Run As MSI File

If you need to deploy an MSI file through GPO by using User startup/login script and the MSI needs to have administrator rights, use the following Run As and Sanur:

runas /user:DOMAIN\account-with-admin-rights "msiexec /i The-File.msi /quiet /log c:\the-log.log ALLUSERS=1" | sanur password-for-account-with-admin-rights

Change Windows Task Folder Permission

1. Copy the tasks folder

XCOPY C:\WINDOWS\TASKS c:\temp /s /e /k /o

2. Go to Windows Explorer and change the c:\temp permission to whatever you like
3. Display the folder permission

CACLS C:\temp /s

4. Copy the SDDL string - the one between the quotes
5. Apply the permisison to the tasks folder

CACLS C:\Windows\Tasks /s:

Build ESX 3.5 Guide

This guide is based on installing ESX3.6 on PowerEdge 2950. The BIOS Setting must be set to:

CPU Virtualization Technology - enabled
AC Power Recovery Mode – last

1. Boot ESX 3.5 installation CD/DVD
2. Follow the installation wizard
3. Add the new ESX host to the Virtual Center
Open VI Client and connect to VC instance



Right click the Datacenter object and choose Add Host…



Type the FQDN name of the new host
Enter the root account login details and click Next



Accept default setting for new ESX host and click Finish

4. Install ESX Patches Using Update Manager
Open VI Client and connect to VC instance
Navigate to the new host in the left pane, and then choose the Update Manager tab
Click on Attach Baseline...



Select the checkbox of the baseline to be used and click OK
Note: If there is no baseline, click Create New Baseline… to create one
You should see the baseline attached to the Host now



Right click the Host in the left pane and select Scan for Updates



Select Yes to confirm scan



Once the scan has finished, right click the Host in the left pane and select Remediate...
On the Remediate Dialog Box, select the baseline checkbox that you want the Host to be remediated against and click Next
Leave the remediation time to: "Immediately" and the failure options to the default values and click Next
Click Finish to start the remediation

5. Change ESX Firewall Settings
SSH and login using: root

Open the port 2500-2510 TCP inbound
$> esxcfg-firewall -o 2500:2510,tcp,in,VeeamSCP

Restart the service:
$>service mgmt-vmware restart

6. Install Dell Server Administrator
Use Veeam or another SCP client to put the Dell OMSA Installer (get the latest Dell OMSA from www.dell.com)
Transfer the downloaded file from Dell website to the /tmp

Extract Dell installer
$> cd /tmp
$> tar -zxvf OM_5.4.0_ManNode_A01.tar.gz

Change directory and then install Open Manage Server Administrator using script
$> cd linux/supportscripts

If the Host has a DRAC card use the following command
$> ./srvadmin-install.sh –b –w –r -s

If the Host does not have a DRAC use this command
$> ./srvadmin-install.sh –b –w -s

Add additional ESX Firewall rule to allow OMSA communications
$> esxcfg-firewall -o 1311,tcp,in,OpenManageRequest


7. Configure SNMP

Use Veeam or another SCP client to put the new SNMP Config File

Create the SNMP config file, and save it as snmpd.conf:
# Sample snmpd.conf containing VMware MIB module entries.

# This is a simple snmpd.conf that may help you test SNMP.
# It is not recommended for production use. Consult the
# snmpd.conf(5) man pages to set up a secure installation.

#syscontact root@localhost (edit snmpd.conf)
#syslocation room1 (edit snmpd.conf)
rocommunity public
trapcommunity public
trapsink 10.0.0.1

# VMware MIB modules. To enable/disable VMware MIB items
# add/remove the following entries.
dlmod SNMPESX /usr/lib/vmware/snmp/libSNMPESX.so

# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
smuxpeer .1.3.6.1.4.1.674.10892.1

Transfer this new snmpd.conf file to /etc/snmp

Open VI Client and connect to VC instance
Navigate to the new host in the left pane, and then choose the Configuration tab
Choose Security Profile from the Software box
Click Properties
Check the SNMP Server checkbox and click OK

8. Install Navisphere Agent (If EMC SAN used)
Download current applicable linux NaviAgent package from Powerlink

Use Veeam or another SCP client to put the NaviAgent ZIP file to the /tmp
SSH and login using: root

Extract the ZIP file
$> cd /tmp
$> unzip -d navi LINUX_AGNT_CLI_6.24.3.2.0.zip

Assign the permission to execute
$>chmod 755 navi -R

Rename the files
$> cd navi
$> mv ESX_install.sh.txt ESX_install.sh
$> mv ESX_uninstall.sh.txt ESX_uninstall.sh
$> mv naviagentcli-6.24.3.2.0-1.noarch.rpm naviagentcli.noarch.rpm

Install Naviagent CLI
$> ./ESX_install.sh naviagentcli

Confirm opening ESX Firewall ports for NaviAgent

Create or edit an existing txt file called: agentID.txt
Add/edit the only two lines to read as below: (name and IP relevant to Host)

hostname.domain.com
10.0.0.23

Use Veeam or another SCP client to put the agentID.txt file into the /root

Reboot the Host
$> shutdown -r now

From this point we assume that SAN Fabric Zoning has been completed and the host can now be assigned to the SAN Storage Group applicable to the VI Cluster. This will allow it to access all necessary shared VMFS storage locations.

9. Configure Storage
Open VI Client and connect to VC instance



Navigate to the new host in the left pane, and then choose the Configuration tab
Choose Storage Adapters from the Hardware box
Right click the first HBA and click Rescan
Once completed, right click the second HBA and click Rescan
You should now see the assigned LUN (where available)

10. Configure Networking
Open VI Client and connect to VC instance
Navigate to the new host in the left pane, and then choose the Configuration tab
Choose Networking from the Hardware box
Select Properties of the default Virtual Switch: vSwitch0



Select the VM Network and click Remove
Click Yes to confirm



Select Add, choose VMkernel and click Next



Leave the name as defaults and check the box Use this port group for VMotion
Assign the necessary IP address and subnet mask to the switch, this must be different to the host address, and should be the next numerical above the host address.
Click Next



Click Finish
A prompt will appear notifying you that there is no Default Gateway set.
Choose Yes to set the default gateway for VMotion



Enter the correct Default Gateway value (usually the same as the servers Default Gateway)



Choose the Network Adapters Tab of the vSwitch0 Properties
Click Add



Select the second nominated adapter to add to the switch and click Next (this will give the service console and VMotion network redundancy)



Select Next to leave the network adapters in Active/Active mode
Click Finish and then choose Close to close the vSwitch0 properties
Select Add Networking...



Leave the default selection of Virtual Machine and choose Next



Ensure the default Create a virtual switch radio button is selected
Check the network adapters to be associated with the VM Switch (Should be a minimum of two) and click Next



Confirm the settings and choose Finish

11. Configure License
Open VI Client and connect to VC instance
Navigate to the new host in the left pane, and then choose the Configuration tab
Choose Licensed Features from the Software box
Click Edit on License Source



Select the Use License Server radio button and specify the address of the ESX License Server and Click OK
Click Edit on ESX Server Edition
Select ESX Server Standard radio button and Click OK

Trinity Rescue CD

Have you ever have to restore your local administrator password because you forget the password of it?

The best boot CD so far:
http://trinityhome.org

CCA Finally!!

Today I passed CCA with score 95%!! Wohoooo....

Next one... ???

IIS Anonymous User Account Reset Password

If you get this:

HTTP 401.1: DENIED BY INVALID USER CREDENTIALS:

This error code will have you focus on the credentials of the IUSR account. If you are receiving a 401.1, from a IIS perspective it means we have to go and look at IIS to make sure the IUSR username and password is correct for Anonymous access on all the IIS vDir's.

Occasionally the IIS guest account (IUSR_ account) has it's password out of sync between the IIS Metabase, Active Directory OR SAM (depending if the IUSR account is a local or domain account) and the credentials entered as the Anonymous user and password for the WSUS Virtual Directories in IIS. We need to make sure that the correct user account and credentials are used at 2 places:
In Active Directory or Local Account.
In the IIS Metabase.

Ensure that the IUSR account is not locked. Sometimes a 401.1 error could be caused by a locked IUSR account.

Then query the IIS Metabase to establish what the existing IUSR password is:
Edit c:\Inetpub\AdminScripts\ADSutil.vbs

Search for the line that reads "IsSecureProperty = True" and change it to "IsSecureProperty = False". Save and close the file.

From command line run:
Cscript adsutil.vbs get w3svc\anonymoususerpass

This will return an output like this:
anonymoususerpass : (STRING) "ThisIsTheIUSRaccountPassword"
Take note of the password, INSIDE of the quotes. The quotes are not part of the password. For safety, copy it into notepad.

Go to either Active Directory (if a domain account is used for the IUSR account) or find the LOCAL ACCOUNT for IUSR. In most cases IUSR will be a local account. Reset the password for your IUSR account with the password we just pulled from the IIS Metabase.

Gmail and Hotmail Fetcher

I use fetchmail to fetch emails from any POP3 account. Since Gmail support POP3 (you need to enable it), I can fetch it use the following command:

poll pop.gmail.com proto pop3 and options no dns
user 'myemail@gmail.com' there with password 'mypassword' is myforwardemail@localemail.com options ssl

Hotmail is a little bit trickier, because it is a HTTP based email.
To Fetch Hotmail, I use GetLive:

Before you set GetLive, make sure you set your 'reading pane' to off in your Hotmail setting
Get GetLive from the Internet (just Google it)
Create a config file (getlive.conf):

UserName=myusername
Password=mypassword
Domain=hotmail.com
Downloaded=/var/log/getlive.log
processor=sendmail -i myforwardemail@localemail.com
Delete=Yes
Folder=Inbox
mode=200810

and create a cron job to execute:

GetLive.pl --config-file getlive.conf

WSUS Tricky

Sometime it is very hard to register a computer account to the WSUS. Use the following script to make sure a computer is registered to WSUS:

net stop wuauserv

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v NextDetectionTime /f

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientIdValidation /f

net start wuauserv

wuauclt /resetauthorization /detectnow

Note: you can also use this script to your ESX VI customization template to make sure your new VMs deployed from that template has a unique SusClientId

NTVDM.EXE

For the last 2 weeks, I was stuck with trying to run old MS-DOS application on Windows 2003. It was previously ran on Windows 2000 fine, no problem at all. Suddenly when we migrated this app to Windows 2003, users start complaining that the application randomly freezes on them...

We tried everything we could think of, like setting up the compatibility layer on the batch file before running the app, e.g.

set __COMPAT_LAYER=Win2000 DisableThemes

it did not work...

Finally, we found the solution, it appears that the ntvdm.exe process is running on multiprocessors - which does not work for this particular MS-DOS app. So we need to tell the ntvdm.exe process to run only on uni-processor. To do that:

- backup your original ntvdm.exe file (c:\windows\system32)
- find and download imagecfg.exe (google it)
- copy the ntvdm.exe from the location above to a temp folder
- run: imagecfg.exe -u ntvdm.exe in the temp folder
- copy this new ntvdm.exe to system32, dllcache, servicepack\i386 folders, otherwise the Windows File Protection will replace your modified ntvdm.exe file with the original one
- test it, you will see only a single processor will be used to run ntvdm.exe

How to View ESX Running Tasks

Sometime when you are managing your ESX hosts with VC connection to your VI, you might get the 'connection time out' when doing something that takes longer that 15 minutes (hard coded), for example, merging/deleting a huge snapshot file

To view whether or not the task is still running on your host, SSH to your host

#> vimsh

[/]$ vimsvc/task_list
(ManagedObjectReference) [
'vim.Task:haTask-1488-vim.vm.Snapshot.remove-169152700', 'vim.Task:haTask-1520-vim.VirtualMachine.removeAllSnapshots-169152743', 'vim.Task:haTask-1520-vim.vm.Snapshot.remove-169152682', 'vim.Task:haTask-ha-root-pool-vim.ResourcePool.createResourcePool-169152886', 'vim.Task:haTask-ha-root-pool-vim.ResourcePool.updateConfig-169152786'
]

To view a specific task:

[/]$ vimsvc/task_info haTask-1488-vim.vm.Snapshot.remove-169152700
(vim.TaskInfo) {
dynamicType = ,
key = "haTask-1488-vim.vm.Snapshot.remove-169152700",
task = 'vim.Task:haTask-1488-vim.vm.Snapshot.remove-169152700',
name = "vim.vm.Snapshot.remove",
descriptionId = "vm.Snapshot.remove",
entity = 'vim.VirtualMachine:1488',
entityName = "ausyddbt04",
state = "running",
cancelled = false,
cancelable = false,
error = (vmodl.MethodFault) null,
result = ,
progress = 95,
reason = (vim.TaskReasonUser)
{ dynamicType = , userName = "vpxuser", }, queueTime = "2008-12-22T03:29:20.870373Z", startTime = "2008-12-22T03:29:20.870373Z", completeTime = , eventChainId = 169152700,
}

ESX Change Service Console IP Address

Delete existing VSWIF0:

esxcfg-vswif -d vswif0

Add a new one:

esxcfg-vswif -a vswif0 -p Service\ Console -i 10.1.1.1 -n 255.255.255.0 -b 10.1.1.255

Note: -i is the IP address, -n is the subnet and -b is the broadcast address

If you need to change the default gateway, edit the:

/etc/sysconfig/network

Dont forget to change the /etc/hosts file as well

reboot!

Printer Queue Stuck

After printing a job, the print indicator window only goes to 99% and the job never completes itself, although the paper spits out and it is finished. If you try to then print another job, it won't print because it thinks the first job isn't done (but it is).

When you try to open the queue, the first document says "Deleting- printed". It's almost like it's stuck at deleting the old job.

Do this:
- Stop the "Print Spooler" service.
- Delete all the existing print spool files. (Stored in "C:\WINDOWS\system32\spool\PRINTERS" by default).
- Start the "Print Spooler" service.
- Right-click the printer's icon in the Printers and Faxes folder and choose Properties.
- Click the Advanced tab.
- Click the Print Processor... button.
- Make a note of the existing "Print processor" selection on the left (in case you need to revert it.). Then change it to "WinPrint". Click OK.
- Click OK on the printer's properties window.
- Try sending a print job to see whether it persists in the print queue.

Passed 70-444 TodaY!!

Woooohooo~~ I passed 70-444 exam today which means I am officially MCITP Database Administrator (SQL 2005)! Don't really like to be a DBA but this helps me getting more details understanding of SQL 2005

How exciting after a loooooong night study for the last 3 months :)

Remove Offline Folder Share

Continuing from my previous blog about migrating file and print server, the clients might try to sync the offline folder to both old and new server. To fix this

disable offline folders
delete all the files in c:\windows\csc
enable offline folders

Re-Mapping Shared Folders or Printers

When you are tasked to migrate a file/print server, you have 2 options - keep the same server name for the new server or use a new name.

Keeping the same server name is an easier solution - you can build a new server with a temp name, do whatever you need to do and when the cutover time, rename the old server name to something else and name the new server to the old server name.

However, this approach is not always an option for you. If you need to use a different name for your new server, you need to somehow re-map all the shared folders and printers to the new file/print server.

Here is the script to map the printers:

' Full path to text file containing list of printer share names. e.g.
' OldPrinter1,NewPrinterA

Const PRINTERS_FILE = "\\server\printers$\new-printers.csv"

'Old and new Printer Server information
Const OLD_SERVER = "\\oldservername"
Const NEW_SERVER = "\\newservername"

'Create something to store the list of printers in
Set objPrinters = CreateObject("Scripting.Dictionary")

'Open the File in Read Only mode
Set objFileSystem = CreateObject("Scripting.FileSystemObject")
Set objFile = objFileSystem.OpenTextFile(PRINTERS_FILE, 1, False, 0)

Do While Not objFile.AtEndOfStream
arrLine = Split(objFile.ReadLine, ",")

' Load each printer entry into memory (keyed list, key is the old printer name)
If Not objPrinters.Exists(arrLine(0)) Then
objPrinters.Add LCase(arrLine(0)), LCase(arrLine(1))
End If

Loop

Set objFile = Nothing
Set objFileSystem = Nothing
Set objWSH = CreateObject("WScript.Network")

On Error Resume Next

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_Printer WHERE Network=True",,48)

For Each objPrinter in colItems
If UCase(objPrinter.ServerName) = UCase(OLD_SERVER) Then
strPrinter = LCase(objPrinter.ShareName)
strOldPrinterPath = objPrinter.ServerName & "\" & strPrinter

'Remove any printer still connected to OLD_SERVER
objWSH.RemovePrinterConnection strOldPrinterPath, True, True

'See if the old Printer exists in the file (from memory)
If objPrinters.Exists(strPrinter) Then

' Create the new Printer Path
strNewPrinterPath = NEW_SERVER & "\" & objPrinters(strPrinter)
Err.Clear

' Add the new Printer Connection
objWSH.AddWindowsPrinterConnection strNewPrinterPath

If objPrinter.Default = "True" Then
objWSH.SetDefaultPrinter strNewPrinterPath
End If
End If
End If
Next

Set colItems = Nothing
Set objWMIService = Nothing
Set objWSH = Nothing
Set objPrinters = Nothing

Here is the script to map the shared folder:

' Full path to text file containing list of share names. e.g.
' OldShared,NewShared Const
SHARES_FILE = "\\server\printers$\new-shares.csv"

' Old and new Server information
Const OLD_SERVER = "oldserver"
Const NEW_SERVER = "newserver"

' Create something to store the list of shares in
Set objShares = CreateObject("Scripting.Dictionary")

' Open the File in Read Only mode
Set objFileSystem = CreateObject("Scripting.FileSystemObject")
Set objFile = objFileSystem.OpenTextFile(SHARES_FILE, 1, False, 0)

Do While Not objFile.AtEndOfStream
arrLine = Split(objFile.ReadLine, ",")

' Load each shares entry into memory (keyed list, key is the old printer name)
If Not objShares.Exists(arrLine(0)) Then
objShares.Add LCase(arrLine(0)), LCase(arrLine(1))
End If
Loop

Set objFile = Nothing
Set objFileSystem = Nothing

'Create a filesystem object
Set FileSystemObject = CreateObject("Scripting.FileSystemObject")

'Create a drives collection
Set Drives = FileSystemObject.Drives

Dim objNetwork, strDriveLetter
Set objNetwork = CreateObject("WScript.Network")

'step through the drive collection, and extract'the drive letter and the type of drive
'according to the Microsoft VBScript documentation'there are 6 distinct types of drive

For Each DiskDrive in Drives
DriveLetter = DiskDrive.DriveLetter
DriveType = DiskDrive.DriveType

strDriveLetter = DriveLetter & ":"

Select Case DriveType
Case "0" DriveType = "Unknown type of drive"
Case "1" DriveType = "Removable drive"
Case "2" DriveType = "Fixed drive"
Case "3" DriveType = "Network drive"
Path = DiskDrive.ShareName
'get the server name of this shared folder
Temp = Right( Path, Len( Path ) - 2 )
IndexOfSlash = InStr( Temp, "\" )

OldServerName = Left( Temp, IndexOfSlash - 1 )

'get the shared name
OldSharedName = Right( Temp, Len( Temp ) - Len(OldServerName) - 1 )

'we only touch the shared folder in the old server
If UCase( OldServerName ) = UCase( OLD_SERVER ) Then
'is this the old shared name
If objShares.Exists( OldSharedName ) Then
'delete the old mapping drive
objNetwork.RemoveNetworkDrive strDriveLetter, True, True

strNetworkPath = "\\" & NEW_SERVER & "\" & objShares(OldSharedName )

'sleeping for a while
WScript.sleep 3000

'map the new drive persistently
objNetwork.MapNetworkDrive strDriveLetter, strNetworkPath, True
End If
End If
Case "4" DriveType = "CD-ROM drive"
Case "5" DriveType = "RAM Disk"
End Select
Next

Set Drives = nothing
Set FileSystemObject = nothing
Set objNetwork = nothing
Set objShares = nothing

Good Luck

MCITP One More to GO!!

After a long journey of studying, finally I finished my study of SQL 2005 and took the 70-443 exam today with the score 970.

This is part of my goal to get the MCITP: Database Administrator which I need to sit on one more exam 70-444 to finalize this.

As per my prev post, I am working with SQL 2005 servers and it gets me excited to know more

Windows 2000 Domain Controller - Restore Trust Relationship

If your domain controllers are not replicated to each other and your are getting the following errors:

netdiag

DC list test . . . . . . . . . . . :[WARNING] Cannot call DsBind to DC1). [SEC_E_WRONG_PRINCIPAL]

dcdiag

Warning: DC1 is the Schema Owner, but is not responding to DSRPC Bind.[DC1] LDAP bind failed with error 31,A device attached to the system is not functioning..

Warning: DC1 is the Schema Owner, but is not responding to LDAP Bind.
Warning: DC1 is the Domain Owner, but is not responding to DSRPC Bind.
Warning: DC1 is the Domain Owner, but is not responding to LDAP Bind.
Warning: DC1 is the PDC Owner, but is not responding to DS RPC Bind.
Warning: DC1 is the PDC Owner, but is not responding to LDAPBind.
Warning: DC1 is the Rid Owner, but is not responding to DS RPC Bind.
Warning: DC1 is the Rid Owner, but is not responding to LDAPBind.
Warning: DC1 is the Infrastructure Update Owner, but is not responding to DS RPC Bind.
Warning: DC1 is the Infrastructure Update Owner, but is not responding to LDAP Bind.

It could be the trust relationship between the domain controller is broken. To establish the trust back, do the following:

1. Find the PDC Role

netdom query fsmo

2. Reset the computer account password from the other Domain Controller

net stop kdc

netdom resetpwd /server: /userd: /passwordd:

reboot

Kerberos Ticket Granting Ticket

One day - I was setting up WSUS and creating GPO that only applies (with Security Filtering) to a security group that has computer accounts as a member of. So I started adding computers to this new security group.

I waited... waited... and waited... but nothing happened on the WSUS console. Those computers that I added to the security group do not appear on the WSUS console.

I ran the gpresult and found out that the GPO has not been applied to the computer. I ran gpupdate /force so many time, but nothing was working.

It turns out that the computer would not know about its membership until the Kerberos TGT is renewed. To renew the ticket, the computer has to be restarted, wait for 7 days (default value) or use klist.exe to purge the ticket and renew it. Because the computer does not know anything about its new membership, the GPO wasn't applied to it.

To use KLIST, do the following:

• get psexec.exe from MS SysInternals
• get the klist.exe from Windows Resource Tool Kit
• get the nltest.ext from Windows Resource Tool Kit
• run the cmd.exe as a system shell:

psexec.exe /i /s /d cmd.exe

• from that new cmd prompt, run:

klist tgt

• check when was the ticket renewed
• to purge the tickets, run:

klist purge

• to renew the tickets, run:

nltest /dclist:

Then you can run gpupdate /force again to force the GPO and then run wuauclt.exe /detectnow to register the client to the WSUS

Citix Hanging at Mapping Client Drives

Quick tips [that works for me]:

If you are trying to login to a published application on Citrix and it was hanging on the "Mapping Client Drives" forever....

Go to the citrix server itself, try to restart the Citrix Print Manager service (or kill the cpsvc.exe process), restart the Print Spooler service and start the Citrix Print Manager again

Flex and .NET Web Service Error Handling

I was doing this Flex project that consumes .NET Web Service and could not figure out how to catch SOAPException from .NET Web Service.

It turns out that Flex could not read any response from the Web Service that has HTTP response code other then 200. You will get the following error (fault) from the Web Service if Flex was getting the HTTP response code other then 200:

FaultCode:Server.Error.Request
faultString:'HTTP request error'
faultDetail:'Error: [IOErrorEvent type="ioError" bubbles=false cancelable=false eventPhase=2 text="Error #2032: Stream Error.

Which is annoying because there was not specific details about the error!!

The workaround is to force .NET to return with the response status 200 if the response status code either 500 or 300.

You do this by put the following code in your application global.asax

<%@ language="C#" %>protected void Application_EndRequest(object sender,EventArgs e)
{
if(Context.Response.StatusCode==500 Context.Response.StatusCode == 300)
{
Context.Response.StatusCode = 200;
}
}