Microsoft Archives - Page 8 of 10

[Solved] NTFRS – Journal Wrap Errors detected on Domain Controller

File Replication Service has detected that the replica set “DOMAIN SYSTEM VOLUME (SYSVOL SHARE)” is in JRNL_WRAP_ERROR

Are you getting this error in your File Replication Service?

The File Replication Service has detected that the replica set “DOMAIN SYSTEM VOLUME (SYSVOL SHARE)” is in JRNL_WRAP_ERROR.
Replica set name is : “DOMAIN SYSTEM VOLUME (SYSVOL SHARE)”
Replica root path is : “c:\windows\sysvol\domain”
Replica root volume is : \\.\C:
A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found. This can occur because of one of the following reasons.
[1] Volume “\\.\C:” has been formatted.
[2] The NTFS USN journal on volume “\\.\C:” has been deleted.
[3] The NTFS USN journal on volume “\\.\C:” has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
[4] File Replication Service was not running on this computer for a long time.
[5] File Replication Service could not keep up with the rate of Disk IO activity on \\.\C:.
Setting the “Enable Journal Wrap Automatic Restore” registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.

This is caused when the Sysvol gets currupted and is simple to fix. I will walk you through the steps.

First off before we do anything lets backup by taking a Shadow Copy of the C: Drive. To do this we will open MyComputer and select the C:Drive, right click it and select properties. Now find the ShadowCopy Tab, highlight the C: Drive and click the “Create Now” button to create a backup point on the drive. You do not need to “Enable” ShadowCopy to take a 1 time snapshot.

Now that we have a backup point to go to if all hell breaks loose we can safely move on to the next step. Open up REGEDIT and navigate to the RegKey -> System\CurrentControlSet\Services\NtFrs\Parameters and create a new REG_DWORD key called Enable Journal Wrap Automatic Restore and place a 1 as the hex value.

Now launch a Command window(DOS) and run the following commands:

NET STOP NTFRS

NET START NTFRS

This will then cause the following to appear in your File Replication Service Event Log:

The File Replication Service is deleting this computer from the replica set “DOMAIN SYSTEM VOLUME (SYSVOL SHARE)” as an attempt to recover from the error state,
Error status = FrsErrorSuccess
At the next poll, which will occur in 5 minutes, this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.

This will be followed by the following Event Log:

File Replication Service is scanning the data in the system volume. Computer MyDomainServer cannot become a domain controller until this process is complete. The system volume will then be shared as SYSVOL.

This will be followed by the following Event Log:

The File Replication Service moved the preexisting files in c:\windows\sysvol\domain to c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog.

Now we need to wait a bit and allow the replication to complete. This has taken anywhere from 5 minutes to 20 minutes for me based on server and what is being replicated. You will know it is complete when you get the Event Log:

The File Replication Service is no longer preventing the computer MyDomainController from becoming a domain controller. The system volume has been successfully initialized and the Netlogon service has been notified that the system volume is now ready to be shared as SYSVOL.

Once you get this log your replication is complete and the Journal Wrap issues are fixed. We now need to go back to REGEDIT and change the entry we placed in there from a 1 to a 0.

You are all done.

May this help someone out there..

Cubert

XYMON -> New BBWin Client GUI 1.1 Released.

Are you looking for a BBWin Client GUI to configure BBWin.cfg?

Can I see by raise of hand how many of you out there wishes for a good BBWin GUI so you don’t have to edit a that bloody XML file. I am having to flip between Wordpad, Task Manager and the Services console to place in the services and processes I want to monitor on my Windows hosts and that was such a pain.

So out comes BBWin-GUI!

Download file –> BBWin-GUI-1.1

BBWin is an open source client for Windows working with BigBrother or Xymon(Hobbit) monitoring software. We also have a custom VM appliance with XYmon and Cacti pre installed and ready to go. See MAG Server here on Squidworks for more information.

Our new BBWin GUI will read in your current BBWin.cfg file and then allow you to edit it. It provides all the services and processes running on your system and pulls all the unique event logs so you may choose what to accept and what to ignore. Inside the new BBWin-GUI you will find your local disks and the ability to exclude disks as well as set the thresholds for warnings and panics. Checkout some of the screen shots below. Download and try BBWin GUI.

As always I hope this little app helps someone out there.

Enjoy

Cubert

How-to : Pass a username and password to Windows shutdown.exe command.

Here was my scenario I found myself in not to long ago. I have an Active Directory domain with a server outside of the domain in it’s own workgroup. It used different credentials for the administrator account then what the domain uses. One day it stopped responding to RDP and several control programs we have on it so we needed to do a reboot.

No problems right? just type in the command below:

shutdown /r /t 3 /m \\ServerName

Not so right, right off the bat we get ServerName: Access is denied.(5)

That’s right we do not have permissions “Yet”… But how do we send permissions to shutdown.exe ? If you do a shutdown /? you will find no switches for username and password but there is a way around this.

We will connect to the servers IPC$ and authenticate then we will run our command. Here is what you do:

First lets make a connection and authenticate by running the following cmd:

NET USE \\MyServer\IPC$ mypassword /USER:myuser

If successful then we are now ready to run the shutdown cmd in the same window:

shutdown /r /t 3 /m \\ServerName

Wait a few seconds and and you should get back your prompt which tells you the command was sent successfully. You now have authenticated and sent the shutdown cmd to a remote server using different permissions.

I hope this helps someone out there

Enjoy

Cubert

How-to: Setup Ubuntu and PHP to use MSSQL Microsoft SQL Server

It is easier to get PHP on Ubuntu to connect to MSSQL than it is to get PHP on Windows.

I would not normally believe such a thing until I tried to setup a pre-existing install of PHP on Windows missing any MSSQL extensions. Looking through Google to find information was less than quick and I found myself wanting to go back to my old faithful Ubuntu server, but how?

Here are my 10 quick steps to get PHP seeing MSSQL:

There are some basic software we will need to grab using apt-get, then we will install them and modify the php.ini file to update the new extension. I will go over the process below on how to install and in what order but before we do that I will give you a brief description of what we are doing.

We will need to get the source for PHP, we will also need the PHP Development packages. We will be installing FreeTDS and then editing our php.ini file. Lastly restarting Apache to complete the process.

For the rest of this we will assume you have ( sudo su -) so you do not need to sudo each cmd, but if not then add sudo where it applies. We are also assuming you already have a working php system and only need to add MSSQL functionality.

apt-get source php5 – This will install the PHP source in the the current directory that you are in.
cd php5-5.3.2/ext/mssql – This will place you in the PHP source directory for MSSQL. You may need to edit the directory path as 5.3.2 was the version as of this document and may not be the same version you are installing.
apt-get install freetds-dev – This installs the extra libraries we will need for MSSQL
apt-get install php5-dev – This installs the application (phpize) which we will use next to help build the MSSQL extension.
phpize – Run this while inside the (/ext/mssql ) directory
./configure –with-mssql – This creates the MakeFile we will need to build the extension from source.
make – This cmd builds the extension.
cd modules – move in to the module directory.
cp mssql.so /usr/lib/php5/20090626 – Here you will need to pay close attention to the last directory here. This will very based on your version so change the numbers to fit what you have in your (/usr/lib/php5) directory.
vi /etc/php5/apache2/php.ini – We want to go down to where you will find (Dynamic Extensions) and add on a new line the following -> extension = mssql.so then save and close the vi session ( Esc : wq)

You are all done, just restart Apache and test your mssql_connect

Restart Apache:

/etc/init.d/apache2 restart

Enjoy

Cubert

W32Time Error : No valid response has been received from manually configured peer time.windows.com

Time, I don’t need no stinking time!!

You won’t here Windows saying that, Microsoft relies on time for Active Directory to work correctly so if you start to drift you will see access errors. Have you seen the following eventlog in your system logs resently?

The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 60 minutes. NtpClient has no source of accurate time.

Or maybe this one?

Time Provider NtpClient: No valid response has been received from manually configured peer time.windows.com after 8 attempts to contact it. This peer will be discarded as a time source and NtpClient will attempt to discover a new peer with this DNS name.

This is a sure sign that your having issues getting and setting time correctly. By default the setting for w32tm is to get it’s time from time.windows.com. There are many people out there having trouble getting time from that source since the DST change. So how do you fix it? You can use the w32tm /config options to change the time server you are using. This will then allow Windows to get time from a more reliable source.

In a DOS shell run the following lines.

w32tm /config /manualpeerlist:pool.ntp.org,0x8 /syncfromflags:MANUAL
net stop w32time
net start w32time
w32tm /resync

This will set the new time server as pool.ntp.org and then force a resync of the time across the domain.

Enjoy

Cubert

Increasing MS Exchange 2010 message size limits

There’s a few places you must go to change this and that is in global settings under Organization Configurations as well as the HUB Transport connectors under Server Configuration.

To modify the global settings go to the following menu areas inside you Exchange Management Console.

Organization Configuration->Hub Transport->Global Settings tab->Properties of Transport Settings

Here you can adjust your transport send/receive limits by editing the properties.

Then you must modify the connectors found inside the Send Connectors tab

Organization Configuration->Hub Transport->Send Connectors tab->Properties of Default Send

Then you can adjust your send connectors default maximum message size under Server Configuration

Receive Connector Server Configuration->Hub Transport->Receive Connectors Pane->Properties of Default

Here you can adjust your receive connectors default maximum message sizes. After the settings have been changed you will want to either restart your server or reload all exchange services (which ever is easier for you).

Event 10009 (Error) DCOM was unable to communicate with the computer computer name using any of the configured protocols.

If DNS resolves a users system and that system is no longer at that IP then you may see a Event ID 10009 in the systems event logs. Check DNS for duplicate entries first… If you have the same computer name in DNS twice with 1 IP being correct and IP not, remove the wrong IP address.

This was a recurring error regarding a particular laptop on our network. This computer had not actually been on the network in months, but the error was showing up every thirty minutes in ten-error bursts.

What I eventually realized was that a laptop was not on the network but a Iphone had taken the IP address that was last associated with the laptop. However, nothing in DHCP showed anything out of order.

Finally I took a look in DNS, and sure enough there was an entry for that laptop associated with the IP address of the Iphone.

Seemingly, DCOM saw something at that IP address and was trying to communicate with it as if it were the laptop. Once I had deleted the laptop from the DNS the error was no longer appearing.

If you are seeing DCOM related to a computer that is NOT currently on the network, this might offer a fix.

I hope this helps someone out there

Cubert

Synchronization with your iPhone failed for 1 items Entourage & Outlook 2011 & Exchange

Synchronization with your iPhone failed for 1 items.
The following items couldn’t be sent to your mobile phone. They haven’t been deleted. You should be able to access them using either Outlook or Outlook Web App.

        Item Folder:       Inbox
      Item Type:       IPM.Schedule.Meeting.Resp.Pos
      Item Created:       1/11/2010 2:34:18 p.m.
      Item Subject:       Accepted: MyMeetingTest

This problem may occurs when the Accepted: or Declined: email that come back from booking a meeting with a resource or person is opened from Entourage before it was opened with the Iphone. It is related to the unread/read mark placed on the email.

If you leave the Accepted/Declined messages unread you do not get the “Synchronization with your mobile failed for 1 items” but once you have read the message you start getting the errors. What really is happening (or not happening for that matter) is that the message remains unread on the mobile device. So for some reason Exchange is not transferring the read/unread mark to the mobile device as expected.

If you then look at the message on the device it says “This message cannot be displayed because of the way it is formatted. Ask the sender to send it again using a different format or email program. text/plain”

Now if you open the Accepted/Declined message on the device before it has been read on the Entourage client it then reads fine “Your request was accepted” and no errors show up.

It appears to be an problem with Microsoft clients (Entourage & Outlook 2011 and Exchange 2010 and some reports on 2007) .

We have been waiting for Microsoft to release a fix for this issue to which the just did on May 25, 2011 with the release of Update Rollup 3 for Exchange Server 2010 Service Pack 1.

http://support.microsoft.com/kb/2529939

Recursive Access Control Lists with Max Depth

Here is a Visual Basics script I put together which will list all of the Access Control Lists (ACL’s) for all folders in a particular directory.

It allows you to specify a start point and a max depth to recurse.

I needed this so that I could generate a report listing the ACLS’s for various shares. It uses the CACLS executable and as long as you have access to the shares it should run without issue. (However, as with anything Microsoft, I make no guarantees that it will function properly on your system). I tried to account for various idiosyncrasies’ in the way windows operates but if you find a bug, let us know and we will try to correct it.

Download -> ACL List script

How-to Allow End Users To Manage Exchange 2010 (SP1) Distribution Groups

Distribution Groups in Exchange 2010 are managed from the OWA or what it’s now know as Outlook Web App. Owners of a distribution list can manage there own distribution list if you have correctly set the feature RBAC (Role Based Access Control)in Exchange 2010. As you can guess Microsoft Exchange Server 2010 now comes with the new RBAC (Role Based Access Control) permissions model. This new permissions model allows you to define both a broad, as well as a more granular assignment of permissions.

While you can perform granular assignments in Exchange 2010, there are also Predefined Role Groups that you can use if you want an easier way of assigning permissions to end users. Below I will walk you through a very quick and easy way to provide end users the ability to modify distribution groups.

First we will need to create a new custom role based on the default ‘MyDistributionGroups’ Role. To do this we will use the Exchange Management Shell in Exchange 2010 aka Powershell with Exchange Modules.

Open up the Exchange Shell and copy and paste the following:

New-ManagementRole -Name MyUsersDistributionGroups -Parent MyDistributionGroups –Description “This role enables individual users to view distribution groups and add or remove members to distribution groups they own.”

The above cmd made a new role based on MyDistributionGroups, we need to make change to this new role because we don’t want all the same settings as MyDistributionGroups.

Next we need to modify the new role.

Remove-ManagementRoleEntry MyUsersDistributionGroups\Set-Group -Confirm:$false
Remove-ManagementRoleEntry MyUsersDistributionGroups\Remove-DistributionGroup -Confirm:$false
Remove-ManagementRoleEntry MyUsersDistributionGroups\New-DistributionGroup -Confirm:$false

Then we set the DistributionGroup parameters:

set-ManagementRoleEntry MyUsersDistributionGroups\Set-DistributionGroup -parameter Confirm ,ErrorAction ,ErrorVariable ,Identity ,MailTip ,MailTipTranslations , OutBuffer ,OutVariable ,WarningAction ,WarningVariable ,WhatIf

Then finally we need to apply this role to our users. For all people to get these setting you must add the new role to the existing “Default Role Assignment Policy” which is applied to every one.

New-ManagementRoleAssignment -Role MyUsersDistributionGroups -Policy “Default Role Assignment Policy”

Once that’s done you must add the user who will manage group to the distribution list so the user can modify the members of the Distribution Group. This is done inside the Exchange Management Console under recipients / Distribution Groups. Find the Group you want to allow the user to manage and place them in the “Managed By” box under the Group Information Tab.

That’s It!!! Now we let the user login to the Outlook Web App and make modifications to the distribution groups the now own. To make edits they should login and select the options menu then select all options. It will display a menu that will provide access to Groups. Select groups and you should see 2 lists, The 1st list is all groups your a member of and the 2nd list is all groups you own or manage. Double click the group name to manage that group and its memberships.

I hope this helps someone else get group management working after a upgrade from Exchange 2007, and in less time than it took me.

Enjoy

Cubert