Information Technology

21 Jun 2016 Tuesday

Patching Windows Server 2012R2 Gen2 Virtual Machine on Hyper-V

There are few potential hurdles to overcome when patching a new virtual machine running Windows Server 2012R2 utilising the Generation 2 format of Hyper-V. After applying all available patches and the necessary reboot the VM is stuck at “updating your system (6%)” on a black screen. Not much can be done at this point, powering then machine down and up again results in the same scenario. Long story short, this is caused by a sequence available updates are applied. The problem is the rollup patch KB3000850 (775.2 MB). The Known Issues section in this KB advises is to install KB2975061 before you install KB3000850. The solution here is then is to install all patches but KB3000850, and once rebooted proceed to install the later. This will get around the stuck at “updating your system (6%)” issue.

The second issue then relates to newly installed Gen2 virtual machines only. There still seem to be some issues around the Secure Boot with this. The following workaround will get pass this problem.

1. Shutdown the Virtual Machine.
2. In the VM settings, disable Secure Boot.

3. Start the VM and install the updates.
4. Shutdown the VM and re-enable Secure Boot again.
5. Start up the VM.

By RZM 0 Comments

20 May 2016 Friday

DFS Replication – This member is waiting for initial replication

I have come across “This member is waiting for initial replication” for a replication group after adding a new member server. It turned out that some of the existing group members where not replication anymore either. There are quite a few ways to approach this, including restarting the replication service, enable/disabling Read-Only etc. However, non of these seem to kick start the replication. Although DFS is a multi-master technology there are ways of controlling where the content is replication from (source). All member servers but one where marked as Read-Only and I run the following command to explicitly set the remaining writable server as the replication master.

[codesyntax lang=”dos”]

Dfsradmin Membership Set /RGName:<replication group name> /RFName:<replicated folder name> /MemName:<member you want to be primary> /IsPrimary:True

[/codesyntax]

After given it some time for those changes to replicate through the topology the “Primary” returned “Reference member returned no replicated folders. Backlog calculations cannot be performed because the reference member returned zero replicated folders.” At this point it looked like that problem was with the “Primary”. To rectify the problem the local DFS configuration had to be reset. To do this follow the following steps. This applies to the “Primary” but can be done to any member server as well if they seem to be “stuck”.

Stop replication service
Gain access to the System Volume Information folder

Open a command prompt and delete the C:\System Volume Information\DFSR folder
Restart replication service

Once the replication service has been restarted the DFS configuration will be recreated and you should see content being replicated through the topology. If there are still member server that are stuck at the initial replication, repeat the same procedure here.

By RZM 0 Comments

28 Apr 2016 Thursday

Cisco Proximity – Laptop not connection “Searching for Video Systems …”

Across our whole range of HP Elitebook we have seen the problem where the Cisco proximity client will not connect to an endpoint (MX800’s in our case). Proximity is enabled and they are running CE8.1. The client will return “Proximity: Searching for video systems …”. The Troubleshooting Guide – Cisco Proximity offers a couple of suggestions but non of these solved the problem.

After some research and testing the follow is solving the problem (Windows 7) on the range of HP Laptops deployed.

Open Control Panel\Hardware and Sound and click on Sound. Click on the Recording Tab and select the Internal Mic. Then click on Properties.

Select the Effects Tabs and check the Disable System Effects, which is not selected by default. Click OK on all open settings panes. In order for this setting to take effect the Cisco Proximity client needs to be restarted. Once restarted you should see “Proximity: Connected to xxx …”. Although this was only verified on HP EliteBooks it might work for other too.

By RZM 0 Comments

21 Dec 2015 Monday

Windows Server 2012R2 PowerShell with Parameters Scheduled Task

More and more PowerSell script are being used for routine task. However, when it come to use the Windows task scheduler it is not obvious how to set up a task running a PowerShell script, particular if that script requires parameters as an input.

To make this work you have to specify PowerShell under the action settings and the parameters are past in with a -command prefix via the Argument input box. Below shows an example. This essentially puts together the command line that will be execute.

By RZM 0 Comments

27 Nov 2015 Friday

Preparing Windows Domain to deploy Windows 10

Windows 10 has arrived and is here to stay. Most organization will still be running Windows 7 as there preferred OS for Enterprise Desktops and Laptops. However, main stream support for Windows 7 will cease in January of 2015.

Time to take a look at your Windows Domain Based enviroment to establish what needs to be done to fully support Windows 10.

Domain Functional Level
According to Mircosoft a Windows 10 machine can be joint to a domain as long as the domains functional level is Windows Server 2003 or higher. Windows 2000 is not supported anymore.

Administrative Templates for GPO settings
To fully support all Windows 10 setting via GPO’s the Administrative Templates (.admx) for Windows 10 should be installed. The minimum support Windows Server version here is 2008.

System Center Endpoint Protection
If you organization is using SCEP deployed via SCCM, native support for Windows 10 is provided by SCCM 2012 SP2 (or SCCM 2012 R2 SP1).

Browser
With Windows 10 a new browser named “Edge” has been announced as the new standard browser. This browser will not, in its current state, replace Internet Explorer but there is no doubt that the main chunk of development will happen here. Internet Explorer 11 is still available with Windows 10 and of course can still be used in conjunction with Enterprise Mode for Internet Explorer, that is designed to help companies migrating old versions of Internet Explorer to version 11 (starting and still running on Windows 7). Many people still don’t know this functionality exists, but its capability of emulating Internet Explorer 8 will greatly help you migrate your old business critical websites. However, it’s clear that Microsoft will be pushing and recommends to start testing on Microsoft Edge.

By RZM 0 Comments

22 Oct 2015 Thursday

Windows 2012R2 Hyper-V configuring NTP

As good practice you might want to configure NTP on you Windows 2012R2 Hyper-V host to ensure that all Virtual Machines on that host will have the correct time as they will sync against the Hyper-V host by default. This can be configured by a per VM basis via disable time sync. Open VM settings -> Management -> Integration Services and uncheck Time Synchronization.

NOTE: If you have Domain Controllers visualised you might end up with a chicken and egg situation whereby the the Hyper-V host will get the time from the visualised DC running on it and in turn, if the Time Synchronization for the DC’s isn’t disabled, they will get the time of the Hyper-V host. To get around it run the procedure below on the Hyper-V host and DC and then disable the Time Synchronization integration service.

To configure NTP on the Hyper-V host open up a PowerShell as Administrator and run the following commands.

w32tm /config /manualpeerlist:"0.pool.ntp.org 1.pool.ntp.org" /syncfromflags:MANUAL
Stop-Service w32time
Start-Service w32time
w32tm /resync

To verify the new settings run w32tm /query /status.

PS C:\w32tm /query /status
Leap Indicator: 0(no warning)
Stratum: 2 (secondary reference - syncd by (S)NTP)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0780928s
Root Dispersion: 0.0274164s
ReferenceId: 0xC1011F42 (source IP:  193.1.31.66)
Last Successful Sync Time: 10/22/2015 11:49:05 AM
Source: 0.pool.ntp.org
Poll Interval: 7 (128s)


Firewall considerations
Typically you would be sitting behind a corporate firewall. For NTP sync to work port udp/123, which is the NTP protocol has to allowed. For a Cisco ASA FW it looks like this.

By RZM 0 Comments

02 Oct 2015 Friday

Extend Cluster Shared Volume on Windows Server 2012R2

After the initial setup it didn’t take long until the assigned volume sizes weren’t sufficient anymore. After looking around it seem that the diskpart tool will extend a Cluster Shared Volume with a few command.

First, increase the size of the LUN on your storage to the required size
Open up a command prompt on the current owner node
Run diskpart
>> rescan
>> list volume
>> select volume x
>> extend volume
>> list volume

That’s it. The volume will be extended to the maximum size as the LUN has been increased to.

[codesyntax lang=”dos”]

Microsoft DiskPart version 6.3.9600

Copyright (C) 1999-2013 Microsoft Corporation.
On computer: GLL-HYP-01

DISKPART> rescan

Please wait while DiskPart scans your configuration…

DiskPart has finished scanning your configuration.

DISKPART> list volume

Volume ### Ltr Label        Fs     Type        Size     Status     Info
———- — ———– —– ———- ——- ——— ——–
Volume 0         System Rese NTFS   Partition    350 MB Healthy    System
Volume 1     C                NTFS   Partition    232 GB Healthy    Boot
Volume 2     E   Data_Drive_ NTFS   Partition   1397 GB Healthy
Volume 3     D   Data_Drive_ NTFS   Partition   1862 GB Healthy
Volume 4         Quorum       NTFS   Partition    479 MB Healthy
Volume 5         VMS          CSVFS Partition   4095 GB Healthy
C:\ClusterStorage\Volume1\
Volume 6         FS_VM        CSVFS Partition   1023 GB Healthy
C:\ClusterStorage\Volume2\
Volume 7         Prod_Images CSVFS Partition   2047 GB Healthy
C:\ClusterStorage\Volume3\
Volume 8         AWS-Gateway CSVFS Partition   2047 GB Healthy
C:\ClusterStorage\Volume4\

DISKPART> select Volume 6

Volume 6 is the selected volume.

DISKPART> extend

DiskPart successfully extended the volume.

DISKPART> list volume

Volume ### Ltr Label        Fs     Type        Size     Status     Info
———- — ———– —– ———- ——- ——— ——–
Volume 0         System Rese NTFS   Partition    350 MB Healthy    System
Volume 1     C                NTFS   Partition    232 GB Healthy    Boot
Volume 2     E   Data_Drive_ NTFS   Partition   1397 GB Healthy
Volume 3     D   Data_Drive_ NTFS   Partition   1862 GB Healthy
Volume 4         Quorum       NTFS   Partition    479 MB Healthy
Volume 5         VMS          CSVFS Partition   4095 GB Healthy
C:\ClusterStorage\Volume1\
* Volume 6         FS_VM        CSVFS Partition   2047 GB Healthy
C:\ClusterStorage\Volume2\
Volume 7         Prod_Images CSVFS Partition   2047 GB Healthy
C:\ClusterStorage\Volume3\
Volume 8         AWS-Gateway CSVFS Partition   2047 GB Healthy
C:\ClusterStorage\Volume4\

DISKPART>

[/codesyntax]

By RZM 0 Comments

24 Sep 2015 Thursday

Windows File Server – You don’t currently have permission to access this folder.

This in an issues that has been bothering me for quite some time and still exists in Windows Server 2012R2. With the introduction of Windows Vista came the first implementation of User Account Control (UAC) and with it, this Windows file server NTFS permission issue. For years I have just ignored it and carried on but during a recent File Server Migration I reviewed NTFS permission and noted that almost every Admin that had ever managed this File Server and been granted explicit access rights. Over the years this left quite a mess and some orphan entries in the ACL’s.

When accessing a folder on a Windows file server, it prompts saying “You don’t currently have permission to access this folder”. We know this folder has the following permissions set on it:

Local Administrators – Full Control
Domain Administrators – Full Control
User Access Group – Full Control

The user account I use is a member of the Domain Admins as well as being nested in the local Administrator group on the File Server and hence I should have access to this folder. If I click continue to this prompt, UAC will automatically add my user name with full control permissions to the folder and all sub folders and files which I’m attempting to access. With multiple administrators having done the same over the years this has resulted in unwanted user name ACL’s spread across folders and files throughout the file server making the permission structure a mess.

SOLUTION

There are three group policy settings are responsible for this behaviour which can be found under:

Computer Configuration –> Windows Settings –> Security Settings –> Local Policies –> Security Options

User Account Control: Admin Approval Mode for the Built-in Administrator account
User Account Control: Behaviour of the elevation prompt for administrators in Admin Approval Mode
User Account Control: Run all administrators in Admin Approval Mode

Set the policies settings as follows in the following order as per the screenshot below:

I have used gpedit.msc to make the changes on the local File Server only. You can of course create a GPO and apply to all of your (File) Servers.

Now, when a administrators navigate the file server they are no longer prompted to add their account to NTFS permissions and in result making a mess of my NTFS permission structure.

By RZM 0 Comments

14 Sep 2015 Monday

Delete files/directories Windows Server 2012 – Filename too long

This is common problem due to the inherited restriction of the Windows file system. The quickest way is to use robocopy that is now part of Windows Server 2012 and supports long file names. We are basically mirroring an empty directory to the directory we would like to delete and because the source is empty it will clear the destination directory. One done you can delete the empty_dir and the the_dir_to_delete.


mkdir empty_dir
robocopy empty_dir the_dir_to_delete /s /mir
rmdir empty_dir
rmdir the_dir_to_delete

By RZM 6 Comments

15 Jun 2015 Monday

Migration DHCP Server from Windows 2008 to Windows 2012

For years this has been a tedious task when it came to moving the DHCP server role. In most case this involved manually creating all subnets, IP reservation, Server option etc. and only the DHCP lease database could be copied over. With Windows Server 2012 Microsoft has addressed the issue and in the spirit of their new approach it has implement some cmdlet in PowerShell to do this rather painless. Depending on your environment you could get away with 4 simple steps, provided you have a Windows 2012 Server with the DCHP role installed ready.

Export ALL setting including DCHP lease from the old Windows 2008 Server
Shutdown down (and disable automatic startup for the service) the DHCP Server
Import the setting into the new DHCP server
Authenticate and start DHCP Server on the Windows 2012 Server

This can take less than two minutes and you are done and ensures you haven’t missed anything either.

PowerShell Export command line (Make sure the directories used exisit):
[codesyntax lang=”powershell”]

Export-DhcpServer -ComputerName ServerName.Old -Leases -File c:\export\dchp.xml -verbose

[/codesyntax]
PowerShell Import command line:
[codesyntax lang=”powershell”]

Import-DhcpServer -ComputerName ServerName.New -Leases -file c:\export\dchp.xml -BackupPath c:\dhcp\backup\ -Verbose

[/codesyntax]

The above are just same plain examples for the syntax. Feel free to explore the cmdlet, i.e. export only the server setting if you plan to set up a second DHCP server to explore the new replication feature that was introduced with Windows Server 2012.

Last but not least, depending on your environment, you may have to update the servers and/or network equipment with the IP/Name of your new DHCP server. Examples are Cisco’s Wireless LAN controllers and Cisco router/switches using IP helper-address to point clients to a remote DHCP server. It might be worth noting that multiple IP helper-addresses per Interface are possible. It might be advisable to have the Cisco router/switch amended before the actual migration.

By RZM 0 Comments

Firewall considerations

SOLUTION

Posts pagination

Send a Message