David Moisan's Blog: SBS

Spreading a Meme: Scripting/Sysadmin

Tue, 17 Jun 2008 13:58:14 GMT

Mind Of Root is spreading a meme! What was one’s first job as a sysadmin and when did they learn scripting?

How old were you when you started using computers?

I was, um, 16, and a freshman at Salem High. We had a PDP-11/60 and a computer lab. I loved it.

What was my first machine?

My brother bought a TRS-80 Color Computer in my junior year of HS, and I used it through college, eventually buying enough parts for it that I had half ownership. The first computer I owned personally was a 286 PC clone in 1991.

What was the first real script you wrote?

In high-school, I and my brother and several of our friends took turns being sysadmin for the PDP-11. It ran RSTS, which was a BASIC-based timeshare system for educational use. Its scripting language was BASIC! I wrote a script to backup files from our system disk (a large removable disk pack) to our secondary disk (another pack). The backup system on RSTS, like most all minicomputers at the time, was made to use tape as the backup media, like the (now old-style) NTBackup, and we didn’t have any tape drives.

What scripting languages have you used?

BASIC (!!), VBScript, CMD, Perl and now PowerShell.

What was your first professional sysadmin gig?

That would be the job I hold now at Salem Access Television, the first job I’ve had in a while where I get to be sysadmin, though of course I have much deeper responsibilities there.

If you knew then what you know now, would have started in IT?

When I got out of college, I felt a little disillusioned and considered technical writing. I never seriously considered a non-technical career (like management), but I wasn’t going to be a coder as I had originally trained for. After going through the “Parachute” job book too many times. I now believe IT was the right thing for me after all. It’s a craft of sorts.

If there is one thing you learned along the way that you would tell new sysadmins, what would it be?

Get involved with community; it’s much easier to stay connected than it was when I was an intimidated freshman in college. I was alone for too much of my college life. Don’t be afraid to look at the big picture; as you get more experience, you won’t see your world only through a shell prompt. Also don’t forget the larger community—at SATV I am making a difference for us in how we serve our community. Keeping things smooth can be its own reward.

What’s the most fun you’ve ever had scripting?

I have fun just learning scripting, though I admit I haven’t had the time or energy to get into the real esoteric stuff that’s in PowerShell CTP 2, though I do run it and do tinker from time to time.

Who am I calling out?

SBS 2008 has PowerShell built in. It will be the first exposure to PowerShell for many SBS admins, so I want to call out people in the SBS community:

Working with SBS 2008, Part 3: Migration Migraines

Fri, 06 Jun 2008 23:56:56 GMT

If you saw the original drafts of my last two posts that I stupidly put online, Working with SBS 2008, Part 1- Single-Server Migration and Working With SBS 2008, Part 2- Answer files and the installation, you know I tried doing a Swing migration on my "old" SBS 2008 beta box. Didn't work. But I still got my server migrated, though the swing was a complete bust.

There were three things I needed migrated: My user profile on my workstation, my email and my Sharepoint site (which only had a few items in it as a test). There were some other files on the server I wanted saved but those were trivial to deal with.

The profile was the easiest. I used the Windows User State Migration Tool (USMT) Version 3.0.1. It's the command-line scriptable counterpart to the Windows migration wizard included in Vista and XP. It was easier yet to save the profile when I stopped trying to websurf on the machine while USMT was running!

Sharepoint 3.0 is backed up via the Sharepoint Site Administration page. Wish I could say how the restore went but I accidentally deleted the backup files.

An obstacle I ran into was the backup volume on the old server. SBS 2008 uses disk-based backup and configures a volume with a VHD file, the same format as Virtual Server and Virtual PC(though the VHD has no boot sector and cannot be used for virtual-to-physical migrations.)

You can open the disk, extract the VHD and use vhdmount from Virtual Server to access the files I wanted to restore, but I really wanted my new copy of SBS to recognize the restore volume and use it to restore applications under Windows, much as the System Restore feature of the Server 2008/Vista install disk lets you mount your backup disk and restore from it.

Apparently, Windows Server Backup doesn't do that, so it's vhdmount for me. I used that on the new SBS machine to extract the Exchange databases from the old backup, which are in the directory c:\program files\microsoft exchange\mailbox\first storage group\mailbox database.edb.

This is where I ran into a wall: I copied the mailbox directory to a temp directory and ran the Exchange Troubleshooting Assistant to create a Recovery Storage Group to hold the restored database and merge the mailboxes (only mine!) into the new database.

This is what happened instead:

Log Name:      Application
Source:        MSExchangeIS
Date:          6/3/2008 8:47:28 AM
Event ID:      1088
Task Category: General
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SLAPPY.dmproductions.local
Description:
The information store could not be loaded because the distinguished name (DN) /O=[a different site name for the SBS beta]/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN= of message database "Recovery Storage Group\Mailbox Database" does not match the DN of directory /O=FIRST ORGANIZATION/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=.

The database may have been restored to a computer that is in an organization or site different than the original database.

By design, I cannot mount the old database. I made the conclusion only after many contortions where I ran eseutil with many different options, thinking the database was corrupted. It likely was not; I just couldn't do anything with it.

Nice thinking by the SBS team, and that is not sarcasm. MS product managers are adamant that one cannot use beta code for production nor can one expect to migrate between betas or between betas and release candidates. This is the first time I've ever seen it enforced in a database!

I did have a PST file for backup, but because I forgot a checkbox when saving my mail, I only had an older copy from two months ago. Annoying--I did do my business with the Salem Commission on Disabilities via email, but not a big disaster for me.

This migration was a migraine, and I'm bitterly disappointed I could not do a Swing. But, SBS 2008 runs fine and when RC1 comes, I will have forgotten this.

I'm moving on.

Working With SBS 2008, Part 2: Answer files and the installation

Sat, 31 May 2008 20:54:51 GMT

Continued from my last post.

To move on with our migration, we need to go through the steps to create an answer file to define our new network, not only defining the name and IP address of our new server, ~~but also the name and IP of our "swing" server that we'll be running in Virtual PC on my workstation.~~

A few housekeeping details were mentioned in the Reload Nuggets post that I'll repeat here: Unlike SBS 2000 and SBS 2003, SBS 2008 Premium does not include ISA Server! You'll need an external router or firewall device on the edge of your network. It's beyond the scope of this blog post to suggest a firewall, since it depends much on what, if any, services you need exposed on the Net and the resources you have available. Suffice it to say there are numerous options, from a simple cheap broadband router, to a Linux-based junk-computer firewall, all the way to a member server running Windows 2008 and ISA 2006 (which you can do with the 2nd copy of Windows Server that comes with SBS 2008 Premium.)

Next step is to run the SBS Answer File Generator, which is in the /tools folder of SBS 2008 Disc 1. Make life easier on yourself and just copy that whole directory to your XP or Vista workstation. Run SBSAfg.exe. These are the settings we'll use:

Installation Type: New Installation

Get Installation Updates: True
Run Unattended: False
Clock and Time Zone settings: [set these as desired]
Company information: [fill this out as appropriate]
Server Name: SLAPPY [I name my machines after Animaniacs characters <g>. Slappy's a cranky mean squirrel]
Domain Name: [your existing domain name, which will be "something.local" if you kept up with SBS best practices]
Password: [you should know this one]
Domain Administrator Account Name: [you should know this too...]
DHCP is running on the source server: False
Default Gateway: x.x.x.1 [your router's or edge firewall's address]
Server IP address: x.x.x.x

Save the answer file (sbsanswerfile.xml) and copy it to a USB stick. You do want to print the answer file from the program as well. Make a hard copy and save it to XPS or PDF for reference. This is something you'll want to keep in your file or customer's file when you do a "real" installation.

Boot the machine you will use for your SBS machine and insert Disc 1. Plug in your USB key with the answer file and any disk drivers you might need. Go through the dialogs and start the installation. This part takes about 45 minutes.

After several reboots, you'll see the wizard "Install Windows Small Business Server 2008" which will take you through the information you supplied in your answer file.

There's more waiting, more rebooting and finally:

Working with SBS 2008, Part 1: Single-Server Migration

Sat, 31 May 2008 17:46:50 GMT

The SBS 2008 Technical Preview is now out. Reload Nuggets has an excellent walkthrough if you are installing SBS 2008 clean. If this applies to you, go there immediately and stop reading. Otherwise:

I mentioned in my earlier post that I have a weird SBS site at home (in the corner of my bedroom where the network cables are coiled up, under my workbench.) Microsoft officially supports two scenarios for SBS: A new clean installation--which is virtually automatic, and a two-server migration where the old server is connected to the new one and files, AD, Sharepoint and Exchange are copied from old to new.

To be fair to Microsoft, there are very few SBS customers that are in a position to do a same-server migration. SBS 2008 is 64-bit only; SATV, like most other SBS shops, has a 32-bit machine and it cannot be migrated to the new SBS (though it can and probably will be migrated with the MS two-server scenario).

That was exactly my position when I first participated in the private SBS 2008 beta: I have a 64-bit Tyan Tomcat 1000S (Opteron 1215) and 4 gigs of memory. I did get SBS 2008 onto the machine and my personal shop migrated, albeit with enough rough edges to cut my fingers off.

~~We're doing a Swing Migration.~~ Actually, we aren't. After much testing, I've found it is simply not feasible to perform a migration the way I had first thought.

This is the result of my trying to do a Swing migration:

Ha ha, "non-critical". Sure. Exchange and Sharepoint were missing and for some reason the install files were not on the machine and I could not find them on the DVD, likely buried in the disk image. I really admire Jeff Middleton and wanted to perform his migration method, but it didn't work out. Stupid of me to blog about it before I even knew if it would work! My fault, not Jeff's.

But, I move on. I used an answer file to get the machine named the way I like it and fit into the domain I already have, so that's my next post.

SBS 2008: I can finally say what I've been doing for the past six months

Sun, 25 May 2008 01:48:31 GMT

My colleague Phillip E. writes about Small Business Server 2008:

For those of us on the private SBS 2008 "Cougar" beta program, we have been privileged to have access to the new RC0 build of SBS 2008 since late last Thursday.

I think I can talk about what I've been doing for the past several months: I was on the private beta for SBS 2008. Microsoft still has the beta testers under an NDA for the beta bits that we tested, but I have my hands on the RC0 build and will give my impressions of it when I cut over to it on my personal box sometime next week.

Without going into too many details, I have a quirky home office with some weird requirements. Combine that with a case of abandoned hardware (on a motherboard, no less!) and it was a very interesting beta!

As Phil puts it, SBS 2008 will be a steep(-ish) learning curve going from SBS 2003. There's a lot that's different and I have had to resolve problems and make some decisions I've not made before in my testing.

Vista, as you may know, makes some breaking security changes to try to enforce best practices amongst developers and users. Windows Server 2008 similarly makes some changes, including Vista's changes, but most notably how Windows Backup works. There are also changes in SBS itself to be well aware of, especially if you are an SBS Premium shop (as is Salem Access Television.)

On the other hand, It's been working out so far, since the post you're reading is passing through my SBS box. I've always been a big fan of Microsoft's server products, and SBS 2008 is no exception.

I'll be liveblogging my latest installation. Stay tuned for that one.

Windows 2008 Conundrum: Changing a motherboard or storage controller out from under Vista and Windows Server 2008

Thu, 24 Jan 2008 02:06:57 GMT

I've owned a personal SBS box for about five years. I started in 2002 with an eval copy of SBS 2000 on an old, old Pentium II 300 MHz, Intel 440BX. I got an old copy of SBS 4.5 (!!!), which we once used at SATV until 2001. That was very brief; I moved to SBS 2003 shortly thereafter in 2004 or so.

During that time I've had to change hardware out from under SBS many, many times. My box is a quasi-test machine so I have looser standards for software trials than in a real production systems, essentially "run a backup and then run SETUP.EXE and see what happens." Mostly nothing happens. Other times...

The big issue for Windows in general and servers in particular: Storage controller drivers. Nothing brings you to tears faster than to see "0x0000007B INACCESSIBLE_BOOT_DEVICE" on your very-necessary SBS box after moving it to a new controller.

The usual resolution involves a repair install where you can insert the Windows media, hit F6 and provide the storage drivers you need. This is usually the only driver you really need to provide; after that point, it's a matter of installing drivers in Windows as usual. Vista and Windows Server 2008 let you provide drivers via a USB stick or other removable media. This is excellent.

Unfortunately, the boot technology is changed from XP/2003. There is no longer a repair install option. The bootloader can scan the disk and detect Windows partitions, fixing the MBR if it's inconsistent, but it does not give an option to load a new driver.

I realize that Windows has never, ever had this option in a normal boot, but then again in "old" Windows (pre-NT), one could always open the hard disk with a boot floppy. There was only one kind of IDE driver! (But, sadly, a million kinds of CDROM drivers...)

NT and NTFS happened (a good thing, mind!) and you couldn't use your boot floppy for much of anything besides installing drivers though the option exists in Vista to this day.

Tim Anderson has a few ideas in his blog, "Changing the motherboard or storage controller underneath Windows XP and Vista", that involve booting into a recovery CD like BartPE or WinPE and manually loading the correct driver, and the correct registry entries.

This is a little scary to do by hand, but it's necessary. Many times, one needs to recover a system that hasn't been backed up, but which is completely intact except that its storage drivers don't match the ones on the motherboard. This is the situation I have most often faced as an SBS administrator.

I would boot the Windows install media, insert a floppy with the drivers and then do a repair install from the Windows media, and then run Windows Update to roll the updates forward to bring the machine back to normal and be done. Works fine even on a server and even on the uber-complex SBS.

Now, with Vista and 2008, what do I do?

I've been fortunate not to have disk controller problems in Vista, but SBS 2008 is not far away and I still have no procedure for recovering from a changed disk controller.

What do I do?

I'm thinking this will involve WinPE. More later.

Vantec NexStar 3 enclosures don't like some Intel boards

Wed, 23 Jan 2008 01:40:12 GMT

I'm all-AMD at my personal office, but we are a Dell shop at SATV, so this item from Philip got my attention.

I was in the market for enclosures recently and I settled on the Vantec NexStar 3. It is a dual-interface 3.5"-disk enclosure with USB and eSATA. Both my machines have eSATA ports so this was a good choice.

Philip had the worst thing happen (other than smoke) when connecting a new device to his server--lockup! He has a ticket open with Vantec. A point he made is that the newest revision of the Vantec is the one with problems.

I've had no trouble with my Vantec, but unfortunately, it's also the new revision. I'd love to test it at SATV but my external drives are all tied up with backups.

Source: MPECS Inc. Blog: New Vantec NexStar 3 version does not like S3000AH Intel Boards

Vista tip: Using the DiskPart Command to Create a Bootable USB Flash Drive

Sun, 09 Dec 2007 19:22:15 GMT

Hat tip to Philip E. for this one!

One often needs to flash a BIOS with a boot disk. Back in the day, this was done with floppy disks, but there are more and more problems in doing this.

For one, many BIOS images will not fit on a 1.44M floppy; at best, you need two floppies, one to boot and one to hold the image. (Similar to the old Linux boot/root floppy pair.) Secondly and most importantly, the floppies are slow and none too reliable. I have never bricked a computer from a bad BIOS flash and I would not miss it if I were to never experience this!

HP had a utility that would let you make a USB disk bootable if you provided a boot floppy (such as one made in XP), but it seems to have disappeared from their site. The utility can be found here: http://www.bay-wolf.com/usbmemstick.htm.

But Vista has an easier way. The diskpart utility now supports flash drives! From a command prompt do:

On a Vista system plug in the USB flash drive to an available USB port (ReadyBoost compatible is best)
Start-->diskpart [Enter] (UAC Prompt)
list disk (USB flash drive will show in the list - Disk 1 for this example)
sel disk 1
clean
create par primary
sel par 1
act
format fs=fat32 (note that USB HDD's will need to be NTFS)
exit

You'll then have to copy system files from the floppy (MSDOS.SYS and COMMAND.COM), plus any files you need to flash. I have one USB stick that I keep a boot sector on to use for flashing machines. (I don't routinely reformat any of my USB sticks.)

Original: MPECS Inc. Blog: Windows Vista - Using the DiskPart Command to Create a Bootable USB Flash Drive

Cougar is Coming

Thu, 01 Nov 2007 03:39:00 GMT

I've applied to be a beta tester on the next version of SBS, codenamed "Cougar". There's been a buzz about Cougar, and Eric Ligman writes about What is going to be in "Cougar?"

Read the whole post, but two things to know about Cougar:

Cougar will be 64-bit. This is required by Exchange 2007 which is 64-bit only
ISA Server will not be included in SBS. Eric doesn't mention this, but this has made the rounds in the SBS blogosphere for the past year.

64-bit machines aren't going to be a problem. I am already running 64-bit on both my home machines. By the time we plan a new server at SATV in a year, we will be buying 64-bit, and most likely a quad-core machine at that, assuming there are no eight-core CPU's in the meantime!

What is going to hurt some is losing ISA. ISA Server is the best security software I've ever used. I can understand what MS is doing though--they need to balance capabilities versus ease of integration. ISA is a very hard piece of software to coexist with (and on) the SBS domain controller.

The logging features of ISA are beyond compare and I will miss them. But I've only once ever been asked to mine the logs for questionable web access, and I've almost never had to do log analysis. I, and a lot of other small business IT professionals, just don't have the time to see who is banging on port 11345 for two hours on a Sunday morning. (I used to have ISA page me for port scans. That didn't last long.) ISA has wonderful reports, but I never read them!

I expect to be able to live without ISA one way or another, by using the firewall features of our broadband router, or by using m0n0wall, or something of that sort. But it is something SBS shops need to be aware of as you look towards Cougar.

Well, this bites!

Wed, 31 Oct 2007 18:03:11 GMT

My SBS box is down! In the immortal words of Duke Nukem, "Well, this s---ks!"

All due to a $3 piece of plastic!

The clip on the CPU heatsink retainer broke violently on Sunday sometime between the 4th quarter of the Patriots game and the 1st inning of the Red Sox game. (Hey, I'm a Boston sports fan through and through!) I heard the snap but didn't realize what had happened until the system overheated and shut down. Even then, I didn't know what happened until after I rebooted the system, noted the high temperatures, shut it down and found the heatsink was loose.

Though this heatsink retainer is standard and works with the stock AMD CPU coolers I use, it is a surprisingly hard item to find. Tyan would not send me a new one, so I ended up getting one from an eBay merchant and am waiting by the mailbox for it.

Unfortunately, I use the server to stream police scanner audio, and tonight is Halloween so I have to scramble for a replacement. I miss my server! At least Vista works great offline without a domain.

Important change for SBS & Vista shops: GPMC not part of Vista SP1

Tue, 11 Sep 2007 17:20:31 GMT

When Service Pack 1 for Vista is released, there'll be an important change to be aware of if you are running Vista in your SBS environment: The Group Policy Management Console (GPMC) snap-in, normally built into Vista, will be removed in SP1.

If you have used the new group policy settings in Vista, you know that these settings are not accessible from GPMC in Windows 2003 itself; to access Vista GP settings you must use the editor, and GPMC, from a Vista client.

The next version of SBS (2008, "Cougar") is at least a year away, so SBS shops running Vista clients between now and SP1 will need to make their Vista GP settings from a Vista client.

I don't mind if MS makes the change but there had better be a separate version of GPMC when SP1 is released.

HT: Darren Mar-Elia's Group Policy Blog: GPMC not part of Vista, SP1

SBS 2003: Error on logon after restore: applnch.exe - Unable To Locate Component

Mon, 30 Jul 2007 02:46:36 GMT

You might see this error when you logon to the console after restoring your SBS 2003 system:

Event Type:    Information
Event Source:    Application Popup
Event Category:    None
Event ID:    26
Date:        7/29/2007
Time:        6:03:02 PM
[...]

Description:
Application popup: applnch.exe - Unable To Locate Component : This application has failed to start because MAPI32.dll was not found. Re-installing the application may fix this problem. 

This is Exchange-related.  In Microsoft's questionable wisdom, there are two DLLs named MAPI32.DLL.  One is for client machines such as would run Outlook and it is about 120K.  The other MAPI32.DLL is 600K and it lives inside Exchange (in %programfiles%\exchsrvr\bin).  They are not the same!

If Exchange System Manager is run on a server that has the client MAPI32.DLL in %Windir%\system32, as might happen with a restored SBS box, it will complain. The usual workaround is to rename that DLL to "MAPI32.DLL.OLD". (That would keep you from running Outlook, but you know you're not supposed to be doing that on a server, right?)

However, whenever you log on, you get the aforementioned error from applnch.exe.

Workaround:

Copy the MAPI32.DLL in the Exchange directory (in \program files\exchsrvr\bin, should be the 600K one.) to \windows\system32\.

For some reason, applnch is happy with that situation and won't throw you any more errors.

Fixing WMI problems with File System Resource Manager (FSRM)

Mon, 30 Jul 2007 02:33:03 GMT

If you have SBS 2003 R2 and you've installed the File System Resource Manager and you've just restored your system from backup, you may see this error in the Application log:

Event Type:    Error
Event Source:    SRMSVC
Event Category:    None
Event ID:    8197
Date:        7/28/2007
Time:        4:07:56 PM
User:        N/A
Computer:    DOT
Description:
File Server Resource Manager Service error: Unexpected error. 

Operation:
   Starting File Server Resource Manager Service.

Error-specific details:
   Error: IWbemDecoupledRegistrar::Register, 0x80041011

Do this from a command prompt:

cd %windir%\system32\wbem

mofcomp srm.mof

net stop srmsvc

net start srmsvc

Fixing Exchange WMI errors after a restore

Mon, 30 Jul 2007 00:19:50 GMT

I use my personal SBS box for testing and I am aggressive about trying new patches, software and configurations, things that I could not try at SATV, things that most SBS consultants would not do to their clients.

So, I do lots of bare metal restores. There are always errors in the logs afterwards. Always. I'm sick of putting error codes in a search engine, so I'm blogging the ones I've resolved so I don't have to use the search box so often!

It's common for WMI (Windows Management Instrumentation) to be corrupted or miss entries in its database after a restore. This affects Exchange in the following ways:

The Exchange System Manager may fail with error 0x80041010 .
You may receive event 9098 from MSExchangeSA, "The MAD Monitoring thread was unable to read its configuration from the DS, error '0x80041010'." This may be logged every five minutes.

Do this from a command prompt:

MOFCOMP.EXE -N:root\cimv2\applications\exchange wbemcons.mof
MOFCOMP.EXE -N:root\cimv2\applications\exchange exwmi.mof
MOFCOMP.EXE -N:root\cimv2\applications\exchange exmgmt.mof
MOFCOMP.EXE -N:root\cimv2\applications\exchange msgtrk.mof

MOFCOMP.EXE -N:root\cimv2\applications\exchange smtpcons.mof

Wait 5 minutes and verify that the 9098 events don't reappear.

Fixing 1202 "Security policies were propagated with warning" errors after a restore

Sun, 29 Jul 2007 22:57:46 GMT

I recently had to restore my brand new Tyan machine from backup, when I inadvertently broke the RAID 1 array on it. (Of all the RAID systems I've used, Ciprico's, which the Tyan has on-board, is the most opaque to me, or so it seems.)

Every time I do a restore, I always seem to break more and more things, despite doing what I thought were best practices (install Windows, install drivers, update to Service Pack 2 and then restore with NTBackup.)

This time I'm getting errors from SceCli: 1202, "Security policies were propagated with warning".

This blog, MPECS Inc. Blog: SBS 2K3 - Group Policy computer settings not applied, had the solution:

From a command prompt do:

esentutl /p %windir%\security\database\secedit.sdb

If you're using Powershell, this is:

esentutl /p $env:windir\security\database\secedit.sdb

It'll ask you to confirm that you want to run it. Click OK.

If you have ever used edbutil in Exchange to fix databases, you should find this familiar. As soon as it tells you the database is repaired do:

gpupdate /force

Answer N when it asks you "OK to Logoff". Open Event Viewer and confirm that you get an informational message from SceCli, "Security Policies are applied successfully".

Hat tip to Philip E.!

RAID drivers for the Tyan S3950 Motherboard

Sun, 08 Jul 2007 16:28:57 GMT

I recently got a Tyan Tomcat 1000S (S3950) motherboard and went in circles trying to get the proper drivers for SBS to see the RAID controller. After consulting with Tyan and doing some searching, I found the drivers. The Tyan uses the Broadcom ServerWorks HT1000 disk controller, and Broadcom has spun off its storage division (including that chipset) to Ciprico. (I'd never heard of them; at first thought, weren't they selling anti-anthrax drugs? Oh, that's Cipro!)

Here's the link to the drivers: Ciprico RaidCore downloads page.

Windows Media Services and 0x80041010 or 0x80041011 Errors

Fri, 29 Jun 2007 23:56:26 GMT

If you are experiencing an error popup in Windows Server 2003 when using the Windows Media Services snapin with error 0x80041010 or 0x80041011, this is caused by associated WMI information that becomes unregistered and inaccessible to the application. I saw this on my personal SBS box after I migrated it to a new motherboard with a bare metal restore. How to fix it:

Search your computer for a file named lnwmsevents.mof. Copy or extract this file (it might be in a .cab file) to the desktop. If you can't find this file, it should be included in Service Pack 2.

From a command prompt do:

mofcomp lnwmsevents.mof
Microsoft (R) 32-bit MOF Compiler Version 5.2.3790.3959
Copyright (c) Microsoft Corp. 1997-2001. All rights reserved.
Parsing MOF file: lnwmsevents.mof
MOF file has been successfully parsed
Storing data in the repository...
Done!

Open the Windows Media Services console, click on Properties/Event Notification, and make sure the WMS WMI Event Handler is enabled. If it is, WMI is now registered properly and your WMI errors should disappear.

Take care,

Dave

Powershell: Quick script to email DST status

Mon, 19 Mar 2007 17:06:47 GMT

Described by some as "another Y2K", DST in North America started 3 weeks earlier. Unfortunately, I never got to post this in timefor the changeover, but DST will end 1 week later, so we're not done testing.

Here's a Powershell script that gets DST status and mails it to the address specified in the command line. It's great boilerplate code if you need to send a quick status email and much much better than the old way with NT CMD, Blat and VBScript.

# Send-DSTStatus
#
# Get current time and DST status of specified computer and email to specified user
# For use in supporting North American DST changes
#
# D. Moisan 2/23/2007
#
param([string]$computer, [string]$email)
#
# Parameters (Required):
#
# -computer <computer to scan for status>
# -email <email address>

if ($email -eq "") {
   write-host "Usage:"
   write-host
   write-host "send-DSTStatus [-computer <computer>] -email <somebody@somewhere.com>"
   write-host
   write-host "`t-computer defaults to local machine if not specified"
   write-host
   exit
   }

#
# Set up email sender address and server name
#
$sender = "Administrator@satvonline.org"  # Change as needed
$mailservername = "salemtv.satv.loc"    # Change to your SMTP server's address

$mailserver = new-object system.net.mail.smtpClient
$mailserver.Host = $mailservername
$mailmessage = new-object system.net.mail.mailmessage($sender,$email)

# If -computer parameter not specified, use localhost

if ($computer -eq "") {
   $computer = $Env:Computername
   }

# Get WMI Objects

$wmios = get-wmiobject "Win32_OperatingSystem" -computer $computer
$wmisys = get-wmiobject "Win32_ComputerSystem" -computer $computer

# Compose message

$maildate = get-date
$mailmessage.Subject = "DST Status Report for $computer on $maildate"
$mailmessage.Sender = $sender
$messagetext = $mailmessage.Subject + "`n`n"
$messagetext += "Local Time for $computer : " + $wmios.ConverttoDateTime($wmios.LocalDateTime) + "`n`n"
$DSTEnabled = $wmisys.EnableDaylightSavingsTime
$DSTInEffect = $wmisys.DaylightInEffect
$TZOffset = $wmisys.CurrentTimeZone
if ($DSTEnabled) {
   $messagetext += "DST is ENABLED`n" }
else {

   # We can't tell if Windows 2000 clients have DST implemented since
   # the WMI property EnableDaylightSavingsTime is not supported there
   # so if the property is null (as is the case in 2000), we skip reporting
   # DST enabled.  IF it is False (as in an XP/2003 client with DST turned off),
   # we report that.

   if ($DSTEnabled -eq $False) {
      $messagetext += "DST is NOT ENABLED`n"
      }
   }

if ($DSTInEffect) {
   $messagetext += "DST is IN EFFECT`n" }
else {
   $messagetext += "DST is NOT IN EFFECT`n" }

$messagetext += "Current timezone offset: $TZOffset `n"
$messagetext += "`n`n"

# Send mail and report it on the console

$mailmessage.Body = $messagetext
write-host "From: $sender"
write-host
write-host "To: $email"
write-host
write-host $messagetext
$mailserver.Send($mailmessage)

Wow, the regression testing for Windows Server 2003 SP2 is really thorough!

Mon, 19 Mar 2007 17:01:43 GMT

I saw this KB, Windows Server 2003 Service Pack 2 application compatibility, and noted this program tested:

Vendor Application name Version
3D Realms Duke Nukem 3D 1

*snort!*

Gee, do you think Duke Nukem Forever will work on Longhorn Server?

Windows Server 2003 SP2 Quirk: Exchange doesn't start

Thu, 15 Mar 2007 15:02:45 GMT

Windows Server 2003 Service Pack 2 is out. As usual, my home SBS box took it without problems, but not our SBS server at the studio. After a protracted install (over an hour!), I rebooted and Exchange Information Store did not start. I started it manually and it came up. Further analysis got me these two event log entries:

Event Type: Error
Event Source: DCOM
Event ID: 10010
Date: 3/14/2007
Time: 9:48:51 PM
Computer: [...]
Description:
The server {9DA0E106-86CE-11D1-8699-00C04FB98036} did not register with DCOM within the required timeout.

[And then this...]

Event Type: Error
Event Source: Service Control Manager
Event ID: 7024
Date: 3/14/2007
Time: 9:48:56 PM

Computer: [...]
Description:
The Microsoft Exchange Information Store service terminated with service-specific error 2147500037 (0x80004005).

The server cited in the DCOM message is the Microsoft Exchange Property Mapping Interface. Exchange has new and interesting dependencies every day!

Exchange started on the next reboot when I reinstalled IE7, so this is probably transient. Just so you know.

Susan Bradley has more to say on SP2.

Reboot Time: New Update Rollup for ISA in SBS 2003 Premium

Thu, 01 Feb 2007 04:11:14 GMT

Another update rollup for ISA server. This is a Windows Installer Patch (.MSU) file. You will need to reboot.

An update rollup is available for computers that are running ISA Server 2004, Standard Edition and Windows Small Business Server 2003, Premium Edition

Learn PowerShell by Rewriting VBScript

Thu, 30 Nov 2006 03:42:49 GMT

If you're a busy admin and you are new to PowerShell, you might wonder just where to start. Yes, you've downloaded PowerShell and perhaps played with it, trying a few lines of script.

But how can you learn all that from scratch?

If you know VBScript, why not convert a few short scripts to PowerShell? Here's one example, stolen from SAPIEN Technology's blog: Play WAVs with SAPI.

This script uses the Microsoft Speech API in an inventive way to play WAV files in the Windows\Media directory. It first speaks the name of the file, then plays it.

Here's my version:

# speak-wav.ps1
function DemoWav {
param ($File)
trap {return}
    $objFile.Open($file.FullName)
    $objSPVoice.Speak($file.Name)
    $objSPVoice.SpeakStream($objFile)
    $objFile.Close()
return;
}

$objSPVoice = new-object -com "SAPI.SpVoice"
$objFile = new-object -com "SAPI.SpFileStream"

$strMediaDir = join-path $Env:Windir -childpath "Media"
get-childitem $strMediaDir -filter "*.wav" | foreach {
    write-output $_.name
    demowav $_
    }

Let's deconstruct this: PowerShell, unlike VBScript, requires you to declare your functions up-front before they're called by the main code. Function Demowav flows and performs the same way as in the VBScript version, so we'll get back to that later.

Continuing on to the start of the main code, almost all VB scripts except the very simplest access COM objects like so:

Set objSPVoice = CreateObject("SAPI.SPVoice")

In PowerShell this is:

$objSPVoice = new-object -com "SAPI.SpVoice"

This is one of the most common conversions you'll see. Remember that references to objects within VBScript are almost always COM or ActiveX so you need to specify the -com option in new-object or else PoweShell will think it's a .Net object and error out.

Another place where the idioms of VBScript and PowerShell are very different is in file and directory processing. VBScript uses a file system object at a very low level, so your script code has to do all the low-level work of traversing directories and resolving file paths, as in this code:

strWinDir= objShell.ExpandEnvironmentStrings("%WinDir%")
strMediaDir=strWinDir & "\Media"

Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objFiles=objFSO.GetFolder(strMediaDir).Files

For Each file In objFiles
'only get .wav files
    If Right(file.name,3)="wav" Then 
    WScript.Echo file
    DemoWav file
    End If
Next

I am sad to recall that in the early days of Windows NT scripting, I was having to do stuff like this in Perl. Parsing a string to get the extension? Ewww? Going to yet another object to get the environmental variables?

To get the %Windir% environment variable we simply do this in PS:

$Env:Windir

Here's the main body of our code:

$strMediaDir = join-path $Env:Windir -childpath "Media"
get-childitem $strMediaDir -filter "*.wav" | foreach {
    write-output $_.name
    demowav $_
    }

Join-path simply takes two filenames and joins them in a path, so that $Env:Windir and "Media" become (when resolved) "C:\windows\media\".

get-childitem is the most important command: This cmdlet, when applied to a filesystem, will return a list of objects corresponding to files in that directory. The -filter parameter tells the cmdlet to filter the output as specified, so in this case, we are only returning *.WAV files.

Learn this cmdlet; you'll use it everywhere.

The pipe "|" character is where the fun starts. I mentioned that get-childitem returns a list of objects. These objects get piped to the next statement:

| foreach {
    write-output $_.name
    demowav $_
    }

That's our loop. It's very similar to the VBScript. Note the $_ variable. You'll see this everywhere. That variable just means "current object in the pipeline". So for each WAV file, the script writes the name of the file to the console with write-host and calls our function demowav. Note that there are no parentheses in function calls in PowerShell, unlike VBScript and everywhere else.

Now we're back to the function at the top of the file:

function DemoWav {
param ($File)
trap {return}
    $objFile.Open($file.FullName)
    $objSPVoice.Speak($file.Name)
    $objSPVoice.SpeakStream($objFile)
    $objFile.Close()
return;

This is straightfoward and almost identical to the VBScript code. param just declares valid function and program parameters (remember, no parens for function declarations in PS!) trap {return} just tells this function to return from the function in case of errors. The only point of difference is that $file is an object, rather than just a string representing a file name, so we need to specify $file.FullName--which is the file's complete path--when we open the file. ($File.Name provides just the name without the full path.)

This was a long post, but if you got through it, and have basic knowledge of PowerShell, you'll be able to convert short scripts nearly in your head. It took me two hours to write this post but only 10 (!) minutes to co nvert the original script.

Microsoft's Script Center has a guide on converting VBScript to PowerShell that you'll find useful.

Have Fun!

Dave

del.icio.us tags: PowerShell VBScript converting script tutorial "Speech API" Microsoft

Killing Spam with Exchange IMF and PowerShell

Tue, 03 Oct 2006 18:34:48 GMT

del.icio.us tags: PowerShell, Exchange, IMF, Spam, Microsoft, Windows Server

If you have an Exchange shop, you probably have Exchange Intelligent Message Filter. The IMF filters out junk mail to a folder (usually Program files\exchsrvr\mailroot\vsi 1\ucearchive) which you must inspect for false positives and empty from time to time.

There are tools to manage the IMF archive; I use Daryl Maunder's Exchange IMF Archive Manager and there is also IMFCompanion, but neither of these tools will empty the archive automatically. Realistically, in a small shop like SATV's, it's a burden to manually inspect the archives; as spam volume gets heavier, inspection is no longer viable.

I just use a simple PowerShell script that counts the items in the IMF archive, notes the count in the Application log and then deletes the items.

Here's the code. Most of it is housekeeping to manage the event log:

# Delete-IMFSpam  - Deletes spam mail from Exchange IMF Folder
#
# Deletes spam mail from Exchange IMF folder and enters an event in the 
# Application log reporting number of spam mails found and deleted
#
# David Moisan 9/22/2006
# 
# v1.0
#

$sSource = "Delete-IMFSpam"
$sLog = "Application"
$sMachine = [System.Environment]::MachineName

$sEventIDSpam = 1
$sEventIDNoSpam = 2

$sEventLogInformational = [System.Diagnostics.EventLogEntryType]::Information
$sEventLogWarning = [System.Diagnostics.EventLogEntryType]::Warning
$sEventLogError = [System.Diagnostics.EventLogEntryType]::Error

$sUCEArchive = "$env:programfiles\exchsrvr\mailroot\vsi 1\UCEArchive"

# Create source in eventlog if it isn't already there

if (-not [System.Diagnostics.Eventlog]::SourceExists($sSource,$sMachine)) {
   [System.Diagnostics.Eventlog]::CreateEventSource($sSource, $sLog, $sMachine)
   }

# Create new eventlog object to make entries

$eLog = new-object System.Diagnostics.EventLog($sLog,$sMachine,$sSource)

# Get count of spam items

$SpamCount = (get-childitem $sUCEArchive\*.eml | measure-object).Count

# Display count to the log and the console
# Delete spam if directory not empty

if ($SpamCount -gt 0) {
   remove-item "$sUCEArchive\*.eml"
   $eLog.WriteEntry("UCEArchive: $Spamcount item(s) found and deleted", $sEventLogInformational, $sEventIDSpam)
   }

else
    {
    $elog.WriteEntry("UCEArchive:  No spam items found", $sEventLogInformational, $sEventIDNoSpam)
    }

# Done

$elog.Close()
exit

Run the script:

powershell delete-IMFSpam.ps1

And here's the event log:


MachineName : [...]
EventID     : 1
TimeWritten : 9/30/2006 1:00:48 AM
EntryType   : Information
Source      : Delete-IMFSpam
Message     : UCEArchive: 674 item(s) found and deleted

This was just in 3 (!!) days since the folder was last emptied.

Take care,

Dave

Cannot Open Message Tracking Center with error 0x8004100E

Fri, 01 Sep 2006 23:55:57 GMT

I recently restored my SBS machine from tape (never mind why) and had this error. A hit on Google Groups yields this solution:

From a command prompt do

mofcomp -n:root\cimv2\applications\exchange
c:\windows\system32\wbem\msgtrk.mof

This post on Google Groups has more information.

Take care,

Dave

Problems with MS06-034 (KB917537) IIS Patch

Fri, 14 Jul 2006 03:26:30 GMT

If you're running Windows Server with IIS, you may have encountered a problem with this month's security update, KB917537. The update client fails to install the patch, then asks for a reboot and the cycle repeats.

Try this fix, via microsoft.public.windowsupdate: Before Microsoft Update starts installing updates, stop IIS from the command line (net stop w3svc or for PowerShell, stop-service w3svc) or via the management console.

Then run, or continue, Microsoft Update. The patch should take.

Also remember that most patches log their installation in the Windows directory, in the form <patchname.log>, so KB917537 has the log KB917537.log. If you are looking through windowsupdate.log and not finding any hints, you need to look at this log or the log associated with any failed update.

Take care,

Dave

When a blue screen is really hardware

Tue, 27 Jun 2006 02:02:44 GMT

The SBS Diva has a bluescreen problem. Several commenters on her blog suggested that it might be hardware-related. Let me join the chorus.

I've been fighting bluescreens on my 5-year old MSI Athlon XP-based motherboard for almost two months. The problem was hardware. Here's how I found the problem.

To reiterate the diagnostic criteria for hardware-related problems, they are:

1) Symptoms are intermittent

2) Symptoms happen after machine has been powered on for a while

3) Bluescreen diagnostics point to many different causes.

4) Memory tests may or may not indicate a problem.

In my case, the bluescreens were happening, seemingly at random. I would do bluescreen analysis with the debugging tools, as I described in an earlier post, each and every time it crashed. I found a wide variety of errors, many of these happening in win32k.sys.

I removed as many third-party drivers as I could (I own a Kensington trackball), and reverted to the "safe" settings in the BIOS. I checked the ventilation on my system, cleaned and replaced one of the fans and the power supply and even suspected the keyboard. After all this work, it still bluescreened.

I put in a new stick of memory from Crucial and performed a memory test with Microsoft's tester, running through two passes. No change. Bluescreens still.

One cause of defective hardware is not always recognized outside of service centers or the hobbyist PC community. Look at these pictures of my motherboard. The round objects are capacitors. They help to regulate voltages in electronic equipment, including my motherboard. They're often in a hot, dusty, environment, and they sometimes fail. (This problem is too common. Google "bad caps" for a sampler.)

Normal capacitors have flat tops (the triangular score lines on the top are normal and do not indicate any defect.)

Bad capacitors generate heat and pressure inside, which result in the cap bulging its top. Eventually, the cap may "pop" (the reason for the score lines on the top) or simply short out. In either case, the device it's wired into--hello, motherboard!--may fail.

My 5-year old MSI board was all but certainly brought down by the two caps in the photo, which just happen to be near the memory sockets (obscured by wiring). It's little wonder I was having problems;

If you have a flashlight and a magnifier, and a few minutes, you can check your motherboard for bad caps yourself. Just turn off your computer and unplug it, remove the cover (following directions in your hardware manual) and have a look.

Caps can be anywhere on your motherboard, but they are most commonly located around the DIMM (memory) sockets and around the CPU, where you'll find a large cluster of them.

Normal caps will have flat tops--again, the triangular score lines at the top are normal. Bad caps will have bulging tops, or they'll "leak"; there may be junk leaking out of the cap and running over the motherboard. Badcaps.net has more photos.

If you find a bad cap, there's not much you can do other than replacing the motherboard or calling for service. But at least you won't be running in circles with crashdumps.

Take care,

Dave

P.S. Happy ending for me: One new motherboard and processor later (Athlon 64), I was back in business one day later.

The Heartbeat of Windows

Sun, 04 Jun 2006 02:11:09 GMT

Windows has a heartbeat! Yes, it's true! How can this be? Windows is not exciting for most admins when things are running normally (and the excitement over a new BSOD is much much overrated.)

Windows servers (and desktops) have a registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\TimeStampInterval.

This is a DWORD and the default is 5 for servers and 0 for workstations (XP, Win2K Pro, etc.)

When set, Windows writes a timestamp to the registry every 5 seconds (or, presumably, for whatever the DWORD is set to.) A value of 0 disables it.

With this entry set, if the computer bluescreens or you pull the plug, Windows uses the timestamp to determine that the last shutdown was unexpected, and its approximate time. See the following registry entry from my very sick workstation after one of its many bluescreens:

Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6008
Date:  6/3/2006
Time:  1:06:47 PM
User:  N/A
Computer: WAKKO
Description:
The previous system shutdown at 1:02:58 PM on 6/3/2006 was unexpected.

The UPTIME.EXE utility I posted about previously will set the heartbeat. Simply do uptime /heartbeat and follow the prompts to turn it on or off.

Take care,

Dave

Little-known Windows utility: UPTIME.EXE

Sun, 04 Jun 2006 01:54:37 GMT

When administering a server or a collection of servers, you need a way not only to see your systems in the present (is the server up or down or bluescreened; is the web service running or stopped or not even reachable), but also in the recent past (when did it last boot? How long has it been up?)

Since NT, there's been a utility to check system uptime, UPTIME.EXE. It produces output like this:

uptime /s

Uptime Report for: \\DOT

Current OS: Microsoft Windows Server 2003, Service Pack 1, Uniprocessor Free.
Time Zone: Eastern Daylight Time

System Events as of 6/3/2006 9:44:34 PM:

Date:      Time:        Event:               Comment:
---------- ----------- ------------------- -----------------------------------
5/5/2006 8:12:11 AM Boot
5/5/2006 12:33:56 PM Shutdown             Prior uptime:0d 4h:21m:45s
5/5/2006 12:35:13 PM Boot                 Prior downtime:0d 0h:1m:17s
[...]
6/2/2006 8:04:36 AM Shutdown             Prior uptime:0d 0h:14m:32s
6/2/2006 8:08:12 AM Boot                 Prior downtime:0d 0h:3m:36s

Current System Uptime: 1 day(s), 13 hour(s), 36 minute(s), 55 second(s)

--------------------------------------------------------------------------------

Since 5/5/2006:

           System Availability: 99.5831%
                  Total Uptime: 29d 10h:34m:54s
                Total Downtime: 0d 2h:57m:29s
                 Total Reboots: 20
     Mean Time Between Reboots: 1.48 days
             Total Bluescreens: 0

The word wrap may make this hard to read, but essentially UPTIME.EXE lists all the boot and shutdown events and calculates uptime (and downtime) from them.

It uses the Event Log to determine uptime, as explained in this KB article "Why Windows NT reports 6005, 6006, 6008 and 6009 Event Log Entries".

This practice has continued through Windows Server 2003, so UPTIME still works.

UPTIME.EXE is available from Microsoft.

Take care,

Dave

WSUS SP1 available

Sun, 04 Jun 2006 00:14:03 GMT

If you run Windows Server Update Services (WSUS), a new service pack (SP1) has been released. More information and download from Microsoft

I had difficulty installing it on my home SBS box; apparently the install would die after installing a new instance of WMSDE when the new instance wouldn't start after installation and the remainder of the process would fail.

Rebooted, retried installation, and it worked. The odd part was that the WSUS install asked to reboot again, which I did. WSUS worked and is working fine still. It was then installed on an SBS server at work with no incidents.

Lessons: Be aware of what maintainance you performed on a system before you install an update; I had stopped the WSUS administration site (mistakenly) in order to use wsusutil to clean up old, superseded uptates in the update database.

That's probably what caused the install to fail the first time.

Lesson 2: There are extensive debugging logs in Program Files\Update Services\LogFiles. Read them and send them to Microsoft if necessary. I found out much about how the update is installed and the steps it goes through, and importantly, where it fails.

Take care,

Dave

Generating crash dump reports with PowerShell

Thu, 25 May 2006 00:36:13 GMT

I've been using the new Windows scripting language PowerShell. I've also been having a lot of problems with my workstation; ever since I found my machine overheating--due to old, slow fans, it's never been the same since, averaging a crash a day. Is it just the hardware? Is it a bad driver? Did I just not seat the cards correctly last time I opened it?

I use Microsoft's Debugging Tools For Windows to diagnose crashes for SATV's servers and other machines and I was getting tired of going to WinDbg and putting in the same commands every time I needed to look at a crash dump.

Here's my first PowerShell script, a simple wrapper for KD, the command line debugger.

# crashreport.ps1
# Create debug analysis logs using KD
# D. Moisan 5/24/2006
#
# Usage: crashreport <dumpfile>
#
# Input: <dumpfile> can be a full memory dump, kernel dump or minidump
#
# Output: Log file to standard output
#
# Note: Debugging Tools for Windows must be installed
# in its default directory (Program Files\Debugging Tools For Windows)
#
if ($Args.Count -eq 0) {
"Usage: crashreport <dumpfile>"
exit }

set-alias kd $Env:ProgramFiles"\Debugging Tools For Windows\kd.exe"

# Debug commands are specified here. See the Debugging Tools For
# Windows for more details
#
# Commands are: !analyze -v    Verbose analysis of the crash
#                kv             Stacktrace
#                !process       Current process and thread at crash
#                lmf            List loaded modules and file paths
#                q              quit KD (or else KD will keep running)
#

$debugcommands = "`"!analyze -v; kv; !process; lmf; q`""

"Using debug commands: " + $debugcommands

"Generating debug output"

$crashdumpfile = $Args[0]

"Using crash dump file: " + $crashdumpfile

# Execute kd with commands

kd -c $debugcommands -noshell -z $Args[0]

"Debug Output to log file: " + $debugoutputfile
"Done!"
exit

Take care,

Dave

SBS 2003 SP1/ISA 2004: WMI scripts don't work (Part 2)

Sat, 06 Aug 2005 02:05:00 GMT

In my last post, I talked about how ISA 2004 could keep your WMI scripts from running properly on your SBS machine. Here's how I diagnosed it on my server:

ISA 2004 has an awesome monitoring capability. It can monitor the firewall and display sessions and blocked ports in real time. ISA has a query filter you can edit down to client IP's, destination IP's, ports and protocols. Great for troubleshooting, especially in this case!

It helps to know that WMI uses DCOM which uses RPC, in fact it's essential to know what protocols your script or program may use under the hood.

First, pick your WMI script. It should be one that you can run against a remote machine. Most Scriptomatic-generated scripts can do this.

Open ISA Management and select Monitoring and click the Logging tab. Click Edit Filter. Select Log Record Type Equals Firewall and Log Time set to Live. If there are any other filters, remove them. Select Filter By Destination IP and enter the IP address of the remote machine you are running the script against. Click Start Query.

In another window, such as a command window, run your script. It should fail. Rerun it again a few times. In the ISA Management window, you should see some entries pop up in the Logging Tab. Click on Stop Query. Click on Copy All Results to Clipboard and paste it to a spreadsheet.

The formatting of this blog won't let me put the whole log in here legibly, but these are the fields that came up in my troubleshooting that I want to point out:

Client IP: 192.168.12.x (the SBS machine)

Destination IP: 192.168.12.10 (the remote machine)

Protocol: RPC (all interfaces)

Action: Closed Connection

Rule: Allow RPC from ISA Server to trusted servers

Result Code: 0x80074e24

Note that ISA will log the rule it uses to deny (or allow) access. "Allow RPC from ISA server to trusted server" is an ISA system policy, according to the ISA help file. The help file also explains that this system policy is grouped under Authentication Policy and that I can change it with the System Policy Editor.

The result code, unfortunately, is not in ISA Help but it is on the ISA 2004 SDK page. 0x80074e24 is listed as FWX_E_CONNECTION_KILLED. In other words, ISA dropped it, as it does most RPC connections (and WMI) when "Enforce strict RPC compliance" is checked.

As I mentioned in my last post, I've been running in circles for over a month trying to fix this. Once I got smart and had the idea of using ISA monitoring to troubleshoot this, it only took me about 30 minutes to fix. ISA 2004 is an excellent product!

SBS 2003 SP 1/ISA 2004: WMI scripts don't work (Part 1)

Sat, 06 Aug 2005 00:39:47 GMT

If you just upgraded to SBS 2003 SP1 with ISA 2004 and you use scripts on the SBS machine to monitor and control your client machines or member servers (such as the scripts you find at Technet Script Center), your scripts might not work any longer.

This problem is acute when you use WMI scripts (such as those from the famous Scriptomatic tool) to run against a remote machine and get information from it. The scripts may give no results, or fail with a 0x800706ba error.

Scripts that you run on a workstation against your SBS machine may fail as well.

After running in circles for a month, I figured it out. I'll explain how I finally diagnosed this in my next post, but if you have this problem and just want to stop banging your head, here's how to fix it:

On the SBS machine, open up ISA Server Management (if you don't remember where it is, click Start/All Programs/Microsoft ISA Server/ISA Server Managment)

Find "Firewall Policy" on the left pane and right click it. Select Edit System Policy. The System Policy Editor should pop up.

Scroll down to Authentication Services and select it. In the General tab, note the checkbox marked "Enforce strict RPC compliance". Note the information balloon that reads: "When 'Enforce strict RPC compliance' is not selected, additional RPC type protocols, such as DCOM, will be enabled."

Bingo.

Uncheck "Enforce strict RPC compliance". Click OK. Note the bar on the top of the ISA console that prompts you to apply or discard your changes. Click Apply. Click OK.

Your WMI scripts should now work.

Dell Servers can now take Windows 2003 SP1

Tue, 07 Jun 2005 11:39:34 GMT

If you're running Windows Server 2003 on Dell machines, you may know (or should) that Service Pack 1 breaks Dell OpenManage 4.3. This also applies to SBS 2003 SP1.

Dell has (finally!) released OpenManage 4.4.

UPDATE: You may have discovered this by now, but when you install OM, Dell will want you to update your RAID controller drivers <i>and</i> the firmware too. It's normal (and good!) practice for me to update all the drivers and firmware before a service pack, but I never got the notification from Dell about the drivers. Oops.

David Moisan's Blog: SBS

Spreading a Meme: Scripting/Sysadmin

How old were you when you started using computers?

What was my first machine?

What was the first real script you wrote?

What scripting languages have you used?

What was your first professional sysadmin gig?

If you knew then what you know now, would have started in IT?

If there is one thing you learned along the way that you would tell new sysadmins, what would it be?

What’s the most fun you’ve ever had scripting?

Who am I calling out?

Working with SBS 2008, Part 3: Migration Migraines

Working With SBS 2008, Part 2: Answer files and the installation

Working with SBS 2008, Part 1: Single-Server Migration

SBS 2008: I can finally say what I've been doing for the past six months

Windows 2008 Conundrum: Changing a motherboard or storage controller out from under Vista and Windows Server 2008

Vantec NexStar 3 enclosures don't like some Intel boards

Vista tip: Using the DiskPart Command to Create a Bootable USB Flash Drive

Cougar is Coming

Well, this bites!

Important change for SBS & Vista shops: GPMC not part of Vista SP1

SBS 2003: Error on logon after restore: applnch.exe - Unable To Locate Component

Fixing WMI problems with File System Resource Manager (FSRM)

Fixing Exchange WMI errors after a restore

Fixing 1202 "Security policies were propagated with warning" errors after a restore

RAID drivers for the Tyan S3950 Motherboard

Windows Media Services and 0x80041010 or 0x80041011 Errors

Powershell: Quick script to email DST status

Wow, the regression testing for Windows Server 2003 SP2 is *really* thorough!

Windows Server 2003 SP2 Quirk: Exchange doesn't start

Reboot Time: New Update Rollup for ISA in SBS 2003 Premium

Learn PowerShell by Rewriting VBScript

Killing Spam with Exchange IMF and PowerShell

Cannot Open Message Tracking Center with error 0x8004100E

Problems with MS06-034 (KB917537) IIS Patch

When a blue screen is really hardware

The Heartbeat of Windows

Little-known Windows utility: UPTIME.EXE

WSUS SP1 available

Generating crash dump reports with PowerShell

SBS 2003 SP1/ISA 2004: WMI scripts don't work (Part 2)

SBS 2003 SP 1/ISA 2004: WMI scripts don't work (Part 1)

Dell Servers can now take Windows 2003 SP1

Wow, the regression testing for Windows Server 2003 SP2 is really thorough!