Fixing SBS 2003 RWW for Console Access From XP SP3, Vista SP1 and Windows Server 2008

Sick of waiting for Microsoft to release a fix to RWW to enable Console access to SBS 2003 and any other Windows Server 2003 systems connected to your SBS network? So am I. So I’ve fixed it. Process is as follows:

Navigate to C:\Inetpub\Remote

Make a copy of tsweb.aspx

Open tsweb.aspx in your favorite editor (mine’s Notepad++)

Line 304 looks like this:

MsRdpClient.AdvancedSettings2.ConnectToServerConsole = console

 

Replace it with this:

version = MsRdpClient.Version
if strcomp(version,"6.0.6001") < 0 then
  MsRdpClient.AdvancedSettings2.ConnectToServerConsole = console
else
  MsRdpClient.AdvancedSettings2.ConnectToServerConsole = false
  MsRdpClient.AdvancedSettings6.ConnectToAdministerServer = console
end if

 

Save the changes. You can now establish console sessions to your SBS 2003 box and any other Windows Server 2003 boxes on your SBS network.

If anyone’s got a better way for displaying code in a Blogger page I’d be interested in knowing about it.

How to Demote a Long-Disconnected Domain Controller

Just looking back on some old notes.

Found out nearly 4 years ago that I had to reconnect a branch office Windows Server 2003 domain controller that had a reasonable amount of data (in DFS) and apps on it and I had a weekend in which to do it. A re-install would have been pushing it. Especially the DFS replication (don't even ask about the backups...).

I distinctly remember at the time that there wasn't anything on TechNet, except one of those teaser PowerPoint presentations saying how Windows Server 2003 had better support for long-disconnected domain controllers (which I can no longer seem to find with Google. Hmph.).

Some of my Kerberos experience on FreeBSD and - at that time - my new-found knowledge of pointing Google at Microsoft to search for useful information helped me to try to understand what was going on.

After having a good guess of what I thought was wrong and running down some dead-ends, I ended up surprising myself when the following process worked:

• Change tombstone on FSMO DC to 180 days
• Push out changes from FSMO DC to other DCs using replmon
• Remove GC role from long-disconnected DC on both FSMO DC and on long-disconnected DC using AD Sites and Services
• Push out changes from FSMO DC to other DCs using replmon
• Stop and Disable KDC on long-disconnected DC
• Use netdom to reset machine account password for long-disconnected DC on FSMO DC
• netdom resetpwd /server:<FSMO DC hostname> /ud:<Domain>\<Admin Account> /pd:<Admin Passwd>
• restart long-disconnected DC
• Use dcpromo repeatedly to demote server (I got timeouts for netlogon taking too long to respond; WAN authentication latency problem?)
• restart the now demoted long-disconnected DC
• Click OK to "one or more services failed to start"; not finding a DC
• Use Terminal Services to remove demoted DC as a DNS NS from AD-integrated zones on the FSMO DC
• Use Terminal Services to connect to FSMO DC and replicate the entire domain
• run dcpromo to promote standalone server

Thought I'd post this to help out any other poor sod stuck in this sorry state.

Might just have to run up a couple of VMs to verify this still works...

TechNet now has guidance on this with the Reconnecting a Domain Controller After a Long-Term Disconnection article. Doesn't look like what I've got above.

The Power of Community (Susan Bradley, You Rock!)

April was a bad month for me. My father was hospitalised on Monday 7th and I spent the early part of that week trying to help Dad work out what he was going to do after leaving hospital. My father was fiercely independent and had been living independently up until that point. Things got worse on Thursday 10th when Dad was told that his kidneys were shutting down. I'd organised a flight for Friday, but due to a bird strike I wasn't able to get there until Saturday morning. My father had passed away during my flight over on the Saturday. Renting a hire car turned out to be a painful process, but the drive from the airport to the hospital was great as I was able to recollect all the good times I'd had with my father. I've still got a great image of my father with his large black-framed glasses, thinning hair, his close cropped beard and a cheeky smile showing his broken, yellow teeth. The look he'd give after saying something pithy.

My sister had recently separated from her husband and was looking after her three children, so the task of packing up my Dad's rental place, organising the funeral and carrying out the executor role fell primarily on me. I was able to get the flat emptied, organise those tasks that needed doing locally and organising the funeral all in five days so I could get home to my 8-month pregnant wife.

During this time I still had work commitments. Most of the tasks I was able to delegate accordingly with the exception of a budget submission for a client that was going to be performing asset transfers to a new entity in their new financial year and also required moving from SBS 2003 due to the 75 CAL limit. I was recommending an SBS 2003 to Essential Business Server migration, but due to the lack of pricing details I wasn't able to come up with software licensing costs. My alternative was to price up the SBS 2003 Transition Pack as well as full priced versions of the SBS components. The Transition Pack got tricky as the SBS licenses were Open Licences with Software Assurance at Government pricing. The Transition Pack was Retail license only. As you can see this got ugly early.

In a fit of desperation I sent an e-mail to the SBS Diva, Susan Bradley, asking if she knew of anyone that would be able to assist me with working out the best transition method license-wise. Not only did Susan find me a group of people who were able to provide answers to some of the questions I was posing but she also sent me some very nice e-mails of support during the flat-clearing stage. Susan also kept an eye on the replies I got and followed up with me to ensure I was getting useful feedback. Pretty amazing seeing that I only met Susan once in person at the SMB Security Summit in Sydney last year and other communication via e-mail and blog comments.

This epitomises the power of community (and just how amazing Susan Bradley is!). Engaging with like-minded people, building relationships and helping one another. Now I'm not saying that I pretend to know Susan, but her blog demonstrates her generous nature, her attention to detail and her professionalism. Without this record I never would have sent her the e-mail asking for assistance. I sent the e-mail knowing that I could rely on the answers to be correct.

This trust is the most valuable attribute you can develop when engaging in community activities. Opinions are great as they help define you and your world view to others, but trust is developed by providing high quality and correct information. And when the information isn't correct or incomplete, then prompt apology and providing correct information is paramount to re-establish trust. On top of this consistency is important. If you look at Susan Bradley's blog you get all of this and more.

So in my roundabout way I'm really trying to publicly acknowledge Susan for her amazing contribution in what was a very difficult time for me. Susan you are a LEGEND! You are the glue for the SBS community and I thank you very much for the help you have provided me and I hope that I'm able to repay the generosity that you extended to me. If not to you directly, then to the others in the SBS community by means of paying it forward.

Sophos Enterprise Console - Stuck on Connecting to Server

I have a problem on an SBS 2003 Premium Edition box (2 NICs and running ISA Server) where launching the Enterprise Console sits forever at the connection screen.



This is the same problem even if I perform a console-only install to a separate box.

The drastic remedy is to reboot the server. By using the console on a separate box I was able to use TCPView to find that EnterpriseConsole.exe was connecting to MgntSvc.exe on the server.

I then tried stopping the service from the command line:

> net stop "Sophos Management Service"

Which resulted in me being told that the service could not be stopped. I then used PsKill to stop the service:

> pskill "Sophos Management Service"

And I then restarted the service:

> net start "Sophos Management Service"

This then allowed me to successfully use the Enterprise Console.

Windows Server 2008 Standard Edition - License Change Regarding Virtualisation

The introduction of Hyper-V to all editions of Windows Server 2008 (except Web Edition) has meant there's been a licensing change to the Standard Edition.

The previous editions of Windows Server Standard Edition allowed for 1 instance of Windows Server to be installed as a Physical Operating System Environment (POSE) or as a Virtual Operating System Environment (VOSE). This meant that if you wanted to host a virtualised Windows Server 2003 R2 Standard Edition on say Virtual Server 2005 R2 running on Windows Server 2003 R2 Standard Edition, then you needed to acquire 2 licenses of Windows Server 2003 R2 Standard Edition - one for the physical instance and one for the virtual instance.

The new licensing change brings the Standard Edition in line with the Enterprise Edition. This means that Windows Server 2008 Standard Edition can be installed twice using the one license - once for the physical instance and once for the virtualised instance. The caveat is that the physical instance can only be used for the purposes of hosting the virtualised instance. All the workload for the Standard Edition license is to be performed in the virtualised instance, with the physical instance used to host and maintain the virtualised instance.

More information can be found in the Licensing Information section of the Hyper-V FAQ, Microsoft's Licensing Virtualisation changes and the Volume Licensing Product Use Rights.

SBS 2003 Media, Service Packs, Repair Install - Oh My!

This has been a long-running battle I've had with Microsoft over the years - the inability to either roll my own slipstreamed SBS media, or obtain slipstreamed SBS media at reasonable cost (like the Volume License media kits).

Why would I want to roll my own or access low-cost SBS media, you ask?

Well, if you ever have to do a Repair Install of your SBS box and you've added a Service Pack, you're hosed. The Repair Install will undo the service pack applied to the once-working box, and on reboot will give you a lovely blue screen. The only way around this is to restore from the last full backup, or re-image from your favorite imaging tool of choice (two listed below if you're not already using one).

Thanks to the wonderful advances of products like Acronis True Image and ShadowProtect, performing Repair Installs are a thing of the past, especially if you're using Repair Install to migrate a Retail SBS install to new hardware. The hardware independent restore capabilities of these products makes a full backup / minimal install / full restore / repair install redundant, as well as a lot slower.

But it's a pain if you don't have these, so make sure you have SBS media from the same channel (OEM, Retail or Volume License) with the Service Pack you're running already slipstreamed. Or simply don't install Windows Server 2003 Service Packs to SBS 2003 boxes.

Recovering Public Folder Items Easily in Exchange Server 2003

I occasionally get requests from clients and colleagues asking me to recover Public Folder items from Exchange Server 2003.

Thankfully for me I performed the ultimate fubar while performing a test migration from NT4.0 + Exchange 5.5 to SBS 2003 Premium back when SBS 2003 first came out. That's right, I managed to blow away the majority of the Public Folder store in one fell swoop, simply because I wasn't following my own instructions properly and wasn't used to the new Exchange System Manager interface.

Thankfully, I had just been getting familiar with the new capabilities of Outlook Web Access and had used the Recover Deleted Items feature to get familiar with it and to be able to instruct clients on how to use it.

I didn't really want to have to spend the time re-copying the Public Folder store from the Exchange 5.5 install, so I looked for the Public Folder equivalent of the Recover Deleted Items feature for the mailbox. It appeared to be missing. Or was it?

I had noticed that the Recover Deleted Items window had essentially opened the Deleted Items folder in the mailbox and had set a URL variable. The variable and its setting was:

cmd=showdeleted

Being the lazy kind of guy I am - as well as being inquisitive - I thought I would give some link hacking a try. I opened up the Public Folders link, navigated to the parent folder of the folder I deleted, right-clicked on the parent folder and selected Open in new... This opened the folder in a new window. The URL of this folder was of the form:

https://server/public/Public%20Folder/?Cmd=contents

I then replaced contents with showdeleted. The URL then looked like:

https://server/public/Public%20Folder/?Cmd=showdeleted

Ta da! The folder I trashed was now visible and capable of being recovered, which saved me additional copying time. Sometimes screwing up a test environment is a great way to learn a new, lazy technique :-)

Stopping Sophos PureMessage 3.0 from Generating an NDR Storm

I upgraded to the latest version of Sophos PureMessage (v2.6.1 upgrade to v3.0) on an SBS 2003 server.

The upgrade went smoothly as per usual. Hats off to Sophos for providing good quality products and excellent documentation.

This version now includes AD integration and allows for recipient validation. I enabled this, as well as verifying the upgraded settings. I kept an eye on progress for about 90 minutes as I was performing other administrative tasks.

When I came back to it the next morning, the server was being sluggish. Investigation showed that the were several thousand NDRs queued up, and further investigation revealed that the Exchange journal mailbox was bouncing Read Receipts with a Permission Denied error back to PureMessage. Unfortunately, the Read Receipts had no From header, so PureMessage was generating an NDR and trying to send it to an address of '<', which is a completely invalid address. This was then escalating an alert message to the Alert address, which had filled up the resulting mailbox. The mail bounce that was occuring was also generating an unscannable error due to too many nested attachments, which also queued up an alert message.

The remedial action was to remove the administrator alert address. This stopped the queuing. I then turned off administrator alerts for the On Unscannable action for the Exchange Store scanning and the Transport scanning. This helped stopped further NDR flooding.

The final action I performed that finally killed the NDR storm was to fire up the Exchange System Manager, go into the SmallBusiness SMTP Connector properties, go into Content Restrictions and turn off System Messages.

I also opened up the Delivery Restrictions placed on the mailbox that I'm using for Exchange Journalling until I can verify what the appropriate restrictions should be on the mailbox such that it works with PureMessage 3.0, seeing as the previous settings worked fine with PureMessage 2.6.1 (which was only accept messages from the Exchange Journalling mailbox).

Modifying SBS 2003 SP1's bkprunner.exe for Improved Backup Performance

I'll quickly jot this down before I forget.
I've recently been having a shrinking backup window on one of my client's SBS 2003 boxes. It backs up to tape and I didn't want to create a backup script and lose the nice reporting features that SBS provides. So I hacked the bkprunner.exe process instead :-)
On my own SBS 2003 box I was getting terrible server performance during my daily backup to USB drives. I found the undocumented /FU switch that was included with the SP1 version of ntbackup and some registry modifications that the Exchange team of Microsoft IT performed to improve their backup performance.

Open Explorer and go to "C:\Program Files\Microsoft Windows Small Business Server\Backup"
Make a copy of bkprunner.exe

Download and extract XVI32.
Run XVI32.exe
Open bkprunner.exe in XVI32

The address range $10F0-$11B7 is used for backups to .bkf files
The address range $11B8-$1277 is used for backups to tape

To turn off verify when backing up to a .bkf
Go to address $113A
In the hex pane (the middle one), type in the following hex values:
6E 00 6F 00 20
This enters in the text "no " in Unicode format.

To turn off buffered writes (as explained in MSKB 839272 and also here) when backing up to a .bkf - recommended
Go to address $115E
In the hex pane (the middle one), type in the following hex values:
46 00 55 00 20 00 20 00 20 00 20
This enters in the text "FU " in Unicode format.

To turn off verify when backing up to tape
Go to address $1202
In the hex pane (the middle one), type in the following hex values:
6E 00 6F 00 20
This enters in the text "no " in Unicode format.

Registry modifications for performance
Run regedit
Open HKEY_USERS
Load Hive
Open SBS Backup User's NTUSER.DAT registry hive; call the key name BACKUP
Browse to HKEY_USERS\BACKUP\Software\Microsoft\Ntbackup\Backup Engine.
Edit the value of the entry Logical Disk Buffer Size from 32 to 64.
Edit the value of the entry Max Buffer Size from 512 to 1024.
Edit the value of the entry Max Num Tape Buffers from 9 to 16.
If the above keys don't exist, create them as String values.
Click on HKEY_USERS\BACKUP
Unload hive

Outlook Web Access 2003 New E-mail Problem

One of my clients contacted me to say that their Distribution Lists weren't working in Outlook Web Access 2003. Due to the roaming nature of staff and the lack of Outlook installed on the PCs, I was unable to get them to switch to Outlook to check if the problem occurred there.

I spent a bit of time on it earlier this evening, only to find that I got a cryptic "The item could not be found. It may have been deleted" error pop up when trying to send an e-mail to a Distribution List created in the user's Contacts.

OK. Back to basics. I created a new Distribution List and added the addresses one by one. Wouldn't you know it, the problem only reared its ugly head on the last email address. Interestingly, the same problem occurred when I entered in the email address into a new message.

I looked at the Contact entry with the associated email address and found the cause of the problem - there was a trailing space at the end of the email address. I backtracked the cause of the error - an import of e-mail addresses from Alt-N's WorldClient created a trailing space for each imported address. How very nice of the Exchange Migration Wizard to create Contact entries with invalid email addresses. Grrr.

Looks like I'll be writing a script to strip trailing spaces from the email fields of the Contact entries...

Small Business Server 2003 - The Dreaded 5 CAL Reset Issue

A runaway process on SBS2003 decided to fill up all the disk space on C: in the early hours of the morning. The fallout from this was the System log was corrupt and the SBS license data was reset to the default 5 CALs.
The System log was easy to fix - reboot the server.
The SBS license data was an absolute pain. I'd never run the "Back up licenses" utility in the Licensing section of Server Management. Microsoft have KB article 888818 discussing this, which is either re-enter the licenses, restore the C:\WINDOWS folder or restore a backup of the licenses.
The first wasn't an option as I was offsite and the person with the key to the safe wasn't in. The second was just not viable - why Microsoft couldn't specify which file/folder needed restoring I don't know. The third would have been OK if ever I had run it.
After much stuffing about I found that the SBS2003 licenses are kept in the licstr.cpa file in the WINDOWS\system32 folder. Thankfully, Microsoft actually keep an automatic backup of this in autolicstr.cpa. The simple process was to stop the License Logging Service, rename licstr.cpa to licstr.cpa.old, then copy autolicstr.cpa to licstr.cpa. After this I started License Logging Service and used Server Management to confirm that the licenses had been restored.

Exchange Server 2003 Mailbox Recovery Using Recovery Storage Groups, NTBackup and Exmerge

OK, this is my quick-n-dirty guide to recovering a mailbox from an Exchange 2003 system. I'll tidy it up later.

• Download Exmerge from Microsoft


• Follow the instructions in MSKB 292509 to create a group that will allow the Administrator account to read/write mailbox data


• Open Exchange System Manager, expand Servers. Right-click on <server name> under Servers. Select New > Recovery Storage Group...


• Enter in a name for the RSG and also the file locations. The defaults are fine. Click OK


• Right-click on the Recovery Storage Group object.


• Choose Add Databases to Recover…


• Highlight the Mailbox Store (the one to be restored).


• Enable This Database can be overwritten by a restore


• Run NTBackup, select Restore and Manage Media, find the correct media, expand the Exchange Information Store and select Logs and Mailbox Store.


• Click Start Restore, Restore to <server name>, and set the Temporary location to the file location used to create the Recovery Storage Group. Enable Last Restore Set.


• After the database has been restored, mount the Recovery Storage Group database using Exchange Server Manager.


• Run Exmerge and select Extract or Import (Two Step Procedure).


• Select Step 1.


• Enter in <server name> for Exchange Server Name.


• Select Recovery Storage Group database.


• Select Mailbox to recover.


• Select Folder location to save .PST files to.


• Start ExMerge, click Next


• Choose Extract or Import (Two Step Procedure)


• Pick Step 2: Import data into an Exchange Server Mailbox


• Again type the name of your Exchange server then click Next


• Mark the mailboxes you want to merge, click Next twice


• Specify where the .PST files should be merged from and click Next


• Check mailbox data, then Dismount RSG database and remove files from the RSG file location


• You're done!

MOM 2005 Workgroup Edition Install Problem

I decided to have a look at Microsoft Operations Manager 2005 Workgroup Edition to see if it would help me in my management of several clients with multiple Windows servers.
I went to install it in a Windows Server 2003 virtual machine on my SBS2003 server. I installed a new instance of SQL Server 2000 and then upgraded it to SP4. The MOM2005 installer then failed the SQL prerequisite check - no SQL instances found! I then tried installing it on my SBS2003 box. It found only one SQL instance - my WSUS installation, but didn't think it was SP3 or later.
I then proceeded to find MSKB 902803, which gave me a modified msiexec install, but appeared to be targeted to MOM2005 and not the Workgroup Edition. I then managed to find a conversation in an Ars Technica forum. The process in summary is:

Load the registry editor and browse to:
HKLM\Software\Microsoft\MSSQLServer\MSSQLServer\CurrentVersion

Change the CSDVersion key from 8.00.2039 to 8.00.761

Instances can be found at:
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\\MSSQLServer\CurrentVersion 

Run MOM 2005 Workgroup Edition setup

Change the value back when you are done.

This was the technique I used to successfully install MOM 2005 Workgroup Edition.

Windows XP Netlogon 5719 Errors

Had a new PC to remotely install at a client site. The site is running Windows Server 2003 Domain Controllers and makes use of GPOs to manage the settings and software installation. I added the PC to the domain and placed it in the correct OU for the necessary software installation and rebooted. I was very surprised to not see any files being shifted from the server to the PC. Logged in remotely as Administrator and found that the User policies had been applied, but not the Computer policies.
A look through the Event Log found the dreaded Netlogon 5719 error - "no domain controller could be found". Tried locking down the network card to use 100Mbps/Full Duplex. No joy. Tried setting ExpectedDialupDelay in HKLM\System\CurrentControlSet\Services\Netlogon\Parameters. Still no joy.

The network card was an SiS 900 integrated NIC and an old driver was being used. Upgraded to the latest version of the driver. Still no joy. Right. Let off some steam by vigorously chopping some wood that really, really needed it. Still didn't help my GPO problem, but made a big difference to my mood.

I then decided to see what drivers were available to me for this network card. Found that there was a signed Microsoft driver for the SiS 900, so I decided to try this before having to go onsite with a new network card. Installed the driver, rebooted the system and noticed a flurry of file transfers from the server to the PC. Yay!

I shall now make sure that if I see the problem in the future to see if there's a signed Microsoft driver for the network card before getting hot under the collar (especially as the amount of wood to chop up is getting lower!).

Exchange Server 2003 - Migration From IMAP4

Had to migrate mailbox contents from an MDaemon Pro 8.x installation to an SBS2003 installation. Client was only using WorldClient, so I decided to use the Migration Wizard to migrate from an IMAP4 server. I had already used the Active Directory Migration Tool to migrate users, groups and computers, so account creation wasn't needed.
I fired up the Migration Wizard and proceeded to get stuck when it asked for a User List file. A bit of hunting found me this page
which provided the format for the user list file. Thankfully MDaemon has a nice account export feature, so I was able to export to CSV, then use Excel to get the extracted information into the necessary format. The format required is as follows:

IMAP_Mailbox,SMTP_Address,IMAP_Password,IMAP_Server
user1,user3@legacy.test.local,password,192.168.10.101
user2,user3@legacy.test.local,password,192.168.10.101
user3,user3@legacy.test.local,password,192.168.10.101

The header is needed. The Migration Wizard then went and matched up the mailboxes to existing accounts. All account mapping were correct and the migration then proceeded without a hitch.
Another useful time-saving migration tool is the File Server Migration Toolkit. It makes share and security migration a breeze. The DFS Consolidation Root capability also allows the migration to occur leaving the orginal UNC path intact! Very, very slick!

MSDE2000 Installation Error on Windows 2003 DCs

Well I've just spent the last few hours trying to install Sophos Enterprise Console 1.0 on 3 Windows Server 2003 systems. One of the server installs worked just fine and the other two failed with the following message:

Error 3500. The custom action "InstallMSDE" failed with the following error: Fatal error during installation. 1603

A Google search using "sophos error 3500" yielded nothing useful. A search of "sophos error 1603" proved more valuable. It pointed me in the direction of looking in the MSDE install log (C:\Documents and Settings\Administrator\Local Settings\Temp\SophosMSDEInstaller.log in this case). The line of interest was:

InstallSQLAgentSecurity failed (SERVER02,LocalSystem,87).

A Google search for "InstallSQLAgentSecurity failed" then yielded "Backup Exec 9.x or 10.0 for Windows Servers fails to install ..." which detailed the exact problem, but with Veritas Backup Exec 9.x/10.x.

One of the links included in this document was "PRB: The MSDE Installation Does Not Succeed If the Installation Computer Is Running Terminal Services in Application Server Mode".
The problem with this was I wasn't meeting all the criteria - I was using VNC to remotely install the software after it failed first time. Long experience with software installation on a W2K3 system even when accessing the console session over RDP has resulted in VNC being installed on my W2K3 systems.
Further wading through the Google result set then gave me this: "Solution for the WSUS/WMSDE install error"

This accurately described my problem - MSDE failing with the same error. Not only that, but it explained why one of my servers installed Sophos Enterprise Console correctly - it was the one with the FSMO roles! I excitely followed the instructions in the Microsoft Knowledge Base article titled "How to view and transfer FSMO roles in Windows Server 2003" and yay! A successful installation.
Performed the FSMO transfer again on the third server, then went home for much needed food and sleep.
Must allocate some time for the next time I need to do this to see exactly which FSMO role needs transferring.