Month: November 2014

Windows 2012R2 Cluster – Migration/Move fails

After having a Windows 2012R2 Cluster up and running and after having some Virtual Machines up and running as well the next step usually is to test the failover, i.e. migration to a different node. The cluster is running on two physical Dell servers. As a secondary node a PowerEdge T610 with two Intel Xeon E5620 processors was used. Although almost 4 years old and with some extra RAM the server should be able to run most of the important VM in case node one fails. The first node is running on a new PowerEdge R720 with two Intel Xeon E5-2609 processors.

All VM’s were installed with affinity to node 1. Every attempt to move any VM to the second node failed. The logs pointed with error messages like “The virtual machine ‘SRV-ADC-03’ is using processor-specific features not supported on physical computer ‘SRV-HYP-02’. To allow for migration of this virtual machine to physical computers with different processors, modify the virtual machine settings to limit the processor features used by the virtual machine.”  or “Cannot restore this virtual machine to the saved state because of hypervisor incompatibility. Delete the saved state data and then try to start the virtual machine.”.

Microsoft explicit mentions this when using totally different processors like Intel and AMD. It appears to be applicable for different processor generations too. Of course the instruction set particular with regards to visualisation will improve/change with every generation. The solution is to enable the option below for the respective VM. Once this is done the migration/move works flawless.

Migrate option for different processors

By RZM 0 Comments

Error determining whether the target server is already a domain controller: The target server is already a Domain Controller.

I was trying to add a new Windows 2012R2 Domain controller to an existing Domain. I was using the GUI tools, may be I should do this with PowerShell the next time. After adding the AD and DNS role I went through the DCPROMO wizard dcpromoand kicked off the promotion. After a manual reboot I checked and all of DNS and AD seems to be working fine including replication. However, I’m still being prompted in the Server Manager to promote the server. When I do the following messages is displayed – “Error determining whether the target server is already a domain controller: The target server is already a Domain Controller.” After some research it looks like I’m not the only one, check out these posts. First thing always, run DCDIAG. The output only confirms that everything seems to be working. The solution seems to be to just disable/acknowledge the notification by clicking the “x” beside the task. Even after a reboot the notification doesn’t come up anymore.

dcpromoclick

 

 

 

 

 

[codesyntax lang=”text” lines=”fancy”]

Directory Server Diagnosis


Performing initial setup:

   Trying to find home server...

   Home Server = SRV-ADC-01

   * Identified AD Forest. 
   Done gathering initial info.


Doing initial required tests

   
   Testing server: IEGW\SRV-ADC-01

      Starting test: Connectivity

         ......................... SRV-ADC-01 passed test Connectivity



Doing primary tests

   
   Testing server: IEGW\SRV-ADC-01

      Starting test: Advertising

         ......................... SRV-ADC-01 passed test Advertising

      Starting test: FrsEvent

         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems. 
         ......................... SRV-ADC-01 passed test FrsEvent

      Starting test: DFSREvent

         ......................... SRV-ADC-01 passed test DFSREvent

      Starting test: SysVolCheck

         ......................... SRV-ADC-01 passed test SysVolCheck

      Starting test: KccEvent

         ......................... SRV-ADC-01 passed test KccEvent

      Starting test: KnowsOfRoleHolders

         ......................... SRV-ADC-01 passed test KnowsOfRoleHolders

      Starting test: MachineAccount

         ......................... SRV-ADC-01 passed test MachineAccount

      Starting test: NCSecDesc

         ......................... SRV-ADC-01 passed test NCSecDesc

      Starting test: NetLogons

         ......................... SRV-ADC-01 passed test NetLogons

      Starting test: ObjectsReplicated

         ......................... SRV-ADC-01 passed test ObjectsReplicated

      Starting test: Replications

         ......................... SRV-ADC-01 passed test Replications

      Starting test: RidManager

         ......................... SRV-ADC-01 passed test RidManager

      Starting test: Services

         ......................... SRV-ADC-01 passed test Services

      Starting test: SystemLog

         ......................... SRV-ADC-01 passed test SystemLog

      Starting test: VerifyReferences

         ......................... SRV-ADC-01 passed test VerifyReferences

   
   
   Running partition tests on : ForestDnsZones

      Starting test: CheckSDRefDom

         ......................... ForestDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... ForestDnsZones passed test

         CrossRefValidation

   
   Running partition tests on : DomainDnsZones

      Starting test: CheckSDRefDom

         ......................... DomainDnsZones passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... DomainDnsZones passed test

         CrossRefValidation

   
   Running partition tests on : Schema

      Starting test: CheckSDRefDom

         ......................... Schema passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Schema passed test CrossRefValidation

   
   Running partition tests on : Configuration

      Starting test: CheckSDRefDom

         ......................... Configuration passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... Configuration passed test CrossRefValidation

   
   Running partition tests on : DOMAIN

      Starting test: CheckSDRefDom

         ......................... DOMAIN passed test CheckSDRefDom

      Starting test: CrossRefValidation

         ......................... DOMAIN passed test CrossRefValidation

   
   Running enterprise tests on : DOMAIN.INC

      Starting test: LocatorCheck

         ......................... DOMAIN.INC passed test LocatorCheck

      Starting test: Intersite

         ......................... DOMAIN.INC passed test Intersite

[/codesyntax]

 

By RZM 2 Comments

Fix Windows Error – User profile cannot be loaded

The correct error message you will see is “The User Profile Service service failed the logon. User profile cannot be loaded.”The User Profile Service service failed the logon There are plenty of fixed and How-to-Do’s out there, all suggestion to edit the registry and rename the profile in question. However, the error would occur the first time a user tries to logon to a machine with a newly created AD account. e.g. the user has no profile on the computer yet. The solution seems to correct the security settings for the default profile that is used to set up the user.

  1. Enable “Show hidden files, folders, and drives in Explorer” (Organise -> Folder and Search options -> View)
  2. Go to C:\Users, right mouse click on “Default” -> Properties
  3. Click on the Security Tab and then Advanced
  4. Verify that for “Include inheritable permissions from this object’s parent” the check box is checked. If it is not checked and greyed out click on Change Permissions and in the next screen check the check boxes “Include inheritable permissions from this object’s parent” and “Replace all child object permissions with inheritable permissions form this object” are checked. Press “OK” and ignore the Error Messages.
  5. Reset the Folder option for “Show hidden files, folders, and drives in Explorer

Hopefully that will have fixed the problem and the next time the user is trying to logon a profile will be created.

For further information and how to fix the the issue if the above doesn’t work look here.

Another good How-to-Fix with some background info’s and good discussion can be found here.

Also check it the Trust-Relationship with the Domain is not brocken either.

 

By RZM 0 Comments

Installing OpenDNS Virtual Appliance in Multi-Domain Setup

The OpenDNS Umbrella package supports upon request integration with your on-prem Active Directory. This allows for very granular access policies and control as well as monitoring. Once enabled you will see a drop-down box in the upperOpenDNS Domain Selection left hand corner of you Dashboard. OpenDNS provides context based access to the components you need to set up the Active Directory integration. This applies to the Virtual Appliances that are provided fro VMWare and Hyper-V, e.g. the appliances are customised for your for the Domain you have currently selected. This means before downloading and setting you the OpenDNS VA’s make sure you are in the right Domain and download the correct images. Otherwise the VA’s will not show up or show up in a different Domain.

OpenDNS Component Download

By RZM 0 Comments

Windows Server 2012 LACP NIC Teaming

NIC Teaming using Windows Server 2012(R2) has never been any easier. However, you will be presented with two options for the Teaming Mode – Switch independent or LACP. If in doubt go with the first one as this will always work and doesn’t require any further configuration. If the network switch infrastructure supports the Link Aggregation Control Protocol (LACP) I usually prefer this method, particular for production environments. Once the switch is enabled for LACP, the team dynamically configures the switch whenever it comes online or is reconfigured.  This means that you do not need to constantly log calls for the network admins when you are doing physical server operations.

Windows Server NIC - Teaming (LACP)
Windows Server NIC – Teaming (LACP)

Cisco IOS command to add 4 interfaces into a single Ethernet Channel.

[codesyntax lang=”bash”]

interface Port-channel2
 description GLW-HYP-01 LACP
 switchport access vlan (your VLAN number(s)) if applicable otherwise omit line)
 switchport mode access
 switchport nonegotiate
!
interface GigabitEthernet1/0/1
 description Hyper-V LACP
 switchport access vlan (your VLAN number(s)) if applicable otherwise omit line)
 switchport mode access
 switchport nonegotiate
 spanning-tree portfast
 channel-group 2 mode active
!
interface GigabitEthernet1/0/2
 description Hyper-V LACP
 switchport access vlan (your VLAN number(s)) if applicable otherwise omit line)
 switchport mode access
 switchport nonegotiate
 spanning-tree portfast
 channel-group 2 mode active
!
interface GigabitEthernet1/0/3
 description Hyper-V LACP
 switchport access vlan (your VLAN number(s)) if applicable otherwise omit line)
 switchport mode access
 switchport nonegotiate
 spanning-tree portfast
 channel-group 2 mode active
!
interface GigabitEthernet1/0/4
 description Hyper-V LACP
 switchport access vlan (your VLAN number(s)) if applicable otherwise omit line)
 switchport mode access
 switchport nonegotiate
 spanning-tree portfast
 channel-group 2 mode active

[/codesyntax]

By RZM 0 Comments

List all Mobile Devices connected to Office365 (Exhange 2010/2013) – PowerShell

All credit to Port25Guy.com for creating this handy script to get a summary of all mobile device connected to you Exchange organisation. The script will generate a CSV file as well as send an Email in HTML format. This allows for setting up a schedule run for periodic housekeeping on all of you mobile device.

 

[codesyntax lang=”powershell”]

### BEGINNING OF SCRIPT

### Updated cmdlet's http://go.microsoft.com/fwlink/p/?LinkId=254711 MobileDevice rather than ActiveSyncDevice
### http://blog.zmarzly.me

#####
#
# Get-MobileDeviceReport
# Author: Paul Ponzeka
# Website: port25guy.com
# email ponzekap2 at gmail dot com
#
######
param(
    [Parameter(Mandatory = $true)]
    [string] $SMTPServer = "",
    [Parameter(Mandatory = $true)]
    [string] $SMTPFrom = "",
    [Parameter(Mandatory = $true)]
    [string] $SMTPTo = "",
    [Parameter(Mandatory = $true)]
    [string] $exportpath = ""
    )

#######
#
# HTML Formatting Section
# Thanks to Paul Cunningham at http://exchangeserverpro.com/
#
#######
#
# 
#
######
$style = "<style>BODY{font-family: Arial; font-size: 10pt;}"
$style = $style + "TABLE{border: 1px solid black; border-collapse: collapse;}"
$style = $style + "TH{border: 1px solid black; background: #dddddd; padding: 5px; }"
$style = $style + "TD{border: 1px solid black; padding: 5px; }"
$style = $style + "</style>"


$messageSubject = "Mobile Device Report"

$message = New-Object System.Net.Mail.MailMessage $smtpfrom, $smtpto
$message.Subject = $messageSubject
$message.IsBodyHTML = $true

####  Get Mailbox

$EASDevices = ""
$AllEASDevices = @()

$EASDevices = ""| select 'User','PrimarySMTPAddress','DeviceType','DeviceModel','DeviceOS', 'LastSyncAttemptTime','LastSuccessSync'
$EasMailboxes = Get-Mailbox -ResultSize unlimited
foreach ($EASUser in $EasMailboxes) {
$EASDevices.user = $EASUser.displayname
$EASDevices.PrimarySMTPAddress = $EASUser.PrimarySMTPAddress.tostring()
    foreach ($EASUserDevices in Get-MobileDevice -Mailbox $EasUser.alias) {
	$EASDeviceStatistics = $EASUserDevices | Get-MobileDeviceStatistics
    $EASDevices.devicetype = $EASUserDevices.devicetype
    $EASDevices.devicemodel = $EASUserDevices.devicemodel
    $EASDevices.deviceos = $EASUserDevices.deviceos
	$EASDevices.lastsyncattempttime = $EASDeviceStatistics.lastsyncattempttime
	$EASDevices.lastsuccesssync = $EASDeviceStatistics.lastsuccesssync
    $AllEASDevices += $EASDevices | select user,primarysmtpaddress,devicetype,devicemodel,deviceos,lastsyncattempttime,lastsuccesssync
    }
    }
$AllEASDevices = $AllEASDevices | sort user
$AllEASDevices
$AllEASDevices | Export-Csv $exportpath\ActiveSyncReport.csv

######
#
# Send Email Report
#
########

$message.Body = $AllEasDevices | ConvertTo-Html -Head $style

$smtp = New-Object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($message)

##END OF SCRIPT

[/codesyntax]

By RZM 0 Comments

Installation error – Windows Azure Active Directory module for Windows PowerShell

This is a rather missleading error messages – “In order to install Windows Azure Active Directory Module for Windows PowerShell, you must have Microsoft Online Services Sign-In Assistant version 7.0 (64 bit) or greater installed on this install-errorcomputer.” This seems to caused by a wrong version check when trying to install the official Windows Azure Active Directory Module for Windows PowerShell. Note, Effective October 20, 2014, the 32-bit version of Azure Active Directory Module for Windows PowerShell (32-bit version) is discontinued. Support for the 32-bit version will no longer occur, and future updates to the Azure Active Directory Module will be released only for the 64-bit version. Microsoft strongly recommend you install the 64-bit version to ensure future support and compatibility. Before trying the fix below make sure you have the .NET framework 3.5 installed/enabled as this is a pre-requisite. If this doesn’t fix it try the following:

  1. Open regedit.exe
  2. Find the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSOIdentityCRL
  3. Change the value of MSOIDCRLVersion from 7.250.4303.0 to 7.250.4551.0
  4. You should now be able to install the Windows Azure Active Directory Module for Windows PowerShell.
  5. After the installation is complete, change MSOIDCRLVersion back to 7.250.4303.0

 

 

By RZM 0 Comments
Send a Message