Archive for the ‘Server 2012’ Category

Server Essentials not Sending Health Reports

A built in feature of Server Essentials, till 2019, is the ability of the server to send a daily “Health Report”. This contains information about the last backup, storage, services and more. I always configure this on all Essentials servers and set to send at 7:00 am for my review later. On 4 of the Essentials servers I manage it seems on the morning of the Daylight Savings change, at 1:00 am it tried to send a report for some reason, failed, and has failed the 7:00 am report ever since.

Though the error shows the problem is the “Windows Server Essentials Management Service” is not running, checking the Services management console shows it is. Simply restarting the service resolves the problem. You can right click on the last report and choose “send e-mail” to verify.

Advertisement

Category:

E-mail, Essentials, Reporting, Server 2012, Server 2019, Troubleshooting, Uncategorized

Tagged with:

Remote Access

Many years ago I wrote numerous blog articles relating to VPNs, and primarily PPTP VPNs. Hits on those blog pages are up 300% since the Coronavirus outbreak due to people looking for ways to work from home. I wanted to warn PPTP is an old solution and is considered to be “broken” and very insecure. Please consider other options.

Rather than creating new articles explaining how to configure various remote access methods I thought I would provide some suggestions and links as it has all been written before by very talented IT folk.

Firstly VPNs. I would always recommend using a VPN appliance/router over the server itself. It is more secure, authenticates at the network perimeter not the server itself, and allows more control. Cisco, Sonicwall, Juniper, Watchguard, and others provide very good solutions . However one concern with any VPN solution is the fact that though it is a secure tunnel, it also allows any and all traffic between an unmanaged remote client computer and the corporate network. Viruses can travers the VPN tunnel, should the client PC be hacked the hacker has direct access to the corporate network, and the remote user can easily copy/steal corporate data that they maybe should not. In addition VPNs occasionally just do not work due to network addressing, slow ISP service, or blocked protocols by ISPs.

If you do want to set up a VPN on a windows server, I would recommend SSTP.  Thomas Maurer has a great configuration guide:https://www.thomasmaurer.ch/2016/10/how-to-install-vpn-on-windows-server-2016/

Perhaps a better option than a VPN is a terminal server, now called a remote desktop server (RD Server). I have never seen the RDP protocol blocked, performance is usually better than a VPN, and all data stays on the corporate network. If set up correctly it uses the Remote Desktop Gateway service and SSL which is very secure. You can, if you like, also use this within your VPN tunnel and if using a business class VPN solution restrict traffic to RDP.

Another alternative if you don’t want to set up an RD Server is to configure the RD Gateway service on your server and allow users to connect securely to their own desktops PCs with the same level of performance. This was a built in feature of SBS and Server Essentials 2016 and earlier.  Mariette Knap has a excellent article on configuring the RD Gateway service, specifically on Server 2019 Std:https://www.server-essentials.com/support/setup-rds-gateway-as-a-replacement-for-access-anywhere-from-the-essentials-experience-role

Regardless of what method you use, as soon as you allow any remote access, make sure you configure Group Policy to enforce strong passwords and to lock accounts after ‘X’ wrong password guesses.  (I use 5, and lock out for 30 minutes). You can set this on the server for domain wide deployment or on an individual PC using GPedit.msc. For both it is located under Computer Configuration |Windows Settings | Security Settings | Account Policies .

The other alternative of course is to use cloud based services such as Microsoft’s Office 365 which you can from any where, at any time.  If dong so, make sure you enable multi-factor authentication for security.

I hope this is of some help and please stay safe n these uncertain times.

 

 

 

Category:

Networking, RRAS/VPN, SBS, Server 2012, Server 2019, TS/RDS, Uncategorized, VPN, Windows 10

Tagged with:

An Authentication error has occurred

It seems recently many users are receiving an error logging into Remote Desktop Servers (Terminal Servers) from off-site. The error reads:

KB4103725

An authentication error has occurred.
The function request is not supported.
Remote computer <ServerName>
This could be due to CredSSP encryption oracle remediation.
For more information, see https://go.microsoft.com/fwlink/?linkid=866660

This is a result of a March 13th update. The previous error message was shorter, but an Apr 17 update elaborated the error message to read as above.

The link explains how to resolve using group policy but the simple fix, as of May 8th, is to apply the KM4103725 monthly rollup update. This will require a reboot on most servers, but should resolve the problem once complete.

 

Category:

Active Directory, Server 2012, Troubleshooting, TS/RDS, Uncategorized

Tagged with:

DFSR Event ID: 2147485861

It seems Server Essentials and possibly others will often show in the daily report a DFSR Event ID: 2147485861 error. There is also a corresponding Warning Event logged in the DFS Replication log (sub-folder of Applications and Services Logs) of the event viewer with Source DFSR and Event ID 2013, followed by an Event ID 2212. This is most often caused by a dirty shutdown.

image

There are numerous articles on the Internet explaining how to resolve this, but I was told they were not clear to some readers. So, hopefully to clarify:

Firstly open Regedit and locate the key below, and verify it is set to 1. If not change it to 1.   (Note: you should always backup the registry before making any changes)

HKLM\System\CurrentControlSet\Services\DFSR\Parameters\StopReplicationOnAutoRecovery

Then in the error message within the report locate the command as highlighted in the image above, but cut and past it from your server report as it will have the correct volume GUID. Make sure it is all one line. You may want to use Notepad to reassemble if broken in the report. You need to use an elevated command prompt to run this.

If you run the command with the wrong GUID it will display; “No Instance(s) Available”.

If successful your command window should look similar to this:

image

This should resolve the problem, but it may return at some point in the future.  The Windows Server 2012 Essentials Build document (wiki article) suggests to prevent this in the future, after running the command successfully, change the aforementioned registry key from 1 to 0.  Doing so enables DFS Replication automatic recovery.

http://social.technet.microsoft.com/wiki/contents/articles/13620.windows-server-2012-essentials-build-document.aspx#DFSR_Error_in_Health_Reports

Category:

Essentials, Reporting, Server 2012, Troubleshooting

Tagged with:

Virtual Machine Management Service failure

I recently came across a Hyper-V host which after a power outage and a dirty shut  down, due the absence of a UPS, could not connect to the Virtual Machine Management Service.  When opening the Hyper-v console the VMs were not listed, and selecting “Connect to Server” resulted in the following error message; “An error occurred while attempting to connect to server ‘ServerName’.  Check that the Virtual Machine Service is running and that you are authorized to connect to the server.”

image

The Hyper-V services displayed running in the Services management console, and permissions had not changed, however when checking for dependencies for the Hyper-V Virtual Management Service it show no dependencies.  Comparing this to another Hyper-V host reveals the service depends on the Remote Procedure Call (RPC) and Windows Management Instrumentation service. Both of these were running as well.

When services and system information is not present in various consoles, and the WMI service is running, it can often be a result of missing or corrupt WMI files.  You can confirm this by running msinfo32.exe (System Information).  If so, you will receive a message “Can’t collect Information.  Cannot access the Windows Management Instrumentation software.  Windows Management files may be moved or missing.”

image

If this is the case there is an easy fix:

  • Always have a full backup of your system before making any changes!
  • Note:  Microsoft recommends troubleshooting, and restoring the WMI files rather than deleting them as I describe here.  Deleting the files can affect 3rd party software which may require reinstalling.  For more information see the links at the end of this article.  In this case the WMI checks showed no inconsistencies and a reset failed, so rebuilding was the best option.
  • Stop the Windows Management Instrumentation service, which will warn you that it will also stop the Hyper-V Virtual Machine Management and other services, verifying the link between the two.
  • Rename the WMI information file folder to something such as .old  C:\Windows\System32\wbem\Repository.old
  • image
  • Restart the host.   Upon reboot it will recreate the Repository folder and its contents.  You may find the first logon hangs for a few minutes and also it may be slow for a while as it rebuilds the files.
  • image
Additional information regarding troubleshooting WMI:

http://blogs.technet.com/b/askperf/archive/2009/04/13/wmi-rebuilding-the-wmi-repository.aspx

http://technet.microsoft.com/en-us/library/ff404265.aspx

Category:

Hyper-V, Server 2012, Troubleshooting, Uncategorized

Tagged with:

Disable WSUS on Managed Computers

The past 8 or more years most of us have managed PC updates using WSUS (Windows Server Update Service) and Group policy.  However, the structure of the modern office has changed to a large percentage of mobile employees who never ‘touch down’ at headquarters.   If these devices do not connect to the domain they do not have updates applied.

A client who has not returned to the office in 18 months, and likely will not for the life of their laptop, recently asked how they could update their machine manually.  Currently they were not able to do so as Windows Update showed “settings are managed by your system administrator”, in other words, by WSUS

image

It is quite simple to disable WSUS management in the registry, however remember if the device is reconnected to the domain, the WSUS policies will be reapplied.  Therefore you may want to move the device to an OU not linked to the WSUS policy or remove the device in the policy under security filtering.

Disclaimer:  Be aware making incorrect registry changes can have disastrous effects to the health of the device.  Be sure to backup the registry before editing.  To do so see the following Microsoft article; “How to back up and restore the registry in Windows”  http://support.microsoft.com/kb/322756 

  • Open the registry editor, by entering Regedit in the Start / Run box, and browse to:  HKLM\Software\Policies\Microsoft\Windows\
  • Locate the WindowsUpdate  Key and delete it
  • Reboot the PC (may take 2 reboots)
  • Now you can manually update and configure Windows updates to automatically check for and install updates directly from the Microsoft Update site

image

You may want to consider using a newer service such as Windows Intune to manage your computers, especially mobile devices.  http://www.microsoft.com/en-us/server-cloud/products/windows-intune/

Category:

Active Directory, Registry, SBS 2008, SBS 2011, Server 2012, Troubleshooting, Uncategorized, Windows 7, Windows 8

Tagged with:

Introduction to Microsoft Virtualization – Halifax event

For those following my blog in Atlantic Canada, you may be interested in an upcoming local event:

An Introduction to Microsoft Virtualization and the Private Cloud with System Center 2012 and Hyper-V

Event Details

Spend an evening with Mitch Garvis, Virtual Technology Evangelist with Microsoft Canada, getting to know the Microsoft server virtualization story.  Learn not only about Hyper-V, but also the management and Private Cloud scenarios that System Center 2012 SP1 brings to the table,  Learn how to build your cloud, and also how Microsoft sets itself apart from (and ahead of) the competition in the Virtualization world!

This informal event will consist almost entirely of discussions and demos, with only a smattering of PowerPoint and fluff.  The demos will be entirely unscripted, so you will get to ask what you want to see… and Mitch will do it!

The event is to be held Tuesday, June 11, 2013 from 5:30 PM to 9:00 PM, at the Nova Scotia Community College Institute of IT Campus, 5685 Leeds St., Halifax, NS

To register:  http://www.eventbrite.com/event/6998359281

Category:

Hyper-V, Server 2012, Training, Uncategorized

Locate default Computer or User OU

In troubleshooting an issue with the SBS user creation wizard, I wanted to know what was set as the default Organizational Unit in which users would be placed.   Though the following works with any server version which is domain functional level Server 2003 or newer, SBS defaults to placing users in the MyBusiness\Users\SBSUsers OU and I wanted to verify this was set appropriately.  There are 100 articles explaining how to change the default users OU using the command “Redirusr”, or “Redircmp” for computers, but it was difficult to find a link explaining how to locate the current defaults.  There are a few links explaining where the information is stored, which is in the “wellKnownObjects” attribute of the properties of the domain, in Active Directory Users and Computers.

image

However when you click on “View”, to inspect the settings for that attribute, you get a popup warning; “There is no editor to handle this attribute”, and the same happens when using ADSI Edit.

image

Thanks to a tip by Alex Verboon, using Microsoft’s (Sysinternal’s) Active  Directory Explorer will allow you to see the settings of this attribute.  Download AD Explorer, run the app, on a single domain server you can live all fields blank and click OK.

image

Click on your domain, then in the right hand window right click on wellKnownObjects”, and choose properties.

image

In the resulting window you can review the current settings for the default OU’s for Computers and Users

image

image

Category:

Active Directory, SBS, SBS 2003, SBS 2008, SBS 2011, Server 2012, Troubleshooting, Uncategorized

Tagged with:

Canadians – Win a Trip for Two to Mexico!

Microsoft Canada has created a great opportunity for free on-line training in Microsoft Private Cloud services, while at the same time entering your name for a chance to win a trip for two to Mexico.  Free evaluation software is available for System Centre 2012, Windows Server 2008 R2 SP1, and Windows Server 2012 RC, as well as 6 free Virtual Academy courses, and 14 guided labs to introduce you to the Microsoft Private Cloud.

Keep in mind contest regulations state; “Sweepstakes is open to individual legal residents of Canada “ so your odds of winning are far greater than with global sweepstakes.

Learn About The Microsoft Private Cloud to Win a Trip for Two to Mexico!

Mexico2Microsoft has released new and exciting products that will change the way IT Pros utilize Virtualization and Microsoft Private Cloud solutions.   Two products which are a part of these great changes are the newly released System Center 2012 and the soon to be released Windows Server 2012.  Both of these solutions were designed to make virtualization and extending to the private cloud simpler and much more efficient.

With these new changes to Infrastructure and the IT world, it’s a great time to learn about these new solutions and keep yourself and your organization ahead of the curve in terms of where technology is headed.  In fact, Microsoft has even added an incentive to learn about their Private Cloud solutions through the Skyrocket Sweepstakes!

Entering is easy!  All you have to do is register, and then download a free TechNet evaluation like Windows Server 2012 RC or System Center 2012 to get started.  Every applicable evaluation you download gives you an entry into the sweepstakes! And the best part is the more evaluations you download, the better your chances.  And what’s the prize you may ask? Oh, just a 7 day, 8 night trip for two to Cozumel, Mexico!

The contest ends September 6th so don’t wait!  Register now!

Category:

Hyper-V, Networking, Server 2012, Windows 8

Tagged with:

Tag Cloud