Active Directory, Exchange, Microsoft Clustering, Scripting, MOM, SQL. : Windows Server

Tips - 4

Nirmal Sharma — Tue, 03 Nov 2009 14:15:00 GMT

A Quick Tip To Disable "Initial Configuration Tasks List" This article explains how you can disable the Initial Configuration Task List at logon. What All Ports Are Required By Domain Controllers And Client Computers? This article explains the...(read more)

Tips - 3

Nirmal Sharma — Tue, 03 Nov 2009 14:03:00 GMT

Group Policy Offers New Functionality in Windows Server 2008 This article explains the improvements to the Group Policy in Windows Server 2008. Domain Controller Options Not Supported By RODC This article explains the DC Options which are not supported...(read more)

Tips - 2

Nirmal Sharma — Tue, 03 Nov 2009 13:44:00 GMT

A Quick Tip To Prevent Users From Accessing The Computer Tab This article explains a quick tip which you can use to prevent users from accessing the Computer Tab on My Computer property. A Quick Tip To Create A User Mode Process Dump File This article...(read more)

Tip - Block Write Access To Run and RunOnce Registry Entries - Rectified.

Nirmal Sharma — Fri, 03 Oct 2008 10:13:41 GMT

Blocking write access to Run and RunOnce registry entries for malware or other unwanted programs running in the system. Your system becomes unstable because of the malware programs running in the background. You identify these programs and kill them in...(read more)

Tip - Block Write Access To Run and RunOnce Registry Entries.

Nirmal Sharma — Fri, 03 Oct 2008 06:15:28 GMT

Blocking write access to Run and RunOnce registry entries for malware or other unwanted programs running in the system. Read more here... http://www.windowsnetworking.com/kbase/WindowsTips/WindowsXP/UserTips/Boot/BlockWriteAccessToRunandRunOnceRegistryEntries...(read more)

Tip - How To Delete System Blocked Files

Nirmal Sharma — Thu, 25 Sep 2008 04:49:59 GMT

How to delete Files/Folders which are being blocked by the processes running in the background. Read more here... http://www.windowsnetworking.com/kbase/WindowsTips/WindowsXP/AdminTips/Utilities/HowToDeleteSystemBlockedFiles.html...(read more)

Tip - How to run your own application when Windows Starts?

Nirmal Sharma — Wed, 17 Sep 2008 16:41:30 GMT

This article explains a registry entry which you can use to run your application instead of Windows default Shell (Explorer.exe). Read more here... http://www.windowsnetworking.com/kbase/WindowsTips/WindowsXP/RegistryTips/Customization/HowtorunyourownapplicationwhenWindowsStarts...(read more)

Tip - How to break into registry to explore HKLM\SAM and HKLM\SECURITY keys?

Nirmal Sharma — Mon, 18 Aug 2008 11:37:00 GMT

This article explains how you can use Psexec.exe to execute registry editor to explore SAM and SECURITY registry hives. Read more here... http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/RegistryTips/RegistryTools/HowtobreakintoregistrytoexploreHKLMSAMandHKLMSECURITYkeys...(read more)

Tip - A Quick Tip to designate a domain controller for client authentications.

Nirmal Sharma — Mon, 18 Aug 2008 11:33:00 GMT

This article explains the use of SRV priority. This applies to Windows 2000, Windows 2003 and Windows Server 2008. Read more here... http://www.windowsnetworking.com/kbase/WindowsTips/WindowsServer2008/AdminTips/ActiveDirectory/AQuickTiptodesignateadomaincontrollerforclientauthentications...(read more)

McaFee File System Filter Driver may cause STOP Error on Windows Server 2003

Nirmal Sharma — Wed, 20 Feb 2008 22:10:00 GMT

After analysing one of the dump on production box I realized that McaFee filter driver which sits between Kernel Mode and File System may cause a STOP error on Windows Server 2003 systems. Generally, this is caused by all anti-virus software.

The module for File System Filter Driver of McaFee is: naiavf5x.sys and filter drivers are: NaiFiltr and NaiFsRec. These drivers provide the real time protection for file systems (AKA files and folders). They sit between Kernel Mode and User Mode and runs with Windows NT Executives. The main purpose of this driver is to filter the I/O Operations for all the file systems (C:,D:,E, etc).

The reason for unexpected shutdown is : PAGE_FAULT_IN_NONPAGED_AREA (50). Generally, this STOP error message occurs when there are some issues with: RAM, corrupted NTFS volume or Anti-virus software (Filter drivers). There could be other possibilities of the above mentioned STOP error message but once we have found the root cause (naiavf5x.sys) after checking the memory.dmp, we should eliminate the other possibilities.

Why this happens:

The file system filter driver of anti-virus keeps the data of its own in the Pagefile area or hard-coded memory. Other Windows processes (specially NTKRNLPA.exe) keep locking this page area when different I/O Operations occur. For example, one application or service is trying to access a file on drive D:\, the Antivirus file system filter driver invokes itself and checks the file (integrity, suspicious file etc) before it can allow application/service to access the file. Since the File System driver is a TSR program (Terminate and Stay Resident), it has to keep its non-volatile data in RAM or pagefile memory area. It retrieves these data at the time of performing I/O Operation (performing an operation when application/service tries to access the file). If this data is not found or not available or locked by other processes then Windows will throw a STOP error message. Okay..you may ask why Windows throws STOP error message, it can also log an event in System log instead of shutting down the system? It doesn't because any the change occurred in Kernel Mode processes/services always result in system crash. The crashed Kernel Mode processes need to re-initialise itself in order to make itself alive back in the system and this is only possible (only for Kernel Mode processes) when whole system is rebooted (this is as per Windows kernel architecture - first Windows Kerenel mode processes initialise and then User Mode processes. Please note - in Unix, this is not the case as Linux/Unix Kernel has been separated from processes or third party services. You can always use INIT or other commands to re-initialise processes). Kernel mode processes always run using Realtime Priority that means they can fight with each other when a conflict raises between functions executed by them.

McaFee filter drivers can be located at:

HKLM\SYSTEM\CurrentControlSet\Services - you can find the McaFee filter drivers for naiavf5x.sys under this key. There is also one more way to check this using Device Manager by clicking on View > Show Hidden Devices and then expand Non-Plug and Play Drivers to find the Antivirus drivers.

Solutions:

1. Update the NTKRNLPA.exe - A patch is available from Microsoft. As per below article, this is a recommended patch for the above mentioned STOP error message.

http://support.microsoft.com/kb/832336

2. Update or reduce the functionality of McaFee filter driver: Only one of two can be used.

a. We can upgrade the McaFee filter driver by installing the latest patch.
b. Fall back to previous version of naiavf5x.sys.

1. Disable the McaFee filter driver temporarily by changing the Start value in above mentioned registry key and then setting the value to 4 = SERVICE_DISABLED - This solution is not recommended as this is required in order to allow McaFee to provide real time protection.

In fact, system will already disable the driver on server:

Start 4 = SERVICE_DISABLED
IMAGE_NAME: naiavf5x.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4187c4b7
FAULTING_MODULE: bae27000 Ntfs
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50

Revisiting - Communication Protocols: Why services work on TCP or UDP or Both

Nirmal Sharma — Thu, 14 Feb 2008 05:37:00 GMT

This article explains why some services work on TCP or UDP or both the protocols. In this article, we will explain the two most commonly services used in network environment: DNS and LDAP.

We often discuss why services use both the protocols i.e. TCP and UDP. These services can also relay on TCP instead of UDP because TCP is a connection-oriented protocol whereas UDP is connection-less then why uses UDP?

There are several reasons explained in this article:

The DNS works on TCP because TCP is a connection-oriented protocol and it requires data to be consistent at the destination whereas UDP is a connection-less protocol and doesn't require data to be consistent or don't need a connection to be established with host for consistency of data.

UDP packets are smaller in size and they can not be greater then 512 bytes. So any application needs data to be transferred greater than 512 bytes uses TCP.

For example, DNS uses both TCP and UDP for valid reasons described below: Note that UDP messages are not larger than 512 Bytes and are truncated when greater than this size. So DNS uses TCP for Zone transfer and UDP for name queries either regular (primary) or reverse. UDP can be used to exchange small information whereas TCP must be used to exchange information larger than 512 bytes. If a client doesn't get response from DNS it must retransmit the data using TCP after 3-5 seconds of interval.

We all know that there shouldn't be any inconsistency in DNS zones - to make this happen DNS always transfer Zone data using TCP because TCP is reliable and make sure zone data is consistent by transferring the full zone to other DNS servers who has requested the data.

The problem occurs when Windows 2000 server and Advanced Server products uses Dynamic ports for all above 1023. In this case your DNS server should not be Internet facing i.e. doing all standard queries for client machines on the network. The router (ACLs) must permit all UDP inbound traffic to access any high UDP ports for it to work.

LDAP: LDAP always uses TCP. LDAP doesn’t use UDP because LDAP and Netlogon services at client side requires a secure channel to be established between KDC server and Client computer to send the data and this can be done only using TCP not UDP. UDP is only used when finding a domain controller (Kerberos) for authentication.

Windows Default User and All Users folders are missing.

Nirmal Sharma — Thu, 27 Sep 2007 16:15:00 GMT

The following knowledgebase article explains the situation in which new users can not log on to local computer or domain.

Scenario:

The following may be the scenario:

1. Newly created users can not log on to the system

2. All Users and Default User profile is corrupted.

3. All Users and Default User profile is pointing to a different location in the registry.

Cause:

By default, when Windows 2000 is installed it creates the two default folders. These two folders are: All Users and Default User. The logon process of user creates the user profile of the newly created user in the \Documents and Settings folder. The logon process uses these two folders to copy the contents to new profile. Windows identifies these two folders by looking at the following registry location:

HKLM\Software\Microsoft\Windows NT\ProfileList

In the right pane, Windows will have the following entries:

ProfilesDirectory REG_EXPAND_SZ %SystemDrive%\Documents and Settings

DefaultUserProfile REG_SZ Default User

AllUsersProfile REG_SZ All Users

Resolution:

You may need to take the following action to correct the abovementioned issues with the user profile:

1. Copy the All Users and Default User from a working computer to problematic computer.

2. Change the location of All Users and Default User profile in registry so that it points to the correct location.

How to Create A Service Dependable on Another Service.

Nirmal Sharma — Tue, 25 Sep 2007 18:30:00 GMT

The following knowledgeable article will explains the procedure you can use to make a service dependable on another service.

You need to know the following things before you can proceed with this:

Short name of the service you are making dependent of.
The registry location of the service.

For example, we have two services: Alerter and ThirdPartyService. Both the Services must exist in registry in order to make this work.

We need to find out the short name of ThirdPartyService. Now, navigate to the following location in registry to locate the short name of ThirdPartyService:

HKLM\System\CurrentControlSet\Services\thirdpartysvc --- this would be the short name of ThirdPartyService.

Next, navigate to the following location in registry:

HKLM\System\CurrentControlSet\Services\Alerter

In the right pane, create a Multi SZ entry as explained below:

Right Click > select Multi-String Value

Then create a entry DependOnService entry and put the short service name of ThirdPartyService as a value of this entry.

Exit the registry editor and restart the Alerter service.

Net Config Server command.

Nirmal Sharma — Sun, 23 Sep 2007 20:16:00 GMT

The following knowledgebase will help you analyze the information useful when typed Net Config Server command. The Net Config Server command is the subset or command line tool to configure the Computer Property page in System applet. This command is very useful to check couple of things.

You can configure the following settings using the Net Config Server command:

Configure the computer description to be shown when browsing through network.
Make server hidden when browsing network.
Configure maximum connection time for the client computers to this server.

The above is an example of Net Config Server command. The above output from this command shows the Server Name, Server Comment etc. You can change the Server comment by using the following command:

Net Config Server /SRVCOMMENT: "Internet Information Server"

In the same way, you can use the following command to change the server's visibility in network:

Net Config Server /HIDDEN: Yes / No

The "Maximum Logged On Users" displays the number of connections this server can accept over the network. It displays maximum 10 that means only 10 users can log on to this server or access files over the network. You can not change this.

The "Idle session time (min)" is the time up to which users can be active on this server. After expiry of this time, the users will be disconnected automatically and they have to log on to again to access files. By default, it is 10 minutes but you can change it to as per your requirement. To change the idle time setting, please use the following command:

Net Config Server /AUTODISCONNECT: 50

How To View The Available Servers On A NetWare Network Using Command Line

Nirmal Sharma — Sun, 23 Sep 2007 20:11:00 GMT

This knowledgebase will tell you how you can view a network servers list on NetWare network.

The following command can be used to display a lit of servers running on a NetWare Network:

Net View /Network:NW

Please use the following command if you want to see the list of resources on a server running in the NetWare Network:

Net view \\computer_name /Network:NW

If you omit the /Network:NW, the command will display the resources shared on specified computer.

How To See the Print Jobs On A Remote Computer Using Command Line

Nirmal Sharma — Sun, 23 Sep 2007 20:09:00 GMT

The following knowledgebase can be used to see the print jobs running on remote or local computer and their size.

Net Print

You can also use do the following using the Net Print command:

Control a Print Job.
Hold a print job for printing.
Delete a print job
Reactive a print job that is held.

The following options can be used with Net Print command:

NET PRINT \\computername\sharename [\\computername] job# [/HOLD | /RELEASE | /DELETE]

\\computername Is the name of the computer sharing the printer queue(s).

sharename Is the name of the shared printer queue.

job# Is the identification number assigned to a print job. A computer the one or more printer queues assigns each print job a unique number.

/HOLD Prevents a job in a queue from printing. The job stays in the printer queue, and other jobs bypass it until it is released.

/RELEASE Reactivates a job that is held.

/DELETE Removes a job from a queue.

How to find the Actual Logon Domain Name of a Client Computer

Nirmal Sharma — Sun, 23 Sep 2007 20:05:00 GMT

The following knowledgebase will show you how to find a client’s actual domain name on which client has logged on successfully.

By typing Net Config Workstation you can see the domain name. The output will be:

The “Logon domain” in above output shows the domain name on which client has logged on successfully. This domain controller of this domain has logged on client successfully. This also shows that there is trust relationship between child and parent domains.

You can also search the following registry key to check which DNS Domain name was used by the Group Policy:

HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\History.

You can see the DCName in the right pane which contains the DNS Domain name of client machine.

Windows Update - Continued...

Nirmal Sharma — Thu, 20 Sep 2007 19:33:00 GMT

You can try to register the following DLLs if Windows Update service is not starting up or having some issue updating/running Windows Updates:

1. Create a batch file and copy the following DLL into the batch file and then double to register the following modules.

regsvr32 c:\windows\system32\vbscript.dll
regsvr32 c:\windows\system32\mshtml.dll
regsvr32 c:\windows\system32\msjava.dll
regsvr32 c:\windows\system32\jscript.dll
regsvr32 c:\windows\system32\msxml.dll
regsvr32 c:\windows\system32\actxprxy.dll
regsvr32 c:\windows\system32\shdocvw.dll

2. Restart the Windows Update and Automatic service

3. Stop the Cryptographic Service

4. Remove the folder \Windows\System32\Catroot2

5. Rename the \Windows\SoftwareDistribution folder.

This above folder is the restoring point for Windows Update service.

6. Now restart the Cryptographic Service.

7. Create another batch file and put the following lines in it and then double click on it to register the modules:

regsvr32 /s Softpub.dll
regsvr32 /s Mssip32.dll
regsvr32 /s Initpki.dll
regsvr32 softpub.dll
regsvr32 wintrust.dll
regsvr32 initpki.dll
regsvr32 dssenh.dll
regsvr32 rsaenh.dll
regsvr32 gpkcsp.dll
regsvr32 sccbase.dll
regsvr32 slbcsp.dll
regsvr32 cryptdlg.dll
regsvr32 Urlmon.dll
regsvr32 Shdocvw.dll
regsvr32 Msjava.dll
regsvr32 Actxprxy.dll
regsvr32 Oleaut32.dll
regsvr32 Mshtml.dll
regsvr32 msxml.dll
regsvr32 msxml2.dll
regsvr32 msxml3.dll
regsvr32 Browseui.dll
regsvr32 shell32.dll
regsvr32 wuapi.dll
regsvr32 wuaueng.dll
regsvr32 wuaueng1.dll
regsvr32 wucltui.dll
regsvr32 wups.dll
regsvr32 wuweb.dll
regsvr32 jscript.dll
regsvr32 atl.dll
regsvr32 Mssip32.dll

Your Windows Update should work.

How do you check if Windows is updating or not?

Nirmal Sharma — Mon, 17 Sep 2007 00:02:00 GMT

Users at technical board ask me many questions related to Windows Updates. They are much worried about networked computers/servers and keep asking questions related to that at boards.

I have been asked many times by users about Windows Updates. A question is still roaming in there mind about Windows Updates - this is whether my server is getting updates or not ! This is really a big challenge in computing environment to keep your computer upto date. If you delay for one day, a virus or hacker may infiltrate and disturb your whole network.

There are many ways to check it. Here are couple of them:

1. Using Registry - you can navigate to the following location in registry and check for Article or Hot Fix no. applied to the computer. If its there that means Hot Fix or updates have been applied successfully.HKLM\Software\Microsoft\updates\Windowsxxxx\ --->>> check out the list of updates being applied.

2. Using Psinfo.exe from Sysinternals. You can download it from Microsoft site or Internet. You can run this exe on a specified computer and it will give you a list of hot fix or updated installed on that computer.

3. Using Add/Remove Programs in Control Panel, you can see the list of updates installed as software programs.

4. You can also check the Windows Update log file. This file gives you information about all the Hot Fix and updates being applied on the server.

Citrix Presentation Server 4.0 issue with Windows 2003

Nirmal Sharma — Mon, 10 Sep 2007 21:33:00 GMT

Couples of forums are going through an issue for Citrix Presentation Server 4.0. This issue is related to Citrix and Microsoft both. Windows is causing a STOP error on servers having Citrix Presentation Server installed. This is caused because of a conflict between Win32k.sys and WDICA.sys module of Citrix.

Currently Citrix is handling all the cases one by one and then supply a private hotfix as the replacement of WDICA.sys file. We have suffered the same and after analyzing the dump, we have found that WDICA.sys and Win32k.sys are conflicting with each other. We have unexpected shutdown on many of our production server on which Cirix Presentation Server 4.0 is installed. After analyzing memory dumps we have found that this is being caused by WDICA.sys and Win32k.sys system modules. WDICA.sys is the module being used by Citrix application and responsible for communication between Citrix Server and ICA Client. Win32k.sys is the Windows Kernel module and always active to process requests coming from other sub-components of Kernel. There was a page fault at the following address for WDICA.sys driver/module:

1. 91c84184 8082cffc 0000008e c0000005 8087bb96 nt!KeBugCheckEx+0x1b

2. 91c84548 808896e2 91c84564 00000000 91c845b8 nt!KeTerminateThread+0xee2 Thread terminated unexpectedly !

3. 91c845c8 80830e58 91c84628 8b371100 80892853 nt!Kei386EoiHelper+0x1d2

4. 91c8462c f4515208 0000000c f4515526 878b4000 nt!ZwYieldExecution+0x1

9f8 91c84668 f4515907 878b4000 91c8468c 00000000 WDICA+0x12208 91c84684 f451621e 00000200 91c846d8 88539ff8 WDICA+0x12907 91c8469c f4516500 878b4000 f452627a 878b4000 WDICA+0x1321e 00000000 00000000 00000000 00000000 00000000 WDICA+0x13500

After analyzing DC (memory area: 1,2,3,4) of module in memory.dmp generated by servers, I have found that one of the function from WDICA.sys replaced the memory area forcefully (because both the process/threads run in higher priority so anyone can replace each others memory area) used by Kernel module (Win32k.sys) and this resulted in termination of all the threads of Win32k.sys. Since Win32k.sys is a Kernel component, any termination in Kernel thread results in system crash or STOP error. After digging more into this, I found that this is an issue with both the modules. The new functions in Citrix module are conflicting with Win32k.sys while shadowing a user session from one Citrix server to another Citrix server. Users keep shadowing session for their purpose and after about 2-3 minutes one of the servers reboots with STOP error.

Solution and couple of points:

1. Its happening because of the two modules: Win32k.sys and WDICA.sys. Probably replacing WDICA.sys should be okay for now but its good to replace Win32k.sys too. A hotfix from Microsoft is available to replace the Win32k.sys module. Please note: Win32k.sys replacement is part of Service Pack 2 and Microsoft recommends to upgrade its product with latest version but one can obtain Wn32k.sys separately from Microsoft.

http://support.microsoft.com/kb/907966

2. For WDICA.sys – You should contact Citrix to obtain the old version of WDICA.sys module. The file version must be 4.0.2198.1.

3. It started since when Hotfix replaced the module WDICA.sys with latest version.

4. It happens when shadowing a user on another server. For example, Administrator is on Citrix1 shadowing a user on Citrix2 and after 2-5 minutes Citrix2 reboots with STOP error.