Insomniac Ramblings

How to reset trust between parent and child domains

2011-07-18T10:46:00.003+08:00

Try this from the parent domain:

NETDOM TRUST parentdomain.com /Domain:child.parentdomain.com /UserD:child\administrator /PasswordD:* /UserO:parent\administrator /PasswordO:* /Reset /TwoWay

VMware: Not using Fault-tolerance? Turn off FT to enable Cluster Compliance

2011-01-24T11:11:00.002+08:00

http://kb.vmware.com/kb/1017714

To disable Fault Tolerance compliance checks:

Right-click the cluster and click Edit Settings > VMware HA > Advanced Options.
Enter das.includeFTcomplianceChecks in a blank field, and give it a value of false.

When this setting is applied, Fault Tolerance Compliance Checks are removed from the description under theProfile Compliance Tab for the cluster and is no longer a role during a Cluster Compliance check.

Note: To re-enable the checks, remove the das.includeFTcomplianceChecks option.

To remove unused plug-in from vCenter use Managed Object Reference

2011-01-19T10:31:00.002+08:00

Found at http://vcenterservername/mob

Logon with vSphere credentials;

Click on content, then
Extension manager
Find the plug-in which needs to be removed; for example, look for extensionList["VirtualCenter"], the parameter you need is just VirtualCenter
Click UnregisterExtension, in the VALUE field, enter the name of the plug-in you wish (in this example it's VirtualCenter
Click on Invoke Method (to remove plug-in

Upgrading from Lower version of Windows 7 to Enterprise

2010-10-19T13:59:00.000+08:00

This steps are for Home Premium to Enterprise. Have not had the opportunity to try from Windows Starter Edition. Will update post once that is successfully tested:-

Upgrading from Home Premium is possible, just make the following registry changes:

Under Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion modify the following keys:

EditionID from “HomePremium” to “Enterprise”.
ProductName from “Windows 7 HomePremium” to “Enterprise”.

Default Gateway disappearing after reboot

2010-06-15T17:54:00.002+08:00

This is an interesting problem. It's a possible bug after applying Vista SP2.

Symptoms:
Manually added Default Gateway disappears upon reboot.

Cause:
Null or empty line in registry key "DefaultGateway | REG_MULTI_SZ"

Solution:

Start Regedit
Navigate to HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
Select CLSID of network adapter (you can identify your adapter by looking at the IPAddress registry Data field).
Doubleclick "DefaultGateway" (You will see a list of all gateways that disappeared, especially if you've tried multiple gateways and rebooted a few times). Very likely the first line will be blank or empty. Remove this first empty line, click OK, exit regedit and reboot.

RSA II Slimline Refresh 1 (Remote Supervisor Adapter II Slimline Refresh 1 - Part number 39Y9566)

2010-05-10T19:54:00.002+08:00

This is a real PITA. Nothing like searching/googling, trawling through the net looking for this needle in the haystack.

Especially if your fingers are fast becoming frozen after spending 6 hours in a proper data center...

Adapter ships with old firmware and won't work with newer servers unless firmware is updated.

Firmware is also very difficult to find from IBM's website.

When you try to open a remote console (after installing the adapter) you'll hit this error:
The firmware on this ASM does not include functionality to support this server. You can update its firmware on the next page

In my case, had just added the (P/N 39Y9566 Remote Supervisor Adapter II Slimline refresh 1)

There are two packet files that to be updated in sequence:
1st - PAETBRUS.PKT
2nd - PAETMNUS.PKT

You can find the firmware update files here:
http://www-947.ibm.com/systems/support/supportsite.wss/docdisplay?lndocid=MIGR-64575&brandind=5000008

vCenter and SQL 2008 SP1 on Windows 2008 R2

2010-04-21T20:56:00.005+08:00

vCenter won't install on the Web Edition.
You can install SQL2008 on 2008 R2, just have to disable all services until SP1 has been applied.
When creating the ODBC connections, use "%systemdrive%\Windows\SysWoW64\Odbcad32.exe" and not the ODBC from Administrative Tools section.

BEFORE, installing vCenter Server, do:

1. Start -> Administrative Tools -> Server Manager.

2. From the left pane, select “Features”

3. On the right hand pane, click “Add Features”

4. Expand .NET Framework 3.5.1 Features

5. Select only .NET Framework 3.5.1 (do not select WCF Activation as it will install IIS which conflicts with Apache Tomcat, which of course vCenter will install).

vCenter Server should now install without any issues.

Reconnect child domain to AD forest after tombstone period without demoting child domain DCs

2010-04-15T20:21:00.000+08:00

Frankly information on how to fix this problem IS available. It's just that Microsoft's support site contains KB articles that haven't been fully updated.

See this article: Orphaned child domain controller information may not be replicated to other Windows 2000 Server-based domain controllers

To resolve this issue, you must create a replication link, and you must enable one-way authentication instead of two-way authentication. To do this, follow these steps:

On a domain controller in the root domain, add the Replicator Allow SPN Fallback registry value. To do this, follow these steps.

Note Perform steps 1 through 6 on this same domain controller.
1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type Replicator Allow SPN Fallback, and then press ENTER.
5. Double-click Replicator Allow SPN Fallback in the right-pane, type 1 in the Value data box, and then click OK.
6. Restart the domain controller.
At a command prompt, type the following:
repadmin /optionsfully_qualified_domain_name_(FQDN)_of_the_root_domain_controller+DISABLE_NTDSCONN_XLATE

Note The Repadmin.exe tool is located in the Windows 2000 Support Tools.

For additional information about how to install the Windows 2000 Support Tools, click the following article number to view the article in the Microsoft Knowledge Base:
301423 How to install the Windows 2000 support tools to a Windows 2000 Server-based computer
At a command prompt, type the following:
repadmin /add CN=Configuration,DC=Domain_Name,DC=Domain_NameFQDN_of_the_root_domain_controller FQDN_of_the_child_domain_controller
At a command prompt, type repadmin /showreps. A successful incoming connection should be displayed for the configuration naming context from the child domain controller.
At a command prompt, type the following:
repadmin /options FQDN_of_the_root_domain_controller -DISABLE_NTDSCONN_XLATE
Remove the Replicator Allow SPN Fallback registry entry. To do this, follow these steps:
1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
3. Right-click Replicator Allow SPN Fallback, click Delete, and then click OK.
Force replication between all domain controllers in the root domain. To do this, follow these steps:
1. On a domain controller in the root domain, click Start, point to Programs, point toAdministrative Tools, and then click Active Directory Sites and Services.
2. Expand Sites, expand Servers, expand your Server_Name folder, and then click NTDS Settings.
3. If there are other domain controllers in your environment to replicate, they will be listed in the right pane. Right-click the first domain controller in the list, click All Tasks, and then click Check Replication Topology to start the Knowledge Consistency Checker (KCC).
  
  An incoming connection object from one or more of the child domain controllers is displayed. You may have to update the display by pressing F5.
  
  Note You must perform this step for each domain controller in the root domain.
Allow replication to occur throughout the forest. Then, run the repadmin /showreps command on the root domain controller and on the child domain controllers. This step makes sure that Active Directory directory service replication is successful.

Note The "Replication Allow SPN Fallback" registry entry enables the Active Directory to use one-way authentication if two-way authentication cannot be performed because of a failure to resolve a Service Principle Name (SPN) to a computer account.

@ARK-DS

Problem is almost resolved. Been talking to Microsoft these last two weeks - we are at the last stage of monitoring replication and cleaning up.

And yes, you are right about KB http://support.microsoft.com/kb/887430. It's the first step required to rejoin the orphaned domain to parent. Unfortunately, I didn't get confirmation that this would work with Windows 2008 servers and in Windows 2003 Forest/Domain level installations - if I had, it would have saved a call to Microsoft. :-) AND Microsoft's KB article was updated (APPLIES TO doesn't mention anything other than Windows 2000 Servers!!) See attached image kb887430.jpg

However, the whole process isn't as simple and involves many steps.

OK people, this is for the benefit of the masses.

From watching Microsoft troubleshoot the problem, besides the SOPs they ask you to do, (MPSReport, Network analyser captures, etc), these are the steps and things to take note of if you have a situation such as this.

1. You need to run the commands on the PDC.
2. You need to double-check using regedit even after using the "repadmin /regkey " - If you don't do that, although the command returns successful execution, the key might still be there.

www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/Q_25306989.html#a30815303

WSUS 3.0 SP2 on Windows Web Server 2008 R2

2010-03-26T16:22:00.000+08:00

To install IIS 7.0 on Windows Server 2008

Start the Server Manager (click Start, click Run, and then type CompMgmtLauncher).
In the tree view, select Roles, then in the Roles pane click Add Roles.
In the Add Roles Wizard, click Select Server Roles, select the Web Service (IIS) check box, click Next, and then click Next again.
At this time you may see a message box Add features required for Web Server (IIS)? Click Add Required Features.
In the Select Role Services window, make sure that the following services are selected:
- Common HTTP Features (including Static Content)
- ASP.NET, ISAPI Extensions, and ISAPI Features (under Application Development)
- Windows Authentication (under Security)
- IIS Metabase Compatibility (under Management Tools, expand IIS 6 Management Compatibility)
Click Next, and then review your selections.
Click Install.

Get all your AD troubleshooting tools from one place

2010-03-16T15:52:00.001+08:00

MPS Reporting Tool:
This MPS Reporting Tool is utilized to gather detailed information regarding a systems current configuration. The data collected will assist the Microsoft Support Professional with fault isolation.

http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd915706/MPSRPT_DirSvc.EXE

Once downloaded, run the .exe file and it will extract (and run)

The interesting stuff is in %windir%\MPSReports\DirSvc\Bin

No more need to go hunting around for your support folder in your windows server CD/DVD/ISO!

Additional use link for Microsoft Network Monitor (v3.3):
http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=983b941d-06cb-4658-b7f6-3088333d062f

Find FSMO roles

2010-03-15T18:43:00.000+08:00

at command prompt type:

netdom query fsmo

Windows 2008 Server Core Backup

2010-03-11T13:06:00.000+08:00

Reference:-
http://thebackroomtech.com/2008/03/12/creating-backups-of-windows-2008-server-core-machines/

Install Windows Backup:
start /w ocsetup WindowsServerBackup

System State Backup:
wbadmin.exe start systemstatebackup -backuptarget:d:

Allow backup to C: (critical volume)

To enable the system state backup files to be targeted to critical volumes, you must set the value of the AllowSSBToAnyVolume registry entry under the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wbengine\SystemStateBackup\

Set the value of this entry as follows:
Name: AllowSSBToAnyVolume
Data type: DWORD
Value data: 1
Note When this value is set to 1, system state backups to any volume are enabled. To revert to the default behavior, set the value to 0.

Add back domain that has exceeded tombstone lifetime

2010-03-01T20:24:00.002+08:00

http://technet.microsoft.com/en-us/library/cc949136(WS.10).aspx

Membership in Domain Admins, or equivalent, is the minimum required to complete this procedure. Review details about default group memberships at Active Directory Local and Domain Default Groups(http://go.microsoft.com/fwlink/?LinkID=150761).

Use Repadmin to restart replication following Event ID 2042

Open an elevated Command Prompt. To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
At the command prompt, type the following command, and then press ENTER:
repadmin /regkey +allowDivergent

Reset the registry to protect against outdated replication

When you are satisfied that lingering objects have been removed and replication has occurred successfully from the source domain controller, use Repadmin to prevent divergent replication. To do prevent divergent replication, run the command repadmin /regkey -allowDivergent. For example, to restrict divergent replication on a domain controller named DC1 in the Fabrikam.com domain, run the command repadmin /regkey dc1.fabrikam.com –allowDivergent.

How to move the NTP time server role to new domain controller (Windows Server 2008 R2)

2010-02-25T12:36:00.000+08:00

There's alot of confusion for this.

Should NOT use net time commands.

On the old domain controller, run the following at command prompt

w32tm /config /syncfromflags:domhier /reliable:no /update

net stop w32time && net start w32time

On the new domain controller, run the following at command prompt

w32tm /config /manualpeerlist:time.windows.com /syncfromflags:manual /reliable:yes /update

net stop w32time && net start w32time

3rd Party tools for Virtualized Environments

2009-10-07T17:19:00.001+08:00

ToutVirtual's VirtualIQ Professional "...provides simple, easy-to-use actionable information about your dynamic virtualization environment. Use contextual drill-downs to get additional information on an as needed basis. VirtualIQ Pro uses automated methods to generate auto-correlated visibility into your dynamic virtual infrastructure..."

OpenFiler as an ESX iSCSI target

2009-10-07T17:00:00.005+08:00

Pretty much decided that this is the best platform.
(Cheap/Free/Opensource iSCSI target devices for VMware ESX/ESXi)

It's faster than FreeNAS, FreeNAS iSCSI target is a file mounted on a SMB share (additional layer)
Does not have the limitations of StarWind free

Objectives:

Reasonably fast access for file server use (VMware ESXi VM)
Multi-volume replication for data redundancy
Cheap 3rd Tier Storage for enterprise environment

Nexenta as an ESX iSCSI target

2009-10-07T16:42:00.003+08:00

(Cheap/Free/Opensource iSCSI target devices for VMware ESX/ESXi)

Possibly working but kludgy if multiple targets are required.
Running ZFS over iSCSI as a VMware vmfs store - Ubiquitous Talk

Logical Volume Manager (LVM)

2009-10-07T16:14:00.003+08:00

Need to deploy an opensource or free solution for 3rd tier iSCSI SAN for use with vSphere (VMware, ESX, ESXi) storage.

Redhat, Wikiopedia, LVM1, LVM2, LVM How-to "What is LVM?" (tldp.org), A Beginner's Guide to LVM (with VMware Server VM hand's on using Debian Etch (without RAID)

Woah!

"...I was advised by many people who had lots of Linux experience to never use LVM, as I would have trouble transferring files from an old slave drive to a new install on a new master drive..." - borgward (I'm wonder why?)

Cheap/Free/Opensource iSCSI target devices for VMware ESX/ESXi

2009-10-07T16:07:00.007+08:00

Candidates

Openfiler (Redhat, Fedora Core)
FreeNAS (FreeBSD)
Nexenta (OpenSolaris, Ubuntu hybrid?); Home, download
StarWind (Windows iSCSI target plug-in, feature-limited free edition available)

Comparisons, Reviews, Versus, Actual Implementations

FreeNAS vs Openfiler
Running ZFS over iSCSI as a VMware vmfs store - Ubiquitous Talk

Recover/Change Lost Admin Password on Windows 2003/2008 Domain (Active Directory)

2009-10-07T15:48:00.000+08:00

http://www.petri.co.il/reset_domain_admin_password_in_windows_server_2003_ad.htm

"...

Requirements

Local access to the Domain Controller (DC).
The Local Administrator password.
Two tools provided by Microsoft in their Resource Kit: SRVANY and INSTSRV

..."

HS21 Blades, Qlogic 4052, IBM DS3300 as an iSCSI Target for VMware

2009-10-07T15:30:00.005+08:00

http://vmtoday.com/2009/06/ibm-ds3300-iscsi-write-performance-solved/

"...Read performance was decent from the array, but write performance was terrible, maxing out at 10Mpbs throughput and insanely high latencies on long writes when the system was under load. This led to some long P2V operations, poor guest performance, and some questions from the project sponsors on why I couldn’t make the environment sing..."

http://solutions.qlogic.com/KanisaSupportSite/dynamickc.do?command=show&externalId=Post-10992037&forward=threadedKC&kcId=Post-10992037&sliceId=Post-10992037

"Issue seems to be with the Nortel switch and the qla4052. When first initialize they are able to connect to the switch fine, but when the firmware is loaded, they will not negotiate with the Nortel switch if the port is set to auto. Once the firmware is loaded you will notice that the link is down on the switch.
All you need to do is on the switch set the port to 1000 full duplex instead of auto"

"The problem is not the Qlogic. It is the Nortel switch. I have to downgrade the firmware version to 1.2.4.1 or older then everything works. Even IBM & Nortel, they can repeat the problem but no solution yet anyway. But again once you have everything working, who will change the firmware again."

3D Flip in Windows Server 2008 R2

2009-10-05T04:38:00.001+08:00

Does it work?