Ondrej Žilinec – IT Blog

Where there is a problem with AD replication, there is most of the time problem with DNS. Most of the time there are bad DNS records or missing DNS records. There is cool utility to check DNSLint.exe from Microsoft. It is designed to do all manual check I do when trying to solve AD replication problems.

You can download it from here and also read more about it.

It’s bad it’s not included into operating system by default.

Couple days ago I migrated fileserver. We moved redirected My Documents for users on another server. We also hided these shares behind DFS namespace to make it more manageable in future. But we found out problem with this setup –  offline files. Windows XP kept offline copies of old and new redirected files. We had to clean this offline data database. I setup start up script:

@ECHO OFF
IF EXIST C:\OfflineFilesClean.txt (
  REM Do one thing
) ELSE (
  reg.exe add “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache” /v FormatDatabase /t REG_DWORD /d 1 /f
  echo Vymazane > C:\OfflineFilesClean.txt
)

This script was dedicated just for Windows XP, so I had to apply GPO using WMI filter:

SELECT * FROM Win32_OperatingSystem WHERE Version LIKE “5.1%” and ProductType = “1”

This script would work also on Windows 7 and Windows 8, but those OS didn’t have problem.

That’s all for today,

We had some problems with backup system backing up Windows Server 2012 deduplication enabled volumes. We decided to disable Data Deduplication on volume. After volume was converted back into “non data deduplication mode”, we found out that all Shadow Copies meta data was lost. It means all “Previous Versions” were lost. I really don’t see any reason to act like that, but there is probably some. It would be great if Windows warns you before you do the change. But it doesn’t 🙂

Have a nice day,

I had weird problem today. Customer called that GPO I have created to set Proxy server for Internet Explorer doesn’t work anymore on Windows 7. He was right. There was Internet Explorer 10 installed on Windows 7. Proxy configuration was made by Internet Explorer Maintenance:

This was not applied on Windows 7 Internet Explore 10, even there was eventlog it should be applied. Then I set these settings using GPO Preferences. I could create settings just for IE 5,6,7 and 8:

I have decided to create settings using Internet Explorer 8. I set all settings I wanted and saved GPO:

Nothing happened. It’s because this settings are limited to Internet Explorer 8.0. So we need to dig into XML file which handles these settings. XML file InternetSettings.xml is located at \\DOMAIN\SYSVOL\DOMAIN\Policies\{76C1E5D1-9CA6-4682-AD41-FD038DDED1E9}\User\Preferences\InternetSettings. When you open this file you can see XML file with all settings. There is one attribute called MAX which defines on which version these settings are applied. I changed it to value “10.50.0.0” and now everything works:

What a stupid work around 🙂

When you install Exchange in environment you want to allow users to log into mails using their e-mail address. If your domain name is different from your e-mail domain, you have to add UPN suffix first. More abour it HERE. Then you need to change User Principal Name into Primary SMTP Address. I wrote little script to do so:

Get-Mailbox |
  ForEach-Object{
   Write-Host “For: ” + $_.SamAccountName
   Write-Host ”   – change UPN from: ” + $_.UserPrincipalName + ” to: ” + $_.PrimarySmtpAddress
   Set-ADUser -Identity $_.DistinguishedName -UserPrincipalName $_.PrimarySmtpAddress
 }

Have a nice day,

Imagine you have DHCP server on network. You have all Windows XP and older clients. When DHCP server was not accessible on network during client’s startup, client computer couldn’t get IP address and it assigned APIPA address. This was a problem. So let’s look what’s new since Windows 7.

I prepared following scenario:

• One DHCP server Windows Server 2012 – 192.168.0.10
• One DHCP server Windows Server 2012 acting as default gateway – 192.168.0.11
• One Windows 8 client – DHCP assigned
• One Windows 7 client – DHCP assigned

When I client wants to get TCP/IP settings from DHCP server, there are four DHCP packets (DISCOVER, OFFER, REQUEST and ACK) going on network. Network dump on DHCP server:

This is normal behaviour even in old clients. Now I shutdown client and stop DHCP server. When I started client computer I found out that client computer has IP address it received from DHCP server before reboot.

So let’s restart client again and see what happends. Client computer has same TCP/IP settings, it had before reboot (TCP/IP settings received from DHCP server before I stopped DHCP server). Client computer keeps asking DHCP server to renew TCP/IP settings (using DHCP REQUEST):

So how client computer knows if it has to set cached TCP/IP settings before DHCP server stopped to respond? I assume it depends on gateway and its IP or MAC address. So let’s disconnect gateway from network and reboot client computer. Now client has APIPA TCP/IP settings and it looks for DHCP server by DHCP DISCOVERY:

It means it depends on health of gateway if client keeps TCP/IP settings assigned by DHCP or not. I haven’t seen any ICMP packet to check network healt of gateway so I assume it check MAC address. So let’s look for ARP packets from client to gateway. Looks like client asks for MAC address of saved default gateway IP address. When it received answer, it sets TCP/IP settings to cached TCP/IP settings:

Question is if client computer compares MAC address to some saved one or it just waits for ARP response and doesn’t care of MAC address. Let’s change MAC address of default gateway. Client keeps asking via ARP for MAC address. MAC address is different and client doesn’t set its saved TCP/IP settings (it sets APIPA settings):

So where client computer saves MAC address of default gateway?

Yes, in registry. 🙂 It’s saved under registry key:

and there are subkeys for each interface and under this key there is binary value called DhcpGatewayHardware which contains MAC address:

When client starts it checks for MAC address of its saved default gateway IP address. Then it compares to saved MAC address from registry. If these two MAC addresses don’t match, client deletes all saved TCP/IP settings from registries and uses APIPA (if there is not Alternate Configuration). In background it still looks for DHCP server by sending DHCP DISCOVER packets.

So now we have smaller problem on Mondays when DHCP server is down (of course by accident 🙂 ) and everyone is trying to get to network resources 🙂

I haven’t find any article about this new behaviour on oficial Microsoft websites.

That’s all folks,

When I do some change I note when and what I have done. I use notepad. I used to type date and time to every step I made, for example during migration. My colleague Robert Švec told me about key F5 which puts actual date and time into notepad document 🙂

That’s just a quick quickie today.

At one Microsoft Exchange 2010 server I was receiving too many events number 106:

This event basically describes problem with some performance counter. I had problems with about 10 performance counters and I didn’t want to deal with them separatelly. Exchange 2010 has definition its performance counters stored in directory “C:\Program Files\Microsoft\Exchange Server\V14\Setup\Perf\”. There are XML files which define performance counters. Before you can manipulate with performance counters you need to run Exchange Management Shell and run in it following command:

add-pssnapin Microsoft.Exchange.Management.PowerShell.Setup

This Snap-in allows you to use two Cmd-lets:  Remove-PerfCounters and New-PerfCounters. So let’s do two things which help us to get rid of events 106:

Deregister all performance counters for Exchange:

[PS] C:\Program Files\Microsoft\Exchange Server\V14\Setup\Perf>dir *.xml | foreach { Remove-PerfCounters -DefinitionFileName $_.Name }

Register all performance counters for Exchange:

[PS] C:\Program Files\Microsoft\Exchange Server\V14\Setup\Perf>dir *.xml | foreach { New-PerfCounters -DefinitionFileName $_.Name }

Since I reregistrered all performance counter definitions into Exchange 2010 server I have no problem with event 106.

This was quickie for today 🙂

I always don’t remember commands to list all FSMO roles in domain so I decided to take a quick note into my diary 🙂 :

• Connect to domain controller
• run ntdsutil
• write roles
• write connections
• write connect to server SERVER_NAME
• write q
• write select operation target
• write list roles for connected server

More sexy command is

netdom query /domain:DOMAIN_NAME fsmo

and viola. I know it’s dummy post, but I had to wrote it down 🙂

Today I had problem on one server Windows Server 2008 R2. This server logged error 800B0001 with Windows Update Client:

When I looked at event viewer I saw same error:

and WindowsUpdate.log logged following:

I knew about one issue which is described in this article. But this article didn’t help. When I looked for file C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab, I found out there isn’t such a file. I copied this file from other server Windows Server 2008 R2 and now everything works fine 🙂

So in Microsoft world .cab file is not trusted if it doesn’t exist! 😀 Coool.