NVSPBind – A Command Line Utility For Managing Network Protocol Binding On Server Core Or Hyper-V Server Installs (About Time!)

I had a case a few months back where I’d determined that QoS was screwing over some network connectivity on a Server Core install. On a full install I’d simply use ncpl.cpl and remove the QoS Packet Scheduler binding from the adapter. Not so on the Core install. I had to resort to some registry hacking to disable the QoS Packet Scheduler to resolve my problem.

In my Inbox Zero efforts for my RSS feeds I came across this NVSPBind article on John Howard’s blog. Awesome! This will save some time in the future when enabling/disabling protocols.

Download links are here:

NVSPBind - http://code.msdn.microsoft.com/nvspbind

NVSPScrub - http://code.msdn.microsoft.com/nvspscrub

NVSPScrub helps restores your virtual networking configuration if you happen to screw it up with NVSPBind! :-)

Fixing SBS 2003 RWW for Console Access From XP SP3, Vista SP1 and Windows Server 2008

Sick of waiting for Microsoft to release a fix to RWW to enable Console access to SBS 2003 and any other Windows Server 2003 systems connected to your SBS network? So am I. So I’ve fixed it. Process is as follows:

Navigate to C:\Inetpub\Remote

Make a copy of tsweb.aspx

Open tsweb.aspx in your favorite editor (mine’s Notepad++)

Line 304 looks like this:

MsRdpClient.AdvancedSettings2.ConnectToServerConsole = console

 

Replace it with this:

version = MsRdpClient.Version
if strcomp(version,"6.0.6001") < 0 then
  MsRdpClient.AdvancedSettings2.ConnectToServerConsole = console
else
  MsRdpClient.AdvancedSettings2.ConnectToServerConsole = false
  MsRdpClient.AdvancedSettings6.ConnectToAdministerServer = console
end if

 

Save the changes. You can now establish console sessions to your SBS 2003 box and any other Windows Server 2003 boxes on your SBS network.

If anyone’s got a better way for displaying code in a Blogger page I’d be interested in knowing about it.

SBS 2008 RC1 Is Out

Microsoft have made SBS 2008 RC1 available via Public Preview. It can be downloaded from here.

Other useful links from the TechNet site:

Release Notes, Installation Guide, SBS Documentation, SBS Resources and the SBS 2008 Evaluation Centre.

 

Very handy documents to download and read:

Windows Small Business Server 2008 Installation Guide

Windows Small Business Server 2008 Console Help

Windows Small Business Server 2008 Migration Help

Migrating to Windows Small Business Server 2008 from Windows Small Business Server 2003

Migrating to Windows Small Business Server 2008 from Windows Small Business Server 2008

Windows Small Business Server 2008 Release Candidate Reviewer’s Guide

 

Three very useful resources to keep an eye on while evaluating and testing SBS 2008:

The Official SBS Blog

SBSfaq.com

Smallbizserver.Net

 

And finally, if you plan on testing this in a Virtual Machine, check out:

VMWare Settings for SBS 2008

Note that SBS 2008 requires 4GB of RAM. It won’t install with any less memory than this. You can use an evaluation of VMWare Workstation or either VMWare Server or VMWare Server 2.0 Release Candidate. Both VMWare Workstation and VMWare Server 2.0 Release Candidate support USB 2.0 devices, so you can test server backups/recovery with removable USB drives with these products.

Essential Business Server RC1 Is Out

Microsoft have made EBS RC1 available via Public Preview. It can be downloaded from here.

Other useful links from the TechNet site:

Release Notes, Installation Guide, EBS Documentation, and the EBS Evaluation Centre.

 

Very handy documents (in .doc, .pdf or .xps format) to download and READ (as Susan says) before any migrations:

Windows Essential Business Server Product Overview

Windows Essential Business Server Getting Started Guide

Windows Essential Business Server Installation Guide

Migrating Active Directory Domain Services Scripts, Roaming Profiles, Redirected Folders, and Home Directories to Windows Essential Business Server

Migrating the DNS Role to Windows Essential Business Server

Migrating DHCP Server Service to Windows Essential Business Server

Migrating Microsoft Exchange Server to Windows Essential Business Server

Migrating from Windows Small Business Server 2003 to Windows Essential Business Server

 

Two very useful resources to keep an eye on while evaluating and testing EBS:

The Essential Business Server Team Blog

EBSfaq.com

 

And finally, if you need some gear to run this on, check out:

HP BladeSystem – in particular, the c3000 enclosure (“Shorty”)

IBM BladeCenter – in particular, the BladeCenter S offering

Intel Modular Server

How to Demote a Long-Disconnected Domain Controller

Just looking back on some old notes.

Found out nearly 4 years ago that I had to reconnect a branch office Windows Server 2003 domain controller that had a reasonable amount of data (in DFS) and apps on it and I had a weekend in which to do it. A re-install would have been pushing it. Especially the DFS replication (don't even ask about the backups...).

I distinctly remember at the time that there wasn't anything on TechNet, except one of those teaser PowerPoint presentations saying how Windows Server 2003 had better support for long-disconnected domain controllers (which I can no longer seem to find with Google. Hmph.).

Some of my Kerberos experience on FreeBSD and - at that time - my new-found knowledge of pointing Google at Microsoft to search for useful information helped me to try to understand what was going on.

After having a good guess of what I thought was wrong and running down some dead-ends, I ended up surprising myself when the following process worked:

• Change tombstone on FSMO DC to 180 days
• Push out changes from FSMO DC to other DCs using replmon
• Remove GC role from long-disconnected DC on both FSMO DC and on long-disconnected DC using AD Sites and Services
• Push out changes from FSMO DC to other DCs using replmon
• Stop and Disable KDC on long-disconnected DC
• Use netdom to reset machine account password for long-disconnected DC on FSMO DC
• netdom resetpwd /server:<FSMO DC hostname> /ud:<Domain>\<Admin Account> /pd:<Admin Passwd>
• restart long-disconnected DC
• Use dcpromo repeatedly to demote server (I got timeouts for netlogon taking too long to respond; WAN authentication latency problem?)
• restart the now demoted long-disconnected DC
• Click OK to "one or more services failed to start"; not finding a DC
• Use Terminal Services to remove demoted DC as a DNS NS from AD-integrated zones on the FSMO DC
• Use Terminal Services to connect to FSMO DC and replicate the entire domain
• run dcpromo to promote standalone server

Thought I'd post this to help out any other poor sod stuck in this sorry state.

Might just have to run up a couple of VMs to verify this still works...

TechNet now has guidance on this with the Reconnecting a Domain Controller After a Long-Term Disconnection article. Doesn't look like what I've got above.

Sophos Enterprise Console - Stuck on Connecting to Server

I have a problem on an SBS 2003 Premium Edition box (2 NICs and running ISA Server) where launching the Enterprise Console sits forever at the connection screen.



This is the same problem even if I perform a console-only install to a separate box.

The drastic remedy is to reboot the server. By using the console on a separate box I was able to use TCPView to find that EnterpriseConsole.exe was connecting to MgntSvc.exe on the server.

I then tried stopping the service from the command line:

> net stop "Sophos Management Service"

Which resulted in me being told that the service could not be stopped. I then used PsKill to stop the service:

> pskill "Sophos Management Service"

And I then restarted the service:

> net start "Sophos Management Service"

This then allowed me to successfully use the Enterprise Console.

Hyper-V Release Candidate is Here

Microsoft have made the Hyper-V Release Candidate available.

The Release Candidate has better (but not complete) localisation support, support for the x86 versions of Windows Server 2003 SMP, Vista SP1 and XP SP3, integration components for Vista SP1 and XP SP3 (yay!), and improved performance - especially with pass-though disk support.

It's looking good so far...

Windows Server 2008 Standard Edition - License Change Regarding Virtualisation

The introduction of Hyper-V to all editions of Windows Server 2008 (except Web Edition) has meant there's been a licensing change to the Standard Edition.

The previous editions of Windows Server Standard Edition allowed for 1 instance of Windows Server to be installed as a Physical Operating System Environment (POSE) or as a Virtual Operating System Environment (VOSE). This meant that if you wanted to host a virtualised Windows Server 2003 R2 Standard Edition on say Virtual Server 2005 R2 running on Windows Server 2003 R2 Standard Edition, then you needed to acquire 2 licenses of Windows Server 2003 R2 Standard Edition - one for the physical instance and one for the virtual instance.

The new licensing change brings the Standard Edition in line with the Enterprise Edition. This means that Windows Server 2008 Standard Edition can be installed twice using the one license - once for the physical instance and once for the virtualised instance. The caveat is that the physical instance can only be used for the purposes of hosting the virtualised instance. All the workload for the Standard Edition license is to be performed in the virtualised instance, with the physical instance used to host and maintain the virtualised instance.

More information can be found in the Licensing Information section of the Hyper-V FAQ, Microsoft's Licensing Virtualisation changes and the Volume Licensing Product Use Rights.

SBS 2003 Media, Service Packs, Repair Install - Oh My!

This has been a long-running battle I've had with Microsoft over the years - the inability to either roll my own slipstreamed SBS media, or obtain slipstreamed SBS media at reasonable cost (like the Volume License media kits).

Why would I want to roll my own or access low-cost SBS media, you ask?

Well, if you ever have to do a Repair Install of your SBS box and you've added a Service Pack, you're hosed. The Repair Install will undo the service pack applied to the once-working box, and on reboot will give you a lovely blue screen. The only way around this is to restore from the last full backup, or re-image from your favorite imaging tool of choice (two listed below if you're not already using one).

Thanks to the wonderful advances of products like Acronis True Image and ShadowProtect, performing Repair Installs are a thing of the past, especially if you're using Repair Install to migrate a Retail SBS install to new hardware. The hardware independent restore capabilities of these products makes a full backup / minimal install / full restore / repair install redundant, as well as a lot slower.

But it's a pain if you don't have these, so make sure you have SBS media from the same channel (OEM, Retail or Volume License) with the Service Pack you're running already slipstreamed. Or simply don't install Windows Server 2003 Service Packs to SBS 2003 boxes.

Heroes Happen {2008} - Good News for Hobart and Darwin!

If you go up to the Heroes Happen {2008} site, you'll notice an absence of Hobart and Darwin in the list of venues.

Good news! Microsoft are going to do a Wave launch in Hobart and Darwin. It's going to be scaled down relative to the launches in the other capital cities, but this is certainly better than nothing at all.

The dates I've been provided with are:

8 April - Darwin

15 April - Hobart

Contact Microsoft Partner Services on 132058, option 4 to make sure you're added to the invite list for these events.

Details will be added to the Partner Portal in due course.

Using Windows Server 2008 as a Desktop OS - Installing Windows Live Writer

I'm using Windows Server 2008 as my primary desktop OS, for which I'll be blogging on over the coming weeks as I encounter non-obvious problems. I'll also cover my installation experiences which might help out others who wish to do the same.

The recent problem I had is that I saw the Windows Live suite of applications come out of Beta and I wanted to try them out. OK, up to the Microsoft Downloads site for the Windows Live category and download Windows Live Writer to use it on my Blogger account.

I download WLinstaller.exe, run it and I'm immediately presented with the following unhelpful error:

Hmmm, no Windows Live Writer for my Terminal Servers then.

Undeterred, I download and install Windows Live Writer on a spare Windows XP machine, open up regedit and navigate to HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstaller and go browsing for Windows Live Writer. Within a couple of minutes I find the entry and also find that it has cached the MSI to:

C:\Program Files\Common Files\WindowsLiveInstaller\MsiSources\Install_{9176251A-4CC1-4DDB-B343-B487195EB397}.msi

So I copy this file to my Windows Server 2008 laptop, expecting to have to modify it with Orca. What the heck, I'll try running it first. And it installs without problem. And I'm using it just fine, as this blog article is written using it.

I'll try the same trick with the other Windows Live programs and write up my findings accordingly.

Recovering Public Folder Items Easily in Exchange Server 2003

I occasionally get requests from clients and colleagues asking me to recover Public Folder items from Exchange Server 2003.

Thankfully for me I performed the ultimate fubar while performing a test migration from NT4.0 + Exchange 5.5 to SBS 2003 Premium back when SBS 2003 first came out. That's right, I managed to blow away the majority of the Public Folder store in one fell swoop, simply because I wasn't following my own instructions properly and wasn't used to the new Exchange System Manager interface.

Thankfully, I had just been getting familiar with the new capabilities of Outlook Web Access and had used the Recover Deleted Items feature to get familiar with it and to be able to instruct clients on how to use it.

I didn't really want to have to spend the time re-copying the Public Folder store from the Exchange 5.5 install, so I looked for the Public Folder equivalent of the Recover Deleted Items feature for the mailbox. It appeared to be missing. Or was it?

I had noticed that the Recover Deleted Items window had essentially opened the Deleted Items folder in the mailbox and had set a URL variable. The variable and its setting was:

cmd=showdeleted

Being the lazy kind of guy I am - as well as being inquisitive - I thought I would give some link hacking a try. I opened up the Public Folders link, navigated to the parent folder of the folder I deleted, right-clicked on the parent folder and selected Open in new... This opened the folder in a new window. The URL of this folder was of the form:

https://server/public/Public%20Folder/?Cmd=contents

I then replaced contents with showdeleted. The URL then looked like:

https://server/public/Public%20Folder/?Cmd=showdeleted

Ta da! The folder I trashed was now visible and capable of being recovered, which saved me additional copying time. Sometimes screwing up a test environment is a great way to learn a new, lazy technique :-)

Stopping Sophos PureMessage 3.0 from Generating an NDR Storm

I upgraded to the latest version of Sophos PureMessage (v2.6.1 upgrade to v3.0) on an SBS 2003 server.

The upgrade went smoothly as per usual. Hats off to Sophos for providing good quality products and excellent documentation.

This version now includes AD integration and allows for recipient validation. I enabled this, as well as verifying the upgraded settings. I kept an eye on progress for about 90 minutes as I was performing other administrative tasks.

When I came back to it the next morning, the server was being sluggish. Investigation showed that the were several thousand NDRs queued up, and further investigation revealed that the Exchange journal mailbox was bouncing Read Receipts with a Permission Denied error back to PureMessage. Unfortunately, the Read Receipts had no From header, so PureMessage was generating an NDR and trying to send it to an address of '<', which is a completely invalid address. This was then escalating an alert message to the Alert address, which had filled up the resulting mailbox. The mail bounce that was occuring was also generating an unscannable error due to too many nested attachments, which also queued up an alert message.

The remedial action was to remove the administrator alert address. This stopped the queuing. I then turned off administrator alerts for the On Unscannable action for the Exchange Store scanning and the Transport scanning. This helped stopped further NDR flooding.

The final action I performed that finally killed the NDR storm was to fire up the Exchange System Manager, go into the SmallBusiness SMTP Connector properties, go into Content Restrictions and turn off System Messages.

I also opened up the Delivery Restrictions placed on the mailbox that I'm using for Exchange Journalling until I can verify what the appropriate restrictions should be on the mailbox such that it works with PureMessage 3.0, seeing as the previous settings worked fine with PureMessage 2.6.1 (which was only accept messages from the Exchange Journalling mailbox).

Modifying SBS 2003 SP1's bkprunner.exe for Improved Backup Performance

I'll quickly jot this down before I forget.
I've recently been having a shrinking backup window on one of my client's SBS 2003 boxes. It backs up to tape and I didn't want to create a backup script and lose the nice reporting features that SBS provides. So I hacked the bkprunner.exe process instead :-)
On my own SBS 2003 box I was getting terrible server performance during my daily backup to USB drives. I found the undocumented /FU switch that was included with the SP1 version of ntbackup and some registry modifications that the Exchange team of Microsoft IT performed to improve their backup performance.

Open Explorer and go to "C:\Program Files\Microsoft Windows Small Business Server\Backup"
Make a copy of bkprunner.exe

Download and extract XVI32.
Run XVI32.exe
Open bkprunner.exe in XVI32

The address range $10F0-$11B7 is used for backups to .bkf files
The address range $11B8-$1277 is used for backups to tape

To turn off verify when backing up to a .bkf
Go to address $113A
In the hex pane (the middle one), type in the following hex values:
6E 00 6F 00 20
This enters in the text "no " in Unicode format.

To turn off buffered writes (as explained in MSKB 839272 and also here) when backing up to a .bkf - recommended
Go to address $115E
In the hex pane (the middle one), type in the following hex values:
46 00 55 00 20 00 20 00 20 00 20
This enters in the text "FU " in Unicode format.

To turn off verify when backing up to tape
Go to address $1202
In the hex pane (the middle one), type in the following hex values:
6E 00 6F 00 20
This enters in the text "no " in Unicode format.

Registry modifications for performance
Run regedit
Open HKEY_USERS
Load Hive
Open SBS Backup User's NTUSER.DAT registry hive; call the key name BACKUP
Browse to HKEY_USERS\BACKUP\Software\Microsoft\Ntbackup\Backup Engine.
Edit the value of the entry Logical Disk Buffer Size from 32 to 64.
Edit the value of the entry Max Buffer Size from 512 to 1024.
Edit the value of the entry Max Num Tape Buffers from 9 to 16.
If the above keys don't exist, create them as String values.
Click on HKEY_USERS\BACKUP
Unload hive

Small Business Server 2003 - The Dreaded 5 CAL Reset Issue

A runaway process on SBS2003 decided to fill up all the disk space on C: in the early hours of the morning. The fallout from this was the System log was corrupt and the SBS license data was reset to the default 5 CALs.
The System log was easy to fix - reboot the server.
The SBS license data was an absolute pain. I'd never run the "Back up licenses" utility in the Licensing section of Server Management. Microsoft have KB article 888818 discussing this, which is either re-enter the licenses, restore the C:\WINDOWS folder or restore a backup of the licenses.
The first wasn't an option as I was offsite and the person with the key to the safe wasn't in. The second was just not viable - why Microsoft couldn't specify which file/folder needed restoring I don't know. The third would have been OK if ever I had run it.
After much stuffing about I found that the SBS2003 licenses are kept in the licstr.cpa file in the WINDOWS\system32 folder. Thankfully, Microsoft actually keep an automatic backup of this in autolicstr.cpa. The simple process was to stop the License Logging Service, rename licstr.cpa to licstr.cpa.old, then copy autolicstr.cpa to licstr.cpa. After this I started License Logging Service and used Server Management to confirm that the licenses had been restored.

Exchange Server 2003 Mailbox Recovery Using Recovery Storage Groups, NTBackup and Exmerge

OK, this is my quick-n-dirty guide to recovering a mailbox from an Exchange 2003 system. I'll tidy it up later.

• Download Exmerge from Microsoft


• Follow the instructions in MSKB 292509 to create a group that will allow the Administrator account to read/write mailbox data


• Open Exchange System Manager, expand Servers. Right-click on <server name> under Servers. Select New > Recovery Storage Group...


• Enter in a name for the RSG and also the file locations. The defaults are fine. Click OK


• Right-click on the Recovery Storage Group object.


• Choose Add Databases to Recover…


• Highlight the Mailbox Store (the one to be restored).


• Enable This Database can be overwritten by a restore


• Run NTBackup, select Restore and Manage Media, find the correct media, expand the Exchange Information Store and select Logs and Mailbox Store.


• Click Start Restore, Restore to <server name>, and set the Temporary location to the file location used to create the Recovery Storage Group. Enable Last Restore Set.


• After the database has been restored, mount the Recovery Storage Group database using Exchange Server Manager.


• Run Exmerge and select Extract or Import (Two Step Procedure).


• Select Step 1.


• Enter in <server name> for Exchange Server Name.


• Select Recovery Storage Group database.


• Select Mailbox to recover.


• Select Folder location to save .PST files to.


• Start ExMerge, click Next


• Choose Extract or Import (Two Step Procedure)


• Pick Step 2: Import data into an Exchange Server Mailbox


• Again type the name of your Exchange server then click Next


• Mark the mailboxes you want to merge, click Next twice


• Specify where the .PST files should be merged from and click Next


• Check mailbox data, then Dismount RSG database and remove files from the RSG file location


• You're done!

Understanding Group Policy

I had a client that wanted to add network printers and set a default printer on a set of computers regardless of who logged into the computer.
I found out that Group Policy has a Loopback mode that allows User Configuration to either be Merged or Replaced. This is done by enabling Loopback mode in the Computer Configuration and selecting Replace or Merge mode. The User Configuration settings in the same GPO are then applied based on the computer, rather than the user.
I then had some problems applying the GPO to a set of computers. If I only included the necessary computers in Security Filtering, the user was then denied access to the User Configuration settings. If I added Authenticated Users to the Security Filtering, the GPO was applied to everyone on all computers!
I then worked out that I misunderstood the membership of Authenticated Users. This contains all the computer accounts as well as all users.
I resolved the GPO problem by including the set of computers on which the script needed to run and also including the Domain Users group. The GPO was then only applied on the required set of computers.
So, Authenticated Users is really authenticated users and computers - a pity you can't easily see the membership of this group!

MOM 2005 Workgroup Edition Install Problem

I decided to have a look at Microsoft Operations Manager 2005 Workgroup Edition to see if it would help me in my management of several clients with multiple Windows servers.
I went to install it in a Windows Server 2003 virtual machine on my SBS2003 server. I installed a new instance of SQL Server 2000 and then upgraded it to SP4. The MOM2005 installer then failed the SQL prerequisite check - no SQL instances found! I then tried installing it on my SBS2003 box. It found only one SQL instance - my WSUS installation, but didn't think it was SP3 or later.
I then proceeded to find MSKB 902803, which gave me a modified msiexec install, but appeared to be targeted to MOM2005 and not the Workgroup Edition. I then managed to find a conversation in an Ars Technica forum. The process in summary is:

Load the registry editor and browse to:
HKLM\Software\Microsoft\MSSQLServer\MSSQLServer\CurrentVersion

Change the CSDVersion key from 8.00.2039 to 8.00.761

Instances can be found at:
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\\MSSQLServer\CurrentVersion 

Run MOM 2005 Workgroup Edition setup

Change the value back when you are done.

This was the technique I used to successfully install MOM 2005 Workgroup Edition.

DHCPServer 1010 1014 1016 Errors

I've recently installed a server at home and installed SBS 2003 SP1 Premium Edition on it. Everything went smoothly and I eventaully set up the Monitoring to send me daily reports. I started to get concerned with the DHCPServer 1010, 1014 and 1016 errors that were occurring daily. Backing up and restoring the DHCP database didn't work, chkdsk /f /r didn't show any errors, and hard drive diagnostics were fine. Memory testing was also fine. I removed Anti-spyware and Anti-virus software. Still no difference.

With much grinding of teeth, the occasional expletive and the desire to smash something out of the way, I continued the Googling to find an answer. Lo and behold, there was a thread in the newsgroup microsoft.public.windows.server.sbs which talked about turning off indexing on the %WINDIR%\System32\DHCP folder. I decided to give this a go by going into the folder properties, clicking Advanced on the General tab and disabling "For fast searching, allow Indexing Service to index this folder". Clicked OK twice and waited a couple of days to see if the critical error count dropped in the Monitoring report. Yes! Victory! The 1010, 1014 and 1016 errors stopped occurring! Sanity has been restored! The cat no longer cringes when I'm around!

Windows XP Netlogon 5719 Errors

Had a new PC to remotely install at a client site. The site is running Windows Server 2003 Domain Controllers and makes use of GPOs to manage the settings and software installation. I added the PC to the domain and placed it in the correct OU for the necessary software installation and rebooted. I was very surprised to not see any files being shifted from the server to the PC. Logged in remotely as Administrator and found that the User policies had been applied, but not the Computer policies.
A look through the Event Log found the dreaded Netlogon 5719 error - "no domain controller could be found". Tried locking down the network card to use 100Mbps/Full Duplex. No joy. Tried setting ExpectedDialupDelay in HKLM\System\CurrentControlSet\Services\Netlogon\Parameters. Still no joy.

The network card was an SiS 900 integrated NIC and an old driver was being used. Upgraded to the latest version of the driver. Still no joy. Right. Let off some steam by vigorously chopping some wood that really, really needed it. Still didn't help my GPO problem, but made a big difference to my mood.

I then decided to see what drivers were available to me for this network card. Found that there was a signed Microsoft driver for the SiS 900, so I decided to try this before having to go onsite with a new network card. Installed the driver, rebooted the system and noticed a flurry of file transfers from the server to the PC. Yay!

I shall now make sure that if I see the problem in the future to see if there's a signed Microsoft driver for the network card before getting hot under the collar (especially as the amount of wood to chop up is getting lower!).