THE OFFICIAL BLOG OF THE SBS DIVA

SBS 2011 Essentials Backup Issue:
http://social.microsoft.com/Forums/en-US/partnerwinserversbs/thread/7f5d1fae-27a3-44db-9b84-81510ba5ff2f

Problem:
Alerts windows come up saying unable to connect to server when client Dashboard starts on each laptop regardless of whether on or off LAN.
Unable to do configure manual backup from client Dashboard on each laptop with "cannot connect to the windows server computer backup provider service" message

Solution:
I disabled both the laptop and server firewalls with no success. However, I then disabled the HTTP antivirus filter that is part of the Panda Endpoint Security we have installed on each laptop and re-enabled both firewalls. Launchpad, alerts, and backup were then able to communicate with the server. Note this is not the Truprevent firewall component of the Panda antivirus but a component which is supposed to do some prefiltering on browsing activities. We have seen similar issues with other software interacting with the HTTP filter before and have filed a case with Panda to get it resolved

Music to patch by...

http://www.youtube.com/watch?v=PBECqpxLvGA&feature=player_embedded

http://www.youtube.com/watch?v=d-diB65scQU&ob=av3e

http://www.youtube.com/watch?v=kHg-PhseKOQ&ob=av2e

Insert your own fav titles of course.

So some how I missed this in my first read of MS12-020. 

Buried deep in the mitigation section they specifically call out SBS 2003:

Note Windows Small Business Server 2003 uses a feature named Remote Web Workplace. This feature uses TCP port 4125 to listen for RDP connections. If you are using this feature, you should validate that this port is also blocked from the Internet in addition to port 3389.

http://technet.microsoft.com/en-us/security/bulletin/ms12-020

Actually no, that's not right.  Port 4125 only opens up AFTER you authenticate.  It's not sitting there listening for RDP connections.

I'm not saying that you shouldn't prioritze this patch, far from it, but you should understand the risks.  And on a default SBS 2003 UNLESS you specifically open it up in the wizards, terminal server/3389 is not open.  Furthermore 4125 is not sitting there listening for a connection.

http://blogs.technet.com/b/sbs/archive/2006/07/25/443383.aspx

More specifically about the process there.

http://www.smb150.com/story.php?title=eriq-neale
Eriq Neale has been into Apple before the rest of us are getting into Apple, into Kerio before the rest of us were into Kerio, and wrote several key books on prior SBS editions. He was even a SBS support engineer before becoming a SBS consultant and thus played a key role in helping consultants understand the support view and Microsoft support understand the community.

I was remembering tonight when I first remember Eriq.  Back in 2004 Microsoft closed down the Charlotte SBS team and moved the first level support offshore.

Eriq was one of the casualties of that reorganization.  http://msmvps.com/blogs/bradley/archive/2004/12/06/22637.aspx That blog post memorializes that event. 

Wow that's a long time ago in computer time.  Along the way Eriq went from a guy who you might get a call back from in support to the guy that is one of the key players that built a support company called www.thirdtier.net because he wanted to build a support solution for consultants.  He has walked the walk and talked the talk both inside Microsoft and outside.

He along with http://www.smb150.com/story.php?title=damian-leibaschoff are my two personal nominations.

I'd like to ask all of you, readers of this squalk box of mine to vote for both of them.

Both represent a key selling point of Small Business Server - support and the passionate people behind support of the product.

https://training.partner.microsoft.com/learning/contentserver/msrecordings/jkncdvn48fwktnm6/jkncdvn48fwktnm6.wmv

So how many SBS 2011 Essentials are you selling?

How many SBS 2011 Standard are you selling?

Recording of the most recent SBSC Live meeing. 

http://blogs.technet.com/b/srd/archive/2012/03/13/cve-2012-0002-a-closer-look-at-ms12-020-s-critical-issue.aspx

So by now I hope you've read that this is a seriously needed update.  RDP vulnerability. 

So you don't have RDP open from the outside?  Great but it all depends on what exploit is ultimately coded up .  Worst case someone codes up something that can wiggle inside your network and nail rdp ports that are open.

While SBS 2003/SBS 2008/SBS 2011/WHS and SBSE all use tsgateway or authenticated rdp to get inside and thus are not directly vulnerable you'll still want to watch this if you cannot immediately patch.

Right now there's a Metasploit bounty on a future proof of concept.

The clock is ticking ladies and gentlemen.  Patch.  Now.

Got this message from the mailbag tonight...

"You may already know about this, but since you’ve recently blogged about the pricing issue with OpenDNS and suggested alternatives, I switched over to Norton DNS today and started receiving messages from my Cisco ASA that it was dropping UDP DNS replies from Norton DNS because the packets were over 512 bytes in size.

Here’s a typical message:

 “%ASA-4-410001: Dropped UDP DNS reply from outside:198.xxx.xxx.xxx/53 to inside:192.xxx.xxx.xxx.10/57488; packet length 810 bytes exceeds configured limit of 512 bytes” 

It turns out that Windows Server 2003 and 2008 R2 out of the box have support for EDNS enabled (see KB832223 http://support.microsoft.com/default.aspx?scid=kb;en-us;832223) and advertise that fact when they forward DNS inquiries. So, since my local DNS server runs Server 2008 R2, the Norton DNS servers started responding with larger packets, which my ASA then rejected. I’m assuming that OpenDNS doesn’t yet support EDNS so that’s why the issue never came up before. 

Anyway, the solution mentioned in the KB says first check with your firewall vendor and find out how to set your firewall to handle EDNS. Also, as a work around, the article gives instructions on how to turn off EDNS. But since EDNS is needed for newer things like DNSSEC, I didn’t want to turn it off. Instead, I found good instructions on the web about setting the ASA to read the Server 2008 R2 DNS advertisements and automatically set its minimum packet size accordingly (I believe Server 2008 R2 advertises that it supports 4,000 byte packets – I’m not sure about Server 2003 and I guess Server 2008 out of the box has EDNS turned off?) 

The Cisco ASA instructions I found are at: http://www.networkstraining.com/cisco-asa-and-dnssec-probable-issue-with-packet-size/ 

See the “Update” paragraph near the end of the article about the Cisco fix suggestion. That worked for me, but I had to also remove a leftover line from the old configuration that doesn’t go away after inserting the update ASA code suggested in the article. The line to remove reads “message-length maximum 512” - which is the old default.

Hope this helps somebody."

Hey!  Thank you! I bet it does!

Kinda funny on two levels.

Lockergnome's dad sounds like Lockergnome

and I do predict this is what many clients will say about Windows 8....

"How do I go back?"

http://community.norton.com/t5/Other-Norton-Products/Norton-DNS-for-Business-Costs/td-p/667353

"The service is free if you are a small business. In any other case, please send an e-mail to dns4biz@symantec.com for more information"

And that answers that question.

Goodbye OpenDNS, hello Norton DNS.

https://dns.norton.com/dnsweb/dnsForBusiness.do

Sign up there.

Decide what level of filtering there - https://dns.norton.com/dnsweb/displayBuPage.do

Check out NortonDNS and DynDNS

https://dns.norton.com/dnsweb/homePage.do

http://dyn.com/labs/dyn-internet-guide/

 (see http://msmvps.com/blogs/bradley/archive/2012/03/08/7-days-until-the-opendns-ends-for-most-smbs.aspx )

If you do decide to go back to root hints remember that ALL Windows 2008 r2 boxes have DNS resolution problems with root hints and thus all Win2k8 r2 need to enable a registry edit of - http://blogs.technet.com/b/sbs/archive/2009/01/29/cannot-resolve-names-in-certain-top-level-domains-like-co-uk.aspx

So the other day I was listening to an audible book in my car with selections from various old gardening books.  And believe it or not, you can read an actual copy of one of the featured books online - http://www.archive.org/stream/everyladyflower00johnrich#page/n5/mode/2up  A copy of a book written back in 1844.

It does make one wonder if when we go to all digital books, will we be able to keep copies of these books for our future generations to read.  I mean not that I think we need to keep every book written these days for posterity, as there's a few that I would hope that don't end up in future masterpieces, but it does make you wonder if future generations will be able to maintain and actually read all of this stuff we're making digital only.

I'm reminded of the scene in Star Trek IV....

Kirk: You mean the profanity? That's simply the way they talk here. Nobody pays attention to you unless you swear every other word. You'll find it in all the literature of the period.
Spock: For example?
Kirk: Oh the neglected works of Jacqueline Susan. The novels of Harold Robbins...
Spock: Ah, the "Giants".

I mean what will be our generation's Shakespeare?  What will be our giants of literature and music and how will they be maintained so that years from now future generations of whatever creatures are roaming the planets at that time will be able to read what we've written on ...say ...twitter eons from now?  Will Justin Bieber be our generation's Mozart?

http://www.kpmginstitutes.com/taxwatch/insights/2010/pdf/wnit-071210-sales-use-taxation-in-clouds.pdf And other pondering of online things to think about, an interesting consideration as well.  If you make a sale online, where it the sales tax jurisdiction on that?  Where was the sale made for purposes of jurisdiction if you own offices in multiple locations and the servers handling the transactions are located all around the world?

Enought thought to ponder for tonight.

http://forums.opendns.com/comments.php?DiscussionID=13431&page=1#Item_0

http://forums.opendns.com/comments.php?DiscussionID=13009

If you are like many of us in SMB that recommended OpenDNS, the time to stop doing so is next week.  Effective 3/15 they will stop filtering for businesses unless you pay their higher (highway robbery if you ask me) fees for their service.

http://www.opendns.com/business-solutions/small-medium-businesses/benefits/
For 1 to 50 users they quoted me $1,500.  After having a heart attack they dinged around a bit and came back with $750, and then came back with $500.
I have a problem with firstly someone jumping the price that much and then dropping the price when you have a hissy fit in their forum.  It's either worth the original price tag you tried to get me to pay of $1,500 or it's not, folks.  And quite frankly it's not.  It's a service, not a car that I'm negotiating the price tag on.  I'm not buying a car, and you aren't throwing in free floor mats.

http://msmvps.com/blogs/bradley/archive/2011/10/12/quickbooks-2012-on-sbs.aspx

See that?  It's wrong.

Folks are reporting that you CAN get the database server of Quickbooks 2012 on SBS 2003.  The only thing that you will need to watch is KB2290390.  That for sure you will get.

SBS 2003 Performance Report indicates an automatic service is not running:
http://support.microsoft.com/kb/2290390

And while there's a post that talks about issues with SharePoint and .net 4, I'll be honest I think we don't use customized web parts in
 the SharePoint on SBS 2003 to know if something is broken.  I'd argue if you really used SharePoint in sbs 2003, you'd be on SBS 2011 or hosted SharePoint by now.

What you ABSOLUTELY cannot do is put an older version of Quickbooks - the ones that install .net 1.1 on SBS 2011.  They will for sure mangle that IIS and try to reregister 
the .net 2 and 4 as .net 1.1 and it's a mess to put it back.

So you have Quickbooks 2012 installed on the workstations, the database part installed on the SBS 2011 and everything is running okay but you still see

An unexpected error has occurred in "QuickBooks: Premier Professional Services Edition 2012":
DBConnPool::HandleConnectionError errorCode:-6069, dbCode:-103 from file:'.\.\src\ConnPool.cpp' at line 1038 from function:'DBMgr::DBConnPool::init'

An unexpected error has occured in "QuickBooks: Premier Professional Services Edition 2012":
Connection String:CON=QBConnectionPool-Probe-QB_data_engine_22;;DBF=E:\Program Files\QuickBooks\Company Files\QBcompanyfile.QBW;CommLinks="tcpip(IP=192.168.XXX.XXX;TO=5;DOBROADCAST=NONE;port=55348)";ServerName=Server;DBN=e8e25754e7ab419c939de7ef330cdb6a

An unexpected error has occured in "QuickBooks: Premier Professional Services Edition 2012":
Connection Error:Invalid user ID or password
An unexpected error has occured in "QuickBooks":
Returning NULL QBWinInstance Handle

Ignore it.  It's one of those ignore this errors that Quickbooks throws off.

Part one of my blondeness - http://msmvps.com/blogs/bradley/archive/2012/03/07/how-to-be-really-blonde-but-find-something-out-at-the-same-time.aspx

Okay so the part of this experience where I was really blonde but learned something at the same time.

For network admins in a domain to see all alerts in one place while you are logged in as a domain administrator on the server, you have to be part of a specific group of the "Colorado" based machines.

This is not a problem for Home server that is not a DC.  On storage Server essentials R2, add your domain admins to the RA_AllowNetworkAlertAccess group on the server so that when you log onto the machine as a domain admin over RDP you can see all of the network alerts up in the right corner of the alert settings viewer at the top right.

To do this launch server manager in the system tray. 

Go down to the Groups

Find the RA_AllowNetworkAlertAccess group.  Right mouse click go into properties and add your domain admin in there.

So then when you click on the alert section on the right hand side, it will show all alerts.

Added to the wiki doc - http://social.technet.microsoft.com/wiki/contents/articles/7376.storage-server-essentials-build-info.aspx

So this weekend I updated my hyperV parent and SBS box and rebooted the server but not my workstation as I had rebooted it weeks before (this will be important later, stay tuned).  And the next day I started realizing that the annoying every 1/2 hour on the hour alerts I kept getting (see [a] below ) I was not being alerted to before.  And because I want to leave my box in a broken getting alerts state, I was concerned that I wasn't getting alerts.  So I logged into the server and realized that it truly WAS getting alerts but it just wasn't sending them to my network alert enabled launchpad.

I went to the server and disabled/reenabled my rights as a user to get the alerts. 

I went to the launchpad and made sure it said Local and Server

Still only local alerts.  I looked in the log files (ActiveAlerts.xml in the c:\programdata\microsoft\windows server\data folder)

I looked in the log files (Programdata\microsoft\windows server\logs folder).  It was not getting network alerts on the local machine.  Was seeing them up on the server.

(Can you guess yet as to what EXACT thing I forgot to check?)

So I checked with others to see if they had seen this - no one had.  I checked what updates I installed (dang, some .net's wonder if that's it?).  And still no go.  I was still bummed that I didn't have the alerts any more so that I could test future fixes.  So I opened up a support case and got a lesson in blondeness.

Can you guess the setting I forgot to check?

In the Launchpad, I forgot to check the "Local and Network" settings.  After I rebooted the HyperV parent and the SBS server I broke the communication connection to the server.  This flipped the alerts from "Local and Network" to "Local only", thus leaving me with ONLY my own alerts and losing all the network alerts.

The moral of this story?  Don't forget to check the basics. 

Stay tuned for part 2 of this blog post where I found out something I didn't realize.  Something I'll add to the Windows Storage Server Essentials R2 build doc.

[a] “Computer Monitoring Error” on Dashboard or Launchpad - TechNet Articles - Home - TechNet Wiki:
http://social.technet.microsoft.com/wiki/contents/articles/7852.computer-monitoring-error-on-dashboard-or-launchpad.aspx

SBS 2003 to SBS 2011 migration issues - TechNet Articles - Home - TechNet Wiki:
http://social.technet.microsoft.com/wiki/contents/articles/7919.sbs-2003-to-sbs-2011-migration-issues.aspx

The issues noted on this page have scripts that can be obtained for free from Microsoft to complete a migration without having to roll all the way back.

SBS 2003 to SBS 2011 migration issues that you can call 1-800-Microsoft (or your local Microsoft support) and will get support and hotfixes included at no charge.

There are certain migration issues that can be fixed by calling into Microsoft Support. Because these are known issues they will not be charged.

Windows Small Business Server group policies cannot be configured.:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2645313 

You will see the following in your setup log:

The SBSsetup.log that is located at c:\program files\windows small business server\logs will display the following error:

111205.091758.3837: Task: Running Task(ConfigureGP) with Type(Microsoft.WindowsServerSolutions.ClientDeployment.Tasks.GPOTask) and Assembly(ClientTasks.dll).
[4944] 111205.091758.4472: Task: Beginning of task ClientDeployment.GPOTask
[4944] 111205.091758.4677: Task: no Subkey
[4944] 111205.091758.4736: Task: no Subkey
[4944] 111205.091801.1181: Task: ClientDeployment.GPOTask failed with C:\Program Files\Windows Small Business Server\Bin\GPOTask.exe /config:C:\Users\administrator.JOHNBAY-MIG\AppData\Local\Temp\tmpAE02.tmp
[4944] 111205.091801.1191: Task: Finish of task ClientDeployment.GPOTask
[4944] 111205.091801.1191: Task: In Task ConfigureGP: Windows Small Business Server group policies cannot be configured.
[4944] 111205.091801.1201: Setup: Task ConfigureGP failed.

Small Business Server setup attempts to create several group policies. The setup tries to create the polices on the SBS 2011 server. If the sysvol folder is not shared on the SBS 2011 server then the polciy creation tasks will fail. The issue will occur if during the installation process, you receive a pop up message indicating that Active Directory Replication is taking longer than expected and you choose to not wait.

The SBS 2008 or 2011 Standard Migration Wizard may fail to launch due to an incomplete setup:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2533423 

After running the SBS 2008 or 2011 Standard setup in join domain/migration mode, you launch the Migration Wizard (“Migrate to Windows SBS” link in the console) and the wizard crashes.

The MigrationWizard.log in “c:\program files\Windows Small Business Server\Logs” will have content similar to this:

Setup: Unhandled exception: System.TypeInitializationException: The type initializer for 'Microsoft.WindowsServerSolutions.Setup.MigrationWizard.SystemData' threw an exception. ---> System.Collections.Generic.KeyNotFoundException: StringKeyDictionary missing key: 'JoinDomainServer'.
at Microsoft.WindowsServerSolutions.Common.StringKeyDictionary`1.get_Item(String key)
at Microsoft.WindowsServerSolutions.Setup.MigrationWizard.SystemData.ReadSourceServerName()
at Microsoft.WindowsServerSolutions.Setup.MigrationWizard.SystemData..ctor()
at Microsoft.WindowsServerSolutions.Setup.MigrationWizard.SystemData..cctor()
--- End of inner exception stack trace ---
at Microsoft.WindowsServerSolutions.Setup.MigrationWizard.Program.Main()

Due to a timing condition, the SBS Setup may not resume after the server restarts following the installation of updates. Once that happens, the server boots into a desktop and no errors are displayed. The server seems to be functional although a number of configuration tasks are missing.
If you try the install again, you may not see this another time. It can be due to saying yes to updates (so don't say yes during the install).
Contact Microsoft for a script to complete the install.

Exchange Server 2010 incorrectly changes to evaluation mode after you reinstall or repair Exchange Server 2010 in Windows SBS 2011 Standard:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2527626 

This one occurs for various reasons. I've seen permission errors in the mail store cause Exchange not to install and then someone fixes the permissions and then manually installs Exchange. But by doing so, you will find that it's not activated and is in eval mode. If you end up in this condition, follow that KB.

SBS 2011 Standard Edition Setup Crashes Unexpectedly:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2535810 

Due to a timing condition, the SBS Setup may not resume after the server restarts following the installation of updates. Once that happens, the server boots into a desktop and no errors are displayed. The server seems to be functional although a number of configuration tasks are missing.
If you try the install again, you may not see this another time. It can be due to saying yes to updates (so don't say yes during the install).

The sbssetup.log file that is located at c:\program files\windows small business server\logs will contain the following error:

[4624] 110318.160407.0793: TaskManagement: In TaskScheduler.RunTasks(): The "ConfigureSharePointTask" Task threw an Exception during the Run() call:Microsoft.WindowsServerSolutions.Common.IWorker.IISConfig.IISConfigException: IIS Server Administration threw an exception. See inner exception for details. ---> System.IO.FileLoadException: Filename: \\?\C:\Windows\system32\inetsrv\config\applicationHost.config
Error: Cannot commit configuration changes because the file has changed on disk

If you don't want to start over, you can call 1-800-Microsoft for a script to complete the install.

SBS 2011 Migration Installation May Crash Because of User Rights:
http://support.microsoft.com/default.aspx?scid=kb;en-us;2643832 

4728] 111109.222532.5628: Task: Running Task(ConfigureSharePointDatabaseTask) with Type(Microsoft.WindowsServerSolutions.IWorker.Tasks.ConfigureSharePointDatabaseTask) and Assembly(IWorkerConfig.dll).
[4728] 111109.222532.8724: TaskManagement: In TaskScheduler.RunTasks(): The "ConfigureSharePointDatabaseTask" Task threw an Exception during the Run() call:System.Runtime.InteropServices.COMException (0x8000401A): The server process could not be started because the configured identity is incorrect. Check the username and password. (Exception from HRESULT: 0x8000401A)

The setup process runs a task named ConfigureSharePointDatabaseTask that is responsible for configuring SharePoint on the SBS 2011 server. The task runs using a COM+ application named WSSCONFIG. The WSSCONFIG application runs under the security context of the account used for the migration. The account must have the logon as a Batch security privilege. If the migration account does not have the logon as a batch security right or has been denied logon as a batch the task will fail and SBS setup will crash.

This occurs because your com+ permissions are incorrect. If you end up this condition, call Microsoft for a hotfix to put you back into proper migration path.

For other support issues not listed above please review
http://blogs.technet.com/b/sbs/archive/2011/07/01/sbs-2011-standard-migrations-keys-to-success.aspx  and http://blogs.technet.com/b/sbs/archive/2011/07/11/sbs-2011-standard-migration-keys-to-success-part-3-post-setup-and-common-failures.aspx  and http://blogs.technet.com/b/sbs/archive/2010/08/03/the-ultimate-guide-to-sbs-2008-setup-failures.aspx 
and post in the SBS forum - http://social.technet.microsoft.com/Forums/en-US/smallbusinessserver/threads

The Gnome and our fearless SMBMVPtour newscaster has a new gig. 

The photo above is a hint.  Her costume is also a hint about the topic.

Stay tuned for more....

Dear Microsoft.  I doubt you'll listen to me, but perhaps you'll listen to these folks:

http://answers.microsoft.com/en-us/windows/forum/windows_8-desktop/disable-metro/7f0a0f2b-20db-4961-814b-3403400fdf95

and http://www.zdnet.com/blog/hardware/restore-the-start-menu-and-disable-metro-ui-in-windows-8/18767

I think Microsoft needs to take a lesson from Donny Osmond and BMW Group.  Bear with me as I explain.

When BMW wanted to bring out a different, sportier version, they bought a brand and did not taint their more "corporate, expensive" brand of BMW.  Mini Cooper.  This brand is hipper, cooler and all that.

When Donny Osmond wanted to release a new album, they knew his name was such a kiss of death that DJs would not play his music and listeners would not listen.  So they intially released his album without telling anyone who it was. 

What do both of these have to do with Windows 8 and with Microsoft listening? 

Firstly the young generation that Microsoft wants to aim at, the brand of Microsoft is the kiss of death.  Apple is cool.  Google is hip.  Microsoft is... well stuffy BMW.  Expensive and big.  

I can see how Windows wants to be hipper, cooler, Metro-ish, following Apple and Google.  But in doing so it's soooo jarring in the metro interface to flip over to the Windows gui in the background.  It's like getting inside a Mini Cooper and 1/2 way through the drive, the car flips over to BMW and the ride changes and you go whoa, what happened?

Microsoft is trying to build a Mini Cooper on top of a BMW.  They are trying to do it by announcing ahead of time that they are Donny Osmond.  No matter what pundits you see in the news that say that Windows 8 was released to rave reviews, that's not what I'm seeing in the rank and file.

Listening to the final session of the MVPnation where they are talking about tablets and Windows 8 and they are saying that when Microsoft is coming out with all these new keyboard shortcuts, it's not going to happen with users.  Mouse on desktop HAS to be better than what it is now.  I can see Metro on a tablet platform, but on a desktop, it's painful.  I'm going to wear out the Windows key on the keyboard at this rate. 

Microsoft it appears you are chucking out all of your BMW owners just to chase after car owners you don't have. 

You almost need to keep building that BMW model and come out with a Mini Cooper one.  Then don't tell anyone it's you.  BECAUSE it's Windows, and BECAUSE it's such a jarring change, but not a jarring change once you get under the hood a bit, you need to come out with a different name, only on tablets and be a Donny Osmond and don't tell us it's you.

Bottom line, a lot of churn right now.

How to decommission a Windows enterprise certification authority and how to remove all related objects from Windows Server 2003 and from Windows Server 2000:
http://support.microsoft.com/kb/889250/en-us?sd=rss&spid=1167

If you have a SBS 2003 where you or SOMEONE has added the CA role (as it's not default), you need to remove it before you demote the SBS 2003 from the network.

Book mark that KB in case you need it.