Cisco IP Phone TFTP Server

If you need to create your own TFTP server for the Cisco IP Phones so that they can get any image we want them to have - instead of getting the image from the CUCM, we can create the TFTP server, dump the image from Cisco.com website (.zip) and create XMLDefault.cnf.xml file.

The content of the XMLDefault.cnf.xml file is:

<Default>
<callManagerGroup>
<members>
<member priority="0">
<callManager>
<ports>
<ethernetPhonePort>2000</ethernetPhonePort>
<mgcpPorts>
<listen>2427</listen>
<keepAlive>2428</keepAlive>
</mgcpPorts>
</ports>
<processNodeName></processNodeName>
</callManager>
</member>
</members>
</callManagerGroup>
<loadInformation30007 model="CP-7912">CP7912080000SIP060111A</loadInformation30007>
<loadInformation8 model="CP-7940">P003-08-8-00</loadInformation8>
<loadInformation115 model="CP-7941">TERM41.7-0-2-0S</loadInformation115>
<loadInformation434 model="Cisco 7942"></loadInformation434>
<loadInformation309 model="Cisco 7941G-GE">TERM41.7-0-2-0S</loadInformation309>
<loadInformation435 model="Cisco 7945"></loadInformation435>
<loadInformation7 model="CP-7960">P003-08-8-00</loadInformation7>
<loadInformation30018 model="CP-7961">SIP41.8-5-2S</loadInformation30018>
<loadInformation308 model="Cisco 7961G-GE">SIP41.8-5-2S</loadInformation308>
<loadInformation404 model="Cisco 7962"></loadInformation404>
<loadInformation436 model="Cisco 7965"></loadInformation436>
<loadInformation6 model="CP-7970">SIP70.8-4-2S</loadInformation6>
<loadInformation30006 model="CP-7970">SIP70.8-4-2S</loadInformation30006>
<loadInformation119 model="Cisco 7971">TERM70.7-0-2-0S</loadInformation119>
<loadInformation118 model="Cisco 7971G-GE">TERM70.7-0-2-0S</loadInformation118>
<loadInformation437 model="Cisco 7975"></loadInformation437>
<loadInformation302 model="Cisco 7985">cmterm_7985.4-1-4-0</loadInformation302>
<authenticationURL></authenticationURL>
<directoryURL></directoryURL>
<idleURL></idleURL>
<informationURL></informationURL>
<messagesURL></messagesURL>
<servicesURL></servicesURL>
</Default>

Edit the loadInformation tag with the image version you want that particular phone to load with.

Symantec Enterprise Vault

The following is a modified PowerShell script from Symantec to recall all the files from Vault if the file placeholder exist in the file server

## script attempt - comprehensive FSA script to analyze target locations and evaluate file within it
##
## First we check the registry to see if the bypassrecallimitsforadmins key (8.0) or bypassrecalllimitsforadmins (7.5 something where it was spelt right)
## We also check recalllimitmaxrecalls and recalllimittimeinterval to see if they are set to 99 and 1 respectively to give the best chance to recall all files if needed
## Note: while they may not choose to copy we will still get these values for later processing in case they do
##
## We will prompt for 2 locations: 1) the location of the fatr.exe executable & batch.cmd, and 2) the desired target path
## We will prompt for a decision if the user wants the placeholders that are verified as proper placeholders would also like them recalled (by copy to nul process)
## If they choose the copy option, we will report on the registry settings and recommend changes (and do them if they choose).
## Using these paths we will do the following
## 1) get a directory output of the target path and save that to a file named dirout.txt
## 2) using the dirout.txt file we will process each file in that list in the following manner
## 3) we will run fsutil (windows application) to confirm if the file has reparsepoint (placeholder) information, and if so, if the GUID matches the EV one (because of some issues found on 64 bit, this string has had the spaces removed to ensure matches on 64 and non-64 bit systems)
## *4) we will test the file as well with the fatr.exe application (in report mode) which will detail to us if the offline file bit is set or not
## 5) if the above tests result in finding a file which has the offline bit set, and NO reparse information, we will set the offline bit OFF (this will resolve the 'element not found errors' on archive attempts)
## 6) if the above tests result in finding a file which has the offline bit set, and EV reparse information, we will leave the file alone if copy choice is 'n' or copy the item to nul if 'y'
## 7) if the above tests result in finding a file which has the offline bit set, and reparse information (but not EV info), we will leave the file alone
## 8) if the above tests result in finding a file which has the offline bit unset, and NO reparse information, we will leave the file alone
## 9) if the above tests result in finding a file which has the offline bit unset, and EV reparse information, we will set the offline bit (this situation should not be found)
## 10) if the above tests result in finding a file which has the offline bit unset, and reparse information (but not EV info), we will leave the file alone
## 11) if the above tests result in finding not covered by the above we will report the results found and do nothing

##param

## ver.bat ($exepath = "$(read-host "Please enter the path to the fatr.exe & batch.cmd files. Use the format, :\, e.g. c:\testfolder ")",$tarpath = "$(read-host "Please enter the path to the desired target folder to analyze. Use the format, :\, e.g. c:\testfolder ")",$copyquestion = "$(read-host "If proper placeholders are found, would you like them recalled? Use the format y or n")")
$tarpath = $(read-host "Please enter the path to the desired target folder to analyze. Use the format, :\, e.g. c:\testfolder ")
$copyquestion = $(read-host "If proper placeholders are found, would you like them recalled? Use the format y or n")

## ------------------------------------------------
## Edited by Me (u know)
## ------------------------------------------------

$txtfile = $(read-host "Please enter the path to the file to search target. Use the format, :\\filename, e.g. c:\testfolder\file.txt")

## ------------------------------------------------

## $outpath = "$(read-host "Please enter the path for the output file. Use the format, :\, e.g. c:\testfolder ")" ## we should not need this line as output will be specified at run time.

$restart = 0
$script = $myinvocation.mycommand.definition
$exepath = split-path "$script"

##debug ##write-host $exepath
##debug ##write-host $tarpath
##debug ## write-host $tarpath

Write-Output "++++++++++++++++++++++++++++++++++" > $exepath\test1.txt
Write-Output "" >> $exepath\test1.txt
get-date out-file -filepath $exepath\test1.txt -append
Write-Output "Processing Started" >> $exepath\test1.txt
Write-Output "" >> $exepath\test1.txt


If ($copyquestion -eq 'y'){
Write-Output "Copy operation selected checking registry" >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
$bol = test-path -path "HKLM:\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\FSA\PlaceholderService"
$bol2 = test-path -path "HKLM:\SOFTWARE\KVS\Enterprise Vault\FSA\PlaceholderService"

If ($bol){
## 64 bit PHS
$testreg = get-itemproperty "HKLM:\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\FSA\PlaceholderService"

If ($testreg.BypassRecalLimitsForAdmins -eq 1){
write-host "BypassRecalLimitsForAdmins is set (64 bit)"
write-output "BypassRecalLimitsForAdmins is set (64 bit)" >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
}
Else{
$bypassnotset =$(read-host "The registry setting, BypassRecalLimitsForAdmins is not set, would you like to set it? Use the format y or n ")

If ($bypassnoteset = 'y'){
write-host "Setting BypassRecalLimitsForAdmins to 1"
write-output "Setting BypassRecalLimitsForAdmins to 1"
write-output "" >> $exepath\test1.txt
set-itemproperty -path "HKLM:\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\FSA\PlaceholderService" -name "BypassRecalLimitsForAdmins" -value 1
$restart = 1
}
Else{
write-host "Not setting BypassRecalLimitsForAdmins can cause recall processing to fail if recall limits are encountered. Will exit. "
Break
}
}

If ($testreg.RecallLimitMaxRecalls -eq 99){
write-host "RecallLimitMaxrecalls is set to the highest accepted value (99) "
write-output "RecallLimitMaxrecalls is set to the highest accepted value (99) " >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
}
Else{
write-host "RecallLimitMaxrecalls is NOT set to the highest accepted value (99) "
$recalllimitnotset =$(read-host "The registry setting, RecallLimitMaxrecalls is not set to the highest acceptable value, would you like to set it? Use the format y or n ")

If ($recalllimitnotset = 'y'){
write-host "Setting RecallLimitMaxrecalls to 99"
write-output "Setting RecallLimitMaxrecalls to 99" >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
set-itemproperty -path "HKLM:\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\FSA\PlaceholderService" -name "RecallLimitMaxrecalls" -value 99
$restart = 1
}
Else{
write-host "Not setting RecallLimitMaxrecalls can cause recall processing to fail if recall limits are encountered. Will exit. "
Break
}
}

If ($testreg.RecallLimitTimeInterval -eq 1){
write-host "RecallLimitTimeInterval is set to the lowest accepted value (1) "
write-output "RecallLimitTimeInterval is set to the lowest accepted value (1) " >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
}
Else{
$recalllimitTnotset =$(read-host "The registry setting, RecallLimitTimeInterval is not set to the lowest acceptable value, would you like to set it? Use the format y or n ")

If ($recalllimitTnotset = 'y'){
write-host "Setting RecallLimitTimeInterval to 1"
write-output "Setting RecallLimitTimeInterval to 1" >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
set-itemproperty -path "HKLM:\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\FSA\PlaceholderService" -name "RecallLimitTimeInterval" -value 1
$restart = 1
}
Else{
write-host "Not setting RecallLimitTimeInterval can cause recall processing to fail if recall limits are encountered. Will exit. "
Break
}
}
}
ElseIf ($bol2){
## 32 bit PHS
$testreg = get-itemproperty "HKLM:\SOFTWARE\KVS\Enterprise Vault\FSA\PlaceholderService"
$eval1 = $testreg.BypassRecalLimitsForAdmins

## debug ##
write-host $eval1
If ($eval1 -eq 1){
write-host "BypassRecalLimitsForAdmins is set"
write-output "BypassRecalLimitsForAdmins is set" >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
}
Else{
$bypassnotset =$(read-host "The registry setting, BypassRecalLimitsForAdmins is not set, would you like to set it? Use the format y or n ")

If ($bypassnoteset = 'y'){
write-host "Setting BypassRecalLimitsForAdmins to 1"
write-output "Setting BypassRecalLimitsForAdmins to 1" >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
set-itemproperty -path "HKLM:\SOFTWARE\KVS\Enterprise Vault\FSA\PlaceholderService" -name "BypassRecalLimitsForAdmins" -value 1
$restart = 1
}
Else{
write-host "Not setting BypassRecalLimitsForAdmins can cause recall processing to fail if recall limits are encountered. Will exit. "
Break
}
}

If ($testreg.RecallLimitMaxRecalls -eq 99){
write-host "RecallLimitMaxrecalls is set to the highest accepted value (99) "
write-output "RecallLimitMaxrecalls is set to the highest accepted value (99) " >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
}
Else{
#write-host "RecallLimitMaxrecalls is NOT set to the highest accepted value (99) "
write-output "RecallLimitMaxrecalls is NOT set to the highest accepted value (99) " >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
$recalllimitnotset =$(read-host "The registry setting, RecallLimitMaxrecalls is not set to the highest acceptable value, would you like to set it? Use the format y or n ")

If ($recalllimitnotset -eq 'y'){
write-host "Setting RecallLimitMaxrecalls to 99"
write-output "Setting RecallLimitMaxrecalls to 99" >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
set-itemproperty -path "HKLM:\SOFTWARE\KVS\Enterprise Vault\FSA\PlaceholderService" -name "RecallLimitMaxrecalls" -value 99
$restart = 1
}
Else{
write-host "Not setting RecallLimitMaxrecalls can cause recall processing to fail if recall limits are encountered. Will exit. "
Break
}
}

If ($testreg.RecallLimitTimeInterval -eq 1){
write-host "RecallLimitTimeInterval is set to the lowest accepted value (1) "
write-output "RecallLimitTimeInterval is set to the lowest accepted value (1) " >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
}
Else{
$recalllimitTnotset =$(read-host "The registry setting, RecallLimitTimeInterval is not set to the lowest acceptable value, would you like to set it? Use the format y or n ")

If ($recalllimitTnotset -eq 'y'){
write-host "Setting RecallLimitTimeInterval to 1"
write-output "Setting RecallLimitTimeInterval to 1" >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
set-itemproperty -path "HKLM:\SOFTWARE\KVS\Enterprise Vault\FSA\PlaceholderService" -name "RecallLimitTimeInterval" -value 1
$restart = 1
}
Else{
write-host "Not setting RecallLimitTimeInterval can cause recall processing to fail if recall limits are encountered. Will exit. "
Break
}
}
}
Else{
write-output "Registry Read failed for path HKLM:\SOFTWARE\Wow6432Node\KVS\Enterprise Vault\FSA\PlaceholderService and HKLM:\SOFTWARE\KVS\Enterprise Vault\FSA\PlaceholderService Copy operations may be limited by recall limits "
}
}
Else{
write-host "Copy not selected "
write-output "Copy not selected " >> $exepath\test1.txt
}

if ($restart -gt 0){
restart-service "Enterprise Vault File Placeholder Service"
write-host "Restarting EV File Placeholder Service"
write-output "Restarting EV File Placeholder Service" >> $exepath\test1.txt
write-output "" >> $exepath\test1.txt
}

## ver.bat & $exepath"\batch.cmd" $tarpath > $exepath"\dirout.txt"

## & $exepath"\batch.cmd" $tarpath > $exepath"\dirout.txt"
## above worked at the command line in PS

## ver.bat $readlines = get-content $exepath\dirout.txt
##$readlines = get-childitem $tarpath -force -recurse where-object {$_.mode -notlike "d*"}

## ------------------------------------------------
## Edited by Me (u know)
## ------------------------------------------------

Get-Content $txtfile Foreach-Object {
$searchstring = $_
$searchbase = "$tarpath\$searchstring*"

write-host $searchbase
write-output "Searching folder beginning with $searchstring ..." >> "$exepath\$searchstring.txt"

## $readlines = get-childitem $searchbase -force -recurse where-object {$_.mode -notlike "d*" -and $_.length -lt 10000}

$readlines = get-childitem $searchbase -force -recurse -exclude *.ldb where-object {$_.mode -notlike "d*"}
#$readlines = get-childitem -LiteralPath "F:\Groups\Development\Developments - Commercial\Administration Stationary\VIC\GeneralAdmin\Expenses_04_05\051209memo[Expenses-Richard].doc"


## ------------------------------------------------

##
##
## $count = 0
foreach($readline in $readlines){
$fullname = $readline.fullname
$fsutilout = fsutil reparsepoint query "$fullname"
## pass fsutilout to new variable to ensure string
$fsutiloutst = "$fsutilout"
## debug ## write-host "running fsutil on file " $fullname " returned " $fsutiloutst

$filetest = Get-ChildItem -LiteralPath "$fullname" -Force

#trap{
# $filetest = Get-ChildItem -LiteralPath "$fullname" -Force
# "ERROR Filetest: file $filetest :: "+ $_ out-file "$exepath\$searchstring error.txt" -append
# write-host $_
# continue
#}

#$filetest = $fullname

$offline = $filetest.Attributes -band [System.IO.FileAttributes]::Offline

trap{
"ERROR->file $filetest :: "+ $_ out-file "$exepath\$searchstring error.txt" -append
write-host $_
continue
}

###$fatrout = & $exepath"\fatr.exe" -r "$fullname"
## next pass $fatrout to another variable to properly get it in a string
###$fatroutst = "$fatrout"
## debug ## write-host "running fatr in report mode on file " $fullname " returned " $fatroutst

## Logic for evaluation of the strings

## new test for offline - Determining if an attribute is set
## $File = Get-ChildItem .\test.txt -Force
## $File.Attributes
## if ( $File.Attributes -band [System.IO.FileAttributes]::Hidden )
## { Write-Host "Hidden Attribute Set" }

## Setting an attribute

## $File = Get-ChildItem .\test.txt -Force
## $File.Attributes
## $File.Attributes = ( $File.Attributes -bor [System.IO.FileAttributes]::System )
## $File.Attributes

## Removing an attribute
## $File = Get-ChildItem .\test.txt -Force
## $File.Attributes
## $File.Attributes = ( $File.Attributes -bxor [System.IO.FileAttributes]::System )
## $File.Attributes


If ($fsutiloutst -match'(?m:^Error)' -and $offline -eq 0){
$out1 = "The file "+$fullname+" has no EV reparse information and does not have the offline bit set, no action needed"
out-file -filepath "$exepath\$searchstring.txt" -inputobject $out1 -append

}
elseif ($fsutiloutst -replace ' ', '' -match '(^ReparseTagValue:0x00000010GUID:{9DD58ACD-4BE7-4F36-9CE3-B7738EE3C702})' -and $offline -eq 0){
$out2 = "The file "+$fullname+" has EV reparse information and does not have the offline bit set, will set offline bit"
out-file -filepath "$exepath\$searchstring.txt" -inputobject $out2 -append
$filetest.Attributes = $filetest.Attributes -bor [System.IO.FileAttributes]::Offline
# & $exepath"\fatr.exe" $fullname >> $exepath\test1.txt
}
elseif ($fsutiloutst -match'(?m:^Error)' -and $offline -eq 4096){
$out3 = "The file "+$fullname+" has no EV reparse information and does have the offline bit set, will clear offline bit"
out-file -filepath "$exepath\$searchstring.txt" -inputobject $out3 -append
$filetest.Attributes = $filetest.Attributes -bxor [System.IO.FileAttributes]::Offline
# & $exepath"\fatr.exe" $fullname >> $exepath\test1.txt
}
else{
## only case left should be has reparse, and has offline bit set
# $fullname
If ($copyquestion -match 'y'){
$out4 = "The file "+$fullname+" has EV reparse information, and is offline, will attempt to copy to nul device as copy selection set to 'y'"
out-file -filepath "$exepath\$searchstring.txt" -inputobject $out4 -append

#trap{
# "The File: "+ $fullname out-file "$exepath\$searchstring error.txt" -append
# "ERROR: "+ $_ out-file "$exepath\$searchstring error.txt" -append
# write-host $_
# continue
#}

## copy-item $fullname \\.\nul\ -verbose -force out-file -file path $exepath\test1.txt -append
copy-item -LiteralPath $fullname \\.\nul\
$copyresult = $?

write-output "Copy of $fullname to nul returned $copyresult " >> "$exepath\$searchstring.txt"
}
Else{
$out5 = "The file "+$fullname+" has EV reparse information, and is offline, will not attempt to copy to nul device as copy selection not set to 'y'"
out-file -filepath "$exepath\$searchstring.txt" -inputobject $out5 -append

## copy functionality ## write-host "file " $fullname " has reparse information and is offline, will attempt to copy to nul device"
##
## copy $fullname \\.\nul\
}
}
}


## ------------------------------------------------
## Edited by Me (u know)
## ------------------------------------------------
}
## ------------------------------------------------

Write-Output "" >> $exepath\test1.txt
Write-Output "Processing Completed" >> $exepath\test1.txt
get-date out-file -filepath $exepath\test1.txt -append

This blog has moved

This blog is now located at http://blog.laurence.id.au/.
You will be automatically redirected in 30 seconds, or you may click here.

For feed subscribers, please update your feed subscriptions to
http://blog.laurence.id.au/rss.xml.

Running PEAP with Cisco Aeronet 1231G and Cisco Wireless IP Phone 7925G

To run WiFi with WPA and PEAP using Cisco Aeronet and Windows IAS/NPS, you need the following:

• Cisco Aeronet Access Point
• Windows Server (2003/2008) running IAS/NPS as the Radius server
• Server authentication certificate (commercial or self-signed)

Setting the Access Point

Login to the access point using HTTP/HTTPS, navigate to Security - Server Manager

Create a new radius server, point it to the Windows IAS/NPS (installed later). Speficy the shared secret and port for authentication and accounting

Set the default server priorities to or the new Radius server's IP address you just added

Navigate to Security - SSID Manager

Create a new SSID, attach it to the VLAN and tick the Radio checkbox

For Client Authentication Settings, tick Open Authentication with EAP and Network EAP. Change the Server Priorities to Customize or use defaults

For Client Authentication Key Management, select Mandatory for Key Management and tick WPA

SSID Settings. (optional) select Multiple SSID if you are running this SSID as multiple SSID

Navigate to Security - Encryption Manager

Select Encryption Modes to Chipher with AES CCMP + TKIP

Select Encryption Keys to Key 2 and let the value blank

Setting IAS/NPS

Once the NPS installed, run the wizard to setup the Wireless network.
We need to add a radius client which is the IP address of the Cisco Access Point

Navigate to Advancced tab, select the vendor name to Cisco

Navigate to Policies and select Connection Request Policies. Select the Secure Wireless Policy

Most of the following settings are the default value

Navigate to Use Windows authentication for all users. The following settings are having the default value

Navigate to Secure Wireless Connections. The following settings are having the default value

We specify which AD Security Group has access to this policy

Up to this stage, you need to import a server authentication certificate. This can be a commercial certificate or self-signed certificate. If you use self-signed certificate, you need to make sure the clients machine that is going to connect to this WiFi must trust the Root CA who generate this certificate

Select Microsoft Protected EAP (PEAP) and select Edit

If you have the certificate installed correctly, you should see the option which certificate you want to use

On the Settings tab

CCNA Voice

Yesterday, I passed the 642-436 CVOICE 6.0 which makes me officially a CCNA Voice, yahoo!! CCVP here I come...

BES Upgrade 4.1.7 to 5.0.1

Recently we had to upgrade BES 4.1.7 to BES 5.0.1.
We use the following methods and upgrade was a success:

- Prepare the new server (e.g. set local permission for BESadmin, install MAPI Client and CDO, etc)

- Stop and disable all the BES Services on the old BES

- (optional) Take a backup of the BESMgmt database from the old SQL server

- From the new BES Server, run the Tools\BB50preptool.exe, specify the old SQL server and the BESMgmt database. This will prepare the database to be upgradable to ver 5.x

- Take another backup of the BESMgmt database

- Restore the database to the new SQL server

- Edit the database

In SQL Manager expand the BESMgmt database and select Tables. In the centre window right mouse click ServerConfig and select Open Table. Now edit the columns below and update them to display the new server name

-ServiceName
-MachineName
-RPCEndPoint (only edit the name after “\pipe\BESMonitor” )

Still within the ServerConfig table scroll to the MDSAGConfigId column and ensure it is set to NULL. Now close the ServerConfig table and reselect the Tables fold in the left column and locate the MDSAGConfig table in the centre section. Once again right mouse click and select Open Table and ensure you can only see one row containing all NULL values. If a row containing server settings appears select that entire row and delete it.

You can now close the MDSAGConfig table and we can now be assure no old MDS Service settings are migrated and they can be installed fresh on this new server.

Now select the Tables folder in the left column again. In the centre window right mouse click MDSConfig and select Open Table. Now edit the columns below and update them to display the new server name.
-MDSHost
-MachineName
-ServerName (only edit the name before “_MDS-CS_X”)

- From the new BES Server, run the setup.exe. Select use existing database and point it to the new SQL server

After finished installing, reboot the BES Server

You may get the following error in the System Event Log:

Application popup: BBConvert.exe - System Error : The program can't start because WMVCore.DLL is missing from your computer. Try reinstalling the program to fix this problem.

If so, run the following command: (for Windows 2008 R2)

Pkgmgr.exe /ip /m:"%windir%\servicing\Packages\Microsoft-Windows-Media-Format-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.mum"

MOSS CSS Reference

The best CSS Reference for SharePoint Server 2007 you can find on the Internet - save my life!!

http://www.heathersolomon.com/content/sp07cssreference.htm

MCITP: Server Administrator (Windows 2008)

Just passed 70-649 today with score 1000!! Not expecting that, but hey, I am officially an MCITP: Server Administrator

Passed Exam 70-646

With the score 925!! Not bad for the first exam of year 2010!
Keep going forward, next one is 70-649

Citrix Xen Application DataStore Move

To move SQL database from the old server to the new server:

• Stop IMA service on all Citrix servers
• Take a full backup of the data store DB from the old server
• Restore the backup to the new SQL server
• Edit the MF20.DSN ODBC file on Zone data collector server
• Change the old server to the new server
• Run the following command

C:> dsmaint config /user:sql-username /pwd:sql-password /dsn:"C:\Program Files\Citrix\Independent Management Architecture\MF20.dsn"

C:> dsmaint recreatelhc

• Start the IMA service
• Do the same thing for the rest of the servers

Exchange 2010 Migration - Part 6

To uninstall the existing Exchange 2007 mailbox role, the public folder database of it has to be removed

Part 6 - Exchange 2007 Public Folder Removal

Environment:
1 x Exchange 2007 SP2 (Mailbox)
1 x Exchange 2010 (CAS, Hub and UM)
1 x Exchange 2010 (Mailbox)

Move all the replica from the 2007 to 2010. From the Mailbox server of 2007, run this command:

[PS] MoveAllReplicas.ps1 -server -NewServer

Then try to remove the Public Folder database from the Exchange 2007. You might get the following error:

Object is read only because it was created by a future version of Exchange ...

If you do, you need to run the following PS from the Exchange 2010:

[PS] C:\>Remove-PublicFolderDatabase -Identity "\Second Storage Group\Public Folder Database"

If the removal is done, you can start deleting the Storage Group and uninstall the Exchange 2007 Mailbox role

Exchange 2010 Migration - Part 5

Exchange 2010 has a built in support for MWI and I am using a Cisco Phone which has MWI feature

Part 5 - Exchange 2010 MWI (Message Waiting Indicator)

Existing Environment:
1 x Exchange 2007 SP2 (Mailbox)
1 x Exchange 2010 (CAS, Hub and UM)
1 x Exchange 2010 (Mailbox)

If you do not enable the MWI of your SIP trunk between your Exchange UM and CUCM, you will get this event log warning:

The Unified Messaging server failed to deliver the MWI notification '1/7 (unread/read)' for the UM-enabled mailbox '(3037b9d1-3554-45af-8a68-077e54104120)' associated with UM extension 'xxxxx'. Additional information: Microsoft.Exchange.UM.UMCommon.MwiNoTargetsAvailableException: There are no more targets available to send an MWI message for user .

To get it working, you need to do the following:

• Login to CUCM, go to System - Security Profile - SIP Trunk Security Profile
• Find the SIP Trunk Security Profile that is being used by the SIP trunk between Exchange UM and CUCM
• Edit it and make sure the option Accept Unsolicited Notification is enable and reset the trunk

Exchange 2010 Migration - Part 4

Since my mailbox been migrated to the Exchange 2010 mailbox, I wasn't been able to receive my voicemail through my Outlook

Existing Environment:
1 x Exchange 2007 SP2 (Mailbox)
1 x Exchange 2010 (CAS, Hub and UM)
1 x Exchange 2010 (Mailbox)

Part 4 - UM and Hub Transport Issue

The following error occurred on my UM/Hub Transport server:

The Unified Messaging server failed to submit a message to Hub Transport server 'Hub01' due to the following error: Unexpected SMTP server response. Expected: 220, actual: 500, whole response: 500 5.3.3 Unrecognized command

According to some forums, this occurs because the communication between the UM and Hub Transport server is using TLS and I don't have a valid SSL certificate.

To fix this, either buy a valid certificate and assign it to the UM and SMTP service or do the following:

• Find the Receive Connector (within Server Configuration - Hub Transport) that most likely to be used by the UM to communicate with the Hub Transport. Usually it will use the more specific network addresses from the network tab of its properties
• On the Authentication tab, untick all TLS related options. Make sure Exchange Server authentication is selected
• On the Permission Groups tab, make sure Exchange servers is selected
• Restart Transport and UM Exchange services

Exchange 2010 Migration - Part 3

Since my user account has been migrated to Exchange 2010, my iPhone ActiveSync is broken.

Existing Environment:
1 x Exchange 2007 SP2 (Mailbox)
1 x Exchange 2010 (CAS, Hub and UM)
1 x Exchange 2010 (Mailbox)

Part 3 - ActiveSync Issue

The following event log will be seen on the CAS server:

Exchange ActiveSync doesn't have sufficient permissions to create the "CN=User,OU=Users,DC=domain,DC=local" container under Active Directory user "Active Directory operation failed on dc.domain.local. This error is not retriable. Additional information: Access is denied.Active directory response: 00000005: SecErr: DSID-03151E04, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0".Make sure the user has inherited permission granted to domain\Exchange Servers to allow List, Create child, Delete child of object type "msExchangeActiveSyncDevices" and doesn't have any deny permissions that block such operations.

It turns out that the AD user account is a member of the protective group (e.g. Domain Admins).
To fix this, remove the user from the protective group, go to the user's properties - security - Advanced and tick "Include inheritable permissions from this object's parent"

I had to remove my exchange account from my iPhone and re-add it back to make it work.

Exchange 2010 Migration - Part 2

Existing Environment:
1 x Exchange 2007 SP2 (CAS,Hub and UM)
1 x Exchange 2007 SP2 (Mailbox)
1 x Exchange 2010 (CAS, Hub and UM)
1 x Exchange 2010 (Mailbox)

Part 2 - Migrate Users

From Exchange Management Console - Add a local move request to move user mailbox

I have CUCM that was setup with SIP trunk to the 2007 UM, so I need to re-point it to the 2010 UM - Change CUCM SIP Trunk to 2010 UM's IP Address

Generate SSL Cert for 2010 CAS - Go to IIS 7 of the CAS and generate CSR. Replace the self-signed SSL cert with the new one

I am using ISA 2006 to publish Outlook Web App and ActiveSync - Change owa and ecp authentication to Basic. Do this from EMC - Server Configuration - Client Access

Change ISA OWA publishing rule to point to the new 2010 CAS
Change ISA OWA publishing rule to add /ecp/* to the paths of the publishing rule

Exporting Active Directory Group Membership

Save this code as a .vbs file:

Dim objGroup, objUser, objFSO, objFile, strDomain, strGroup, Domain, Group

'user Input box
strDomain = Inputbox ("Enter the FQDN Domain name, e.g. domain.com", "Domain Name", "Domain Name")
strGroup = InputBox ("Enter the NetBIOS Group name, e.g. mygroup", "Group Name", "Group Name")

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.CreateTextFile("C:\temp\" & strGroup & ".txt")
Set objGroup = GetObject("WinNT://" & strDomain & "/" & strGroup & ",group")

For Each objUser In objGroup.Members
objFile.WriteLine objUser.Fullname & " (" & objUser.Name & ")"
Next

objFile.Close
Set objFile = Nothing
Set objFSO = Nothing
Set objUser = Nothing
Set objGroup = Nothing

Wscript.Echo "Group Membership Exported to the file: " & "C:\temp\" & strGroup & ".txt"

Exchange 2010 Migration - Part 1

Existing Environment:
1 x Exchange 2007 SP2 (CAS,Hub and UM)
1 x Exchange 2007 SP2 (Mailbox)
1 x Exchange 2010 (CAS, Hub and UM)

Part 1 - Install Mailbox Role of Exchange 2010

OS: Windows 2008 R2 x64

Add .NET framework 3.5.1 features
Install filter 1.0 pack x64

Run As Administrator: Cmd
Go to Scripts folder of Exchange installation CD/Folder
ServerManagerCmd -ip Exchange-MBX.xml -Restart

Note: the above command is for Windows 2008 SP2, but works fine for 2008 R2

Add "Exchange Trusted Subsystem" as the local admin group in all Exchange 2007 Servers and reboot them, otherwise you will get "access denied" error when trying to view the OWA/ActiveSync configuration from 2010 console

To be continue...

VMware Virtualization Forum 2009

@Darling Harbour - Sydney
Hot topic: PCoIP, VMware View, ThinApp

VMware Workstation Network Issue

If you try to copy a large file from within the VM to another machine on the network and get the following error: Specified Network is no longer available, then add the following line to your VM's vmx file:

ethernet0.txbw.limit=100000
ethernet0.rxbw.limit=100000

Exchange 2007 Cmdlet - Remove a particular email domain from the org

The fastest way to remove @target.local from AD objects across the Org:

Get-Mailbox -organizationalunit 'dc=domain,dc=local' | % { $a = $_.emailaddresses; $b = $_.emailaddresses; foreach($e in $a) { if ($e.tostring() -match "target.local") { $b -= $e; } } ; $_ Set-Mailbox -emailaddresses $b }

Get-DistributionGroup -organizationalunit 'dc=domain,dc=local' | % { $a = $_.emailaddresses; $b = $_.emailaddresses; foreach($e in $a) { if ($e.tostring() -match "target.local") { $b -= $e; } } ; $_ Set-DistributionGroup -emailaddresses $b }

Get-DynamicDistributionGroup -organizationalunit 'dc=domain,dc=local' | % { $a = $_.emailaddresses; $b = $_.emailaddresses; foreach($e in $a) { if ($e.tostring() -match "target.local") { $b -= $e; } } ; $_ Set-DynamicDistributionGroup -emailaddresses $b }

Get-MailContact -organizationalunit 'dc=domain,dc=local' | % { $a = $_.emailaddresses; $b = $_.emailaddresses; foreach($e in $a) { if ($e.tostring() -match "target.local") { $b -= $e; } } ; $_ Set-MailContact -emailaddresses $b }

Get-MailPublicFolder -organizationalunit 'dc=domain,dc=local' | % { $a = $_.emailaddresses; $b = $_.emailaddresses; foreach($e in $a) { if ($e.tostring() -match "target.local") { $b -= $e; } } ; $_ Set-MailPublicFolder -emailaddresses $b }

Get-MailUser -organizationalunit 'dc=domain,dc=local' | % { $a = $_.emailaddresses; $b = $_.emailaddresses; foreach($e in $a) { if ($e.tostring() -match "target.local") { $b -= $e; } } ; $_ Set-MailUser -emailaddresses $b }

#Get-Recipient -organizationalunit 'dc=domain,dc=local' | % { $a = $_.emailaddresses; $b = $_.emailaddresses; foreach($e in $a) { if ($e.tostring() -match "target.local") { $b -= $e; } } ; $_ Set-Recipient -emailaddresses $b }