Shial's questions

My organization is in the process of setting up a new network at a hosting provider for a very large application project. Since the whole system uses Active Directory we are planning on using a pair of Domain Controllers there that replicate to our headquarters over VPN. These DCs would also serve as backup for our existing system so we could lose connection or power entirely at our headquarters and the remote system could stay up and still let people log in.

Our hosting provider has setup 10.180.87.0/24 as our subnet to use with them. But because our internal IPs are 192.168.1.0/24 and they already have it in use they require us to NAT over to 192.168.50.0/24. This part wasn’t a big issue and easily setup with our Watchguard firewall appliance.

First sign of trouble was when I put the two servers on the domain and they couldn’t connect or find the domain at all. I ended up putting a post-NAT address of DOMAIN.LAN into the hosts file on both servers. They were then able to locate and join the domain.

Making them Domain controllers however has been a problem. They get all the way through setup and then fail with an error when they try to setup all the replication with “RPC server is not available”. I know the domain is prepped correctly, Last week I did all prep work to promote a new server to DC to replace an older machine which went through fine.

I suspect the NAT is the issue and servers are trying to set themselves up with pre-NAT addresses. Our provider wants us to remap our IP scheme to fit with their network and I'm not exactly thrilled with the idea. One option we are considering is creating a server and network on 192.168.50.0/24 and using intersite replication to go from 10.180.87.0/24 to 192.168.50.0/24 to 192.168.1.0/24 (although that is probably gonna be messy network config-wise to figure out.) But I’m not completely convinced if that would solve the issue. A DMZ is another option but need to look into it more before I try to get our provider to set that up.

Has anybody had experience with a similar setup or alternatives for getting DC setup on a remote connection?

One of my VPs has an issue where when she receives an update to a meeting she is unable to accept the meeting change because it says "As the meeting Organizer you do not need to respond to this meeting request".

She is not the meeting organizer and the changes to the meeting time are not coming from her but from somebody else (Often the Executive admin, sometimes her directors). A side effect of this is her calendar doesn't update either (since there wasn't any need to apply a change it now thinks was already done)

Normally seems to occur to reoccurring meetings and it has been very consistent for the last few months.

I have made sure the display name isn't matching anybody else so that is out. I have completely deleted out her Outlook profile and all files, reinstalled Outlook and rebuilt the profiles from scratch to rule out a messed up OST/PST. Nothing special or unique about her exchange profile. I'm not finding much from Microsoft in my searches or other sources so I'm scrambling for ideas.

This is with Exchange 2003 and Outlook 2007

Any ideas?

Edit: A few weeks ago I deleted everything involving her account. Exported her entire email account out to a PST, deleted the AD account, purged the exchange account. reimaged both laptops that she has as well as master clearing the phone. I also deleted out the sync profile in the Mobile Admin on exchange. Rebuilt her from scratch, attached her old pst into a separate account.

It held for a while but now suddenly two different meetings seem to be having it again.

Users of our accounting server have a couple of times gotten odd errors about communication and unable to access SQL resources. When it happens it happens to all of our users at once. My first thought was maybe the SQL Server is out of whack but event logs for it look fine and no issues with the maintenance tasks that are scheduled.

The server does appear to be seeing an IP address conflict however at intermittent times that seem fairly close to the incidents. The MAC address is one of our laptops. All of our equipment excepting the usual stuff is DHCP, double checked and the server address is on the exception list so it should not be handing out at all. I've seen it where our VPN users had trouble because their LAN was on the same range as our LAN and their router wouldn't let them access our network because it thought everything was local but never the other way around. Has anybody ever seen this behavior where a remote LAN gave interference with the Local LAN?

I have one computer that is acting very strangly when working with the domain. I have removed and rejoined this computer to the domain and it found and connected to the domain just fine. but it is unable to see the domain after joining. I am able to do an nslookup on the domain and the correct server responds but the computer itself does not seem to authenticate or see the rest of the domain. I can connect to other file shares for instance but it prompts for a login since it can't authenticate itself.

This computer uses our standard XP image and its just a basic loadout. User accounts are user accounts, only administrator accounts on the machine are the local and domain administrators. Windows Firewall is disabled

I did perform the following commands on it and made sure it was in the right mode.

nbtstat -R
nbtstat -RR
netsh interface ip reset reset.log
netsh winsock reset
ipconfig /flushdns
ipconfig /registerdns

From the command line on the client I an able to lookup the domain, (And the DNS server is one of the DCs so its obviously talking to it.) but that seems to be all I can do with it. One thing too is the domain sees it just fine, I'm connected into it with both VNC and RDP

C:\Documents and Settings\Administrator>nslookup DOMAIN.lan
Server:  SERVER1.DOMAIN.lan
Address:  10.0.0.4

Name:    DOMAIN.lan
Addresses:  10.0.0.4, 10.0.0.147, 10.0.0.15, 10.0.0.11


C:\Documents and Settings\Administrator>nslookup DOMAIN
Server:  SERVER1.DOMAIN.lan
Address:  10.0.0.4

SERVER1.DOMAIN.lan can't find domain: Non-existent domain

C:\Documents and Settings\Administrator>nslookup SERVER1
Server:  SERVER1.DOMAIN.lan
Address:  10.0.0.4

Name:    SERVER1.DOMAIN.lan
Address:  10.0.0.4


C:\Documents and Settings\Administrator>nslookup SERVER1.DOMAIN.lan
Server:  SERVER1.DOMAIN.lan
Address:  10.0.0.4

Name:    SERVER1.DOMAIN.lan
Address:  10.0.0.4


C:\Documents and Settings\Administrator>ping DOMAIN.lan
Ping request could not find host DOMAIN.lan. Please check the name and try
again.

C:\Documents and Settings\Administrator>ping SERVER1

Pinging SERVER1 [10.0.0.4] with 32 bytes of data:

Reply from 10.0.0.4: bytes=32 time<1ms TTL=128
Reply from 10.0.0.4: bytes=32 time<1ms TTL=128
Reply from 10.0.0.4: bytes=32 time<1ms TTL=128
Reply from 10.0.0.4: bytes=32 time<1ms TTL=128

Ping statistics for 10.0.0.4:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Documents and Settings\Administrator>ping DOMAIN.lan
Ping request could not find host DOMAIN.lan. Please check the name and try
again.

C:\Documents and Settings\Administrator>ping SERVER1.DOMAIN.lan
Ping request could not find host SERVER1.DOMAIN.lan. Please check the name and try
again.

The ipconfig looks like it should, its getting all the information although I'm a little curious as to why the domain shows up twice in the DNS Suffix Search list.

C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

    Host Name . . . . . . . . . . . . : COMPUTER8862
    Primary Dns Suffix  . . . . . . . : DOMAIN.lan
    Node Type . . . . . . . . . . . . : Hybrid
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No
    DNS Suffix Search List. . . . . . : DOMAIN.lan
                                        DOMAIN.lan

Ethernet adapter Local Area Connection:

    Connection-specific DNS Suffix  . : DOMAIN.lan
    Description . . . . . . . . . . . : Intel(R) PRO/100 VE Network Connection
    Physical Address. . . . . . . . . : 34-CD-B2-9C-43-FA
    Dhcp Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    IP Address. . . . . . . . . . . . : 10.0.0.118
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Default Gateway . . . . . . . . . : 10.0.0.254
    DHCP Server . . . . . . . . . . . : 10.0.0.4
    DNS Servers . . . . . . . . . . . : 10.0.0.4
                                        10.0.0.147
    Primary WINS Server . . . . . . . : 10.0.0.4
    Secondary WINS Server . . . . . . : 10.0.0.2
    Lease Obtained. . . . . . . . . . : Monday, October 25, 2010 8:06:10 AM
    Lease Expires . . . . . . . . . . : Monday, October 25, 2010 10:06:10 AM

I've been unable to find anything on it and giving it one last day before I just reimage the machine again.

We recently upgraded from a Watchguard X5500e Peak firewall appliance to a Cisco 5500 ASA with the CSC module. The ASA is running the 8.2 software and the CSC is on the 6.3.1172 software. We've finally gotten everything stabilized after a few weeks of pulling hairs and gnashing of teeth and now its down to trying to setup a few items that were lower on the priority list.

With the watchguard we were able to go with the browser to an internal webpage and authenticate against the firewall to allow us to bypass the filters. Useful when a classroom here needs access to streaming media or an executive needs us to download a video. I'm trying to setup something similar but I'm fairly inexperienced with the Cisco devices like this ASA so I'm not sure if its treated as a VPN connection or some kind of ACL. Ideally we would want to setup more than one to limit exposure rather than one thats wide open when used.

I did a search and couldn't find anything related to thing in the other questions asked here and I have had no luck googgling it either.

We have a rather unfortunate legacy application at work, written originally in VB6 it predates anybody in our IT department by at least 5 years. We have a contracted developer for ongoing maintenance and where he can he rewrites sections over into .NET code (Not sure about his techniques here, this is a side job for his regular work as an IBM engineer) the application works fine (such as it is) under windows XP. We have only a couple of Windows 7 machines mainly for testing and this application seems to run into a wall. Things like the background not loading and SQL errors. This is even running under administrator.

Running an SQL trace from the ODBC control panel shows several interesting things. It makes a connection to the database successfully initially where it runs a query to determine if it is running the correct version. This query works fine.

            558-1af0 ENTER SQLExecDirectW 
  HSTMT               0x020D7548
  WCHAR *             0x04C8F0F0 [     115] "SELECT count(*) c FROM tblSoftwareVersion WHERE  fldSoftwareVersion = '123456' AND fldSoftwareName = 'Application.VB'"
  SDWORD                   115

BMS             558-1af0 EXIT  SQLExecDirectW  with return code 1 (SQL_SUCCESS_WITH_INFO)
  HSTMT               0x020D7548
  WCHAR *             0x04C8F0F0 [     115] "SELECT count(*) c FROM tblSoftwareVersion WHERE  fldSoftwareVersion = '123456' AND fldSoftwareName = 'Application.VB'"
  SDWORD                   115

It then seems to drop its connection and can't find the ODBC connection despite the fact its connecting to the same DB. From the trace it looks like it configures the connection then it starts firing off SQLFreeStmt to unbind and close out then when in the application and it tries to do its thing there is no connection.

558-1af0 ENTER SQLFreeStmt 
  HSTMT               0x020D7548
  UWORD                        2 <SQL_UNBIND>

BMS             558-1af0 EXIT  SQLFreeStmt  with return code 0 (SQL_SUCCESS)
  HSTMT               0x020D7548
  UWORD                        2 <SQL_UNBIND>

Then this happens when I try to do something that pulls data

            558-1af0 ENTER SQLDriverConnectW 
  HDBC                0x020DDA00
  HWND                0x00000000
  WCHAR *             0x73EF8634 [      -3] "******\ 0"
  SWORD                       -3 
  WCHAR *             0x73EF8634 
  SWORD                       -3 
  SWORD *             0x00000000
  UWORD                        0 <SQL_DRIVER_NOPROMPT>

BMS             558-1af0 EXIT  SQLDriverConnectW  with return code -1 (SQL_ERROR)
  HDBC                0x020DDA00
  HWND                0x00000000
  WCHAR *             0x73EF8634 [      -3] "******\ 0"
  SWORD                       -3 
  WCHAR *             0x73EF8634 
  SWORD                       -3 
  SWORD *             0x00000000
  UWORD                        0 <SQL_DRIVER_NOPROMPT>

  DIAG [IM002] [Microsoft][ODBC Driver Manager] Data source name not found and no default driver specified (0)

Nearly all of my searching on this issue comes up with programming issues where the connection string has a problem. The only thing that is different in this particular scenario though is Windows 7, I know the connection string is fine since it works on the XP machines. The VB components are supposed to be still functional under Win7. My computer is running 32 bit win7 and my VP is running Win7 64 bit and both have the same problem so that can be ruled out.

I have already tried reinstalling the SQL Native Client and the VB runtime as well as the application in question. Hopefully I can find a solution and not have to resort to using the XP VM.

Edit - Well after many attempts we have been forced to go with the XP VM as the solution here. Either the VB compnents aren't as compatible as they claim or this ancient app is doing something funny.

I've recently undergone training in SQL reporting services with the idea being that I would be leading our conversion from Crystal reports (Enterprise 10) to SQL Reporting services. There are 103 Crystal reports on our system however few of us are aware of the usage of these reports, almost all of them except a couple predate our current IT personal. A handful we know are used by everybody, a chunk we are sure aren't used and the rest we have no idea, some might only get used once a month, others daily by only one person in the organization.

Ideally I would like to find a way to see the hit counts on some of these reports. I already attempted to look at the IIS logs using LogParser but realized that the individual reports aren't stored as separate files but as a single page that generates the report so I have one page with a few thousand hits. I also looked at the administrative console of crystal however the last run field is completely out of whack, many reports have it as either an odd date or blank and these are reports I helped a user run yesterday so I can't consider it as reliable.

Is there a way or a particular log location of some kind that could show me how often a report is accessed over some period?

I'm having an issue with a couple of computers where the RealTime scan for trendMicro 8 just stops with no user intervention. It is random, they might not see it for days then it will just turn off. In the logs I'm seeing the services are sent a stop command, sometimes from the user, other times with one of the administrator accounts. There is two services, Listener and the RealTime Scan, both are sent a stop, not a crash but the Listener is started right up by the SYSTEM after shutting down. They are not dependent on each other, RealTime Scan has no dependancies, Listener depends on Network Connections and WMI. I'm not seeing anything particularly unusual here either in the logs or the running processes.

Sequence:

Stop is sent to Listener Service, 
Stop is sent to RealTime Scan Service, 
Start command sent by SYSTEM to Listener Service.

This all happens within 2-3 minutes of windows starting. All computers are running Windows XP Service Pack 3. Both services are set to start Automatically and they log no other issues.

Event Type: Information
Event Source:   Service Control Manager
Event Category: None
Event ID:   7035
Date:       10/13/2009
Time:       7:41:14 AM
User:       DOMAIN\administrator (Sometimes this is the users name)
Computer:   RNDCOMPNAMEHERE
Description:
The OfficeScanNT RealTime Scan service was successfully sent a stop control.

I'm at a bit of loss as to what else to look at or where to look for further clues as to the source. Searching online nets a bit fat 0 results for this particular problem.

Here where I work we use Symantec BackupExec 11D to handle all of our server backups. recently had an issue crop up on the weekend where the backups got hung up. Ended up restarting all of the backupExec services to unjam it. The backs now are getting written out until they hit the Microsoft Information store (Exchange 2003 on Server 2003)

This is the error in the logs:

Backup- \EXCHANGE\Microsoft Information Store\First Storage Group Error, Unable to open \EXCHANGE\Microsoft Information Store\First Storage Group because it is currently being backed up by another process.

Our vendor has suggested just restarting the entire server (in their opinion the vss service is conflicting with the backupexec) but I'm personally loath to just reboot unless I need to. Has anybody seen this type of issue or know which service might be related to this?