http://www.sysadmintales.com Just another day in paradise... Fri, 25 Sep 2009 20:10:49 +0000 http://backend.userland.com/rss092 en Are you setting up a new PKI implementation in your organization?  Are you using a Standalone Root CA with an Enterprise Subordinate CA?  If so, don't forget to properly set the DSConfigDN attribute for your Standalone Root CA (since it can't read or write in AD!).  If you do forget ... http://www.sysadmintales.com/2009/09/25/set-the-dsconfigdn-for-standalone-root-cas/ I recently had one of my Hub Transport servers running ForeFront for Exchange Server 2007 SP1 start behaving strangely.  It was reporting that the scanner updates for "Norman Virus Control" and "AhnLab AntiVirus Scan Engine" as being over a week old, even though the most current definitions were on the ... http://www.sysadmintales.com/2009/08/31/forefront-for-exchange-scanners-not-showing-as-updated/ This is one of those issues that I just can't figure out why Microsoft did not include both 32-bit and 64-bit print drivers on the media for Windows Server 2008.  Or maybe as a download pack or something.  The trend is definitely to use 64-bit servers (no other choice if ... http://www.sysadmintales.com/2009/08/26/adding-32-bit-print-drivers-to-64-bit-print-server/ This was passed to me by Robert C. Issue:  An application server ran out of disk space on the "C" volume.  We could connect to file shares but RDP sessions and the console session showed a black screen so no one could not log in. Fix:  Since the server ran out of ... http://www.sysadmintales.com/2009/08/24/black-login-screen-on-windows-server-2003/ I recently rebuilt two domain controllers in a remote site to be Windows Server 2008 SP2 64-bit. They were previously running Windows Server 2003 SP2 R2 64-bit and were in DPM 2007 SP1 with no issues.  The build for the 2008 installation from bare metal:  the old DCs were demoted, ... http://www.sysadmintales.com/2009/08/20/dpm-agents-not-functioning-on-server-2008-dcs/ Are you implementing a  Public Key Infrastructure solution?  If so, do you want to fully comply with RFC 3647 and ensure maximum credibility for your PKI solution? If you answered yes to both of these questions then you're going to be spending a lot (A LOT) of time working on the ... http://www.sysadmintales.com/2009/04/16/rfc-3647-certification-practice-statement-cps-template/ We've got an ADAM instance setup that provide proxy authentication for an application.  In one partition of the ADAM instance are the userProxy objects and in another partition objects exist specific to the application that contain security and role information, thus determining what permissions each user has in that application.  ... http://www.sysadmintales.com/2009/04/13/adamad-lds-import-fails-with-error-0x20e7/ With the release of Windows Server 2008 R2, there will finally be native support for Active Directory management in Powershell.  For those of us (myself included) who don't/won't use the third-party add-ins for AD, this is great news! Check out the AD Powershell team's blog:  Active Directory Powershell Blog (easy enough ... http://www.sysadmintales.com/2009/03/23/ad-powershell-cmdlets/ Wow, that was quick!  (I just got SP1 UR6 installed on all my servers a week ago). Update Rollup 7 for Exchange Server 2007 SP1 has been released.  The full list of fixes and updates is documented in MS KB 960384, but I think a lot of people will be happy ... http://www.sysadmintales.com/2009/03/23/exchange-server-2007-sp1-update-rollup-7/ I'm currently doing some testing with Exchange Server 2007 and Data Protection Manager 2007 on Hyper-V.  As I needed several VMs for the testing, I just installed one and then used NewSID to change the VM SID and name before joining each one to my test domain.  Later, upon attempting ... http://www.sysadmintales.com/2009/03/16/data-protection-manager-2007-error-id-998/ If you've got SCR installed and are using the Database Portability model described in "Standby Continuous Replication: Database Portability", here's a useful Exchange Management Shell that scripts the entire activation process.  Just change all of the noted fields to match your source and target servers and even add additional storage ... http://www.sysadmintales.com/2009/03/15/activate-scr-target-via-ems-script/ I finally had the chance to update the rest of our Exchange Server 2007 SP1 servers to UR6 tonight and there were no problems at all.  Even the .NET native image portion went fairly quickly.  WIN!  :) http://www.sysadmintales.com/2009/03/14/exchange-server-2007-sp1-ur6-no-problems/ Just as a quick reminder (because, oh...I forgot myself), if you have Exchange Server 2007 installed in a child domain in a parent/child domain forest then your Exchange security groups are going to be located in the parent (root) domain.  So, if you want to add new Exchange Administrators using ... http://www.sysadmintales.com/2009/03/06/adding-exchange-administrators-fails-with-error-00000525/ It seems like a good number of folks are saying they're having issues with UR6 within their Exchange environments (pay no attention to the one who said it wouldn't install on Exchange Server 2003...). There are quite a few discussions going on currently about the effects of UR6, both at the ... http://www.sysadmintales.com/2009/02/13/problems-with-exchange-2007-sp1-ur6-not-here/ Patch Tuesday this month brought an usual update:  Update Rollup 6.  That's unusual for an UR to appear on Patch Tuesday...but in this case there are two security fixes that are rated as Critical, so the timing makes sense. Get the UR here and install it as soon as possible.  No ... http://www.sysadmintales.com/2009/02/11/exchange-2007-sp1-update-rollup-6-arrives/ Although I haven't actually found the exact cause (and thus the solution), I've run across problems using Symantec Endpoint Protection (i.e. Symantec Corporate 11.0) on Windows Server 2008.  It seems that something in the protection configuration in the Symantec product is blocking Windows Updates.  You'd get the error code 80072F78 ... http://www.sysadmintales.com/2009/02/04/windows-update-error-80072f78-in-windows-server-2008/ It was a bit surprising to find that the TechNet documentation about configuring and starting SCR replication was...ah...less than perfect or easy to use.  Here's a simple set of commands you can use to get your SCR implementation rolling along nicely. Before trying to configure SCR, be sure that your mailbox ... http://www.sysadmintales.com/2009/02/04/how-to-configure-and-start-scr-replication/ I was a bit surprised to see that the most recent Management Pack for Exchange Server 2007 for Operations Manager 2007 didn't understand the differences between CCR and SCR...and how those differences would impact the log queue depths for replication.  So, if you're going to implement SCR (or you already ... http://www.sysadmintales.com/2009/02/04/monitoring-exchange-2007-scr-with-ops-mgr-2007/ There's a small (though important) typo in the TechNet article Protected Computer Software Prerequisites in regards to the required steps to protect Exchange Sever 2007 (or Exchange Server 2003) databases. To properly protect Exchange Server data, you'll need to have the current version of the eseutil.exe and ese.dll files available to ... http://www.sysadmintales.com/2009/01/16/protecting-exchange-with-data-protection-manager-2007/ To protect a server using Data Protection Manager 2007, you must install two prerequisite software items: The DPM agent (see my previous post about the Visual C++ 2008 Redistributable cleanup issue), and The VSS hotfix from MS KB 940349 If you attempt to protect data on a server immediately after it reboots following ... http://www.sysadmintales.com/2009/01/16/data-protection-manager-2007-error-id-31309/ Version 2.0 of the Data Protection Manager 2007 management pack for Operations Manager 2007 was recently released.  This is is not a converted version, so installation is easy.  Be sure to remove the previous version if you had it installed. On the DPM side of things, make sure that you have SP1 ... http://www.sysadmintales.com/2009/01/15/data-protection-manager-2007-management-pack-updated/ I ran across this the other day while trying to get SCR setup on the Exchange servers in our warm DR site...when trying to run the Enable-StorageGroupCopy cmdlet to configure the SCR instance you get the following error: Enable-StorageGroupCopy:  Standby continuous replication is not supported between computers in different Active Directory ... http://www.sysadmintales.com/2009/01/15/exchange-server-2007-sp1-update-rollup-5-scr-bug/ I'm currently working to get a new warm DR site up and running with Active Directory, Exchange Server 2007 SCR and Data Protection Manager 2007.  After installing and configuring the Hub Transport server in the DR site, I sent a test message using bmail to my mailbox to test SMTP ... http://www.sysadmintales.com/2009/01/15/exchange-2007-problem-over-site-to-site-vpn-with-cisco-asa/ The DNS Management Pack for Operations Manager 2007 has been updated again to version 6.0.6480.0, but it still doesn't seem to fix the the major complaint with the previous version (6.0.6278.27). The DNS Library WINS TTL Monitor, despite getting some updated verbiage in the MP Guide, still appears to be broken.  ... http://www.sysadmintales.com/2008/12/30/ops-mgr-dns-management-pack-updated/ You might have noticed, if you've installed SP1 for Data Protection Manager 2007, that it leaves behind the Visual C++ 2008 Redistributable package contents in your root directory.  Tsk, tsk.  How did that slip through beta, but yet be specifically called out in the Release Notes? DPM 2007 SP1 setup leaves ... http://www.sysadmintales.com/2008/12/30/cleanup-after-dpm-2007-sp1-installation/ Although it's been reported in the past that you might sometimes see Data Protection Manager 2007's error 3013 on a Windows Server 2008 system, whereby SQL Reporting Services is not available, it seemed to be rare. Now it appears that perhaps error 3013 is making a comeback with the installation of ... http://www.sysadmintales.com/2008/12/30/data-protection-manager-2007-sp1-turns-off-reporting/ While trying to assist in the new installation of Microsoft Office Communications Server 2007, I ran into this rather unhelpful error in the error logs:  [0x80004002] No such interface supported.  I had full Enterprise Admin permissions so that ruled out the typical permissions suspects.  What I found solved the error was ... http://www.sysadmintales.com/2008/12/19/mocs-2007-0x80004002-no-such-interface-supported/ Seems that the v6.0.6278.27 DNS management pack for Operations Manager 2007 has its own bug of fame.  The "The WINS Connector has stopped working" alert will likely become familiar to you courtesy of the DNS Library WINS TTL Monitor.  It seems that the MP ships with the "hostname" field filled ... http://www.sysadmintales.com/2008/12/16/ops-mgr-the-wins-connector-has-stopped-working/ If you've been getting these errors from your Operations Manager 2007 DHCP Management Pack, the solution is at hand!  Here's the typical error you'd get: Failed Accessing Windows Event Log The Windows Event Log Provider was unable to open the System event log on computer '{69E3F0CF-36C3-9FDC-1892-42FB003E34DB}' for reading. The provider will retry ... http://www.sysadmintales.com/2008/12/16/ops-mgr-2007-failed-accessing-windows-event-log/ Updated Management Packs for Exchange Server 2007 and SQL Server were recently released for Operations Manager 2007.  Check out the updates below as listed in the Management Pack documentation.  As usual, download your Management Packs from the MP Catalog. The following list contains the issues that are fixed in version 6.0.6461.0 ... http://www.sysadmintales.com/2008/12/10/exchange-and-sql-opsmgr-management-packs-updated/