, what I've discovered is that if a user uses Google's DNS (8.8.8.8) they get a response exactly as above. However, OpenDNS appears to further round-robin these responses.

In other words, a user using 8.8.8.8 as their DNS server will always get this response:

x.y.z.3
x.y.z.1
x.y.z.2

But a user using OpenDNS could see them in any order.

I can immediately resolve this issue by only returning x.y.z.3, but I'd like to know:

1. Is there an alternative way to resolve this?
2. Is this behaviour covered in an RFC or standard?
3. Is the OpenDNS behaviour expected and correct?

I realise that it's unlikely anyone here has a definite "Check this box to resolve this" answer, but I'm struggling with this issue and I'm hoping that someone with more knowledge than me can give me some more insight or perhaps some terms and phrases to look for.

I'm investigating an odd issue with some embedded devices - long story short is that some of these devices (Possibly running a specific firmware version) aren't available through the NetScaler SSL VPN connection.

That's by the by, really, but during troubleshooting I noticed something that I'd like to know more about.

For testing, I set up a quick IIS server so that I could run WireShark and I get a subtly different traffic flow depending on whether I go through the VPN or not (Same machine, using Putty in RAW mode).

So, from WireShark on my IIS server (.117 below):

Without the VPN, from the Client I get the following traffic:

SYN
ACK
[Nothing happens, until I type "GET / HTTP/1.1" into Putty]
HTTP GET
ACK
FIN, ACK

With the VPN, from the Client I get:

SYN
FIN, ACK
[Nothing happens, until I type "GET / HTTP/1.1" into Putty]
HTTP GET
ACK
FIN, ACK

From my testing, I believe it's got to be the NetScaler that's sending that spurious FIN (I've tested from a machine in the DMZ, via the same Firewall etc and it doesn't have it) and I don't think it's out of the realms of possibility that an embedded device may not like it.

So, can anyone explain why NetScaler is doing this and how I can change it? I presume it's a TCP Profile configuration but I can't seem to figure it out.

I've attached two screenshots of the capture - both captures are using the same Client <-> Server and the same method (Putty). The only difference is whether I connect through the SSL VPN or not.

Update 1

In a moment of wondering, I changed the Web Server to listen on Port 81, instead of Port 80. With this configuration, the handshake is correct with no spurious FIN messages. This leads me to believe it's going to be something to do with the HTTP optimisation on NetScaler

I'm working on a site where every user is configured to point to a proxy.pac file, hosted internally.

My question is, how should we expect these clients to behave when the pac file is not contactable? Is Internet Explorer meant to timeout and allow the connection? Is there anything we can configure to improve the experience for users offsite?

My testing seems to give inconsistent results, which is why I'm reaching out for community experience.

I have a network appliance which contains some load balancing features - in my design, these features are only for use internally within the appliance. Nothing should EVER speak to them externally and, additionally, the client is low on IP addresses in the devices IP range.

Would it be acceptable to use the Link-Local range for these features? For example, 169.254.1.1.

NB: The device in question won't allow loopback IP's to be used for these features.

I'm attempting to lock down a Windows 7 build but I've noticed that users (In this case, students) can highlight a drive and get to the properties menu. I'd like to disable this if possible.

I normally use the following GPO:

User Configuration\Administrative Templates\Windows Components\Windows Explorer\Remove Windows Explorer's default context menu

Which also disables the "Properties" button, but occasionally customers ask for this to be left enabled. So, is there a way to do both?

I have a Windows Server 2003 box which will be acting as a terminal server. It will actually be running Citrix, but I don't believe that to be relevant here.

There has been a request for every user to use a single mandatory profile. I've used mandatory profiles before, but there have been generally different profiles for different users so I've always used the "Terminal Services Profile" tab to good effect.

What I'd like this time is a single setting, such as a Group Policy or similar that simply forces every non-domain admin user logging on to the box into using the mandatory profile. We'll be using Folder Redirection to take care of everything else.

I'm aware of the following GPO:

Computer Policy\Computer Configuration\Administrative Templates\Windows Components/Terminal Services

Set path for TS Roaming Profiles

But, as that's a computer policy, will it not apply to all users including administrators? If so, is it possible to exclude admins somehow?

Different Windows editions support different amounts of RAM, for example:

Windows Server 2008 R2 Standard: 32GB

Windows Server 2008 R2 Enterprise: 2TB

I'm curious about the impact, if any, of having more than 32GB of RAM on a Server 2008 R2 Standard box. Will performance suffer due to Windows having to manage more memory, despite not being able to utilise it?

This question assumes that no physical or architecture limits are being hit. I.e., Windows is well aware that the machine has >32GB RAM, but only 32GB is usable.

I have an image of a Server 2008 R2 system which has been Sysprepped and was shutdown prior to its first boot. Now, it would seem I screwed the XML file up as it fails halfway through the Serialize section when booted. (To be clear, it fails on the boot after taking the image)

What I'm wondering is, can I alter the Unattend.xml file at this stage using my ability to directly manipulate the saved image?

If so, do I edit the original (In the sysprep directory) or is it transferred elsewhere?

I have a HP R5500 XR UPS with a Management Card. In order to update the firmware for the UPS itself (I.e., not the management cards f/w) one has to connect, via a serial cable, to the management card and enable Pass-Thru mode so as the serial port connects directly to the UPS.

I have done this and successfully updated the firmware, but I was wondering if there was a way to exit Pass-Thru mode without manually resetting the Management Card using the reset pin. In the past I've always done it manually, but this is a remote box so it's more of a hassle.

I'm investigating an issue, which is described almost perfectly here:

http://support.citrix.com/article/CTX122238

I've followed the steps in Part 2 and confirmed that the WMI service does not have the correct permissions that Citrix requires.

My question: How do I change this? The MMC snap-in is read-only and I'm not entirely sure what I'm looking at.

Citrix just say:

If this is not present you must check Microsoft Group Policies to see what is being applied to this server. Change Group Policy to include rights to LOCAL SERVICE.

Which is not very helpful.

It's a Server 2003 R2 box on a very small 2003 domain. It does have GPO's applied, but I can't find any configuration relating to this and I know for a fact it's not a part of our standard rollout because otherwise I'd know about it!

This is effectively a repost of my question at StackOverflow, before I settle on a programmatic solution:

https://stackoverflow.com/questions/7530734/creating-a-cookie-outside-of-a-web-browser-e-g-with-vbscript

Essentially, a customers users are using a website that plays up with some other technology we roll out. We've exhausted all other routes in getting things to work properly, so I'm now in workaround / bodge territory.

I've found an option on the website which does make things work. However, it's undesirable (And needless convoluted unfortunately) for us to direct the users to configure this themselves.

Therefore, what I'd like / need to do is to set a cookie on computer logon. All the cookie contains is "0:-" which just disables the feature we need to disable.

Again, I realise this is highly undesirable but assuming I can find a way out of this, then I'll be out of the woods. Ideally in VBScript, but really anything that is invisible to the users is good.

Just for context, this is a Server 2008 R2 domain with Vista and Windows 7 Clients running IE8 and IE9. That is the scope for work and all I need to get working!

I'm happy to hear alternative suggestions, but the end result is that we want to automatically disable this websites feature for our users.

Any help gratefully received.