Sole's Blog

Posts Tagged ‘How To’

Most experienced consultants use Google daily to find descriptions of problems and solutions, knowing your way around Google and making a good search, can mean the difference between identifying and solving a problem within minutes or hours.

Many times a customer have asked me how to solve a problem, that I didnt know the answer to on the top of my head, after all there is a lot of issues and only so much memory and experience. Not once have I recieved any negative responses from saying “let me do a little research and i will come right back to you”, on the contrary the customer is happy and relieved that I will help them. Dont drop the ball and say “no sorry cant help you”, must customers dont have the time or experience to search for an answer them self, why else would they be asking. Read the rest of this entry »

All PPTP VPN interfaces in ISA 2006 (sp1) disappeared from the Routing and Remote Access Service console, this problem was a cool problem both because it was challenging but also due to the unexpected results and solutions we found.

The first google attempt at finding a solution told us to try the following workaround – Not recommended!

• Run the following command: C:\> netsh int ip reset c:\resetlog.txt

Well this solution might fix the problem here and now, but you might as well turn to the good old solution of restarting your server every time it fails, because this solution will do the following.

• Enable DHCP and remove all IP configuration of all interfaces.
  Not the smartest move on a server, and you are stuck with having to retype all your settings again.
• Most likely the problem will reappear again, since it does not fix the problem.

Now looking deeper into the error, we started looking at event logs – nothing here to help us (let us know if you had any usefull info here for this error). Then we tried various other things, including looking at a snapshot of the memory usage (you can just open taskmgr.exe) and found something surprising. Wspsrv.exe was using more memory handles than all other processes combined on the machine. A memory leak! It has been several years since I ran into a memory leak, it used to be the most common problem for programmers to avoid, but I rarely see them any more. Read the rest of this entry »

The easiest way (I love easy!) to order and install an SSL certificate on Exchange 2007, is to order a SAN (Subject Alternative Name) certificate with AutoCSR meaning you dont have to create a CSR but instead get a certificate backup file. You also save time with the SAN because you only use one certificate for all services and can move services from one domain to another in the certificate with no problems.

Make sure you get a SAN certificate including the full domain name(s) you use to access Outlook Web Access, Outlook Anywhere, Autodiscover and any internal servernames using the certificate (usually free).

The Certificate you order should contain something like this:

• mail.sole.dk and/or owa.sole.dk – for Outlook Web Access
• autodiscover.sole.dk and any other e-mail domain you use with Autodiscover/OA.
• MYSERVER01 – and any other server that will be using the certificate

Personally I setup servers to respond only to OWA on the mail./owa. domain, and use all other services like Outlook Anywhere, ActiveSync, etc. on the autodiscover. address, this way I can use Forms Based Authentication with my OWA website, and NTLM with my other services. Some people argue for and against having internal server names in the certificate, but I figure if they are free anyways, and might help why not add them – and if security is so much an issue that internal server names must not be revealed, you have other much bigger problems anyway.

Now some simple commands to manipulate Exchange 2007 SSL certificates. (Stolen from the danish Exchange 2007 guide on FairSSL a danish SSL certificate reseller – thanks!) Read the rest of this entry »

Sometimes the automatic updates service is interupted while updating the machine, this can result in updates with corrupted data that prevents the service from installing the updates correctly and failing the service. This means the machine will never get past the updates that are giving an error and continue to try and install over and over. This happens on just about any Windows machine that uses Automatic Updates, including Windows XP, Windows Vista, Windows Server 2003 and Windows Server 2008.

• The error prevents the workstation or server in installing updates, roll up packs, hotfixes and service packs, both manually and automatically.
• The error can also be that the Cryptographic service will not start correctly.
• The event error message contains information like not able to verify integrity of update.inf and similair.
• The error is in the verification of the update in Microsoft, this authentication is done with certificates by the Cryptographic service. 

The reason I am describing this error, is that it seems pretty normal, it can happen from servers being shutdown due to power failure, crashes, etc. It took me some while to find any good information on how to correct this error, or more correctly I found alot of information but little that helped.

Read the rest of this entry »

Configuration of Exchange 2007 with Outlook Web Access (OWA), Outlook Anywhere (OA), ActiveSync and Autodiscover can add grey hair to any system administrator or IT consultant. Then also trying to get different authentication schemes and ISA 2006 to play nice is not making it any easier.

Most Administrators have a wish to configure their environments used externally as securely as possible, including using SSL certificates with HTTPS instead of no encryption with HTTP, and using NTLM authentication instead of Basic authentication. But security is not everything, a userfriendly interface like Forms Based Authentication (FBA) is a must to avoid user iritation and support calls.

However getting FBA and NTLM to work together in ISA with Exchange 2007 can be quite scary, so lets go deeper and find out what we need to be aware of to get it working.

Read the rest of this entry »

During installation of Active Directory on a Windows Server 2000/2003/2008 all FSMO roles will automatically be installed on the first server. But Best Practice dictates to move some of theese Flexible Single Master of Operation (FSMO) roles to seperate servers.

If you only have one domain controller (not recommended), there is nothing to do since all roles must be on this server, but if you have multiple servers you should move some of theese roles on to more servers. It is also important to be aware of what servers are Global Catalog servers, especially if you have more than one domain and even if only one domain, they will be prefered by applications like Exchange server.

Read the rest of this entry »