Ondrej Žilinec – IT Blog

When I wanted to Enable AD users in Lync Server 2010 which were members of Domain Administrators and Enterprise Administrators I received error:

Active Directory operations failed on “DC_server”.  You cannot retry this operation: “Insufficient access rights to perform the operation 00002098: SecErr: DSID-03150E8A, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0”

It’s same problem as Exchange has. You cannot be member of those two groups, because periodically all accounts in this groups have cleared Include inheritable permissions from this object’s parent and set explicit permissions by AD. But if you want to add members of those administrative groups into Lync you can check checkbox Include inheritable permissions from this object’s parent, enable user in Lync and uncheck checkbox Include inheritable permissions from this object’s parent after you are done.

Exchange fixed this issue after couple year in Exchange 2010 SP3. Hopefully we will have some fix also for Lync Server.

Today I was wondering why I don’t see any updates for Lync Server on Windows Update webpage. After couple minutes I found out article about LyncServerUpdateInstaller.exe. This little (50MB) utility will do updates for Lync Server.

Warning: This utility will not patch database. You need to use Install-CsDatabase instead as described in articles published with updates, which update database.

Today I started installation of Standard version of Microsoft Lync server. There are some prerequisites for OS where Lync server will run. Here is a quick step-by-step howto:

• Installation of .NET Framework 3.5. Run following commands in Admin Powershell:
  • Import-Module ServerManager
  • Add-WindowsFeature NET-Framework-Core

• In same Powershell windows run following command to install IIS Feature with all required components:

  • Add-WindowsFeature Web-Static-Content,Web-Default-Doc,Web-Http-Errors,Web-Asp-Net,Web-Net-Ext,Web-ISAPI-Ext,Web-ISAPI-Filter,Web-Http-Logging,Web-Log-Libraries,Web-Http-Tracing,Web-Windows-Auth,Web-Filtering,Web-Stat-Compression,Web-Mgmt-Console,Web-Scripting-Tools,Web-Client-Auth

• Install RSAT-ADDS by running following command in same Powershell windows:
  • Add-WindowsFeature RSAT-ADDS

• Reboot server
• We need to install Windows Media Format Runtime. We can do it by running following command from elevated command prompt:

  • %systemroot%\system32\dism.exe /online /add-package /packagepath:%windir%\servicing\Packages\Microsoft-Windows-Media-Format-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.mum /ignorecheck

• Press “Y” to reboot server again.

Tomorrow we will prepate Schema, Domain and Forest to support Lync 2010.

Today I connected to Windows 2012 server an notices weird little arrow in the left upper corner (full screen):

Maybe this will be usefull for some people. I can use only “Start” 🙂

You can access same Remote commands even not in Full Screen RDP:

Enjoy,

I was debugging problem with SCSI tape library and I wanted to inspect data on SCSI connection. I found great utility on Symantec website. It’s kinda SCSI command sniffer.

Here you can read how to install it.

Here is manual how to use it.

I hope this works with all SCSI devices and not only those supported by Symantec 😉

Here is my best practice to re-create tape library under Symantec Backup Exec (I used version 12.5):

• Delete all tape devices from Symantec
  • You must disable Robotic Library first by unchecking “Enable”

• When it’s disabled you can “Delete” tape Drives and then Robotic Libraries

• Uninstall all Symantec drivers using tapeinst.exe
  • In Symantec installation directory look for file tapeinst.exe file and run it.
  • Choose to “Uninstall and remove all Symantec devices…” and run it.

• There shouldn’t be any tape drives and media changers in Device Manager at this time

• Reboot server

• Install Symantec drivers using tapeinst.exe
  • In Symantec installation directory look for file tapeinst.exe file and run it.
  • Choose to “Use Symantec tape drivers for all supported tape devices” and run it

• Now you should see new devices in Device Manager

• Create new tape devices using hotswap.exe
  • This is really straightforward process without need of any explanation.

And you are all done 🙂

Remarks:

• Sometimes this process doens’t work and you need to change SCSI ID if your library allows it.
• Symantec website about tapeinst.exe
• Symantec website about hotswap.exe

Thanks to Róbert Švec for refreshing my memories 🙂

Here is one reason why I don’t like ESET Antivirus:

I don’t think it needs any comments 😀

Here is official website I saw it at.

Problem

Today I was at one customer which recently installed TrendMicro Worry-Free Business Security solution. It’s firewall and anti-* product. Today I noticed there is no free space on C:\ disk. Trend Micro ate 19 GB! The biggest portion of space was located at C:\Program Files\Trend Micro\Security Server\PCCSRV\Log. There were files called ofcdebug-*.log which were about 150 MB of size and there was lots of them. And there new comming and comming 🙂

Solution

Those file are debugging log files. There is really weird way to disable them. In management website you need to click on little small letter “M” in the logo:

New window appears where you can enable/disable debug logs:

This is really weird way to set logging by looking for some small letter “M” 🙂

More about it on official site.

ShowIT-BrachCache_Zilinec

Ak by ste mali nejaké otázky, sem s nimi.

You can configure expiration period for Certification Template. By default there are default maximum validation periods set to:

• One year for Stand-alone Certification Authority
• Two years for Enterprise Certification Authority

This means you have Certification Template set its validity for example for 10 years, but you can enroll certificates with validity 1 or 2 years (Stand-alone / Enterprise Certification Authority).

This can be changed via registry keys described in KB254632.

Thank you for my colleague Róbert Švec.