Ondrej Žilinec – IT Blog

Imagine you have DHCP server on network. You have all Windows XP and older clients. When DHCP server was not accessible on network during client’s startup, client computer couldn’t get IP address and it assigned APIPA address. This was a problem. So let’s look what’s new since Windows 7.

I prepared following scenario:

• One DHCP server Windows Server 2012 – 192.168.0.10
• One DHCP server Windows Server 2012 acting as default gateway – 192.168.0.11
• One Windows 8 client – DHCP assigned
• One Windows 7 client – DHCP assigned

When I client wants to get TCP/IP settings from DHCP server, there are four DHCP packets (DISCOVER, OFFER, REQUEST and ACK) going on network. Network dump on DHCP server:

This is normal behaviour even in old clients. Now I shutdown client and stop DHCP server. When I started client computer I found out that client computer has IP address it received from DHCP server before reboot.

So let’s restart client again and see what happends. Client computer has same TCP/IP settings, it had before reboot (TCP/IP settings received from DHCP server before I stopped DHCP server). Client computer keeps asking DHCP server to renew TCP/IP settings (using DHCP REQUEST):

So how client computer knows if it has to set cached TCP/IP settings before DHCP server stopped to respond? I assume it depends on gateway and its IP or MAC address. So let’s disconnect gateway from network and reboot client computer. Now client has APIPA TCP/IP settings and it looks for DHCP server by DHCP DISCOVERY:

It means it depends on health of gateway if client keeps TCP/IP settings assigned by DHCP or not. I haven’t seen any ICMP packet to check network healt of gateway so I assume it check MAC address. So let’s look for ARP packets from client to gateway. Looks like client asks for MAC address of saved default gateway IP address. When it received answer, it sets TCP/IP settings to cached TCP/IP settings:

Question is if client computer compares MAC address to some saved one or it just waits for ARP response and doesn’t care of MAC address. Let’s change MAC address of default gateway. Client keeps asking via ARP for MAC address. MAC address is different and client doesn’t set its saved TCP/IP settings (it sets APIPA settings):

So where client computer saves MAC address of default gateway?

Yes, in registry. 🙂 It’s saved under registry key:

and there are subkeys for each interface and under this key there is binary value called DhcpGatewayHardware which contains MAC address:

When client starts it checks for MAC address of its saved default gateway IP address. Then it compares to saved MAC address from registry. If these two MAC addresses don’t match, client deletes all saved TCP/IP settings from registries and uses APIPA (if there is not Alternate Configuration). In background it still looks for DHCP server by sending DHCP DISCOVER packets.

So now we have smaller problem on Mondays when DHCP server is down (of course by accident 🙂 ) and everyone is trying to get to network resources 🙂

I haven’t find any article about this new behaviour on oficial Microsoft websites.

That’s all folks,

When I do some change I note when and what I have done. I use notepad. I used to type date and time to every step I made, for example during migration. My colleague Robert Švec told me about key F5 which puts actual date and time into notepad document 🙂

That’s just a quick quickie today.

At one Microsoft Exchange 2010 server I was receiving too many events number 106:

This event basically describes problem with some performance counter. I had problems with about 10 performance counters and I didn’t want to deal with them separatelly. Exchange 2010 has definition its performance counters stored in directory “C:\Program Files\Microsoft\Exchange Server\V14\Setup\Perf\”. There are XML files which define performance counters. Before you can manipulate with performance counters you need to run Exchange Management Shell and run in it following command:

add-pssnapin Microsoft.Exchange.Management.PowerShell.Setup

This Snap-in allows you to use two Cmd-lets:  Remove-PerfCounters and New-PerfCounters. So let’s do two things which help us to get rid of events 106:

Deregister all performance counters for Exchange:

[PS] C:\Program Files\Microsoft\Exchange Server\V14\Setup\Perf>dir *.xml | foreach { Remove-PerfCounters -DefinitionFileName $_.Name }

Register all performance counters for Exchange:

[PS] C:\Program Files\Microsoft\Exchange Server\V14\Setup\Perf>dir *.xml | foreach { New-PerfCounters -DefinitionFileName $_.Name }

Since I reregistrered all performance counter definitions into Exchange 2010 server I have no problem with event 106.

This was quickie for today 🙂

I always don’t remember commands to list all FSMO roles in domain so I decided to take a quick note into my diary 🙂 :

• Connect to domain controller
• run ntdsutil
• write roles
• write connections
• write connect to server SERVER_NAME
• write q
• write select operation target
• write list roles for connected server

More sexy command is

netdom query /domain:DOMAIN_NAME fsmo

and viola. I know it’s dummy post, but I had to wrote it down 🙂

Today I had problem on one server Windows Server 2008 R2. This server logged error 800B0001 with Windows Update Client:

When I looked at event viewer I saw same error:

and WindowsUpdate.log logged following:

I knew about one issue which is described in this article. But this article didn’t help. When I looked for file C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab, I found out there isn’t such a file. I copied this file from other server Windows Server 2008 R2 and now everything works fine 🙂

So in Microsoft world .cab file is not trusted if it doesn’t exist! 😀 Coool.

ADFS deafult changes language of its pages based on language sent from user’s browser. User’s browser sends http header called Accept-Lanaguage. This means that if, for examle, user with Regional settings set to Slovak accesses ADFS website, all pages are in Slovak language. When someone else comes with Regional settings set to English, all pages are in English language.

There was a need for one ADFS portal I implemented to change ADFS websites’ language to one static language – Slovak (multilanguage option shoule be set off). I digged into ADFS files stored deafult at C:\inetpub\adfs\ls\. After couple minutes I found file called Global.asax.cs which contained something about languages. After coulpe minutes trying to understand .NET I figured out what have to be done to change language to Slovak.

On line number 45 I found following line:

I changed this line to:

Since then everything works only in Slovak language. Just a remark: if you are using ADFS Proxy you have to change this settings on ADFS Proxy server. It doesn’t have to be changed on ADFS server (non-proxy).

Couple days ago I wrote about Remote Assistance. I wanted to make this feature as close as possible to administrators so I decided to implement special item in context menu of ADUC. Let’s do it.

We need to prepare script first. I wrote very simple one:

==========

‘
‘ Script to run Remote Assitance on domain computer
‘

Set wshArguments = WScript.Arguments
Set objUser = GetObject(wshArguments(0))

‘
‘ Check if Remote Assistance is installed
‘

Set fso = CreateObject(“Scripting.FileSystemObject”)
If (fso.FileExists(“C:\Windows\System32\msra.exe”)) Then
 ‘ Is istalled
 Set objShell = WScript.CreateObject(“WScript.Shell”)
 Return = objShell.Run(“C:\Windows\System32\msra.exe /offerra ” & objUser.dNsHostName, 1, true)
Else
 ‘ Is not installed, error.
 Wscript.Echo “Microsoft Remote Assistance is not installed on this machine.”
End If

==========

Let’s save this script as .vbs file into \\DOMAIN.LOCAL\NETLOGON directory. Now when we have a script, we need to create context menu in ADUC. This can be accomplished using ADSI Edit tool. Start ADSI Edit tool and look for CN=409,CN=DisplaySpecifiers,CN=Configuration,DC=domain,DC=local. There look for CN=computer-Display. Right-click on CN=computer-Display and select Properties.

In attribute adminContextMenu add following line:

2, &Remote Assistance,\\domain.local\NETLOGON\RemoteAssistance.vbs

Description:

2 – order number

&Remote Assistance – name of the item in context menu

\\domain.local\NETLOGON\RemoteAssistance.vbs – command to run

When you click OK, OK in ADSI Edit your work is done. Now when you click on computer account you can see and use following context menu item:

And that’s all folks.

Couple times in row I write on command line commands which are misspelled. One of my most popular is command exot instead of exit. 🙂 So I started to look around how I can fix my quick fingers. There is one built-in utilitky to create macros in command prompt (cmd.exe) and it’s called DOSKEY. So I started to play with it and I defined my first command macro:

C:\Users\Cievo>DOSKEY exot=exit

and now let’s list my first macro:

There is one bad thing about this macros. There are active only in current session. This can be solved by exporting all macros into file and import this file everytime you start command prompt. To export macros you can use command:

C:\Users\Cievo>DOSKEY /MACROS:ALL > my_macros.cmd

When you want to import your saved macros, you have to just run file my_macros.cmd.

That’s it and now “exot” 🙂

When you play with w32time service to much and you want to reset it to its default settings you can run following commands:

net stop w32time

w32tm /unregister

w32tm /register

net start w32time

I just needed it 🙂

I built RDS farm (Windows 2008 R2) at one of our customer. Customer has his own website where he has links to Excel files on some share. When some user tries to open file from this website he gets following question:

This is normal behaviour. So let’s press Open and we get following error (The file you are downloading cannot be opened by the default program. It is either corrupted or it has an incorrect file type…):

This says that default program is corrupted or it has incorrect file type. Huh? Excel is working fine and also it’s opening files 🙂 So you can Save file and then open it. Then it works fine.

So I started to google and I found one Microsoft KB article, where problem is described. There is also hotfix to download, but there is no hotfix for Windows Server 2008 R2. 🙂 Luckily there is also workaround specified. You can either save file first and then open (which is what we don’t want) or you can tweak registry keys as described in article:

When I implemented this registry tweaks everything works like it should. I’m happy they also posted Workaround and not just Hotfixes.

Have a nice day,