Buckeye Gone Bad

Exchange 2003 messages stuck in local delivery queue for one user

jim — Tue, 25 Aug 2009 11:41:00 GMT

I delivered a new SBS 2003 to replace an old SBS 2003. We had some goofed up Active Directory stuff so the thought was we would just start from scratch but pick up the old Exchange database and place it on the new server. That worked fine but we had some issues with speed of backup. The lab backup and remount worked fine but it took many hours to copy the Exchange database. Anyway there was a bit of overlap that for some reason I did an Exmerge from old server to catch 2 days of email. I really do not recall what happened but anyways. Workstations unjoined and joined to new server. Exmerged everyone back in which worked for all but one. Did an Outlook merge which looked ok. On Monday that problem user reported that he was not getting new mail but everyone else was. Seems odd but yes indeed there sat for local delivery were all of his messages. I did an export of his messages from Outlook to a pst. Deleted his mailbox. Purged the mailbox after editing the retention time. Created new mailbox. Mail was still stuck in queue. Google to the rescue. http://www.thecyberwolfe.com/blog/?p=665 I did the regedit mentioned. Mail flowed. All was good. Google is great if you can imagine the correct search words. Plenty of times I do not find what I need. I am surely not a pioneer but I guess some folks never publicly document their victories over IT frustration.

My SBS backups are failing. Media messages.

jim — Tue, 19 May 2009 20:35:00 GMT

I can’t backup.Something about media or it starts a backup and bombs along the way.

I start with the basics. We currently use usb drives to back up for the most part. Can you see the usb drive from My Computer? Yes is good. No means you need to power down the usb drive, check the connections on the usb cable and power it back up. If it still does not appear try plugging it in to your laptop.

Yes you see it. How much free space does it have? How many backups is the server supposed to save to the drive? 6 copies of a 60 gig backup is going to cause problems on a 300 gig drive. Adjust the number of backups saved, get a bigger usb drive or maybe some file cleanup on the server.

File cleanup on the server:

Search for old *.dmp files. Not a lot of point saving them once you figured out why the server is dumping.

Clear out old logs in the System32 folder.

Review your music policy. When you do My Documents redirect to the server you can send a lot of music and pictures to the server that have nothing to do with work.

Encourage users to clean out their workstation Recycle bin. I use Treesize from Jamsoft. I see gigs of crud on the server because people delete stuff but they do not empty their recycle bin. Treesize is a great utility to help find wasted storage.

Search user folders for old *.tmp, *.dmp and ~*.* files. They all waste space if they are not currently in use.

Backing up to a NAS? When you ran the backup wizard did you choose to back up to \\192.168.16.9\share or did you choose \\simpleshare\share ? Well you just introduced a dns issue. The server may sometimes know what you mean by \\simpleshare but do not bet on it. Since you set the NAS at a static ip, add a host entry in DNS on the server for that ip and name. Start\Administrative Tools\Dns. Your domain name\Forward Lookup Zones\your internal domain name. Right click on the right side and add a new host.

Backing up to a NAS makes backing up to a USB drive seem fast. About 10 gigs an hour for the Simpleshare.I am told that E-SATA is pretty fast but I have not tried it.

I can’t print. Tales of tcpip printing with some RDP fun.

jim — Fri, 15 May 2009 14:41:00 GMT

I can’t print. Tales of tcpip printing.

I have recently had calls about I cannot print. The first was a peer to peer I cannot print. I visit and I cannot ping the printer based on the printer tcpip port properties. Is the printer plugged in to the network? Yes for one and no for another. What is the ip? How is the printer getting its ip? What is doing dhcp? So the first account had a router serving up ips starting at 1. They had about 10 workstations. Printer was hanging out at .5 with a static ip. Ip conflict with a workstation. I moved the printer up to .105 and all was good. Workstation that had that ip started working better. Next printer was an old Xerox which prints great when and if it can print. Once it was plugged in to the network and had a non-conflicting ip all should be good. I could open up the web interface. I actually got it to print out some pages.

I got a call about the troublesome old Xerox printer. I had spent a few hours trying to get it to behave last time I was there. For $150 you can get a brand new Brother network printer which for a low volume workgroup works fine. I had given up on that Xerox which was long discontinued with I assume no support. I had no luck with any driver I used. Well I had a bit of luck as it spit out a few pages but not consistently or with any useful words on the pages.

Next account. I can print sometimes but often not. What is the ip? I can ping but I cannot get to the web interface. Printer has a static ip. Who picked that ip? It certainly was not me. What is doing dhcp? I look at the dhcp table on the server and I see that ip is listed for remote access vpn use. So there is the conflict. We set the printer to a new ip up in the 200’s, at a tcpip printer port and printing is solved.

Next account. Another domain but this office has a bunch of satellite offices with workstations that are not domain members. It is an icky network but my hands are tied. 4 laptops can print to their local tcpip printer and they can print when they remote desktop to the application server. I start at the first laptop. It can print from notepad but that printer never shows up when I log on to the application server. Even when I am logged on as a local administrator and as a domain administrator. I disabled anti-virus. I tried moving from wireless to wired. I check that the remote desktop has printer redirected. I check the settings on another laptop and its remote desktop client looks slightly different. I install the rdp6.1 client from my usb thumb drive. Log in and now the printer is properly redirecting.

I go to the next laptop and install rdp6.1. Then I look at the local printer. There is no local printer. I could swear I had all the laptops set up with a local tcpip printer. Added a printer and all was well.

The other gotcha of course is that your application server has to have the correct driver installed for your local remote printer. On the application server you open up printers and faxes. Click on the word File and Server Properties. Choose the drivers tab and add drivers. If you do not have an exact match you will never print. If you review your event viewer logs you should see a message about printer not added for the remote session. That also gives you a good clue about what driver you need to dig up. This also works if you are trying to remote in to your XP workstation and you cannot print.

I like to set up my dhcp servers with an exclusion range that I use for printers. This reduces the chances of ip conflicts. If the customers would just call me when their printer company visits all would be good. I also like to turn off some of the informational logging in server properties so when I have an issue I can find it. With 20+ users on an application server you can have plenty of print logs of which most are useless for troubleshooting problems.

Stuck network switch ports and workstation drivers

jim — Wed, 04 Mar 2009 14:09:00 GMT

I got a call that two workstations at check in were off the network. I suggested running Malwarebytes Antimalware. That has fixed a few machines at that account. Note that I just got this account. It has almost 100 devices at two locations, no domain, no centralized anti-virus console, no dhcp, four servers, a Sonicwall, A Cisco Pix, no network documentation. And they are about 1.5 hours from the house in good traffic. Wah. So the local guy ran the anti-malware program which came out clean. He changed out the workgroup switch which did not help. They were attached to a workgroup switch that was attached to a HP Procurve switch. I have found that HP Procurve switches are just about bulletproof. I delay a server install to do what I hoped was a quick look see.

I do my usual delete temp internet files, click box in IE to delete temp IE files when exiting and I delete temp files from user profile. I updated nic drivers. I ran WinsockXPfix which did nothing. I assume that it might do something but they were Windows 2000 boxes. Nothing I could do would get the workstation or my laptop to see the network. I plugged the network cable in directly to a workstation bypassing the workgroup switch and got nothing. I walked back to the HP Procurve switch with my laptop and still get nothing. My $100 cable tester shows 4 blinky lights the whole way so network cable and patch cords are probably ok. I try another port on the Procurve and all was good. The network switch got a stuck port but I was not going to reboot the switch that had 72 devices plugged in to it, especially during working hours. I do not recall ever having a Procurve port get stuck or fail. Plenty of failures on other switches though. Usually a reboot of the switch will fix it but I have had some switches keep failing and a replacement solves that problem.

Back to the check in counter. My laptop works there with the workgroup switch. One of the workstations that was down was now up. The workstation I did the most experimenting with was still down. When I used the same static ip my laptop worked so it was not an ip conflict. I gave up on that troubled workstation and reported back to the company manager. They are on a slow workstation replacement getting rid of these old W2K boxes. As I went back to gather up my laptop and tools I had one last ditch effort. I disabled the workstation nic and re-enabled it. It started working. Man was I in hot water. Those ladies so much wanted to get rid of those old slow W2K boxes.

Internet Explorer crashes when viewing pdf files.

jim — Tue, 17 Feb 2009 02:55:00 GMT

I got a call that Internet Explorer kept crashing when trying to click on a link. I suggested upgrading to Acrobat 9. That did not help. I did a site visit and got nowhere fast. I tried doing IE reset, deleting temp IE files and deleting temp files. No diff of course. To be less vague the insurance company had links to pdf files. I could save them and open them but when I would click on them in IE to view in IE it would crash IE. I gave up. A few weeks later another user at another account complains of the same thing. I went to Control Panel/Add Remove and removed the Acrobat reader. I went to Adobe and found Reader 7.x which installed fine and worked fine. No more IE crashes. I did not tempt fate by installing newer versions of Acrobat Reader. I will save that for another day.

Microsoft Mail, telnet, Wireshark, WHS, crummy cable internet

jim — Tue, 17 Feb 2009 02:24:00 GMT

I got a call that a person could not send email using Microsoft Mail in Vista. Charter Cable said just use our web interface. Not so easy for my customer. I used Log Me In free edition so I could see what they were doing. Yes indeed it was failing with useless messages. I tried turning off their Circuit City supplied Webroot firewall. No difference. I started a download of Wireshark. The download is taking forever. I tried to download on my workstation and the download was done in less than a minute. I fuss about my slow download speed being so far from my DSLAM. They were downloading at less than 40k. That is pretty slow as they supposedly have Charter Cable high speed internet. Dialup modems are that fast.

While I am waiting for the download I try to use Telnet. Telnet is not installed in Vista Home. I have it on My Vista Ultimate. Wah. I kill the download and try to do some Flash speed testing at DSLreports.com. Speed was less than 1,000. Some tests at 700-800 actually. I restarted the Wireshark download.

Wireshark is one of my favorite tools. I don’t know how to really use it but I can sometimes get clues. I mean I am not so good with filters. Anyhow I see the LogMeIn UDP traffic taking up most of the Wireshark capture. I sifted through all of that and saw some problems with the smtp conversation. I tried to do copy and paste but the LogMeIN Free does not allow that. So from their workstation I logged in to my Windows Home server and placed that file for later look see. So with the failure I deleted the two emails from their Outbox. I sent myself a simple email which made it. I replied. I then replied back attaching the 800k Wireshark capture. It bombed. So that crummy internet speed is biting us. Hopefully the cable company will send out a tech to test the modem and premise wiring.

I logged in to my Windows Home Server to look at that capture. I click on Analyze and Display Filters choosing to show only tcp. Thousands of lines of UDP gone from view. I use a Microsoft article to do telnet tests often enough. That little bit of telnet experience at least let me know what I was looking at. When you see TCP Previous segment lost in red you know something is not so happy. No quit either in the conversation. http://support.microsoft.com/kb/153119 Telnet can be your friend as can Wireshark

VBScript problems on XP boxes going to remote on SBS 2003 and 2008 register mstscax.dll Send users the 08 cert

jim — Fri, 17 Oct 2008 20:02:00 GMT

I have a SBS 2008 at home with a static ip. I have the server and a XP Pro domain member in my little network. To access domain servers or workstations you have to first install the SBS 2008 certificate. So I sent it in an email and installed the cert. I can access the workstation or the server in the domain from Vista boxes. I can access the computers from a Server 2003. I cannot access them from XP Pro boxes. I have tried 4 different XP boxes. 3 have IE7, one has IE8. One had SP2, the others had SP3. I get a script error. Yes I imported the certificate the same way on the Vista boxes as I did on the XP boxes by expanding the zip file and clicking on the exe. Yes the XP boxes can access other SBS 2003 remote web page connect to servers pages so I do not believe the remote desktop add in is broken. Except the IE8 XP box could not access the SBS 2003. It was really broke. I was getting VBSCRIPT errors. I do get the VBSCRIPT error from the XP boxes when trying to access the 2008 network but they worked fine accessing the 2003 network. I googled a bit and that got me no where.

On my Vista box the add on is mstscax.dll. On two of the XP boxes the add on is msrdp.ocx. I could not reach the other XP box so I will assume it has msrdp.ocx. The IE8 box had the mstscax.dll listed as installed but not used. Note that I can access application servers on SBS 2003 sites fine with these XP boxes (except for the IE8 box) so I suspect that the IE rdp stuff is good enough for SBS 2003.

Note that I can reach the SBS 2008 network and computers from a Server 2003 that uses the same mstscax.dll like a Vista box. I logged on to another Server 2003 and I see that it uses the mstscax.dll.

Maybe I am reading the addins incorrectly but it appears to me that the more modern operating systems are not using the same remote desktop add on as XP. I am I misreading the situation? Has anyone else tried to access SBS 2008 domain workstations via remote.realworlddomain.com from a XP box? Rhetorical questions a day later as I was asking for help in forums yesterday and got no answers.

So Susan told me things in an email I did not want to hear. It was related to the SBS 2008 certificate. She says buy a real one and eliminate that problem of how to get a good cert to an end user. I say fooey. What is generated should work. So we can disagree on that point. But she did tell me to http://support.microsoft.com/kb/928055/en-us which fixed the problem on 3 boxes. One of those boxes was running IE8 which had the mstscax.dll listed as an installed add on but not used.

regsvr32 %systemroot%\system32\mstscax.dll,

Note that the IE8 box was not able to reach a SBS 2003 application server correctly so it is not just a SBS 2008 issue. So I am 3 for 3 when registering the mstscax.dll. When I register that on the IE7 boxes I now see that listed instead of the msrdp.ocx file. So I was indeed on to something when I was really cranky last night. Happiness in the morning when Susan gave me the solution.

So how do you get the SBS 2008 certificate to your end user in East Bumbleduck right now when Microsoft says carry it to them on a usb key? I logged in to the SBS 2008. I made a new OWA email and I attached the Install Certificate Package.zip to emails I sent to the remote users. Remote users can access OWA without the cert. So they open the email, right click the attachment and save as. Extract all and click on the exe to install. So the zip file never really left the domain so it does not get munged up by a bunch of email scanners. Sneakernet for the 21^st century?

So my theory of the day is some folks say who cares, it is just SBS 2008 that is having the issue. No one uses that. Well they will real soon. I was getting complaints about SBS 2003 access so it is not really just a SBS 2008 issue.

Thanks to Susan for being the obsessive queen she is.

Holy cow 30 gigs of WSUS content on the wrong drive

jim — Fri, 29 Aug 2008 13:29:00 GMT

I had a backup failure at an account. I noticed that WSUS managed to get installed on my USB backup drive when I did the last WSUS upgrade. 30 gigs of stuff in content. I clicked on just English and ran the celanup wizard. That did virtually nothing over a long, long time. Plan on a day or more on that wizard. I found this post http://forums.technet.microsoft.com/en-US/winserverwsus/thread/59b5c659-b09e-4d05-84dc-04202fa9f136/ where I ended up here http://technet.microsoft.com/en-us/wsus/bb466192.aspx and downloaded the server diagnostic tool. I installed that tool at c:\wsuscleanup tool. I jumped out to the command prompt and did a cd\wsuscleanup tool. I ran this command wsusdebugtool /tool:purgeunneededfiles and a few minutes later my content was now 4.5 gigs. I can now move that folder over to my server hard drive so my backup can work. That will be another task for another day.

Out of Office not working with Exchange 2003 and Outlook 2007, MDBVU32 and OWA

jim — Thu, 24 Jul 2008 16:28:00 GMT

I had a user call saying their Out of Office was not working. A few years back I had another user at the same account report that same issue. I used mdbvu32 to dig out the crummy OOF and all was good when creating a new OOF. I think they refer to this as OOF but I do not get where the letters came from. OOO seems like what it should be. http://support.microsoft.com/kb/248709 or this article with pictures is how you dig stuff out. http://www.msexchange.org/articles_tutorials/exchange-server-2007/tools/troubleshooting-out-of-office.html

So I dug the stuff out just as the local administrator had done but no luck. So here is the rest of the story. SBS 2000 swung to SBS 2003. Years ago though like maybe 2-3 years ago. The user that was having problems has gone on vacation a number of times since the new server. Workstations are XP Pro SP2 and recently upgraded to Office 2007. They were on Office 2003 until a few months ago. So as you know when in doubt work from Outlook Web Access. I cleaned up the OOF with MDBVU32 and then I turned on the OOF from OWA and it worked. OOF absolutely refused to work from Outlook 2007. I swear I cleaned things up more than a few times with MDBVU32 and tried to turn OOF back on in Outlook 2007.

So short take away is if OOF is not working with Exchange 2003 and Outlook 2007, try digging out with MDBVU32 and turn it on with OWA.

SBS team invites your suggestions

jim — Tue, 03 Jun 2008 02:00:00 GMT

http://blogs.technet.com/kevin_beares/archive/2008/05/23/the-windows-small-business-server-2008-ww-community-survey-is-live.aspx

The SBS team is curious about what you think and what you want. Spend a few minutes giving them some feedback. Just as a point of reference the SBS MVPs and the MVPs friendly to SBS are considered the minority. What I mean is that a lot of my SBS friends run ISA and love/like it. They use SQL for line of business uses. We are constantly told that we are a minority. Maybe so, but we sure are vocal. If you love/like ISA or SQL let them know. Even if you don't tell them what you think and what you want. The do listen and lots of noise creates lots of interest.

Slow XP SP2 boot up, updated nic drivers fixed that.

jim — Fri, 09 May 2008 01:35:00 GMT

I had a call that a user's workstation is taking 5 minutes to boot up. I did some user file cleanup which should have nothing to do with the issue as the slow boot is before the user gets the CAD screen. I did an ipconfig/all to make sure dns was correct. I did an ipconfig/flushdns. I then updated the Realtek nic from a 2002 driver to a 2008 driver. I rebooted the workstation and it came up in a minute after the bios finished its stuff.

Some computer manufacturers are not so good about getting you the latest nic drivers. If you have a computer that uses Broadcom nics you usually need to go to Broadcom to get the latest drivers.

Tiny USB thumbdrives drives? Put them to use, or how to flash your server with a thumbdrive

jim — Tue, 29 Apr 2008 13:05:00 GMT

I have all these crummy usb thumbdrives . Crummy means too small to carry a lot of files on. I considered them useless until my Intel server said create a bootable usb thumbdrive and place the updates on the usb bootable thumbdrive. In the past I had to make a bootable floppy and then a few more floppys to update the various Intel utilities. Now they say place them all on a thumbdrive and boot from that. Finally a use for 128 meg thumbdrive.

This guy has great instructions with screenshots for those of us who can’t read instructions.

http://www.bay-wolf.com/usbmemstick.htm

I can't get my default printer to stick on my application server. Make a group policy.

jim — Thu, 27 Mar 2008 01:33:00 GMT

I had a user buy some wham bam Dell portable pc for $4,000. It sure was fast with Vista Ultimate, Blue Ray, Bluetooth keyboard, lots of ram and processor. Well it sort of looks like a laptop but it weighs a lot. The primary business application does not run on Vista so we set him up to use the pretty new application server. He also has a dog slow XP laptop. I could not get the default printer to stick on the application server. I would log in with one laptop and set the default printer on the application server. He would log in with the other laptop and the default printer on the application server changed. The default printer kept flopping back and forth. Every day was a new day.

So here is what I did. Group Policy management. I made a new GPO under domainname.local Windows Components/Terminal Services/Client/Server data redirection. Do not set default client printer to be default printer in a session. Enabled.

Problem of default printer flopping about due to the client machines was solved.

Exchange connection filter using a Real Time Block list, and IMFPerfmon.msc

jim — Sun, 24 Feb 2008 02:36:00 GMT

Here are some things I do. I may miss a step so you may have to
confirm things. After you added connection filter provider you need to
make sure you have checked that stuff in the default virtual server.

Global Settings/Message Delivery right click Properties.
Sender Filtering: Check Filter messages with a blank sender and Drop
connection if address filter matches filter.
Connection Filtering: Add your favorite RBL services. I happen to use zen.spamhaus.org Please visit www.spamhaus.org to review terms and conditions to see if you are eligible to use their services.
Intelligent Messaging Filtering: I set it at 7 and Reject. You want
reject so if there was a valid message the sender receives notice that
your server rejected the message.
Recipient Filtering: Filter recipients who are not in the Directory.

Apply and go to Servers/Servername/Protocols/Default SMTP Virtual
Server right click Properties.
Advanced.
Edit
I check everything but Sender ID Filter.

Make sure you are on Exchange SP2 and you add the registry dword
HKLM\Software\Microsoft\Exchange\ ContentFilterState set to 1. That
key lets Microsoft Updates get IMF definitions.

I open up perfmon.msc from the Run box.
On the icon bar I click on the notebook icon to get the report view.
Click on the + sign next to it to add some counters.
In the Performance Object drop down box look for
MSExchange Transport Filter Sink. Choose all counters and Add.
Back to Performance Object and choose MSExchange Intelligent Message
Filter. Choose all counters and Add. I really do not care for the per
second counters so you can choose select counters from list if you
like.

Now you have a permon that is showing how much stuff is going in to
your Exchange server that the IMF considers spam. It shows you how
many connections are being rejected by the RBL. It shows you how many
connections are being dropped because the recipient is not in your
Active Directory. I do a little math and come up with some interesting
numbers.

Click on File and save as. I save it as imfperfmon.msc. I right click
on the desktop and make a new shortcut. Type imfperfmon.msc in the
next two boxes. Now you have a shortcut on your desktop anytime you
want to see how the RBL and IMF are doing.

Back to your question. If you have the imfperfmon working you can see
a little about what is coming in. Last night I had an account getting
slammed with some mailer daemon nonsense. I need to visit to see what
is really going on.

Mail may still be stuck in the queue as your server is trying to send
out Non Delivery Reports to bogus addresses. If you have done the
clicks I mentioned and others hopefully the junk will be blocked.
Those NDRs will die off after a few days. The default setting in
Exchange is to try to deliver for 2 days and then give up. There is a
trick to flush all the messages out but it may be just as easy to let
them die out on their own. As long as you do the clicks I did you
should eventually be ok.

Another rant is that I do in Exchange System Manager. Properties of
the Default SMTP Virtual Server/ Access/Relay. I have the button only
in the list. Below that list I do not have the checkbox clicked for
All computers that successfully authenticate. There is no computer
that I want to relay against my server. I want everyone to be using
Outlook or Outlook Web Access to deal with email. That is just another
way for people to cause trouble. Of course after a misadventure I get
to suggest now is the time to have passwords 8 characters long and
having more than 2 things from the keyboard. Since there are at least
6 easy things on the keyboard it should be not hard to create and easy
to remember complex password.
http://www.microsoft.com/protect/you...rd/create.mspx

File association woes as a limited workstation user

jim — Tue, 12 Feb 2008 04:51:00 GMT

I get a call that a new user cannot open tif or jpg file. When they go to Windows Explorer the file association is greyed out. I do a Google search and turn up a registry value of hklm\software\microsoft\currentversion\policies\explorer add dword NoFileAssociate with a value of 0. Or if this is missing it is the same as a 0. Well I searched and searched for other answers as this key did not help. The searches also suggested the HKCU but I would get an error when trying to create a new dword when logged in as a workstation user. I tossed out a white flag. Merv Potter saw the flag. He said it was a power user issue. Well I created a new user on my XP laptop as a limited user. I could not do that file association task. I made the new user a local Power User and he could. I logged on to the workstation in that domain. I made Domain Users Power Users of that workstation. That fixed the problem. Well actualy it did not as that level is a bit higher than I would like but so it goes until someone tells me a better solution.

ADMT and frugal Swing Migration

jim — Thu, 27 Sep 2007 17:41:00 GMT

I got a call from a co-worker at a pop up account. You know the people that call wanting a little help but not a lot. They got a new server with hardware SATA raid 1. They installed SBS on a 500 gig partition. Personally I like to see 30-40 gigs for the OS and one or two other partitions. One partition for Exchange databases. Another partition for data. I like to keep the C: partition fairly free of stuff. My though is that I can scandisk or defrag a 40 gig partition in short order. To scandisk a 500 gig partition might take days. I don not know but it takes pretty long to scan 40 gigs.

They chose to do ADMT. Last time I tried ADMT it bombed. It bombed on moving workstations because that other account had manually entered in ip and dns info on the workstation. Since then I have learned how to do Jeff Middleton’s Swing migration. I do the frugal $50 version using the steps in SBS 2003 Advance Practices book. I have learned that you need to make sure Windows Firewall is disabled when you are doing swings but other than that the swing is pretty easy. You grab AD. You clean it up. You build the new SBS starting with the OS. Grab the AD. Finish installing SBS. Move the Exchange databases and restore the shares. I do not have to touch workstations. I can knock workstations offline for a few minutes while I unplug the old SBS from the network and plug in the new SBS. I need a bit of time to move the Exchange databases over. That might be an hour if the database is not too big. Moving files over can be fast or slow depending on quantity. You might have some user group membership adds. I use Microsoft’s print migration tool to grab printer shares. That usually works.

Back to Thursday night. The goal was to have things up and running in the morning. Well they did have a late start. ADMT bombed moving computer accounts over. I heard about that late Thursday. Bedtime late for me. I suspect the fact their router was providing dns really screwed up that task. More on that later. They marched on moving the Exchange and company files over. That was taking forever which meant continue the project in the morning.

I checked in the next morning and they were starting the unjoin/rejoin workstations. By the time I arrived 1.5 hours later they had one workstation on the new domain. File and Setting wizard was run before hand we tried to move the workstations to the new domain. That worked ok on most of the machines but not all. Many of the workstations were slow to boot, painfully slow for modern workstations. I suggested that the router providing dns was a bad idea. That may have fallen on deaf ears. At the workstations I touched I started manually entering in dns and wins. That helped the machine when applying settings. It also helped when Outlook profiles had to be set to point to the new server name.

Today is Friday. I spent another 2 hours today cleaning up some loose ends with user profiles. I noticed that a few of the workstations would not work from /remote. They also would not accept remote assistance from the SBS Server Management console. The one machine that did work both inside and outside had the dns and wins entered by me. They also had a hodge podge of workstation AV. It seemed that every workstation had a different AV client. I suspect a few were not up to date.

I fixed the WSUS 3 that would not open from Server Management. The SBS official blog has some clicks for that.

http://blogs.technet.com/sbs/archive/2007/05/01/wsus-3-0-on-sbs-white-paper-released.aspx

So the take away if you insist on ADMT is to make sure that the SBS is doing all dhcp. Make sure that the workstations are getting all their ip, dns and wins from the SBS. Of course my personal opinion is to do a swing migration.

Another note from that project. I set up zen.spanhaus.org in the Exchange connection filter. 80% of the incoming was getting blocked. 20% of the remaining was getting blocked by IMF 7. Users were asking where all their email was. I told them that we were blocking spam. Another useless statistic. Over 2360 messages blocked in less than 24 hours for a 10 user office. They might be a bit more productive not sifting through all that spam.

Another takeaway. Do not schedule a new server install the day before the project manager is heading out of town. Do not schedule a new server install 2 days before you move to a new office.

If I am correct and ADMT computer migration bombed because of router dhcp then maybe ADMT would have worked fast enough. Since it did not work they spend 12 of my (coworker David and I) hours plus a day of their IT lead working on the project. The staff did almost no computer work all day Thursday. If we had done a swing and started it Thursday morning, the staff would have worked as long as they wanted until maybe 2:00. I would have knocked them off for an hour while I pulled the Exchange databases over and rebooted their workstations. The would have been a bit off line for another few hours while the 30 gigs of data was pulled from the old server to the new server. If my math is correct swing for $960 or ADMT for $2400. Granted ADMT might have worked without the router dhcp nonsense but that was before I visited. So ADMT might have been pretty inexpensive. Of course if the account had bought Swing for $200 then they would not have had the projected $960 or the actual $2400 fee.

Nobody asked me so maybe I could have saved ADMT, Maybe not. I do know that I have done Swing at a two office location with 30 users and only an hour of down time and a few hours of printer cleanup. I did not have to touch one workstation. I like that.

Exchange 2003 IMF filter is not working. Blackberry users revolt.

jim — Thu, 09 Aug 2007 13:58:00 GMT

I have an account that uses Blackberries. We Have Blackberry Enterprise Server installed on the server. Blackberry users are complaining about spam. The Exchange IMF was not working. We had some issues with that Exchange server a few months ago and it appeared to be working ok. Yesterday I discovered that the IMF was not working at all. Mail is delivered like this. I am not an Exchange Geek but based on what the Blackerries see I am pretty sure this is how it works. Exchange receives the email. Exchange looks at all the settings you have in Global Settings/Message Delivery/Properties. It also looks in the Administrative Group/First Administrative Group/Servers/Servername/Protocols/SMTP/Default SMTP Virtual Server/Properties/General/Advanced/Edit to see what you turned on. All those things you have checked like blacklists, filter blank senders, filter addresses not in Active Directory are run. Exchange continues to deliver the mail after processing those rules. BES grabs a copy of the email after that initial set of rules is run. The messaging AV gets the email and does its sorting but the email has already been sent off to BES. None of your Exchange server based messaging AV is going to help as the messages have were forwarded to BES. On this server I had an error or informational message that popped up in System Manager that the Microsoft support person said we could ignore if the server seemed to be working. One way to sometimes cure a problem is to reapply a service pack. Exchange SP2 refused to install. I found some articles about uninstalling the IMF v1. Then I found a post in the SBS group about how do it this way for either v1 or v2. I stopped all Exchange services. I stopped all messaging av. Stopped SMTP service. Stopped some of the Blackberry services. I renamed C:\Program Files\Exchsrvr\Bin\MSCFV2 folder to oldMSCFV2. Made backup of Exchange registry key. Deleted ContentFilterState and ContentFilterVersion keys. Deleted C:\exchsrvr\bin\contentfilter.dll. I should have renamed that but oh well. Applied Exchange Service Pack 2. I opened regedit and I added HKLM\Software\Microsoft\Exchange dword ContentFilterState is 1. This lets you get updates for IMF via Microsoft Updates. You need to restart the SMTP service for this new key to go in to effect. I tried to run Microsoft Updates but it did not see that I needed any new IMF definitions. The "current" definition in MSCFV2 was dated 2005. I copied folders from oldMSCFV2 folder to MSCFV2. My latest definition was in the folder 6.5.7942.0. regsvr32 c:\Program Files\Exchsrvr\Bin\MSCFv2\6.5.7942.0\MSExchange.UceContentFilter.dll I started all the Exchange, Blackberry and Trend Messaging services. I had one Messaging service that was stuck stopping. I used Process Explorer to kill that process so I could restart it.

It has trapped 244 spam with SCL or 7 or larger in less than 8 hours. That is about 25 less spam going to the four Blackberry users. The rest of the users have a little less to sort through. On the other hand the Exchange administrator now will have 1,000 messages a day to wade through.

I have no way to contact the Blackberry users to see if this working IMF is helping but the Outlook users have less to sift through.

I go to this site for a number of great Exchange tutorials.

http://msexchange.org/

Slow boots and chkdsk errors, bad hard drives that the hardware raid thinks is ok

jim — Thu, 19 Jul 2007 13:17:00 GMT

I had a call a month ago on a Tuesday night about a server that would not reboot. It kept popping up errors and wanted to run chkdsk. It appeared to finally come up and the person who called went home. I tried to remote in to the server and it would not answer. I knew I would have a morning visit. I appeared the next morning and I tried every variation of chkdsk I could come up with. That could be a humorous comment as I know of /f and /r. I called Microsoft tech support and we booted off the install cd. Running chkdsk when there is no OS in the picture nets better results. Well not this time.

This was hardware raid 1 and I was getting array good in the bios boot up. I unplugged one of the drives and tried to run chkdsk again and again. It seemed that I might get a clean /f but the next /r would find issues. I could get the server to boot but not too fast and I never got a clean scandisk twice using chkdsk/f. Once again it is Raid 1 so you have 5 choices. Bad disk 1, Bad disk 2, both disks bad, bad controller card, bad motherboard. There might be other problems but those choices cover the likely scenarios. I gave up on the one hard drive and started working on the other hard drive. That second hard drive cleaned up nicely and booted happy as can be. We lost some email as the backup did not run correctly over the three day weekend. I recovered files from Tuesday but no luck on email. That was painful. What was also painful was my chice of drives. If I had better binary luck I would have ended the Microsoft call in a 1/2 hour instead of 3 or 4 hours. The support engineer was great. He had about 5 years of support experience.

A month later a fellow who used to work with me calls stating that his old SQL server is slow to boot, appears to be running but users are not able to work. I suggested unplugging one hard drive or the other as he is using raid 1 also. He never called back so I bet one of his hard drives was acting up.

You ask “Would a hardware Raid 1 with hot swap?” The problem was the hardware thought the drives were fine. The operating system did not see the drives as happy. I am guessing that no, a hot swap would not have helped.

Lowest user permissions, folder redirection and applications that do not run because of a weird profile

jim — Thu, 19 Jul 2007 12:26:00 GMT

I have a goal sometimes of lowest user privileges. Not often enough though. End users have a much harder time installing junk programs if they are not a local administrator. Drive by malware may have a harder time getting installed. My newsgroup buddies JeffM and SusanB have given me clues and tools to work on making users workstation users. As you may know too many vendors say “make the user an administrator” so their application can work. You can use tools like filemon and regmon to see what is really going on when you run an application. Those two tools let you watch what is happening with the files and the registry. I generally know or assume two things for my down and dirty test. The user needs to have full control of the application folder and the HKLM/Software key for that application. OK, that assumption might be stretching how elevated the permissions need to be but that is where I start.

I am logged in to the workstation as Administrator. Well I might be logged in as a domain administrator but usually I log on as administrator. I then go in to Control Panel/Add-Remove to uninstall any “junk” that either came with the workstation or the user installed. Junk is subjective but Google Desktop, Yahoo toolbar for IE, screen savers, shopper stuff and anything else that I have been bit by in the past. I delete temp files from all the users, delete their IE temp files and do a defrag. I might scan for malware, spyware and viruses if the machine is working weird. That is just some of my housekeeping 101 I do.

I go to My Computer, right click and Manage. I go to local users and groups. I look at the administrator group and remove anyone who should not be in there.

I then log on as the worker bee and let them work. If everything is working well, great. The registry and folder permissions worked every time for me. I have heard application tech support say to me that the user needs to be an administrator. My reply is “How is your Vista development going?” I have 4 third party doctor office software packages I work with regularly. I do have to call in on occasion. Sometimes I hear that administrator nonsense which I explain away.

So every Jim story has a long story it seems. I did this last week for E-Mds. It worked fine. The short story was that a user could not scan in E-Mds unless the workstation log in was a domain administrator log in. I did my registry and file permissions. We logged in as the user that usually sits at the workstation and did a test scan. Things worked great. I get a call a day later and it is not working. I click away trying to find out why and get no where. I call E-Mds support and we start working on things. I happen to like their support. The folks are friendly and we always solve the problem, usually pretty quickly. Well today was not a quick call. We click around and nothing helps. I set the local workstation administrators to domain users and that did not help. That should have eliminated any folder permissions issue on the workstation. I opened notepad and did some save as to the folder on the server that the application uses. That should eliminate server folder issues.

I create a new user on the domain. I log on to the workstation as the new user and E_Mds scanning works fine. That eliminates the workstation and the server permissions. It is down to the user. In the past I have deleted workstation user profiles when something odd just keeps biting me. Almost always seems to work. It did not this time. I had the same issue when I logged back on as the problem user. I did see that the user was having a new profile built as it took a few minutes for the first log in to happen. I inherited the SBS so I am not positive about everything that has been done. I saw no sign of desktop redirection or user profile redirection. I did have My Documents redirection though. I looked in the user’s folder on the server and I saw nothing weird. That is not true. I did have an issue saving a shortcut to her folder but I could create new txt file to her user folder. While she was logged off I renamed her folder 1aajohnson. I made a new aajohnson folder and set the security permissions correct. I logged on as aajohnson and E-Mds scanning worked fine. I copied all of her documents over from her old folder to her new folder. Everything still worked fine.

So the take away. Not only can you get bit by a weird local user profile but a redirected user folder.

I can't see shares on the server!

jim — Fri, 23 Feb 2007 18:27:00 GMT

start
Run
Cmd and enter
ipconfig/all
The gateway, dns and wins should be your SBS
Ping ip of gateway or your SBS if the gateway is not the same as your WINS

If you can ping your server great.

If you have a Dell go to services
Start
Run
Services.msc
Make sure Network Location Awareness is set to automatic.
Go to your network properties.
click on Advanced
Advanced settings
Make sure that your LAN is at the top.

Start
Control Panel
User Accounts
User Accounts
Advanced
Manage Passwords

You could reboot for th enla and nic stuff to stick. The cleared passwords problem should work right away. I also clear passwords in Internet Explorer. Tools/Internet Options/Content and Autocomplete.