Category: How-to

2 Common Issues With Microsoft Terminal Services

Many WAN connections can vary in quality and latency, and often times these two characteristics will manifest themselves in disconnected terminal services sessions. By doing two relatively easy registry hacks, you can reduce these disconnects and improve the overall experience of your users.

 

Keep Alives:

In the registry at HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server, create or edit the DWORD value of KeepAliveEnable and set it to 1. This will turn Keep Alives on. This will serve to stabilize the connection by sending ‘heartbeat’ packets to the client every so often. This will cause an idle connection to be probed every so often just to be sure that the connection is still alive and that the client is still listening on the other side. This will also help prevent disconnects by preventing network devices from killing off sockets that it assumes to be idle.  By turning on Keep Alives, the connection will not appear idle, and therefore the network device will not attempt to terminate the socket.

Two other registry entries to look at are at HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveInterval and HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\KeepAliveTime.  KeepAliveInterval determines the interval separating keep alive retransmissions until a response is received. If a response is received, the delay until the next keep alive transmission is again controlled by the value of KeepAliveTime. KeepAliveTime controls how often TCP attempts to verify that an idle connection is still intact by sending a keep alive packet. If the remote system is still reachable and functioning, it will acknowledge the keep alive transmission.

 

TcpMaxDataRetransmissions:

In the registry at HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, create or edit the DWORD value of TcpMaxDataRetransmissions. By default it is set to 5, but I would recommend doubling that value, to 10.  The value of TcpMaxDataRetransmissions is the number of times TCP retransmits an unacknowledged data segment on an existing connection. TCP retransmits data segments until they are acknowledged or until this value expires.

 

Enjoy..

[Solved] -> Missing Previous Versions Tab on Windows Server 2003 Explorer Properties Box

So you think your missing the Previous Versions Tab when you open windows explorer, right mouse click and select properties on a Windows 2003 server. The reason for this is that Windows Server Explore only supports the Shadow Copy “Revert” feature when connecting to a local drive using Windows Explorer.   To get the “Previous Versions Tab” you should access the the drive as a UNC path in Windows Explorer. The   “Previous Versions Client” is not installed under that properties feature so it does not show up until you browse using a UNC path. See examples below.

Accessing VSS using Explorer and local drive path

 

When you use a UNC path in explorer it provides the Previous Versions client into the properties box for you to be able to mount and restore files as needed.

VSS access via UNC Path in Explorer

 

So access the files using \\servername\Share    or  \\servername\D$\folder  to see the “Previous Versions Tab“.

 

[Solved] – MS EXCHANGE 550 5.7.1 Client does not have permissions to send as this sender

 5.7.1 Client does not have permissions to send as this sender

This is what your Microsoft Exchange 2007 and or 2010 server may report when you try to send email through the Exchange server when permissions have been fouled up. The First this to check on is the “Manage Send As Permissions” under the user mailbox properties in the Exchange Management Console. Access the Exchange management console and select the user that is having the issue. Right Click, go to the send as permissions option.. now check that User NT AUTHORITY\SELF is listed.

Edit Send As Permissions
Exchange 2007

 

If it is not listed here then you need to add it in. This allows the authenticated user to send as their “Self”. Now retest your connection an try send a piece of mail.

 

 

Good Luck,

Cubert 😎

Quick and Easy Setup of Active Directory Authentication for VMware vSphere 5.1 SSO (Single Sign On)

VMware vSphere vCenter Server 5.1 now uses a new SSO (Single Sign On) service to authenticate with Microsoft Active Directory when deploying vCenter. If you do not install this services and configure it for AD then you will not be able to use your domain accounts with vCenter 5.1  During the initial install you may get errors when installing SSO.  KB 2034374 reports that a error of  ” Error 29155 Identity source discovery error”  is due to a failed attempt to automatically discover your Active Directory domain. Verify that the domain name and DNS are setup correctly.

Now lets setup an AD server in vCenter to allow our Domain Accounts. First we will login to vCenter Web Client (https://127.0.0.1:9443) if you used the default ports for the web client installs. The default login is admin@system-domain  and the password you set for SSO during the install process. Once you are logged in to the web client you can continue.

Now Select [Administration]

vCenter SSO-login

 

 

 

 

 

 

 

 

 

Now Select [Sign-On and Discovery] -> [Configuration]

SSO Configuration

 

 

 

 

 

 

 

 

Under the Identity Sources Tab in the right pane select the PLUS symbol to add a new AD source. This will pop up a “Add Identity Source” window, select the active directory radio button and fill out the requested information with you AD Domain name and the “OU” the holds your users and groups.

Here is the generic information you will need just replace the sesenviron.local with your domain and then place your AD credentials at the bottom.

Adding identity source

 

 

 

 

 

 

 

 

 

 

Now that we have a AD server assigned as a source we must now add this newly created connector to our “Default Domains ” list.

Add AD to Default Domains list

 

 

 

 

 

 

 

 

Now that we have it in our Default Domains list lets move it up to be our primary source. To do this highlight the AD domain name and select the blue arrow head pointing up and move the domain name to the top of the list .

Set priority of the domains

 

 

 

 

 

 

 

 

 

 

Now lets select the small floppy disk icon to save the changes to the default domain list box. Once this is complete we should be able to open up the vSphere client application and log in with domain access. You should be using a domain level admin to access vCenter.

 

I hope this helps some people out there.

Cubert 😎

 

 

 

How to Install Printers in Windows 7 WITHOUT Local Admin Rights

Microsoft made some changes to the network printing security in Windows 7 and as a result, many non-admin users are not able to install network printers with an Access Denied message.

I did some research on this today, and found a solution.  We just need to make a new GPO on the domain level for each client network that is experiencing this problem.  These are newer GPO extensions, so its best to create the GPO on a Windows Server 2008 R2 server.  Otherwise, you’ll need to find the ADM extensions and install them on the Server 2003 system.

 

 

  1. Configure Group Policy settings for “Point and Print” on BOTH computer and user settings (Vista previously only had user settings). The Location of the settings can be found here in GPOs:
    1. Computer Configuration\Policies\Administrative Templates\Printers\Point and Print Restrictions
    2. User Configuration\Policies\Administrative Templates\Control Panel\Printers\Point and Print Restrictions
  2. You will need to specify all print servers on the network and be sure to disable all security prompts.

 

 

 

 

Enjoy,

Cubert 😎

[Solved] -> Office 2010 strange behaviors regarding the Save and Send feature missing body of email

Blank e-mail bodies being sent from Outlook when Save and Send feature is used.

Are you having  strange problems where  on occasion a random contact in outlook will disappear from your contacts but you can still see that contact on your IPhone or when users create Word documents, then select “save and send,” “send via e-mail” then “send as attachment.”  They then write a short note in the body of the e-mail and send it but the e-mail comes through with the attachment but without the short note in the body.  If you change the message text to “Plain Text” instead of “HTML” then it works fine.

This issue might be caused by  update KB 2553248 for Outlook. There is a problem with the “Save & Send” feature with builds of Outlook (14.0.6117.5001 MSO 14.0.6112.5000) from the update 2553248.  This specific problem results in blank e-mail bodies being sent from Outlook, only when the “Save & Send” feature is used from another Office application.

Remove the update and see if it helps.

1.       Go to Start and then click Control Panel.

2.       Click on Programs and Features.

3.       On the left side menu, click on View installed updates.

4.       In the list of updates, locate and click update 2553248, and then click Uninstall.

 

Connectwise SQL Query -> Get resent invoiced customer contact list for Microsoft Partner Survey

Do we have any Connectwise Sql hackers out there that might need a SQL script to grab a list of all primary company contacts for all companies invoiced over the last 6 months so you can submit that to Microsoft Partner Portal for the survey Microsoft expects you to send out twice a year?  You know the one where you submit a excel spreadsheet of those customers and Microsoft send them a survey on your behalf.

Well here is a quick SQL Query that will produce that very list for you. Just export to a tab delimited text file.

 

SELECT [dbo].[v_Company_Contact].[Company_Name], [dbo].[v_Company_Contact].[First_Name], [dbo].[v_Company_Contact].[Last_Name], [dbo].[v_Contact_Communication_Type].[Description] AS Email,[dbo].[Contact_Communication].[Description] AS Phone
FROM [Your Database Name].[dbo].[v_Company_Contact]
JOIN [dbo].[v_Contact_Communication_Type] ON [dbo].[v_Contact_Communication_Type].[Contact_RecID] = [dbo].[v_Company_Contact].[Contact_RecID]
JOIN [dbo].[Contact_Communication] ON [dbo].[Contact_Communication].[Contact_RecID] = [dbo].[v_Company_Contact].[Contact_RecID]
WHERE Company_RecID IN (SELECT Company_RecID
FROM [Your Database Name].[dbo].[v_rpt_Invoices]
WHERE Date_Invoice between (‘01/01/2012‘) and (‘07/01/2012‘)
Group By Company_RecID)
and [dbo].[v_Company_Contact].[Default_Flag] = ‘1’
and [dbo].[v_Contact_Communication_Type].[Communication_Type_RecID] = ‘1’
and [dbo].[Contact_Communication].[Communication_Type_RecID] = ‘2’

 

Find the line in the query “WHERE Date_Invoice between (’01/01/2012′) and (’07/01/2012′)”  and change the dates for any range you want to include also change the name of the database to reflect your CW database. WordPress changes ( ‘ ) in to ( ` ) when you copy and paste SQL query so you may need to go through query and revert them back to ( ‘ ). See dates and any thing that has a “=” before it.

 

I hope my SQL Foo helps some one out there in Connectwise land

 

Cubert 😎

PFSense 2.0 – Limiting users Upload and Download Speeds by Limiting Bandwidth.

Manage your Bandwidth

PFSense is by far one of the best gateway solutions out there in my opinion.  I am going to show you one of the many reasons why I think this product is best of breed and that is the Bandwidth limiter. PFSense uses Free BSD as it base, it has included the DummyNet software project which allows you to  simulate/enforce queues and bandwidth limitations, delays, packet losses, and multipath effects, it also implements a variant of Weighted Fair Queueing called WF2Q+. Now that may sound like a lot of reading to get up to speed with but I assure you it is quite easy to set up and maintain, let me show you how.

 

First off I will take a bandwidth test  to see what I get as unregulated bandwidth. I have a cable service from Brighthouse that is 50Mb download and 5 Mb upload.

The image tells the tale, I am getting 50/5 as and result of my speed test using Brighthouse’s Speed test. Now let’s get started with our limiting, we will need to create a Upload and a Download limit we want to apply to each system on the LAN then create one Firewall rule to force the systems on the LAN to follow the limits.

 

Lets get started:

First we need to find our Limiter Web GUI area in PFSense.   This is located under the Firewall Tab -> Traffic Shaper, the 3rd tab is called Limiter.

Next we are going to select Create new limiter , Let’s call it LimitUPLan

  1. Click Enable
  2. Set name to LimitUpLan
  3. Set Bandwidth allowed  (1mb)
  4. Mask Source Address
  5. Give a description
  6. Save
Now lets create another Limiter, Let’s call it LimitDownLAN
  1. Click Enable
  2. Set name to LimitDownLan
  3. Set Bandwidth allowed (3Mb)
  4. Mask Source Addresses
  5. Add Description
  6. Save
Now we should have 2 Limiters available to us when we go to make the Firewall rule. We set in the limiters to mask the source address. This tells PFSense to create a unique queue for each Source address on the LAN side. If we left this set to none then we would have just 1 queue limited to 3Mb for all users on the LAN thus taking a 50Mb service and making it a 3Mb service. That is not what we want here, we want to limit each user to 3 MB each so no one person can abuse our 50 Mb service. We could have 10 users all streaming 3Mb each for a total of 30 Mb of download per second and giving us 20 Mb still available.
Now lets start limiting our LAN systems.
We need to make this rule above any allow rule that allows TCP and/or UDP. If we place it below an allow rule then that rule will take precedence over the rule we want to force our limits on. In this example I have placed rule on my LAN tab as rule #2 above the bottom rule which allows all my traffic out.
Let’s add a new rule:
  1. Action Pass
  2. Interface LAN
  3. Protocol Any
  4. Source LAN Subnet
  5. Destination Any
  6. Description
Now edit the advanced section:

Select the Advance button under the In/Out feature, from the drop down menus select the 2 queues you created (In = Uploads) and (Out = Download). Save and apply the firewall rule and re-test your bandwidth usage.

Bandwidth Now Limited

 

That’s the whole process from start to finish. At this point you should have a rate limit of 3mb per LAN user downstream and 1 MB per LAN user upstream.

 

That is part of the power built-in to PFSense and the BSD platform. Now go off and limit someone today!

 

Cubert  😎

 

 

[Solved] – Network Location in no longer available or Error 59 on Windows XP system

You may have gotten a pop up on Windows that says your network resource is no longer available after a password change or password expired notice and while using Network Neighborhood. During troubleshooting you find that others can access share, the server is pingable but you can not access any share on system and it feels like XP thinks the server is not there.

I have found that this was caused by Windows Credentials being stored in the system and that the credentials  were not correct.    This issue happens in both Windows 7 and XP.

In order to fix something like this you will need to go into the Windows Credential Manager and remove the stored password.

 

To do this:

 

Windows 7: Control Panel – Windows Credential Manager

Windows XP – User Accounts – Username – Stored Network Passwords (Top left link)

 

 

Once removed retry to access share, you should now see share respond and pop up a user password windows. Place in the correct credentials and you’re in.

 

 

I hope this helps someone out there..

 

Cubert  😎

Windows 2003 – Event ID 333 – An I/O operation initiated by the registry failed unrecoverable, The registry could not read in, write out, or flush, one of the files that contain the system’s image of the registry

Event ID 333 description is An I/O operation initiated by the Registry failed unrecoverable. The Registry could not read in, write out, or flush, one of the files that contain the system’s image of the Registry.

 This means that the image of the registry held in memory could not be written to disk. Windows uses what is called the lazy writer to periodically write modified pages of memory to disk. When the lazy writer fails, an event ID 333 is recorded in the System event log.

The symptoms that might accompany the event ID 333 error include:

  • Server hangs: Your server may completely stop responding to keyboard or mouse movements and appears completely locked up, requiring a hard reboot.
  • Server sluggishness: The server is extremely slow to respond at the console, and processing information is significantly delayed.
  • Delayed Terminal Services connections: Users trying to log on to a terminal server could experience slow or delayed logons. Once they log on, they may be able to work without a slow experience; however, the logon takes several minutes instead of a few seconds.

Generally, event ID 333 can be classified into one of three categories:

  • Memory resource depletion: At the time the lazy writer attempted to write the modified pages in cache to disk, there weren’t enough resources to complete the operation. Often this type of problem is accompanied by either an event ID 2020 or 2019.
  • Disk was too busy or inaccessible: Sometimes a busy disk might not respond quickly enough to handle the lazy writer’s request to commit modified pages of memory to disk.
  • Registry bloat: The registry suddenly grows in size, which makes it increasingly difficult for the lazy writer to commit the changes to disk, commonly occurring on terminal servers.

Especially frustrating is how the events continue to flood the System event log (many times per minute) until the server is rebooted. All it takes is one time for the lazy writer to fail for the event flooding to begin. Although the condition that caused the lazy writer to fail might have been brief (such as a short spike in memory usage), event ID 333 continues to be logged even during normal memory utilization. The event is still logged because the system recognizes that a failure to sync the registry has occurred and the registry version contained in memory is out of sync with the version on disk. As a result, the number and frequency of event ID 333 messages isn’t a good indicator of the problem’s severity. By default the lazy writer tries to flush to disk every five seconds.

Event ID 333 Troubleshooting
When troubleshooting event ID 333 errors, first you must determine which general category the error falls into. It’s useful to check the System event log for other event IDs that accompany the 333 error, such as event ID 2020, which indicates a lack of paged pool memory, or event ID 2019, which indicates a leak in nonpaged pool memory.

Use these tools to assist in further diagnosing event ID 333 messages:

  • Performance Monitor: The counters to track are the system, memory, disk, and process objects.
    • Memory object: Look for a rise in nonpaged or paged memory.
    • Process object: Look for continuous rises in a process’s handles just prior to the event ID 333’s being logged.
    • System object: The %Registry Quota In Use counter can be useful in displaying how much of the allowed registry quota is being utilized. The higher the percentage, the more likely that the problem is related to a growing registry.
    • Physical disk: Look for increases in the Avg Disk Queue Length counter, which tracks the average number of read and write requests to the selected disk. If this counter spikes during the problem, start investigating the filter drivers (i.e., antivirus or backup software) on your system.
  • Poolmon.exe: This tool, which is included in the Windows Debugging Tools, is used to track kernel pool memory usage by pool-allocation tag name. Using poolmon.exe can halve your troubleshooting time by enabling you to find the tag that’s leaking memory.
  • Dureg.exe: This tool lets you view the size of the entire registry per hive. Dureg.exe is great for finding which registry hive is consuming the most space, which helps to determine what software might be causing the problem.