Buckeye Gone Bad

SBS team invites your suggestions

jim — Tue, 03 Jun 2008 02:00:00 GMT

http://blogs.technet.com/kevin_beares/archive/2008/05/23/the-windows-small-business-server-2008-ww-community-survey-is-live.aspx

The SBS team is curious about what you think and what you want. Spend a few minutes giving them some feedback. Just as a point of reference the SBS MVPs and the MVPs friendly to SBS are considered the minority. What I mean is that a lot of my SBS friends run ISA and love/like it. They use SQL for line of business uses. We are constantly told that we are a minority. Maybe so, but we sure are vocal. If you love/like ISA or SQL let them know. Even if you don't tell them what you think and what you want. The do listen and lots of noise creates lots of interest.

Slow XP SP2 boot up, updated nic drivers fixed that.

jim — Fri, 09 May 2008 01:35:00 GMT

I had a call that a user's workstation is taking 5 minutes to boot up. I did some user file cleanup which should have nothing to do with the issue as the slow boot is before the user gets the CAD screen. I did an ipconfig/all to make sure dns was correct. I did an ipconfig/flushdns. I then updated the Realtek nic from a 2002 driver to a 2008 driver. I rebooted the workstation and it came up in a minute after the bios finished its stuff.

Some computer manufacturers are not so good about getting you the latest nic drivers. If you have a computer that uses Broadcom nics you usually need to go to Broadcom to get the latest drivers.

Tiny USB thumbdrives drives? Put them to use, or how to flash your server with a thumbdrive

jim — Tue, 29 Apr 2008 13:05:00 GMT

I have all these crummy usb thumbdrives . Crummy means too small to carry a lot of files on. I considered them useless until my Intel server said create a bootable usb thumbdrive and place the updates on the usb bootable thumbdrive. In the past I had to make a bootable floppy and then a few more floppys to update the various Intel utilities. Now they say place them all on a thumbdrive and boot from that. Finally a use for 128 meg thumbdrive.

This guy has great instructions with screenshots for those of us who can’t read instructions.

http://www.bay-wolf.com/usbmemstick.htm

I can't get my default printer to stick on my application server. Make a group policy.

jim — Thu, 27 Mar 2008 01:33:00 GMT

I had a user buy some wham bam Dell portable pc for $4,000. It sure was fast with Vista Ultimate, Blue Ray, Bluetooth keyboard, lots of ram and processor. Well it sort of looks like a laptop but it weighs a lot. The primary business application does not run on Vista so we set him up to use the pretty new application server. He also has a dog slow XP laptop. I could not get the default printer to stick on the application server. I would log in with one laptop and set the default printer on the application server. He would log in with the other laptop and the default printer on the application server changed. The default printer kept flopping back and forth. Every day was a new day.

So here is what I did. Group Policy management. I made a new GPO under domainname.local Windows Components/Terminal Services/Client/Server data redirection. Do not set default client printer to be default printer in a session. Enabled.

Problem of default printer flopping about due to the client machines was solved.

Exchange connection filter using a Real Time Block list, and IMFPerfmon.msc

jim — Sun, 24 Feb 2008 02:36:00 GMT

Here are some things I do. I may miss a step so you may have to
confirm things. After you added connection filter provider you need to
make sure you have checked that stuff in the default virtual server.

Global Settings/Message Delivery right click Properties.
Sender Filtering: Check Filter messages with a blank sender and Drop
connection if address filter matches filter.
Connection Filtering: Add your favorite RBL services. I happen to use zen.spamhaus.org Please visit www.spamhaus.org to review terms and conditions to see if you are eligible to use their services.
Intelligent Messaging Filtering: I set it at 7 and Reject. You want
reject so if there was a valid message the sender receives notice that
your server rejected the message.
Recipient Filtering: Filter recipients who are not in the Directory.

Apply and go to Servers/Servername/Protocols/Default SMTP Virtual
Server right click Properties.
Advanced.
Edit
I check everything but Sender ID Filter.

Make sure you are on Exchange SP2 and you add the registry dword
HKLM\Software\Microsoft\Exchange\ ContentFilterState set to 1. That
key lets Microsoft Updates get IMF definitions.

I open up perfmon.msc from the Run box.
On the icon bar I click on the notebook icon to get the report view.
Click on the + sign next to it to add some counters.
In the Performance Object drop down box look for
MSExchange Transport Filter Sink. Choose all counters and Add.
Back to Performance Object and choose MSExchange Intelligent Message
Filter. Choose all counters and Add. I really do not care for the per
second counters so you can choose select counters from list if you
like.

Now you have a permon that is showing how much stuff is going in to
your Exchange server that the IMF considers spam. It shows you how
many connections are being rejected by the RBL. It shows you how many
connections are being dropped because the recipient is not in your
Active Directory. I do a little math and come up with some interesting
numbers.

Click on File and save as. I save it as imfperfmon.msc. I right click
on the desktop and make a new shortcut. Type imfperfmon.msc in the
next two boxes. Now you have a shortcut on your desktop anytime you
want to see how the RBL and IMF are doing.

Back to your question. If you have the imfperfmon working you can see
a little about what is coming in. Last night I had an account getting
slammed with some mailer daemon nonsense. I need to visit to see what
is really going on.

Mail may still be stuck in the queue as your server is trying to send
out Non Delivery Reports to bogus addresses. If you have done the
clicks I mentioned and others hopefully the junk will be blocked.
Those NDRs will die off after a few days. The default setting in
Exchange is to try to deliver for 2 days and then give up. There is a
trick to flush all the messages out but it may be just as easy to let
them die out on their own. As long as you do the clicks I did you
should eventually be ok.

Another rant is that I do in Exchange System Manager. Properties of
the Default SMTP Virtual Server/ Access/Relay. I have the button only
in the list. Below that list I do not have the checkbox clicked for
All computers that successfully authenticate. There is no computer
that I want to relay against my server. I want everyone to be using
Outlook or Outlook Web Access to deal with email. That is just another
way for people to cause trouble. Of course after a misadventure I get
to suggest now is the time to have passwords 8 characters long and
having more than 2 things from the keyboard. Since there are at least
6 easy things on the keyboard it should be not hard to create and easy
to remember complex password.
http://www.microsoft.com/protect/you...rd/create.mspx

File association woes as a limited workstation user

jim — Tue, 12 Feb 2008 04:51:00 GMT

I get a call that a new user cannot open tif or jpg file. When they go to Windows Explorer the file association is greyed out. I do a Google search and turn up a registry value of hklm\software\microsoft\currentversion\policies\explorer add dword NoFileAssociate with a value of 0. Or if this is missing it is the same as a 0. Well I searched and searched for other answers as this key did not help. The searches also suggested the HKCU but I would get an error when trying to create a new dword when logged in as a workstation user. I tossed out a white flag. Merv Potter saw the flag. He said it was a power user issue. Well I created a new user on my XP laptop as a limited user. I could not do that file association task. I made the new user a local Power User and he could. I logged on to the workstation in that domain. I made Domain Users Power Users of that workstation. That fixed the problem. Well actualy it did not as that level is a bit higher than I would like but so it goes until someone tells me a better solution.

ADMT and frugal Swing Migration

jim — Thu, 27 Sep 2007 17:41:00 GMT

I got a call from a co-worker at a pop up account. You know the people that call wanting a little help but not a lot. They got a new server with hardware SATA raid 1. They installed SBS on a 500 gig partition. Personally I like to see 30-40 gigs for the OS and one or two other partitions. One partition for Exchange databases. Another partition for data. I like to keep the C: partition fairly free of stuff. My though is that I can scandisk or defrag a 40 gig partition in short order. To scandisk a 500 gig partition might take days. I don not know but it takes pretty long to scan 40 gigs.

They chose to do ADMT. Last time I tried ADMT it bombed. It bombed on moving workstations because that other account had manually entered in ip and dns info on the workstation. Since then I have learned how to do Jeff Middleton’s Swing migration. I do the frugal $50 version using the steps in SBS 2003 Advance Practices book. I have learned that you need to make sure Windows Firewall is disabled when you are doing swings but other than that the swing is pretty easy. You grab AD. You clean it up. You build the new SBS starting with the OS. Grab the AD. Finish installing SBS. Move the Exchange databases and restore the shares. I do not have to touch workstations. I can knock workstations offline for a few minutes while I unplug the old SBS from the network and plug in the new SBS. I need a bit of time to move the Exchange databases over. That might be an hour if the database is not too big. Moving files over can be fast or slow depending on quantity. You might have some user group membership adds. I use Microsoft’s print migration tool to grab printer shares. That usually works.

Back to Thursday night. The goal was to have things up and running in the morning. Well they did have a late start. ADMT bombed moving computer accounts over. I heard about that late Thursday. Bedtime late for me. I suspect the fact their router was providing dns really screwed up that task. More on that later. They marched on moving the Exchange and company files over. That was taking forever which meant continue the project in the morning.

I checked in the next morning and they were starting the unjoin/rejoin workstations. By the time I arrived 1.5 hours later they had one workstation on the new domain. File and Setting wizard was run before hand we tried to move the workstations to the new domain. That worked ok on most of the machines but not all. Many of the workstations were slow to boot, painfully slow for modern workstations. I suggested that the router providing dns was a bad idea. That may have fallen on deaf ears. At the workstations I touched I started manually entering in dns and wins. That helped the machine when applying settings. It also helped when Outlook profiles had to be set to point to the new server name.

Today is Friday. I spent another 2 hours today cleaning up some loose ends with user profiles. I noticed that a few of the workstations would not work from /remote. They also would not accept remote assistance from the SBS Server Management console. The one machine that did work both inside and outside had the dns and wins entered by me. They also had a hodge podge of workstation AV. It seemed that every workstation had a different AV client. I suspect a few were not up to date.

I fixed the WSUS 3 that would not open from Server Management. The SBS official blog has some clicks for that.

http://blogs.technet.com/sbs/archive/2007/05/01/wsus-3-0-on-sbs-white-paper-released.aspx

So the take away if you insist on ADMT is to make sure that the SBS is doing all dhcp. Make sure that the workstations are getting all their ip, dns and wins from the SBS. Of course my personal opinion is to do a swing migration.

Another note from that project. I set up zen.spanhaus.org in the Exchange connection filter. 80% of the incoming was getting blocked. 20% of the remaining was getting blocked by IMF 7. Users were asking where all their email was. I told them that we were blocking spam. Another useless statistic. Over 2360 messages blocked in less than 24 hours for a 10 user office. They might be a bit more productive not sifting through all that spam.

Another takeaway. Do not schedule a new server install the day before the project manager is heading out of town. Do not schedule a new server install 2 days before you move to a new office.

If I am correct and ADMT computer migration bombed because of router dhcp then maybe ADMT would have worked fast enough. Since it did not work they spend 12 of my (coworker David and I) hours plus a day of their IT lead working on the project. The staff did almost no computer work all day Thursday. If we had done a swing and started it Thursday morning, the staff would have worked as long as they wanted until maybe 2:00. I would have knocked them off for an hour while I pulled the Exchange databases over and rebooted their workstations. The would have been a bit off line for another few hours while the 30 gigs of data was pulled from the old server to the new server. If my math is correct swing for $960 or ADMT for $2400. Granted ADMT might have worked without the router dhcp nonsense but that was before I visited. So ADMT might have been pretty inexpensive. Of course if the account had bought Swing for $200 then they would not have had the projected $960 or the actual $2400 fee.

Nobody asked me so maybe I could have saved ADMT, Maybe not. I do know that I have done Swing at a two office location with 30 users and only an hour of down time and a few hours of printer cleanup. I did not have to touch one workstation. I like that.

Exchange 2003 IMF filter is not working. Blackberry users revolt.

jim — Thu, 09 Aug 2007 13:58:00 GMT

I have an account that uses Blackberries. We Have Blackberry Enterprise Server installed on the server. Blackberry users are complaining about spam. The Exchange IMF was not working. We had some issues with that Exchange server a few months ago and it appeared to be working ok. Yesterday I discovered that the IMF was not working at all. Mail is delivered like this. I am not an Exchange Geek but based on what the Blackerries see I am pretty sure this is how it works. Exchange receives the email. Exchange looks at all the settings you have in Global Settings/Message Delivery/Properties. It also looks in the Administrative Group/First Administrative Group/Servers/Servername/Protocols/SMTP/Default SMTP Virtual Server/Properties/General/Advanced/Edit to see what you turned on. All those things you have checked like blacklists, filter blank senders, filter addresses not in Active Directory are run. Exchange continues to deliver the mail after processing those rules. BES grabs a copy of the email after that initial set of rules is run. The messaging AV gets the email and does its sorting but the email has already been sent off to BES. None of your Exchange server based messaging AV is going to help as the messages have were forwarded to BES. On this server I had an error or informational message that popped up in System Manager that the Microsoft support person said we could ignore if the server seemed to be working. One way to sometimes cure a problem is to reapply a service pack. Exchange SP2 refused to install. I found some articles about uninstalling the IMF v1. Then I found a post in the SBS group about how do it this way for either v1 or v2. I stopped all Exchange services. I stopped all messaging av. Stopped SMTP service. Stopped some of the Blackberry services. I renamed C:\Program Files\Exchsrvr\Bin\MSCFV2 folder to oldMSCFV2. Made backup of Exchange registry key. Deleted ContentFilterState and ContentFilterVersion keys. Deleted C:\exchsrvr\bin\contentfilter.dll. I should have renamed that but oh well. Applied Exchange Service Pack 2. I opened regedit and I added HKLM\Software\Microsoft\Exchange dword ContentFilterState is 1. This lets you get updates for IMF via Microsoft Updates. You need to restart the SMTP service for this new key to go in to effect. I tried to run Microsoft Updates but it did not see that I needed any new IMF definitions. The "current" definition in MSCFV2 was dated 2005. I copied folders from oldMSCFV2 folder to MSCFV2. My latest definition was in the folder 6.5.7942.0. regsvr32 c:\Program Files\Exchsrvr\Bin\MSCFv2\6.5.7942.0\MSExchange.UceContentFilter.dll I started all the Exchange, Blackberry and Trend Messaging services. I had one Messaging service that was stuck stopping. I used Process Explorer to kill that process so I could restart it.

It has trapped 244 spam with SCL or 7 or larger in less than 8 hours. That is about 25 less spam going to the four Blackberry users. The rest of the users have a little less to sort through. On the other hand the Exchange administrator now will have 1,000 messages a day to wade through.

I have no way to contact the Blackberry users to see if this working IMF is helping but the Outlook users have less to sift through.

I go to this site for a number of great Exchange tutorials.

http://msexchange.org/

Slow boots and chkdsk errors, bad hard drives that the hardware raid thinks is ok

jim — Thu, 19 Jul 2007 13:17:00 GMT

I had a call a month ago on a Tuesday night about a server that would not reboot. It kept popping up errors and wanted to run chkdsk. It appeared to finally come up and the person who called went home. I tried to remote in to the server and it would not answer. I knew I would have a morning visit. I appeared the next morning and I tried every variation of chkdsk I could come up with. That could be a humorous comment as I know of /f and /r. I called Microsoft tech support and we booted off the install cd. Running chkdsk when there is no OS in the picture nets better results. Well not this time.

This was hardware raid 1 and I was getting array good in the bios boot up. I unplugged one of the drives and tried to run chkdsk again and again. It seemed that I might get a clean /f but the next /r would find issues. I could get the server to boot but not too fast and I never got a clean scandisk twice using chkdsk/f. Once again it is Raid 1 so you have 5 choices. Bad disk 1, Bad disk 2, both disks bad, bad controller card, bad motherboard. There might be other problems but those choices cover the likely scenarios. I gave up on the one hard drive and started working on the other hard drive. That second hard drive cleaned up nicely and booted happy as can be. We lost some email as the backup did not run correctly over the three day weekend. I recovered files from Tuesday but no luck on email. That was painful. What was also painful was my chice of drives. If I had better binary luck I would have ended the Microsoft call in a 1/2 hour instead of 3 or 4 hours. The support engineer was great. He had about 5 years of support experience.

A month later a fellow who used to work with me calls stating that his old SQL server is slow to boot, appears to be running but users are not able to work. I suggested unplugging one hard drive or the other as he is using raid 1 also. He never called back so I bet one of his hard drives was acting up.

You ask “Would a hardware Raid 1 with hot swap?” The problem was the hardware thought the drives were fine. The operating system did not see the drives as happy. I am guessing that no, a hot swap would not have helped.

Lowest user permissions, folder redirection and applications that do not run because of a weird profile

jim — Thu, 19 Jul 2007 12:26:00 GMT

I have a goal sometimes of lowest user privileges. Not often enough though. End users have a much harder time installing junk programs if they are not a local administrator. Drive by malware may have a harder time getting installed. My newsgroup buddies JeffM and SusanB have given me clues and tools to work on making users workstation users. As you may know too many vendors say “make the user an administrator” so their application can work. You can use tools like filemon and regmon to see what is really going on when you run an application. Those two tools let you watch what is happening with the files and the registry. I generally know or assume two things for my down and dirty test. The user needs to have full control of the application folder and the HKLM/Software key for that application. OK, that assumption might be stretching how elevated the permissions need to be but that is where I start.

I am logged in to the workstation as Administrator. Well I might be logged in as a domain administrator but usually I log on as administrator. I then go in to Control Panel/Add-Remove to uninstall any “junk” that either came with the workstation or the user installed. Junk is subjective but Google Desktop, Yahoo toolbar for IE, screen savers, shopper stuff and anything else that I have been bit by in the past. I delete temp files from all the users, delete their IE temp files and do a defrag. I might scan for malware, spyware and viruses if the machine is working weird. That is just some of my housekeeping 101 I do.

I go to My Computer, right click and Manage. I go to local users and groups. I look at the administrator group and remove anyone who should not be in there.

I then log on as the worker bee and let them work. If everything is working well, great. The registry and folder permissions worked every time for me. I have heard application tech support say to me that the user needs to be an administrator. My reply is “How is your Vista development going?” I have 4 third party doctor office software packages I work with regularly. I do have to call in on occasion. Sometimes I hear that administrator nonsense which I explain away.

So every Jim story has a long story it seems. I did this last week for E-Mds. It worked fine. The short story was that a user could not scan in E-Mds unless the workstation log in was a domain administrator log in. I did my registry and file permissions. We logged in as the user that usually sits at the workstation and did a test scan. Things worked great. I get a call a day later and it is not working. I click away trying to find out why and get no where. I call E-Mds support and we start working on things. I happen to like their support. The folks are friendly and we always solve the problem, usually pretty quickly. Well today was not a quick call. We click around and nothing helps. I set the local workstation administrators to domain users and that did not help. That should have eliminated any folder permissions issue on the workstation. I opened notepad and did some save as to the folder on the server that the application uses. That should eliminate server folder issues.

I create a new user on the domain. I log on to the workstation as the new user and E_Mds scanning works fine. That eliminates the workstation and the server permissions. It is down to the user. In the past I have deleted workstation user profiles when something odd just keeps biting me. Almost always seems to work. It did not this time. I had the same issue when I logged back on as the problem user. I did see that the user was having a new profile built as it took a few minutes for the first log in to happen. I inherited the SBS so I am not positive about everything that has been done. I saw no sign of desktop redirection or user profile redirection. I did have My Documents redirection though. I looked in the user’s folder on the server and I saw nothing weird. That is not true. I did have an issue saving a shortcut to her folder but I could create new txt file to her user folder. While she was logged off I renamed her folder 1aajohnson. I made a new aajohnson folder and set the security permissions correct. I logged on as aajohnson and E-Mds scanning worked fine. I copied all of her documents over from her old folder to her new folder. Everything still worked fine.

So the take away. Not only can you get bit by a weird local user profile but a redirected user folder.

I can't see shares on the server!

jim — Fri, 23 Feb 2007 18:27:00 GMT

start
Run
Cmd and enter
ipconfig/all
The gateway, dns and wins should be your SBS
Ping ip of gateway or your SBS if the gateway is not the same as your WINS

If you can ping your server great.

If you have a Dell go to services
Start
Run
Services.msc
Make sure Network Location Awareness is set to automatic.
Go to your network properties.
click on Advanced
Advanced settings
Make sure that your LAN is at the top.

Start
Control Panel
User Accounts
User Accounts
Advanced
Manage Passwords

You could reboot for th enla and nic stuff to stick. The cleared passwords problem should work right away. I also clear passwords in Internet Explorer. Tools/Internet Options/Content and Autocomplete.

Blindsided by the US daylight savings time?

jim — Fri, 23 Feb 2007 01:12:00 GMT

Blindsided by the new US daylight savings time?

I am going to be out of town that weekend. Lucky me. I am already suffering though. One account called because appointments are not sticking to the correct time. 10 am in Atlanta in three weeks before the patches should still be 10 after the patches. I don’t know if the account was running this or not. http://support.microsoft.com/kb/931667 . I need to check back with them.

Well here is how I got bit. Outlook kept acting weird on a few workstations at one account. They are using SalesLogix which is a CRM. Outlook works fine when SalesLogix is not installed. I was getting all kinds of errors when installing SalesLogix. I tried and I tried but I could not get it to work. I called the var for support. Ring, no answer and no call back. I looked at the product’s website but there were no answers. Eventually someone called me back with a simple registry edit to adjust their program to play well with the new DST. The install went great and now Outlook and SalesLogix works fine. If I had only known I could have saved a lot of time. If their website had a big bold notice it would have helped. If the var had sent an email. Well maybe the var had sent an email but it was not forwarded to their part time IT staff. Me/us. On the other hand if the account had kept up to date on their SalesLogix they would not have had a problem. The most current version was already patched up with no special clicks.

When are you going to get bit?

Isa, site to site vpn, routing tables

jim — Fri, 16 Feb 2007 01:43:00 GMT

I have a SBS account with 3 routers and 4 servers. Your typical SBS environment.

Main office:

Hospital router 192.168.10.1

Main office site to site router 192.168.10.254

Internet router 10.0.1.1

PSSSBS 192.168.10.2 and 10.0.1.2

Psschartlogic (sql server that syncs a folder and sql)192.168.10.3

Pssapps2 (for remote timeclock use and to see the hospital network apps)192.168.10.4

Remote office:

Clogic2 (sql server that works with psschartlogic)192.168.9.2

Remote office site to site vpn router 192.168.9.1

I had this account working for a year or more on SBS 2000. I have the remote office connecting to the main office pssapps2 to use the timeclock and to look at hospital xrays and lab reports. The hospital internet portal does not have the most up to date lab reports and xrays so we want to use the hospital router via pssapps2 to see stuff. The main office does not need to use pssapps because the timeclock is on psssbs. All the workstations at the main office can use the hospital router to see xrays and reports.

This fell apart when I installed a new SBS 2003 with ISA 2004. On my SBS I added my routing tables. I added my dns entries and host entries. I could resolve names and everything worked fine at the main office. The remote office was having a hard time reaching the servers or workstations. One doc wants to reach his workstation because he had a few unique things on his workstation. Weird thing was that you could reach psschartlogic and psssbs from the remote office but that was it. When I am in the main office working from any main office computer all machines tested would answer a rdp session.

I made sure the Windows firewall was turned off on the pssapps2. I turned off the Trend firewall. No diff. I turned on the Windows firewall and made sure there were exceptions for remote. I turned on logging and I could see the start of a conversation with a 3389 connection but nothing after that. I clicked on default settings and a warning pops up. I click away. Now I cannot get to pssapps2 because the default is let no traffic in. It was 10:30 at night. I was planning on visiting in the morning. Did I mention that this account is a pulmonary and sleep disorder practice? That means the run 24x7. I get calls in the evening when things do not work. I guess I broke things a little too late for anyone to notice. They must have already gotten their face sheets. Oh, they actually run two remote offices but the second remote office dials in using a Microsoft vpn so they did not suffer problems access any resources because the vpn put them in the 192.168.10.x network.

I arrive at the site and the staff is in jeans. This is always a good sign as it suggests no patients or docs for the day. They were doing housecleaning with minimal computer use. That meant free reign of the server with a bit of server going down warning. I go back to pssapps2 and turn off the Windows firewall. I noodle around and I give up on things. I call Microsoft support. This costs money but usually worth it. I almost never call with a 10 minute problem. I often spend 2 hours and even days working on problems. I had a dfs problem at this same account that I spent 2 months working on. I work in Atlanta. I started the support call over the phone. A month later I actually was in Texas for training and spent a few hours with a Microsoft support engineering in his cube working on the dfs problem. We never solved that dfs problem. Well I sort of solved it when I install new hard drives in the problem server and a new operating system. I then used VisaVersa from http://www.tgrmn.com/ It has a gui interface so I can see what is happening. I bought the basic program and the other program that is supposed to set things up as a service. I could never get the service module to work so I told the program to sync using a task schedule every 15 minutes. Program works great. I have used the tool a few times when xcopy did not work when I did a swing migration. I do a swing every month or so. http://www.sbsmigration.com/ I am cheap so I use the procedure listed in http://www.amazon.com/Advanced-Windows-Business-Server-Practices/dp/0974858072 The book covers a lot of things but I use it mainly for the migration process. Jeff has developed a number of scripts that you can use to make the job easier. I need to watch someone use the scripts so I can appreciate them. Sorry I learned computers in dos and mainframes so I am sort of used to working without gui for some tasks. Anyway the kit he has put together is great and worth every penny.

Back to the current problem. Support looks around and can’t see anything. They state something to the affect that ISA is handling all 3389 and we need to change the ports on the other servers and workstations. She starts to change the listening port and I stop her. I do not want to tell my users click on port 3388 for this server and 3387 for this workstation. I request a bump up to the next level of support. I am passed on. I swear that I am still in India as the next guy has a name I cannot pronounce. I was certainly not John and did not sound like a John fromOhio. Well I was in Canada support. I have called there and they are quite international. In the Texas and Charlotte support offices everyone there seemed to be from the US. Well Ray Fong in Charlotte was not from the US but most were. I guess I am just showing my ignorance. An international company should have people from all over the world working for them. I know some folks I met in Charlotte are working over in the UK for Microsoft.

Sorry, I digress again. I explain to Shahram what my goal is and how I have engineered things. We look around. We change some local network settings in ISA. I had the hospital networks, my main office network and my remote office networks listed. 192.168.10.0-192.168.10.255, 192.168.9.0-192.168.9-255, 172.10.0.0-172.0.0.255, and 192.168.4.0-192.168.4.255. He tried to make the main office 192.168.9.0-192.168.10.255. That made not difference.

Here is my routing table from my SBS. Note that there is nothing exciting or worrisome because all my gateways are private ips the real world cannot reach.

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 10.0.1.1 10.0.1.2 20

10.0.1.0 255.255.255.0 10.0.1.2 10.0.1.2 20

10.0.1.2 255.255.255.255 127.0.0.1 127.0.0.1 20

10.255.255.255 255.255.255.255 10.0.1.2 10.0.1.2 20

24.98.210.192 255.255.255.255 10.0.1.1 10.0.1.2 20

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

172.18.0.0 255.255.0.0 192.168.10.1 192.168.10.2 1

172.18.1.0 255.255.255.0 192.168.10.1 192.168.10.2 1

172.20.0.0 255.255.255.0 192.168.10.1 192.168.10.2 1

172.30.10.0 255.255.255.0 192.168.10.1 192.168.10.2 1

192.168.4.0 255.255.255.0 192.168.10.1 192.168.10.2 1

192.168.9.0 255.255.255.0 192.168.10.254 192.168.10.2 1

192.168.10.0 255.255.255.0 192.168.10.2 192.168.10.2 10

192.168.10.2 255.255.255.255 127.0.0.1 127.0.0.1 10

192.168.10.18 255.255.255.255 127.0.0.1 127.0.0.1 50

192.168.10.110 255.255.255.255 192.168.10.18 192.168.10.18 1

192.168.10.255 255.255.255.255 192.168.10.2 192.168.10.2 10

224.0.0.0 240.0.0.0 10.0.1.2 10.0.1.2 20

224.0.0.0 240.0.0.0 192.168.10.2 192.168.10.2 10

255.255.255.255 255.255.255.255 10.0.1.2 10.0.1.2 1

255.255.255.255 255.255.255.255 192.168.10.2 192.168.10.2 1

Default Gateway: 10.0.1.1

===========================================================================

Persistent Routes:

Network Address Netmask Gateway Address Metric

172.30.10.0 255.255.255.0 192.168.10.1 1

192.168.9.0 255.255.255.0 192.168.10.254 1

172.18.1.0 255.255.255.0 192.168.10.1 1

172.20.0.0 255.255.255.0 192.168.10.1 1

172.18.0.0 255.255.0.0 192.168.10.1 1

192.168.4.0 255.255.255.0 192.168.10.1 1

Routing 101. A computer cannot talk to another computer unless it knows how to talk to the other computer. Sometimes this stuff is handled by a server, sometimes by a router, sometimes magic. Well never magic but it seems that way. If you have worked with Cisco routers you know nothing good happens when connecting two sites until you tell the routers how to talk to each other. You go into their Command Line Interface and program away. This Cisco conversation is not relevant to my problem. It is just a high level overview. On a workstation or server you might have to do a route add –p 192.168.9.0 mask 255.255.255.0 192.168.10.254. You can tighten it up if you need to go to a specific workstation or server or a smaller subnet. That is why you see some persistent routes because I used the –p when I ran the command.

After much clicking here and there we ran some netmon traces at psssbs, pssapps2 and from a workstation at the remote office. 20 minutes later Sharam calls back with info. He talked with some other techs and they are sure ISA 2004 is eating up the traffic. Well that was my thought the whole time as it worked with ISA 2000 on the old server. http://support.microsoft.com/kb/888042 The solution is simple. We did route add –p 192.168.9.0 mask 255.255.255.0 192.168.9.254 on pssapps2 and the doctor’s main office workstation. The remote desktop now works fine. What I never understood was how the psschartlogic would accept rdp. I bet I never looked at the route print. I also bet I added a route add –p back 4 months ago when I installed the new hard drives and the new operating system.

Long story short. Check your routing tables. Add some routes to see if good things happen. Make sure you delete those routes if you added them with a –p if they do not help. If you did not use a –p then a reboot will flush out your experiment.

My exchange is slow or I get disconnects

jim — Thu, 15 Feb 2007 00:24:00 GMT

I get a call about Exchange having issues. A co-worker who is really good with Office applications was out the day before and could not find the answer. I wonder in and start noodling around. The workstations have XP Home except one that has Pro. There is a domain controller running Exchange. There is another "server" running XP Pro. I look at hard drive space and the whole 70 gigs is a C partition. I like to chop my servers up to at least a C: and D:. C for the operating system and applications. D: for data and things that consume hard drive space. My thought is that if somehow the D: partiton get filled up at least the OS will keep running. Well there is plenty of space. I make some dns adjustments. I want the server and workstations to look to the dns server on my domain controller, not some isp. I add the wins service. I set sender filter and ad user filter. I delete some postmaster messages from the queue.

I go to the newest workstation. I set its dns to look at the domain controller. It appears to work ok with Exchange. Each workstation is also popping their email account at the isp. A thing I do not do generally. Especially when they have a CBeyond account which comes with static ips and a pretty robust internet connection. The owner calls me up and I report Outlook appears to be working ok. I click around and things open up quickly in Outlook. Then it starts to act up.

I go to another workstation and it is worse. It could be the 1.6Mghz processor but not really. I change that workstation to use the domain controller for dns. Ipconfig/flush dns. I ping the domain controller aka mailserver. It resolves the name but I get some stutters with timeouts. I do a ping -t mailserver and I see lots of drops. I go back to the server and ping from the server to a workstation with lots of drops. I ping from another workstation with lots of drops. I do not see any spazy lights on the network switch. That ends the troubleshooting for the day. I plan to return in the morning with a good Intel nic and a HP Procurve switch. The HP Procurve stuff has never let me down. I did ask if there was anything new in the office. Second question is if there are any Xray machines around. Xray machines can really screw up your network. Crummy cabling that runs parallel to electic lines or around motors and ductwork can also cause problems.

I start the day with a warning I am disconnecting everyone. I install the Procurve and ping away. An occasional stutter but no drops. Miliseconds are all good so it could be the refresh rate of my eyes is the same as the refresh rate of the pings so I miss a few scrolling up. Outlook works fine.

Things left to do. Get a real AV solution. They are using freeware av that is licensed for home use only. The Exchange server has no Exchange av. Just an expired Norton Corporate. I doubt that XP Pro will happen or SBS. Well if I push the no signs of licenses and no holographed cds for the server and no Exchange cds I might get somewhere.

My dhcp keeps shutting down

jim — Thu, 15 Feb 2007 00:10:00 GMT

I have read a few posts about SBS dhcp shutting down. I don't know if it is just SBS or not but I do know that SBS will shut down it's dhcp service if it sees another dhcp server. I usually do two nic servers with the isp connected to the second nic. I do not recall ever seeing the dhcp server shut down with this config. I did see dhcp shut down at one account. Troubleshooting 101. Turn off all the workstations. It still shut down. Unplug everything from the switch except the sever. I started the dhcp and it stayed running. I start plugging in things and I see the service shut down. Curse the cable person who did not leave a drawing with cable jacks. Double curse the cable tech who comes back after I spent an hour making a drawing and he takes my drawing. Stupid me for not making copies, pdfs and stapling it to the wall. Back to the story. A cheap print sharing device has a dhcp service built in to it. Why? Who knows. I disabled it and all was well. Except the stupid thing reenabled itself. Toss that device out the window.

So I see people post in the SBS newsgroup about this dhcp issue. Someone said unbind the dhcp from the external nic. Sounds easy enough. I keep that thought in mind for later use. Finally I see someone post and I respond with my ISP to external nic, internal to network switch. He unplugged all the devices from the switch except the SBS. He still has the same problem. So I mention the unbind dhcp from the external nic. He posts back "How do you do that?" Fair question so I try it myself. Darned it I see it so I keep looking.

Go to your DHCP manager. Right click on your server name/properties/advanced/bindings. Make sure your only your internal
nic is checked.Try to restart dhcp after you unbind from external nic.

Event logs empty?

jim — Mon, 10 Jul 2006 23:56:00 GMT

I had an empty security log on a servr. There is an article about how to delete the dud .evt log but I think it requires some sort of special reboot to get to it. The event logs are locked as part of the start up process. Well that problem server was overwriting system logs that I needed so I bumped up the size to about 4 gigs. While I was there I bumped up the security log size and I deleted the old log. Instantly an event was recorded in the event log.

I guess I now vaguely recall seeing this problem and a deltion of the log fromthe event viewer interface fixed the problem.

ISA, firewalls, isp vpn and other red herrings.

jim — Tue, 16 May 2006 03:16:00 GMT

I have an account. We suggested they use an isp vpn which is really a private network site to site connection. Not really a vpn in a traditional sense. Remote office can see the server just fine once I add the the route entry route add -p 192.168.9.0 mask 255.255.255.0 192.168.10.254. The main office is 192.168.10.x. The router private ip is 192.168.10.254. I can see my application server also after I add the same statement from the command prompt.

I add the 192.168.9.0 to 254 or 255 in ISA 2004.

They challenge is this. They work from a share on a XP workstation. I goof around for a while with no luck. I also cannot browse the main office from network neighborhood. I download the XP Tools from Microsoft. http://www.microsoft.com/downloads/details.aspx?FamilyID=49AE8576-9BB9-4126-9761-BA8011FABF38&displaylang=en Fuzzy recollection here. I think I entered netdiag -status to see what machine was acting as the browse master. I turn off the Computer Browser service on all the remote workstations. I now can see all the machines at the main office. I cannot see the shares on the important machine or on a test machine.

We discovered that if we make a vpn connection to the public name of the server first we can see the shares on the XP workstation.

We call Microsoft and we describe the situation. Unfortunately we used the term vpn to describe the isp provided private network. We means that I was not the only person on the call. (Not really relevant but I did not want you to think I have a split personality.) I tried real hard on numerous occasions to get Microsoft to stop focussing on that isp vpn. They wanted me to do stuff in ISA to terminate the vpn connetion that was not really a vpn connection. They do some network tracing and the last comment is "That is odd. That connection is being dropped rather abruptly." Well a slight paraphrase but that was the gyst of it. I sent the traces off. My support person was ready to go home as was I. I start the call again the next day with a different tech. Once again we are off on a tangent with the vpn in ISA.

I get some wild hair idea to look for firewall settings. I see no Trend firewall running which is good from a troubleshooting perspective. I discover that you can turn on logging in the XP firewall. I make a connection from the remote office and I see it in the log being blocked. I make the vpn or I try from a computer inside the main office and it goes right through. So now I have a strong suspicion that the XP firewall is the problem. I see no where to change the setting in XP to allow traffic from the remote office network.

Google xp firewall group policy and I get this http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/depfwset/wfsp2apa.mspx Inside of this is the excerpt.

•

Scope

The Scope parameter specifies the addresses from which the traffic is allowed. Type * to specify traffic originating from any source IPv4 address or a comma separated list of sources. The sources can be LocalSubnet to specify traffic originating from a directly reachable IPv4 address or one or more IPv4 addresses or IPv4 address ranges separated by commas. IPv4 address ranges typically correspond to subnets. For IPv4 addresses, type the IPv4 address in dotted decimal notation. For IPv4 address ranges, you can specify the range using a dotted decimal subnet mask or a prefix length. When you use a dotted decimal subnet mask, you can specify the range as an IPv4 network ID (such as 10.47.81.0/255.255.255.0) or by using an IPv4 address within the range (such as 10.47.81.231/255.255.255.0). When you use a network prefix length, you can specify the range as an IPv4 network ID (such as 10.47.81.0/24) or by using an IPv4 address within the range (such as 10.47.81.231/24). The following is an example list of sources:

Note This command is shown on multiple lines for better readability; enter them as a single line.

LocalSubnet,10.91.12.56,10.7.14.9/255.255.255.0,10.
116.45.0/255.255.255.0,172.16.31.11/24,172.16.111.0/24

I open the group policy editor and I make a new group policy called XP Firewall

Remote networks.

If I screw things up it is real easy to delete what I did. Once I added the

remote network I ran gpupdate/force on my test machine. I could now see the

shares on my test machine.

Later that night I did the gpupdate/force on the machine I needed to get to

and it now works.

Sorry for the weird wide entries. When I pasted the Microsoft excerpt everything

started getting way too wide.

Is it me or is it Delta? Adventures in IMF and Exchange.

jim — Tue, 16 May 2006 03:11:00 GMT

I had problems with ISA and Delta's website. Problem went away when I removed ISA.

IMF is wacking Delta email reservation confirmation emails when set at 7. Delta goes through with a lot of porn spam when set at 8.

I looked up all the Delta email servers listed using dnsstuff.com. I add all those ips as allowed ips. Exchange System Manager/Global Settings/Message Deleivery/Connection Filter/Global Accept and Deny List Configuration/Add.

I get an email from my account that reservations from Delta are getting blocked again.

I open my spam manager, IMFFilterManager and I note the sending ip. It is an ip not listed in their mx records. I add that ip.

Rant: If they run their business the same way they run their IT then no wonder bankruptcy is lurking. Never mind, I already have heard how management has driven the company to the position they are in.

If I am doing something wrong let me know but I would hope that I am doing this allow email from an ip correctly.

Keep your server up to date? Bios can bite you.

jim — Sun, 01 Jan 2006 23:34:00 GMT

I had a server delivered that just was a squirelly thing. When delivered it seemed to work just fine. After I left and it was actualy in service was when the adventure began. It would do random blue screens. The event log was useless as the codes did not give me any clues. I tried to use some debug tools but I did not make any sense of things. Susan had mentioned somethng about the blue screen king at Microsoft. Last MVP Summit I attended I met the blue screen king. Maybe I did not meet him but I saw him talking to Susan. When I got back home I got his email, zipped up a crash and sent it off. A few days later he said that the problem was out of date bios on the server. The problem should go away with an update to service pack 1. The obvious thing to do was to update the bios first and then run the service pack. I did both and the server has been quiet ever since.

I know some people have some religion about bios updates. They might install ever latest bios as they see them. I am from the if it is not broke bios school. The frustration was that the blue screen gave no indication to me as to the problem. The expert dug in and saw the problem quickly and gave a solution.

ISA 2000 to 2004 on SBS 2003 upgrade

jim — Tue, 25 Oct 2005 01:36:00 GMT

Two frustrations when you do the upgrade. One is FTP does not seem to work and the second is some SSL sites do not work well. Kevin mentioned the ftp solution. Open ISA management and click on the firewall policy. Look for the SBSInternet Access Rule. Right click and configure FTP. Clear the read only box. Click on Apply.

Second annoyance is SSL sites may not work so swell. Configuration and then General. Look for Define Connection Limits on the right. One of those boxes is set to 40. Change it to 160, Apply, OK, and Apply at the top.

You probably need to get the workstation to update their firewall client. Right click and on the workstations firewall client. I just do the click that lets you check the server name. You can waste a lot of time if you do not update the firewall client.