Tag: Windows

[Solved] – Problem loading a certificate to be used for STARTTLS Purpose in Microsoft Exchange 2007

 

Generally this condition occurs if anyone of the following conditions is true:

1. The fully qualified domain name (FQDN) that is specified in the Warning event has been defined on a Receive connector .

2. Send connector on a Microsoft Exchange Server 2007 transport server, and no certificate is installed on the same computer that contains the FQDN in the Subject or Subject Alternative Name fields.

 3. A third-party or custom certificate has been installed on the server and it contains a matching FQDN. However, the certificate is not enabled for the SMTP service.

The warning event indicates that there is a problem loading a certificate to be used for STARTTLS purposes,  here is how to resolve these issues.

1. Open “Exchange Management Shell”.
 
2. Write “get-ExchangeCertificate” and press on “Enter” button.
 
3. Write down the Thumbprint of the certificate that reflect the required FQDN name of the server.
 
4. Review the current certificate that use by the Exchange server and
 
         each certificate function.
 
5. Write “Enable-ExchangeCertificate -Thumbprint ThisIsYourThumbPrintKey -Services “SMTP”
 
       and press on ‘Enter” button. Replace “ThisIsYourThumb…” with the value of -Thumbprint obtained in stage 3.
 
6. Restart the Exchange server.

Now your cooking with SSL Security!!.

Enjoy

Cubert  😎

 

For Creating a Certificate or Certificate Request for TLS check the below article
 
http://technet.microsoft.com/en-us/library/aa998840.aspx

How to display hidden device drivers in Windows Device Manager

Ever wanted to find that other ethernet device that was pulled from you system but don’t see it anymore in Microsoft  Windows Device Manager? What about a pesky AOL adapter driver or some other non existant device that you want to get rid of?

In order to show hidden devices:

 

  1. Right click My Computer and Select Properties
  2. Click Advanced tab
  3. Click Environment Variables
  4. Below the bottom Environment Variables window pane (System Variables), click New
  5. For Variable Name, enter devmgr_show_nonpresent_devices
  6. For Variable Value enter 1
  7. Click OK. OK to close My Computer
  8. Open Device Manager, click on View, select show hidden devices from the menu. Most of the orphans will be in non-plug and play drivers and the icons will appear grayed out. You can right click the grayed out driver and click uninstall.

 

Enjoy

Cubert  😎

 

[Solved] DefaultThrottlingPolicy has gone over budget ‘xxx’ times for component ‘RCA’ within a one minute period – Event log

 In Exchange Server 2010 SP1, client throttling policies are used to manage the performance of the Exchange organization.  All client throttling policies are enabled by default i in Exchange Server 2010 SP1. The throttling policy has group settings that control the amount of resources that a user or a connection can use.

Throttling Policy settings are only applicable for Exchange Server 2010 SP1 and later. If the application event log on the Exchange or SBS2011 servers displays an error message similar to the following example, then the throttling policy settings are applicable to your system:

Process Microsoft.Exchange.RpcClientAccess.Service.exe (PID=XXXX). User ‘Sid~ServiceAccount~RCA~false’ has gone over budget ‘XXX’ times for component ‘RCA’ within a one minute period. Info: Policy:DefaultThrottlingPolicy_abcdefghijklmnopqrstuvwxyz, Parts:ABC:XXX;’. Threshold value: ‘110’

 

If you are experiencing slow Exchange email ingestion that may be caused by these policies, you can modify client throttling policy for an archive service account.

Complete the following steps:

  1. Create the throttling policy: on a computer that hosts the Microsoft Exchange Management Shell, open the Microsoft Exchange Management Shell. Enter the following:

    New-ThrottlingPolicy My_New_Policy

  2. Configure the throttling policy by entering the following:

    Set-ThrottlingPolicy My_New_Policy -RCAMaxConcurrency 150

  3. Apply the throttling policy to archive service account by entering the following:

    Set-Mailbox “MyUserName” -ThrottlingPolicy My_New_Policy

The My_New_Policy can be any name you want to call policy, The My_UserName is the mail box name of the person or account you want to add to the new  ploicy.

 

 

[Kaseya Script] Modify/Disable TCP Global Parameters on Windows systems

Need another Kaseya agent procedure? Here is one I use alot.

This article describes the TCP Chimney Offload, Receive Side Scaling (RSS), and Network Direct Memory Access (NetDMA) and other features that are available for the TCP/IP protocol inside of Windows. I have spent probably hundreds of hours on cases involving TCP Offloading and I know most of the signs (intermittent dropped connections, missing traffic in network traces, RDP blank windows, etc…).

I created a Kaseya script that goes and disables many of these NIC features Windows puts in their OS that causes so much havoc at times. 

Download Script here -> Procedure_Network_feature_shutdown

It is pretty basic, it sets several registery values and runs several shell CMDs using netsh to disable these protocols.

I hope this helps some of you out there.

Cubert.

[Kaseya Scripts] Repair VSS Writers on Windows Servers Agent Procedure

Are you having VSS issues?  Need a script to launch when either errors are reported or as a point and shoot script to repair VSS writer issues? Well Cubert has created a new VSS script that is fairly simple in nature but gets the job done nicely. This Kasey Agent Procedure was written for Kaseya 6+ RMM and has 2 parts.

Part 1: Is the VSS-RESET.bat  batch file that does the actual work by shutting down the services and re-registering the dlls used by the different VSS Writers. Afterwards it outputs a  file to the temp directory with a printout of the VSS writer list cmd.

Part 2: Is the Kaseya Agent procedure that copies the batch file to the system and executes it. It then waits a few minutes for everything to complete and then grabs the report file generated by the batch file and places it on the “GetFile” tab under your [Agent data] menu item inside of LiveConnect.

You can review the report file to see if you are still generating errors after the repairs are preformed.

Download Agent Procedure here -> VSS-RESET

I hope this helps someone out there is Kaseya land!

Cubert.

[VB Script] Automate the copy of folders across the network to a local removable drive in Windows.

So you need a quick method to grabing folders from a UNC path and place a copy of them on a removable drive.  I had a customer who wanted to do the old USB drive swap for off site backup storage. I tried to explain that now with the advent of the cloud we could move the files off site without any user intervention but they really wanted to do it manually.

So here is a Automated script to help with a manual process.

Download Script Here

Here is the basic beak down of the script.

In the first part of the script we set the email server to relay mail to, our domain name and the email addresses we want to send reports to.

‘ Company Internet Domain Name
ODomain = “mydoamin.com”
‘ Set the SMTP server IP
oMyIP = “192.168.1.5”
‘ Where do you want the message to be delivered
oTo = “myemail@mydomain.com;another@email.com“

This next part sets up the local directory we will be copying to, The script during execution will delete all things off the drive and then rebuilds the directory structure you want so we have to tell it the directory we want added back after the delete.

‘### Check folders exist and prep for copy

Dim oName, ODomain, oMyIP, oTo, newfolder, newfolderpath
Set FSO =CreateObject(“scripting.FileSystemObject”)

‘###Change my folder path  ######################
If FSO.FolderExists(“F:\Backup\”) Then 
   FSO.DeleteFolder “F:\Backup”
   wscript.sleep 90000
End If

‘##### Change My folder path#########
newfolderpath = “F:\Backup”
If Not FSO.FolderExists(newfolderpath) Then
   Set newfolder = FSO.CreateFolder(newfolderpath)
   wscript.sleep 5000
End If

 

Now we need to start the actual copy and get some files on our removable disk. You will need to edit the “newfolderpath” so it reflects where you want the files copied to. You will need to edit the FSO.CopyFilder so that it resembles your UNC path. You can copy the em=ntire code block and repeat over and over again for multiple UNC paths or folders.

‘###Grab files and place them in new folder (We must create that new folder now)

‘###  Change my new folder path ###################
newfolderpath = “F:\Backup\MyNewfOLDER”

If Not FSO.FolderExists(newfolderpath) Then
   Set newfolder = FSO.CreateFolder(newfolderpath)
End If

FSO.CopyFolder “\\MyIP Address\MyShare\MyFolder”, “F:\Backup\mYNewFolder” ,True
wscript.sleep 5000

‘### You can copy the top several lines starting with the new folder creation and repeat as many times as needed. This will allow for mulitple locations and folder

Next we write an event log in windows reporting that we completed the copies.

Set WshShell = WScript.CreateObject(“WScript.Shell”)
strCommand = “eventcreate /T Warning /ID 99999 /L SYSTEM /D ” & _
    Chr(34) & “The Script has completed the scheduled backup copy to the offsite drive (F:)” & Chr(34)
WshShell.Run strcommand

Then we send off a email to the users we set in the above script area.

‘ Get the computer name
Set WshNetwork = CreateObject(“WScript.Network”)
oName = WshNetwork.ComputerName
‘ Set the visual basic constants as they do not exist within VBScript.
‘ Do not set your smtp server information here.
Const cdoSendUsingMethod = “http://schemas.microsoft.com/cdo/configuration/sendusing“, _
cdoSendUsingPort = 2, _
cdoSMTPServer = “http://schemas.microsoft.com/cdo/configuration/smtpserver”

‘ Create the CDO connections.
Dim iMsg, iConf, Flds
Set iMsg = CreateObject(“CDO.Message”)
Set iConf = CreateObject(“CDO.Configuration”)
Set Flds = iConf.Fields

‘ SMTP server configuration.
With Flds
.Item(cdoSendUsingMethod) = cdoSendUsingPort

‘ Set the SMTP server address here.
.Item(cdoSMTPServer) = oMyIP
.Update
End With

‘ Set the message properties.
With iMsg
Set .Configuration = iConf
.To = oTo
.From = oName & “@” & oDomain
.Subject = “Backup Copy to Offsite Drive Started”
.TextBody = “The NTVI Server Backup copying is now taking place. The drive should be ready to remove offsite.”
End With

‘ An attachment can be included.
‘iMsg.AddAttachment Attachment

‘Send the message.
iMsg.Send

Thats it, You can download a zipped copy of the entire script using the above link.

I hope this helps you, Enjoy..

Cubert

[Kaseya Agent Procedure] – Run CHKDSK And Repair If Needed.

Free Kaseya Script – Run CHKDSK And Repair

Here is another free script from Cubert’s Dwelling, An Agent procedure that will run a CHKDSK in read only mode. Parse the output and run a chkdsk /F if it meets the criteria set forth in the script. It then emails an alert with the scan results to a email address provided before it uploads a copy of the scan to the get file for storage and review. Finally it updates 2 custom fields in the system info table with a brief result and the last run time. If it finds the disk healthy it will report as such if not it will report one of several error types.

Download Script Here

You will need to unzip the script and import it into Kaseya. Once imported edit the script and find the 2 places it email out and update the email address(es), Then you will need to add the 2 custom fields into your System-info table.

To add the custom fields:
1#  Open Kaseya and go to [Audit] – [View Individual Data] – [System Information] and select the button marked [New Custom Field]

2# The next box that pops up will create a new field, We will need to add 2 fields the first is CheckDisk Status and it will be a type String and Check Disk Updated with a type String.

Now run your disk check and see what it shows. If it meets with the right disk errors, a  repair is sent to the system and a email to you to reboot system when you can so the repair can complete. You can add another execute command under where we call the chkdsk /F with a shutdown -r -t 3 and that will cause the system to reboot its self after issuing the fix cmd. This is great for servers where your scheduling the disk scans during maintenance cycles but not so good with workstations where user gets booted up then a scan runs that then reboots the system will only inflame your users. So be mindful of how you use a shutdown cmd.

Enjoy

Cubert 🙂

How-to Create a SMTP Relay Connector for Microsoft Exchange Server 2010 using PowerShell

Create new connector and assign relay permissions.

Pretty simple really,

Open your exchange power shell and enter the following cmds to create and set permissions on your new connector. Use the New-ReceiveConnectorcmdlet to create the Receive connector Anonymous Relay that listens on local IP addresses.

New-ReceiveConnector -Name “Anonymous Relay” -Usage Custom -PermissionGroups AnonymousUsers -Bindings 192.168.1.5:25 -RemoteIpRanges 192.168.1.1-192.168.1.255

 

Now we must use the Exchange Shell to grant relay permission to anonymous connections on the new Receive connector.  The next cmd-let retrieves the specified Receive connector information and pipes the result to the Add-ADPermissioncmdlet to grant relay permission to anonymous connections on the new Receive connector.

Get-ReceiveConnector “Anonymous Relay” | Add-ADPermission -User “NT AUTHORITY\ANONYMOUS LOGON” -ExtendedRights “Ms-Exch-SMTP-Accept-Any-Recipient”

You can open up a telnet session to the IP of your exchange server and test the mail flow. This will confirm that your relay is up and running.

 

The first thing to do is to open a connection from your computer to your mail server.
telnet 192.168.1.5 25
You should receive a reply like:
Trying ???.???.???.???…
Connected to 192.168.1.5
Escape character is ‘^]’.
220 mail.domain.ext Microsoft Exchange Server XXX.YYY.xxx.yyy

You will then need to delcare where you are sending the email from:
HELO local.domain.name – dont worry too much about your local domain name.

This should give you:
250 192.168.1.5 Hello local.domain.name [Your IP address],

Now give your email address:
MAIL FROM:< mail@domain.com >

Should yeild:
250 2.1.0 mail@domain.com... Sender ok

Now give the recipients address:
RCPT TO:< mail@otherdomain.com >

Should yeild:
250 2.1.0 mail@otherdomain.com... Recipient ok

To start composing the message issue the command DATA

If you want a subject for your email type

Subject: type your subject here
You may now proceed to type the body of your message.

To tell the mail server that you have completed the message enter a single “.” on a line on it’s own.
The mail server should reply with: 250 2.0.0 ???????? Message accepted for delivery

You can close the connection by issuing the QUIT command.
The mailserver should reply with something like:

221 2.0.0 mail.domain.com closing connection Connection closed by foreign host.

Enjoy,

Cubert

[Solved]-Remote Web Workplace will not connect to my computer.

You have a user that has a  Home  (Windows 7 Home) or Work (Windows 7 Pro) Computer

When using remote web workplace they selects connect to my computer, picks their computer from the list and then it never makes it past this point. There is a error icon displayed in the lower progress bar area of the browser.

Running IE as a administrator they are able to use RWW just fine.

The user is an administrator on the computer. IE9 has been removed and replaced with IE8 same results.

Windows firewall is off,  We have tried with the firewall on and off, makes no difference.  We have added RWW site to the trusted site and relaxed all the active security settings for the trusted site, same result. The browser add-ons show the Microsoft rdp active control is installed when in IE both as an admin and just launching it normally so what could be hanging us up?

Well you will find that your UAC is on and one of the results of this being active is that Active X functions are suppressed. Just turn off UAC and the problem will go away.

Go to your start button and in the search window type “UAC”. It will launch the UAC Control and allow you to change the settings

Enjoy

Cubert.

[Solved] NTFRS – Journal Wrap Errors detected on Domain Controller

File Replication Service has detected that the replica set “DOMAIN SYSTEM VOLUME (SYSVOL SHARE)” is in JRNL_WRAP_ERROR

Are you getting this error in your File Replication Service?

The File Replication Service has detected that the replica set “DOMAIN SYSTEM VOLUME (SYSVOL SHARE)” is in JRNL_WRAP_ERROR.
Replica set name is : “DOMAIN SYSTEM VOLUME (SYSVOL SHARE)”
Replica root path is : “c:\windows\sysvol\domain”
Replica root volume is : \\.\C:
A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found. This can occur because of one of the following reasons.
[1] Volume “\\.\C:” has been formatted.
[2] The NTFS USN journal on volume “\\.\C:” has been deleted.
[3] The NTFS USN journal on volume “\\.\C:” has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
[4] File Replication Service was not running on this computer for a long time.
[5] File Replication Service could not keep up with the rate of Disk IO activity on \\.\C:.
Setting the “Enable Journal Wrap Automatic Restore” registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.

This is caused when the Sysvol gets currupted and is simple to fix. I will walk you through the steps.

First off before we do anything lets backup by taking a Shadow Copy of the C: Drive. To do this we will open MyComputer and select the C:Drive, right click it and select properties. Now find the ShadowCopy Tab, highlight the C: Drive and click the “Create Now” button to create a backup point on the drive. You do not need to “Enable” ShadowCopy to take a 1 time snapshot.

Now that we have a backup point to go to if all hell breaks loose we can safely move on to the next step. Open up  REGEDIT and navigate to the RegKey -> System\CurrentControlSet\Services\NtFrs\Parameters and create a new REG_DWORD key called Enable Journal Wrap Automatic Restore and place a 1 as the hex value.

Now launch a Command window(DOS) and run the following commands:

NET STOP NTFRS

NET START NTFRS

This will then cause the following to appear in your File Replication Service Event Log:

The File Replication Service is deleting this computer from the replica set “DOMAIN SYSTEM VOLUME (SYSVOL SHARE)” as an attempt to recover from the error state,
Error status = FrsErrorSuccess
At the next poll, which will occur in 5 minutes, this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.

This will be followed by the following Event Log:

File Replication Service is scanning the data in the system volume. Computer MyDomainServer cannot become a domain controller until this process is complete. The system volume will then be shared as SYSVOL.

This will be followed by the following Event Log:

 The File Replication Service moved the preexisting files in c:\windows\sysvol\domain to c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog.

Now we need to wait a bit and allow the replication to complete. This has taken anywhere from 5 minutes to 20 minutes for me based on server and what is being replicated. You will know it is complete when you get the Event Log:

The File Replication Service is no longer preventing the computer MyDomainController from becoming a domain controller. The system volume has been successfully initialized and the Netlogon service has been notified that the system volume is now ready to be shared as SYSVOL.

Once you get this log your replication is complete and the Journal Wrap issues are fixed. We now need to go back to REGEDIT and change the entry we placed in there from a 1 to a 0.

You are all done.

May this help someone out there..

Cubert