| J.C. 的个人资料J.C.'s space日志网络 |  工具  帮助 |
|
|
4月30日 Cannot Connect to Virtual Machine -- McAfee HIPS Firewall.I was working on a Windows Server 2008 version of Hyper-V that had McAfee's HIPS firewall turned on. It had been on for several weeks without incident, when I needed to turn on and connect to a virtual machine. But whenever I tried to connect to a running VM a very generic "Cannot connect to the Virtual Machine" error popped up as shown below.
 It took me too long to figure out that the firewall was finally causing the issue. Adding the following firewall rule solved the issue:
TCP Incomming onPort 2179 fromPorts 1024-65535 fromIP: Any 4月29日 Delta CRL is present, but not downloadable is IIS 7.0. When navigating to the URL an "HTTP Error 404.11 – URL_DOUBLE_ESCAPED" error occurs.While looking at PKIView for a newly installed CA, I noticed that the delta crl (CAName+.crl) was "Unable to download", despite the file being present in the CDP virtual directory file location. When I copied the URL and browsed to the location, I received an HTTP Error 404.11 -- URL Double Escape error.
This is apparently a new security feature under IIS 7.0 that denies double escape characters in the URL. Not sure what "escape characters" are, but I presume that a space and then the + sign were the characters in my URL.
Fortunately the Error page gave some insight about changing the application.config or web.config file. A quick search on Google led me to a Microsoft KB article that helped to point me in the right direction: Error message when you visit a Web site that is hosted on IIS 7.0: "HTTP Error 404.11 – URL_DOUBLE_ESCAPED"
This article instructs you to change the application.config file by modifying the allowDoubleEscaping property to True. In looking at the application.config file there was a section for each of the virtual directories under the website, except for the CDP virtual directory. All of those sections had their allowDoubleEscaping attribute set to true, so I had code examples to build the xml for the missing section. I did notice however that the CDP file location did have a web.config file, which had a sparse section of xml code specifically for the CDP virtual directory. And this the web.config file is what I actually modified to fix the 404.11 error.
I added a security section under configuration/system.webserver.
<security>
<requestFiltering allowDoubleEscaping="true" /> </security> Original File:
<?xml version="1.0" encoding="UTF-8"?>
<configuration> <system.webServer> <directoryBrowse enabled="true" /> </system.webServer> </configuration> Modified file:
<?xml version="1.0" encoding="UTF-8"?>
<configuration> <system.webServer> <directoryBrowse enabled="true" /> <security> <requestFiltering allowDoubleEscaping="true" /> </security> </system.webServer>
</configuration> This fixed the issue! 4月20日 DSQuery doesn't pipe to DSMove -- Work aroundWhile cleaning up AD for a client, I ran a DSQuery to list all the computers that had been inactive over the last 8 weeks and there were more than 100, so I had to expand the search:
"dsquery computer -inactive 8 -limit 400"
Then I wanted to disable them so I piped that into a DSMod command:
"dsquery computer -inactive 8 -limit 400| dsmod computer -disabled yes"
Wow, this is easy. Now all I have to do is move the disabled computers to a special OU using DSMove. But of course its never that simple. The dsmove command didn't accept the piped in dsquery, so I had to put the phrase in a for loop:
for /f "Tokens=*" %a in ('dsquery computer -disabled -limit 400') do dsmove %a -newparent "OU=Disabled objects,DC=mydomain,DC=com"
If you need to target a specific OU, simply place DN of the OU after the computer:
"dsquery computer "OU=Build,DC=hps,DC=com" -inactive 8 | dsmod computer -disabled yes" 4月15日 GPO Wireless Settings Only Show WEP on Server 2003 32-bit DC's Despite the Connection setting of WAPRan across an interesting GPO issue, while distributing wireless settings to users in the Domain. Despite the actual settings included in the Preferred Wireless network settings the GPO shows WEP with EAP in the settings view of the GPMC.
Apparently the GPMC 1.0 console isn't capable of showing all of the settings, nor can it configure WPA2. The solution is to connect using GPMC from the Remote Services Adminstration Pack on either Server 2008 or Vista. This will show a more accurate "settings view" and allow the configuration of WPA2.
The GPO will be saved on the 32-bit Domain Controllers and replicated throughout the network properly, but will not show up accurately in the Settings View on GPMC 1.0.
4月8日 McAfee Host Intrusion Prevention (HIPS) Firewall doesn't allow PING, despite the default allow PING rule.After Deploying McAfee's Host Intrustion Prevention product (v7.0.3) to a desktop with the firewall turned on and the default "allow Ping" rule enabled, I was unable to ping a remote system.
The system was managed by ePO and the default rule set actually had two ping Rule Groups in place and enabled. The first "Ping and ICMP" had several rules that caused all manner of traffic between systems to crash and caused intermittent problems on the network, so it was deleted from the Polilcy. This left the "Ping" rule group, which included the rules "Allow ICMP Echo Request Outgoing" and "Allow ICMP Echo Reply Incoming."
"Allow ICMP Echo Request Outgoing" allowed ICMP echo requests outgoing to any IP for the PING.EXE application
"Allow ICMP Echo Reply Incoming." allowed ICMP echo replies incoming outgoing to any IP for the PING.EXE application
Looks prettry straight forward for allowing the machine to ping out, but outward pings would not work and there was a log entry stating that the ping request had been blocked??? HIPS is a complicated application and I was afraid that there was some obsure application blocking rule that restricted ping.exe. To test that it was actual a firewall error, I turned off the firewall. Pinging worked.
After modifying the rules several times and in various methods, I finally discovered that the fix was to not limit the application to ping.exe. Removing ping.exe from both rules, but otherwise leaving them unchanged allowed the target machine to ping outward.
3月20日 AD Certificate Services 2008, Version 3 certificate at 2008 level, and Web Enrollment for SCOM.Just had an interesting issue with a new 2008 PKI implementation: My certificate templates were not showing up for Web Enrollement.
I had just set up a complete PKI using AD CS 2008 and was trying to issue certificates to a Gateway SCOM server in the "Other" Forest and to the Management server in the home forest. And of course, I ran into some interesting issues.
For security reasons, none of the default templates were published when the CA was turned up, this was to ensure that someone had to actively approve the publishing of a certificate template and to prevent the auto-enrollment of certificates until the organization was explicitly ready. This unique situation would complicate troubleshooting.
So the first template to be published was the newly created SCOM Certificate template. Now there was nothing special about this template. It is simply a Computer template (with the Server and Client Authentication OIDs, just like the default Computer template). Instead of publishing the default Computer template, I duplicated it and extended its life to 2 years, but when I did this it asked me if I wanted to make this a 2003 or a 2008 version. Well, hell yeah, I want 2008. Why else did I go throught the trouble of deploying 2008 CA's -- (ummm, maybe not!!).
This answer had the effect of adding advanced features to the version 3 certificate, something that I wasn't fully aware of at that time, which I discovered hours later can not be web enrolled.
This of course presents a challenge to a SCOM Gateway server in the "Other" forest, because that is the only method that it has of connecting to the issuing CA in the home forest. (Sure, I could have used a third party manual request generation tool, but I was irked that this wasn't working!!!).
So after a few hours of verifying permissions and settings, I ran across the fact that V3 certificates cannot be webenrolled and the fact that Authenticated Users in the Root Domain does not translate to computers or users in sub-domains. 3月11日 Windows Update Error -- WindowsUpdate_80240019Ok, I just had an issue with WSUS. None of my servers were updating and I was getting a WindowsUpdate_8024001 whenever I tried to update a Vista/Server 2008 server. And the windowsUpdate.log file was showing the following errors:
2009-03-11 21:28:55:852 608 1170 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80190194
2009-03-11 21:28:55:852 608 1170 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80190194 2009-03-11 21:28:55:852 608 1170 Misc WARNING: DownloadFileInternal failed for http://computer.domain.net/selfupdate/wuident.cab: error 0x80190194 2009-03-11 21:28:55:852 608 1170 Setup WARNING: SelfUpdate check failed to download package information, error = 0x80244019 2009-03-11 21:28:55:852 608 1170 Setup FATAL: SelfUpdate check failed, err = 0x80244019 2009-03-11 21:28:55:852 608 1170 Agent * WARNING: Skipping scan, self-update check returned 0x80244019 2009-03-11 21:28:55:852 608 1170 Agent * WARNING: Exit code = 0x80244019 Not sure how it happened, but the root cause was a missing Virtual Directory on the WSUS default website. I added a Virtual Directory called SelfUpdate to the default website and pointed it to the C:\Program Files\Update Services\Selfupdate directory. I gave it full permissions, but I doubt it need all of those.
This solved my problem. Of course I checked the GPO to make sure that the update point was correct there. And I checked the Registry of computers to ensure that the had the update point listed correctly as well (meaning they were getting the GPO properly).
For those of you interested in the post mortem. I am not sure what caused the disappearance of the Selfupdate Virt Directory. I was standing up a Forefront Client Security Server with all roles and retiring my old WSUS server. Somewhere along the line it either was not created or was deleted. 1月12日 Collect DHCP information from the command prompt I needed to document DHCP information for a client across their large Enterprise consisting of more than 15 DHCP servers and each with several scopes. I dreaded documenting by hand, so I turned to my usual trick of collecting information by command line.
First I found just the article I needed about how to get DHCP information at the command line from the Technet Article "To use DHCP commands interactively at the command prompt" My first task was identifying all of the DHCP servers in the organization. Now that could have been easily accomplished from the MMC snap-in, but this is about the Command line. So I used netsh DHCP to accomplish that as well.
Now depending on what information you need to retrieve you can dive down into each server and then further into each scope to retrieve information. I needed to identify the scopes on each server, where their databases were located, and some general idea of the usage of each scope. And I needed to record this to a text file. So I decided to go into each server and get targeted information from each one. So I dug up the following commands:
server \\Server01 -- Switches which server information is retrieved from. Or, type: server\\IPAddress
which takes us to the netsh dhcp server> prompt, then I retrieved the information that I wanted using the following commands.
show scope -- Shows basic scope information
show mibinfo -- show scope use information
show dbproperties -- shows Database information
There are several other commands available, use /help to search for the one you need and you can reference this for usage: http://technet.microsoft.com/en-us/library/cc787375.aspx.
You might also look at the dump command. This actually gives you information about each scope and their options when used at the server level. Or you can dig down into each scope using the command: scope ipaddress and use show commands from there.
Also the show optiondef command will give you the definitions of each scope option. Option 51 is lease time as measured in seconds (that being the most common one you'll need.)
And I discovered that I could run several commands one after the other in a batch file, or in my case by modifying a text file and pasting into the command line.
server \\Server01
show scope
show mibinfo
show dbproperties
server \\Serverdc01
show scope
show mibinfo
show dbproperties
server \\Serverdc02
show scope
show mibinfo
show dbproperties
server \\Serverrdp01
show scope
show mibinfo
show dbproperties
Unfortunately, piping the command out to a text file (>c:\output.txt) didn't work and I didn't have Powershell on the network (Start-Transcript…..). So I ended up listing two or three servers at a time, while using the select all, cut, and paste commands in the CMD.exe window to paste the text into a notepad file. All in all, a way quicker and cooler way of collecting DHCP information across the organization, than using the GUI. 1月5日 Windows PKI Error CodesI got this from the Technet PKI blogHow to decode Windows errorsMany Windows error messages provide a hexadecimal error code, for example 0x8007267C. This code can provide helpful information. But how to translate it into a readable error message?
At least two commands can be used to decode an error code:
· certutil -error [Code] · err.exe [Code]
For example certutil -error 0x8007267C
Certutil is part of all Windows server stock keeping units (SKU) and Windows Vista. The err executable is available from the Microsoft Download center. Changing the Friendly name of a certificateI got this from the Technet PKI blogDefining the friendly name certificate propertyThe friendly name of a certificate can be helpful if multiple certificates with a similar subject exist in a certificate store. One way to set the friendly name is through the certificate MMC SnapIn. Alternatively certutil.exe can be used in the following way:
12月18日 32-bit Print Drivers in a 64-bit WorldOk, I just had an adventure trying to upload drivers to a 64-bit 2008 printer server.... Here's how I finally made that happen. To install 32-bit drivers on a 64-bit Windows Server 2008 print server is a bit complicated (as I found out). To install the 32 bit drivers, you must do so from a 32-bit client.
1. From the 32-bit client you will add the printer. You will get a message about the driver not being available on the server and you will be given the chance to install one. 2. Install the appropriate 32-bit driver. Note: the 32-bit driver must match the name of the 64-bit (i.e. if the driver installed for the HP LJ 3220 printer on the Printer Server is an HP LJ3200 driver, then the 32-bit driver must also be the HP LJ3200 driver, even if there is a specific 32-bit HP LJ3220 driver. The server and client drivers must be the same!) 3. Open the printer properties on the client system. 4. Navigate to the sharing tab. 5. Add additional Drivers. 6. Select the appropriate environments and versions (XP, 2000, Windows 98). 7. Select OK and provide a location for the driver (if necessary). 8. Viola! The printer drivers will be installed on the server. Expired Certificate for Active Synce (Mobile Phone)When I was setting up a Windows Mobile phone for a client. I encountered the following error when trying to connect to an Exchange 2007 server (Should be the same for Ex2003): Synchronization failed. The security certificate on the server has expired. Check that the date and time on the device is correct and try again. Error Code: 80072f05
Which was really perplexing. The certificates were working for OWA, Outlook Anywhere, and the Autodiscover services, so I dug a little deeper. This particular environment had an ISA server protecting a CAS/Hub server and a MBX server. So the first point of contact was ISA, where all of the certificates are, and where authentication for Active Sync begins.
First, I looked on Google for this specific error message and while I found a lot of stuff that was close, nothing was exactly the solution I needed. But they did help me find the problem. Most of these said that I needed to import the certificate into Windows Mobile and part of the process was opening up the certificate, saving it in a binary format, converting that into a .cab file, and importing it to the phone.
So I opened up an MMC on the ISA server and loaded the Certificates Snap-in for the computer account, local computer. The most obvious culprit was the outward facing cert by Verisign (one of the most trusted issuers on the Net). One of the articles that I was following said to make note of the certification trail, although I never figured out why, but I am glad it did. That caused me to notice that the Intermediate Cert for the Verisign Cert WAS expired (1 Jan 04). Apparently the other services were perfectly OK with this, but not Active Sync.
So I went looking for a replacement for the Intermediate cert and sure enough Verisign had an article about just this topic (Why didn't Google find this?? Or why isn't Verisign publishing to Google?? However that circle of events plays out!).
To solve the problem you must find the correct intermediate cert from Verisign (VeriSign Intermediate CA Certificates). Most probably you'll need the Premium SSL Certificate.
Highlight the cert text from Verisign, cut, and paste into a notepad txt file. On the ISA server (or directly on the CAS server if your not using ISA), save the file as, "VerisignIntermediateCert.cer" (enclose it in quotes to prevent notepad from saving it with a .txt extension).
Then from the MMC loaded with the Certificates Snap-in for the computer account, local computer, Open Intermediate Certification Authorities and right click on the Certificates directory. Choose All Tasks -> import Browse to the location of the saved .cer file and import it. Then Delete the Expired Intermediate cert. (Or export a copy and then delete).
For ISA you will have to restart the Microsoft Firewall service (for a CAS you'll restart IIS).
And then your Windows Mobile devices should be able to Sync. Copy a DNS Zone to another with a differnt name
I was presented with a unique challenge here recently to copy one DNS zone to another, Corp.Data.Net to Data.net. Essentially creating a new zone with a different name, but exactly the same entries. No changes necessary just a straight copy.
It was easier than you might think. First, let me introduce you to my little friend DNSCMD.exe, a command line tool. I used to scoff at command line tools, but there are just some things that are better done with the command line, especially bulk changes.
Ok, so task #1 was to export the old zone Corp.Data.Net. Easy enough using the GUI or dnscmd. If you use the GUI save the file to %systemRoot%\System32\DNS with an extension of .dns (I have not tried this so it may not even work, but in theory!!) If you use dnscmd, then the file is automatically place there. Here is the command:
Usage: DnsCmd <ServerName> /ZoneExport <ZoneName> <ZoneExportFile> dnscmd /zoneexport corp.data.net corp.data.dns
Alternately, you can save the file to a sub-directory of %systemRoot%\System32\DNS by adding the directory name and a "\". i.e. For the import directory: dnscmd /zoneexport corp.data.net import/corp.alldata.dns
Task #2 was to import that file. Handily the dnscmd handled that as well:
Usage: DnsCmd <ServerName> /ZoneAdd <ZoneName> <ZoneType> [<Options>]...... There was an AD integrated Primary zone type, but it would not let me import a file using that zone type, so I imported the file as a Primary Zone and then used the GUI to change it to AD integrated.
dnscmd /zoneadd data.net /primary /file data.dns /load
So Task #3 was to AD integrate the Zone. (if you get it to import directly, let me know!!)
Using the GUI -- Right Click on the zone, go to properties, and on the General Tab, near the top is a Change button beside Type. Click that and check AD Integrated near the bottom.
Using dnscmd -- Usage: DnsCmd <ServerName> /ZoneResetType <ZoneName> <Property> [<Options>]
dnscmd /zoneresettyp data.net /DSPrimary |
|
|
