Taiwan CSS Platform Team

Domain Controller Certificate Enroll/Renew Behavior in Server 2008 DC & Server 2003 DC

2012-06-26T09:33:00Z

環境 & 問題描述
============
CA : Server 2008 SP1 Standard OS安裝Enterprise Root CA
DC : Server 2008 SP1 DC & Server 2003 SP2 DC
Server 2008 DCs本身的憑證 (Domain Controller範本申請的憑證)過期而沒有自動Renew , 但是Server 2003 DC會自行Renew

問題原因
============
1. 環境有透過GPO啟動Auto-Enrollment機制
2. 環境CA是Enterprise CA搭配Server 2008 Standard OS , 無法支援V2 憑證範本的Auto-Enrollment功能

解決方式
============

方法一

將Enterprise CA移轉至Server 2008 Enterprise OS或是Server 2008 R2 任何版本的OS
藉此讓Auto-Enrollment機制可以生效 (較建議的方式)

方法二

停用GPO的Auto-Enrollment設定 (因為目前環境無法針對V2憑證範本進行Auto-Enrollment , 所以此設定目前也不會生效)

詳細分析說明
============

預設DC 在沒有進行任何設定時 , 只要環境安裝了Enterprise CA (不管安裝在什麼SKU)

DC都會自動透過預設的設定跟Enterprise CA申請[Domain Controller]此範本的憑證 (此為V1的憑證範本 , 何謂V1 V2範本請閱底下參考資料)

此機制是透過Automatic Certificate Request Settings (ACRS)來進行動作 , 而不是我們目前常說的Auto-Enrollment
(ACRS是Windows 2000時代部屬憑證的方式)

Auto-Enrollment的部分是由Server 2003開始才有的技術 , 要使用憑證的Auto-Enrollment時需要達到底下需求

摘錄: http://technet.microsoft.com/en-us/library/cc783873(v=ws.10)
Windows Server 2003 schema and Group Policy updates
Windows 2000 Server domain controllers running Service Pack 3 or later
Windows XP Professional or Windows Server 2003 clients
Windows Server 2003, Enterprise Edition or Datacenter Edition running as an Enterprise CA

上述需求達成後 , 我們則可以透過GPO的方式將Auto-Enrollment啟動 , 讓Client端可以透過此方式針對V2的憑證範本進行自動申請動作

而如果啟動Auto-Enrollment的設定時 , DC在進行本身憑證的取得時依據OS版本會有不同的行為

Server 2003 DC的行為
==============

1. 啟動Auto-Enrollment後 , 系統在開機時或是GPO套用時針對底下V2的憑證範本進行申請 or 更新

a. Domain Controller Authentication

b. Directory Mail Replication

c. Kerberos Authentication (如果Enterprise CA是裝在Server 2008之後的系統時才會有)

2. 如果上述動作可以成功時 , 則整個流程就完成

3. 假設上述因為某些因素無法申請 or 更新時 (如Enterprise CA裝在Server 2008 Standard OS時 or 權限不足)則會進行下一個動作

4. 透過內建預設的方式跟Enterprise CA透過Domain Controller此V1範本來進行憑證申請 or 更新

PS: 原先V1的Domain Controller範本於Server 2003時已經將其分割成上述a & b兩個V2憑證範本
而在Server 2008出來時又多一個Kerberos Authentication的V2憑證範本

Server 2008 DC的行為
==============

1. 啟動Auto-Enrollment後 , 系統在開機時或是GPO套用時針對底下V2的憑證範本進行申請 or 更新

a. Domain Controller Authentication

b. Directory Mail Replication

c. Kerberos Authentication (如果Enterprise CA是裝在Server 2008之後的系統時才會有)

2. 如果上述動作可以成功時 , 則整個流程就完成

3. 假設上述因為某些因素無法申請 or 更新時 (如Enterprise CA裝在Server 2008 Standard OS時 or 權限不足 or 其他因素)
則不會進行後續動作 (不會像Server 2003一樣跟CA透過V1的Domain Controller範本進行申請 or 更新)

所以由此可以得知為何只有外點的Server 2003 DC沒有受到影響 , 而其他Server 2008 DC都有此問題

相關參考資料
==============

何謂V1 , V2 , V3 憑證範本?
我們從Certificate Template的管理畫面內可以看到底下資訊 , Minimum Supported CAs分別會有三種值
Windows 2000 -> V1 憑證範本 (內建 , 無法編輯內容)
Windows Server 2003 Enterprise -> V2 憑證範本 (最常用 , 將V1憑證範本進行複製後即可產生V2 Template , 可以修改裡面內容如年限 & Support Auto-Enrollment等)
Windows Server 2008 Enterprise -> V3 憑證範本 (涵蓋V2憑證範本的所有功能並多ㄧ些新功能)

詳細資訊可以參考底下網址
Designing and Implementing a PKI: Part III Certificate Templates
http://blogs.technet.com/b/askds/archive/2010/05/27/designing-and-implementing-a-pki-part-iii-certificate-templates.aspx

How to Create a MS-DOS bootable USB flash drive

2012-06-26T04:22:00Z

MS-DOS bootable USB flash is still very useful today. It could be used to access a system that doesn't have any OS installed. Or, it's mostly used to flash BIOS or other firmwares from DOS mode.

There is an existing document in the sevenforum.com that gives you step by step instruction on how to create a MS-DOS bootable flash drive using HP USB Disk Storage Format tool. See link here:

http://www.sevenforums.com/tutorials/46707-ms-dos-bootable-flash-drive-create.html

However, this method may not work for all the USB flash drvies.

Ex: It does not work for my Kingston 4.0GB USB flash drive

Here is another workaround:

Step1: Download rufus utility, Rufus v 1.1.7 without FreeDOS Support (154KB) from here:

https://github.com/pbatard/rufus/downloads

Step2: Download win98_bootdisk.iso image from allbootdisks.com:

http://www.allbootdisks.com/download/iso.html

Step3: Run rufus_v1.1.7.exe

Step4: click the disk icon to the right of "Create a bootable disk using:", and selected the win98_bootdisk.iso you downloaded in step2.

Step5: click start, once you are finished. You could copy your BIOS upgrade files to this USB flash and run the executables in DOS mode.

Windows XP Professional ZH-更新KB2695962後無法使用SSL VPN機制連線的問題

2012-06-26T02:55:00Z

問題徵狀：Windows XP Professional ZH-更新KB2695962後無法使用SSL VPN機制連線的問題

客戶反映更新KB2695962後無法使用SSL VPN的機制連線，移除掉KB2695962之後就可以連線。

解決方法：

如果您的網路設備是Cisco ASA 5500 Series，目前確認是相容問題，請聯繫Cisco做升級。

Cisco ASA 5500 Series SSL VPN機制連線安裝KB2695962後無法連線http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-asaclient

Windows XP Professional ZH-點選開始的「關機」選項後，會延遲兩分鐘左右才出現功能選單

2012-06-26T02:12:00Z

· 問題徵狀：Windows XP Professional ZH-點選開始的「關機」選項後，會延遲兩分鐘左右才出現功能選單

過了兩分鐘才出現

問題說明：

您可能會在事件檢視器裡看到下列的訊息：

找不到來自來源 DCOM 之事件識別碼 10010 的描述。本機電腦可能並未安裝引發此事件的元件，或安裝已損毀。您可以在本機電腦上安裝或修復該元件。

如果事件源自其他電腦，則儲存它們時必須一併儲存顯示資訊。

下列資訊已隨附於該事件:

{9B1F122C-2982-4E91-AA8B-E071D54F2A4D}

GUID：9B1F122C-2982-4E91-AA8B-E071D54F2A4D是CAutoUpdate Class 1.0的元件

之所以發生這個問題，是因為CAutoUpdate Class 1.0的元件在SoftwareDistribution以及子資料匣內無法找到對應的參數。當「元件物件模型」(COM) 物件嘗試登錄時，會將登錄訊息發佈至 CAutoUpdate Class 1.0。由於 CAutoUpdate Class 1.0並未執行，因此登錄訊息會逾時。接著，COM 元件就會在終端機伺服器上記錄事件 ID 錯誤訊息。

通常發生的原因，是因為SoftwareDistribution裡面的資料損毀所導致。

解決方法：

重新命名SoftwareDistribution以及子資料匣

請您將下列指令存成fix.bat，並在發生問題的電腦上執行。

Net stop bits

Net stop wuauserv

cd \documents and settings\all users\application data\microsoft\network\downloader

Del qmgr0.dat

Del qmgr1.dat

cd %systemroot%

Ren SoftwareDistribution SoftwareDistribution.old

Net start bits

Net start wuauserv

再點關機，已可正常點選。

Windows 2008 R2 DHCP Lease Duration

2012-06-25T14:23:00Z

[問題描述]︰

依指令 netsh dhcp server set databasecleanupinterval 15
設定 DHCP Server , address pool 並未依設定每15分鐘進行清除與更新，

[解決方法]︰

新增機碼LeaseExtension以定期清除逾期的 IP address

[說明]：

1.      預設下，DHCP會在IP address租用過期4小時後，將此IP address標示為 [刪除] 狀態。
         此被設定為 [刪除] 狀態的IP address預設需經過1小時才會自DHCP database 被清除。
         但若環境中沒有足夠的可用IP可提供租用，也會立即清除以被認定為 [刪除] 狀態的IP。
3.      設定LeaseExtension 機碼會變更預設將租用到期的IP addres標示為[刪除] 狀態的時間。
         set databasecleanupinterval 則是變更清除[刪除] 狀態IP address的時間。

[如何設定]：

A.         請透過 [執行] > [regedit] > 找到下面的機碼位置：
            HKLM\System\CurrentControlSet\Services\DHCPServer\Parameters
            新增機碼名稱：LeaseExtension
            Value Type: DWORD
            Value Data: time in minutes

[參考資料]：

Determining Lease Duration
http://technet.microsoft.com/en-us/library/cc783573(WS.10).aspx

Although reducing the lease duration creates more DHCP-related network traffic, it increases the rate at which addresses are returned to the available address pool for reassignment. With an average volume of DHCP request traffic, Windows Server 2003 DHCP has a four-hour default grace period after which an expired lease can be reused. This means that an address is marked for deletion four hours after the lease expires, regardless of lease duration. When the volume of DHCP-related traffic is heavy and no leases are available to service lease requests, DHCP immediately instantiates a cleanup cycle, which reclaims any leases marked for deletion. By default, the cleanup cycle occurs every 60 minutes. You can adjust the duration of the default grace period after which an expired lease is marked for deletion by editing the following key in the registry:

DatabaseCleanupInterval
http://technet.microsoft.com/en-us/library/cc963208.aspx

Description

Determines how often the Dynamic Host Configuration Protocol (DHCP) Service deletes expired ( doomed ) records from the DHCP client information database. By default, records expire after four hours. Deleting expired records releases space for new IP addresses.

Windows XP SP3遠端連線錯誤[連線已終止，因未收到遠端電腦的意外伺服器憑證。請嘗試重新連線]

2012-06-25T10:39:00Z

[問題描述]︰

Windows XP SP3 外部user 透過 Terminal Server Gateway 進行遠端連線，不定時出現 [連線已終止，因未收到遠端電腦的意外伺服器憑證。請嘗試重新連線]訊息，造成連線中斷。

[解決方法]︰

新增credSSP機碼與安裝kb953760以解決此問題。

[說明]：

CredSSP 是Windows XP SP3 中新的 Security Support Provider (SSP)，預設未被啟用。CredSSP enables a program to use client-side SSP to delegate user credentials from the client computer to the target server.
kb953760 則是修正Windows XP Kerberos authentication 的已知問題。

[如何設定]：

變更credSSP機碼

1) Click Start, click Run, type regedit, and then press ENTER.

2) In the navigation pane, locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

3) In the details pane, right-click Security Packages, and then click Modify. In the Value data box, type tspkg. Leave any data that is specific to other SSPs, and then click OK.

4) In the navigation pane, locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders

5) In the details pane, right-click SecurityProviders, and then click Modify. In the Value data box, type credssp.dll. Leave any data that is specific to other SSPs, and then click OK.

6) Exit Registry Editor and restart the computer.

2. 安裝Hotfix

When you enable SSO for a terminal server from a Windows XP SP3-based client computer,
you are still prompted for user credentials when you log on to the terminal server
http://support.microsoft.com/kb/953760

[參考資料]：

951608 Description of the Credential Security Service Provider (CredSSP) in Windows XP Service Pack 3
http://support.microsoft.com/default.aspx?scid=kb;EN-US;951608
說明：
CredSSP 是Windows XP SP3 中新的 Security Support Provider (SSP)
CredSSP enables a program to use client-side SSP to delegate user credentials from the client computer to the target server.

Technet Magazine：http://64.4.10.145/en-au/magazine/hh750380
說明：
Windows Server 2008 R2: Why Use Network Level Authentication?

When you connect to an RD Session Host server with an RDC 6.x or later client, you might have noticed you don’t connect directly to the RD Session Host server logon screen to provide your credentials. Instead, a local dialog box pops up to take your credentials on the client. This dialog box is the front end of CredSSP.
When you type your credentials into this dialog box, even if you don’t choose to save them, they go to CredSSP. This then passes the credentials to the RD Session Host server via a secure channel. The RD Session Host server will only begin building a user session once it accepts those credentials.

修改Shadow Copy存放位置時出現錯誤訊息: 0x8004231d

2012-06-25T08:02:00Z

問題描述
=================
C槽的Shadow Copy先前透過修改將其存放於D槽
後續嘗試修改磁碟機Shadow Copy的存放位置成C槽時 , 會出現錯誤訊息: 0x8004231d

解決方式
=================

1. 執行底下指令進行Shadow Copy的大小調整 (此動作會刪除原有的Shadow Copy)

vssadmin resize shadowstorage /for=c: /on=d: /maxsize=2000mb

2. 手動透過UI方式再次進行調整即可

Hyper-V Host上進行VM備份時會造成部份VM進入Save狀態

2012-06-25T07:54:00Z

問題狀況
===================
Hyper-V Host上進行VM備份時會造成部份VM進入Save狀態

問題原因
===================
有問題VM其C槽的Shadow Copy存放區是沒有存放在C槽本身 , 而是存放於D槽

解決方式
===================
將C:的Shadow Copy存放區改成C:本身即可

參考資料
===================
http://blogs.technet.com/b/virtualization/archive/2008/08/29/backing-up-hyper-v-virtual-machines.aspx

要進行online backup時VM的需求如下

無法建立NLB , Error 0x80041008

2012-06-25T07:40:00Z

問題狀況
=================
OS: Server 2008 R2

無法建立NLB , Error 0x80041008

問題原因 & 解決方法
=================

經過確認此問題可能是當下網路卡驅動程式有問題所導致 , 透過底下方式處理即可已經正常

1. 透過裝置管理員將網卡進行移除

2. 重新開機讓網卡自動被偵測並安裝 , 手動設定相關IP設定

3. 嘗試建立NLB即可正常

Clarify the location of 100MB system partition described in KB937251

2012-06-25T06:11:00Z

KB937251: The disk drive numbers may not correspond as expected to the SATA channel numbers when you set up Windows Vista, Windows Server 2008, Windows Server 2008 R2, or Windows 7 on a computer that has multiple SATA or RAID disks

In addition to notify readers that the disk numbers and SATA channels numbers may not match, this KB took a step further to explain the creation of 100MB system partition.

This is its original content:

Additionally, when you install Windows 7, the installation creates a 100MB system partition alongside the Windows partition by default. The system partition is created to accommodate a Bitlocker requirement. Bitlocker requires that the boot files and Windows files are located on separate partitions. By default, the 100MB system partition is created on the disk that is detected as Disk 0. If you install Windows to a disk other than Disk 0, the 100MB system partition will still be created on Disk 0 during the installation.

Content to clarify:

The 100MB system partition will only be created on Disk 0 during the installation, if the user didn't change any of the pre-selected default settings. This by default definition includes: language selection, what type of installation do you want, which disk to install the Windows operating Sytem to...etc. If the user changes any of the pre-selected default settings, then this 100MB system partition is not guarantedd to be installed on Disk 0 as described in this KB.

Example:

I have a customer that chose "adanved options" and selected Disk 1 to install the Windows Operating System. Then he found out that the 100MB system partition is created on Disk 1 instead of Disk 0. This is because when he chose "advanced options" to make a selection change, this is no longer considered "by default", hence, the 100MB system partition is not guarantedd to be installed on Disk 0 as result.

After enable advanced audit of GPO, all regular aduit GPO became invalid

2012-06-22T08:48:00Z

1. 在「本機原則\稽核原則」中的稽核原則以及「進階稽核原則設定」中的稽核原則有何差異？

[安全性設定\本機原則\稽核原則] 中的基本安全性稽核原則設定以及 [安全性設定\進階稽核原則設定\系統稽核原則] 中的進階安全性稽核原則設定似乎重疊，但它們以不同方式記錄及套用。當您使用本機安全性原則，將基本稽核原則設定套用至本機電腦時，您是編輯有效稽核原則，因此對基本稽核原則設定所做的變更與 Auditpol.exe 中的設定完全相同。

這兩個位置中的安全性稽核原則設定之間還有一些差異。

[安全性設定\本機原則\稽核原則] 底下有九個基本稽核原則設定，[進階稽核原則設定] 底下則有 53 個設定。[安全性設定\進階稽核原則設定] 中的設定與 [本機原則\稽核原則] 中的九個基本設定處理類似問題，但前者讓系統管理員對要稽核的事件數目和類型有更多的選擇。例如，基本稽核原則對帳戶登入提供單一設定，進階稽核原則提供四個設定。啟用單一基本帳戶登入設定相當於設定所有四個進階帳戶登入設定。相較之下，設定單一進階稽核原則設定並不會產生您不感興趣之活動的稽核事件。此外，如果您啟用基本 [稽核帳戶登入事件] 設定的成功稽核，只會記錄所有帳戶登入相關行為的成功事件。相較之下，您可以對一個進階帳戶登入設定來設定成功稽核，對第二個進階帳戶登入設定來設定失敗稽核，對第三個進階帳戶登入設定來設定成功和失敗稽核，或設定不稽核，視組織需求而定。

[安全性設定\本機原則\稽核原則] 底下的九個基本設定是在 Windows 2000 中引進，因此可用於所有之後發行的 Windows 版本。進階稽核原則設定是在 Windows Vista 和 Windows Server 2008 中引進。進階設定只能用於執行 Windows 7、Windows Vista、Windows Server 2008 R2 或 Windows Server 2008 的電腦上。

2. 基本稽核原則設定和進階稽核原則設定之間有何互動？

基本稽核原則與使用 Windows Server 2008 R2 和 Windows 7 群組原則所套用的進階稽核原則設定不相容。這是因為使用群組原則套用進階稽核原則設定後，目前電腦的稽核原則設定會立即清除，然後才能套用產生的進階稽核原則設定。在使用群組原則套用進階稽核原則設定之後，只能使用進階稽核原則設定，可靠地設定電腦的系統稽核原則。

編輯及套用本機安全性原則中的進階稽核原則設定，會修改本機群組原則物件 (GPO)，因此如果有來自其他網域 GPO 或登入指令碼的原則時，此處所做的變更可能不會正確反映在 Auditpol.exe 中。這兩種原則類型都可以使用網域 GPO 進行編輯及套用，而且這些設定會覆寫任何衝突的本機稽核原則設定。不過，因為基本稽核原則是在有效稽核原則中記錄，需要變更時必須明確移除稽核原則，否則變更會保留在有效稽核原則中，而使用本機或網域群組原則設定所套用的原則變更則會在套用新原則時立即反映。

重要

無論使用群組原則或登入指令碼來套用進階稽核原則，請勿同時使用 [本機原則\稽核原則] 底下的基本稽核原則設定以及 [安全性設定\進階稽核原則設定] 底下的進階設定。同時使用進階和基本稽核原則設定可能會產生非預期的結果。如果您使用 [進階稽核原則設定] 設定或登入指令碼 (適用於執行 Windows Vista 或 Windows Server 2008 的電腦)，來套用進階稽核原則，務必啟用 [本機原則\安全性選項] 底下的 [稽核: 強制執行稽核原則子類別設定 (Windows Vista 或更新版本) 以覆寫稽核原則類別設定] 原則設定。這樣將可藉由強制略過基本安全性稽核，防止在類似設定之間發生衝突。

3. 如何將安全性稽核原則從進階稽核原則回復到基本稽核原則？

套用進階稽核原則設定會取代任何類似的基本安全性稽核原則設定。如果您之後將進階稽核原則設定變更為 [未設定]，則您需要完成下列步驟，才能還原為原始的基本安全性稽核原則設定：

將所有進階稽核原則子類別設定為 [未設定]。
將網域控制站 %SYSVOL% 資料夾中的所有 audit.csv 檔案刪除。
重新設定並套用基本稽核原則設定。

除非完成這些所有步驟，否則無法還原基本稽核原則設定。

Reference:進階安全性稽核常見問題集

http://technet.microsoft.com/zh-tw/library/ff182311(v=ws.10).aspx#BKMK_19

The relatinoship between Terminal server and Licensing Server

2012-06-22T08:40:00Z

Issue: we can't see anything about license information from TS configuration console

- The Terminal server & Licensing server are in two different domain

確認此問題跟權限有關係, 這是Terminal License 的一個產品設計

Running Licensing Diagnosis
Licensing Diagnosis must be run by a user having administrator privileges. In a domain, it is recommended that a domain account with administrator privileges be used to ensure optimal usability and results.

Reference: http://blogs.msdn.com/b/rds/archive/2007/11/30/terminal-services-licensing-diagnosis-snap-in-extension.aspx

Meanwhile, these two domain should be two-way trust.

Important

To issue RDS Per User CALs to users in other domains, there must be a two-way trustbetween the domains, and the license server must be a member of the Terminal Server License Servers group in those domains.

Reference: http://technet.microsoft.com/en-us/library/cc754625.aspx

Windows 2008 Server無法開啟Windows Backup Console

2012-06-21T08:31:00Z

啟動同時 wbengine.exe crash造成失敗

記錄檔名稱: Application

來源: Application Error

日期: 2012/3/5 上午 10:22:27

事件識別碼: 1000

工作類別: (100)

等級: 錯誤

關鍵字: 傳統

使用者: 不適用

電腦: ComputerName

描述:

失敗的應用程式名稱: wbengine.exe，版本: 6.1.7601.17514，時間戳記: 0x4ce79951

失敗的模組名稱: wbengine.exe，版本: 6.1.7601.17514，時間戳記: 0x4ce79951

例外狀況碼: 0xc0000005

錯誤位移: 0x000000000010ffdf

失敗的處理程序識別碼: 0xd78

失敗的應用程式開始時間: 0x01ccfa76ca13df2b

失敗的應用程式路徑: C:\Windows\system32\wbengine.exe

失敗的模組路徑: C:\Windows\system32\wbengine.exe

報告識別碼: 0d03b8b9-666a-11e1-81ab-e41f1361684e

解決方法︰

移除不正確 :\System Volume Information\WindowsImageBackup\Catalog 路徑下的檔案

或是使用指令

wbadmin delete catalog

參考

Wbadmin delete catalog

http://technet.microsoft.com/en-us/library/cc742154(v=ws.10).aspx

跨Domain指定TS License Server 設定完成後重新開機,Terminal License設定就會missing

2012-06-21T03:36:00Z

這是By Design 的行為TS console不會儲存credential

解決方法︰

您可以將用來登入網站或網路的密碼儲存在 Windows 中。如此一來，您就不必輸入密碼，因為每次您返回該位置時，Windows 將會自動為您登入。

開啟 [使用者帳戶]，請依序按一下 [開始] 按鈕、[控制台]、[使用者帳戶和家庭安全] (如果您是連線至網路網域，則按一下 [使用者帳戶])，再按 [使用者帳戶]。
在左窗格中，按一下 [管理您的網路密碼]。
按一下 [新增]。
在 [登入到] 方塊中，輸入您要存取之網路上的電腦名稱或網站的 URL。
在 [使用者名稱] 與 [密碼] 方塊中，輸入用於該電腦或網站的使用者名稱與密碼，然後按一下 [確定]。

儲存自動登入的密碼

http://windows.microsoft.com/zh-TW/windows-vista/Store-passwords-for-automatic-logon

Windows 2003/Schedule Task failed to start randomly

2012-06-15T08:12:43Z

Issue: Schedule Task failed to start randomly

Cause: There is a Domain Policy defined for “Logon as batch job”, this settings will overwrite all local account’s right.

Repro Step:

1. Create a Schedule Task using local administrator account and password

2. Test run these tasks

3. Define “Logon as batch job” at domain level

4. Run gpupdate /force at Server 2003

5. Once we did apply this policy from Domain, try to run task, it will failed

Failed with “could not start”

Workaround:

· Include the default administrator account at “Logon as batch job” policy

Reference:

http://technet.microsoft.com/en-us/library/cc755659(v=ws.10).aspx

Log on as a batch job

In Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and Windows Server 2003, the Task Scheduler automatically grants this right as necessary. The Task Scheduler injects this right for the user into the computer's effective policy immediately after the task is scheduled. If there is a contradictory group policy defining the Logon as a batch job user right, the effective policy settings will be overwritten by the group policy only upon policy refresh.

Event 1030 and 1065 error appear at Application log

2012-06-15T06:57:12Z

Issue: 機器每天都會產生 1030/1065 的錯誤訊息

Cause:

· 此問題與GPMC介面上的WMI篩選有關, 因為機器的WMI發生問題所以無法執行WMI篩選的工作才出現錯誤

· 從 WMI控制台確認此台機器WMI的確有問題

Resolution:

· 透過指令的方法重建 WMI Repository (附加檔案: wmi.bat)

net stop winmgmt

c:

cd %systemroot%\system32\wbem

rd /S /Q repository

regsvr32 /s %systemroot%\system32\scecli.dll

regsvr32 /s %systemroot%\system32\userenv.dll

mofcomp cimwin32.mof

mofcomp cimwin32.mfl

mofcomp rsop.mof

mofcomp rsop.mfl

for /f %%s in ('dir /b /s *.dll') do regsvr32 /s %%s

for /f %%s in ('dir /b *.mof') do mofcomp %%s

for /f %%s in ('dir /b *.mfl') do mofcomp %%s

echo DONE - you must reboot

pause

· 重新啟動電腦

· WMI已經恢復正常運作, 事件檢視器也不在發生錯誤

Hyper-V 中的guest machine的 DC時間同步的問題

2012-06-12T09:03:32Z

Issue: Hyper-V 中的guest machine的 DC時間同步的問題

Log Analyze:

· 系統事件不斷發生 Event 24, 29, 38的錯誤

Resolution:

· 參考KB976924的方法從Hyper-V介面把時間同步化的功能關閉

You receive Windows Time Service event IDs 24, 29, and 38 on a virtualized domain controller that is running on a Windows Server 2008-based host server with Hyper-V

http://support.microsoft.com/kb/976924/en-us

Disable time synchronization on the host by using Integration Services, and then configure the virtualized domain controller to accept the default Windows Time Service (W32time) domain hierarchy time synchronization. To do this, follow these steps:

Open Hyper-V Manager.
Click Settings.
Click Integration services.
Clear the Time Synchronization option.

Exit Hyper-V Manager.
Restart the server.

· 在其他的DC執行下面的指令與PDC主機同步

Net time /domain: 網域名稱

· Net time \\PDC主機 /set /y

How to fix WSUS MMC console error

2012-06-12T07:25:00Z

Issue: WSUS mmc console 打不開出現錯誤

· WSUS console 出現MMC無法建立嵌入式管理單元, 該崁入式管理單元可能並未正確安裝.

· 除了WSUS MMC console打不開之外, SQL Server的SUSDB也無法進行存取, 錯誤: 916

Resolution:

1.先把WSUS 3.0 SP2 移除, 並保留所有的資料

2.執行下面的步驟重設SQL administrator帳號

a) Go to:

Start > Programs > Microsoft SQL Server 2005 > Configuration Tools > SQL Server Configuration Manager

b) Right click on the SQL server you want to add an account for and click Stop.

c) Once it has stopped, right click on it and open Properties. Go to the Advanced tab.

d) Under “Startup Parameters”, copy and paste that whole string to Notepad as a backup. Go back to the box and add the following right at the end of the string:

;–m

It should look like this:

Press OK when done. What this does is forces SQL to start in single user mode.

e) Now right click the SQL server you had stopped before and start it.

f) Now if you go to SQL Management Studio, it will error out. The only way to get into it is using sqlcmd. So open a command prompt and type:

sqlcmd

which should give you a “1>” prompt denoting line 1. If it gives you an error saying “Login failed for user ‘xxxxx’. Reason: Server is in single user mode. Only one administrator can connect at this time. (Microsoft SQL Server, Error: 18461″, make sure all management consoles are closed and there are no other users logged in using it. Also go to your Windows services and stop all the following services:

SQL Server Agent

SQL Server FullText Search

SQL Server Integration Services

SQL Server Reporting Services

SQL Server VSS Writer

Only SQL Server and SQL Browser should be running. Try “sqlcmd” at the command prompt and it should let you through.

g) Now type the following to add your domain user account with admin privileges:

EXEC sp_addsrvrolemember 'domain\useraccount', 'sysadmin';

GO

It should give you blank line if it was successful.

3.重新安裝 WSUS 3.0 SP2

4.WSUS MMC console正常開啟

RSM (removable storage service) 服務出現錯誤訊息

2012-06-12T06:29:00Z

Problem
=======
2003 使用NTbackup 備份資料事件檢視器出現 RSM (removable storage service) 服務警告

Event log
================
Event Type:   Warning
Event Source: Removable Storage Service
Event Category:       None
Event ID:       94
User:            N/A
Computer:     AAAAAAAA
Description:

RSM database IMPORT failed. The import files might not exist or there may not be enough disk space.

Solution
======
修改登錄值

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\NTMS
value name: ImportDatabase
data type: REG_DWORD
String: 0

Windows XP start up very slowly (Black Screen after Windows XP logo)

2012-05-29T07:43:00Z

問題徵狀：

Windows XP在開機過程中，跑馬燈階段結束，接下來您會��到二分鐘至數十分鐘不等的黑畫面，在黑畫面過程中，不會有任何的游標或視窗出現，在這段時間後仍可以正常出現登入Windows 的畫面。

問題發生原因:

以下所描述的只是可能的一種開機慢原因，並非所有開機慢的原因都是和這篇文章所描述有關。

會發生這個問題，有可能是HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Digest下的子機碼不斷被產生，導致開機在載入C:\Windows\system32\config\Default檔案是需要非常長的時間所致。

解決方法：

1.請您確認在C:\Windows\system32\config\Default這個檔案size是否有數十MB以上。正常來講，這個檔案應該只會二百多KB至1 、2MB不等。如果確認這個檔案的大小確定有至數十MB，請再往下做。

2.執行regedit，找到HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Digest機碼。請直接將Digest這一層整個刪除。

3.重新開機，確認問題是否能解決。

4.如果問題確定解決，您再回到HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings機碼下仍看到Digest會持續產生子機碼，請至新增移除程式看，是否有INTEL(R) management engine components程式存在，如果有的話，請您嘗試移除或是看是否有新版的程式可以安裝，來確認是否可以完全解決這個問題。

WindowsXP中，透過某些區段的內碼造字，在記事本以外的應用程式均不能正常顯示

2012-05-28T02:45:00Z

問題徵狀：當您在WindowsXP中，透過某些區段的內碼造字，在記事本以外的應用程式均不能正常顯示。

問題發生的原因是因為有部分私用字元區域，是保留給私用定義使用者或軟體廠商所編碼的Unicode 字元集中的字碼指標範圍。

下列區段為Windows XP系統會占用到的位置：

Unicode位置：F001~F031

在Big-5內的位置為8350~83A1

解決方法：

請您安裝下列文章編號KB 831176的Hotfix，

831176 富士通專用字體不會正確顯示在 Windows Server 2003 或 Windows XP 中的 Unicode 私人使用區域

http://support.microsoft.com/kb/831176/zh-tw

安裝完成後並重新開機，所有字元即可正常顯示。

· Windows Update自動更新時，KB2518864、KB2572073、KB2633880重覆要求更新

2012-05-28T02:39:00Z

問題徵狀：執行Windows Update自動更新時，KB2518864、KB2572073、KB2633880重覆要求更新

KB2518864、KB2572073、KB2633880 Microsoft.NET Framework的更新元件，問題發生的原因是因為電腦上的 Microsoft.NET Framework 已損毀或遺失，導致檢查更新時無法正確判斷，以致重複檢查以及安裝。

解決方法：

(http://blogs.msdn.com/cfs-file.ashx/__key/CommunityServer-Components-PostAttachments/00-08-90-44-93/dotnetfx_5F00_cleanup_5F00_tool.zip) 下載 .NET Framework 自動清除工具，

http://blogs.msdn.com/cfs-file.ashx/__key/CommunityServer-Components-PostAttachments/00-08-90-44-93/dotnetfx_5F00_cleanup_5F00_tool.zip

選擇【.NET Framework - All Versions】，然後按一下【Cleanup Now】。

重新更新，已不會出現重複的更新。若您的軟體需要用的對應版本的.NET Framework，當您下次更新時，系統會自動幫您偵測並下載對應的版本。

WSUS: Script to delete duplicate SID created by Disk Imaging / Disk Cloning

2012-05-28T02:33:00Z

You might notice that some computers are appearing multiple times in WSUSAdmin - Computers and some of them disappear very often. This is due to duplicate SUS client IDs. Take a look at this script which deletes duplicate SUS client IDs found on a computer. These IDs are often found on computers where the operating system was installed using an image-based setup.

Script Code

============================================

@echo off
Echo Save the batch file "AU_Clean_SID.cmd". This batch file will do the following:
Echo 1.    Stops the wuauserv service
Echo 2.    Deletes the AccountDomainSid registry key (if it exists)
Echo 3.    Deletes the PingID registry key (if it exists)
Echo 4.    Deletes the SusClientId registry key (if it exists)
Echo 5.    Restarts the wuauserv service
Echo 6.    Resets the Authorization Cookie
Echo 7.    More information on http://msmvps.com/Athif
Pause
@echo on
net stop wuauserv
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f
net start wuauserv
wuauclt /resetauthorization /detectnow
Pause

============================================

SUS client ID will be generated at next detection.

Dedicated Video Memory does not display as expected

2012-05-28T02:18:00Z

Consider the following scenario:

You have onboard UMA 384 MB + 1GB from the video adapter and you expect the total video memory to be about = 384MB + 1024 MB => 1408 MB

However, in the Control Panel -> Appearance and Personalization ->Display ->Screen Resolution Panel, click [Advanced Settings]. Under the "Adapter" tab, you will see the Dedicated Video memory value displayed as 1536MB.

Why?

Basically, the UI is coded to display the Dedicated Video Memory in the form of power of 2. So, it uses this function “NextPowerof2(uNumMegs/8)” to calculate the allowed adjustment. And here are the allowed adjustments for different ranges of memory:

// 129M-256M rounds in multiples of 32M

// 257M-512M rounds in multiples of 64M

// 513M-1G rounds in multiples of 128M

// 1G+-2G rounds in multiples of 256M

// 2G+-4G rounds in multiples of 512M

And we can see that for the case of UMA_384+DSC(1024MB), the adjustment is in multiples of 256MB. It is not possible to display 1408MB. And since 1408MB is greater than 1280MB(256*5), that is why you are seeing 1536MB(256*6) by design.

This power of 2 algorithm was implemented per KB938838.

Windows Vista displays the incorrect dedicated video memory size for certain display adapters

http://support.microsoft.com/default.aspx?scid=kb;EN-US;938838

To display a more accurate video memory figures, use the videomemory.exe tool from the DirectX SDK tools. Link:
http://msdn.microsoft.com/en-us/directx/aa937788

How to deploying SCOM Agents to the Workgroup clients

2012-05-28T01:45:00Z

To configure manual agent installs settings

1.Log on to the computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 Management Group.

2.In the Operations Console, click the Administration button.

Note

When you run the Operations Console on a computer that is not a Management Server the Connect To Server dialog box will display. In the Server name text box, type the name of the Operations Manager 2007 Management Server that you want the Operations Console to connect to.

3.In the Administration pane, expand Administration, and then click Settings.

4.In the Settings pane, expand Type: Server, right-click Security, and then click Properties.

5.In the Global Management Server Settings - Security dialog box, on the General tab, do one of the following:

To maintain a higher level of security, select Reject new manual agent installations, and then click OK.

To configure for manual agent installation, click Review new manual agent installations in pending management view, and then click OK.

How to deploying SCOM Agents to the Workgroup clients
Steps that were followed:
=====================
1. Request a certificate for the OpsMgr server using its FQDN
A. Browse to http://<CA_Server>/CertSrv from the OpsMgr server
B. Click the Request a Certificate link

C. Click the Advanced Certificate Request link.
D. Click the Create and submit a request to this CA link.
E. In the Name field, enter the FQDN of the Operations Manager server.
F. In the Type of Certificate Needed drop down select Other…
i. In the OID field, enter 1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2
G. Check Mark keys as exportable.
H. Check Store certificate in the local computer certificate store.
I. In the Friendly Name field enter the FQDN of the OpsMgr server (must exactly match the Name field).
J. Click Submit.

K. Click the Yes button in the security pop-up.
2. Get the certificate request approved by the appropriate authority

3. Install the new certificate on the OpsMgr server
A. Revisit http://<CA_Server>/CertSrv from the OpsMgr server
B. Click the View the status of a pending certificate request link.

C. Click the link for newly issued certificate.
D. Click the Install this certificate link.
E. Select Yes to Security Warning dialog.
F. You should now see Your new certificate has been successfully installed.

4. Export the new certificate on the OpsMgr server and import it with MOMCertImport.exe
A. Open the Certificates snap-in for Local Computer
      i. Launch MMC.exe from the Run box
      ii. Select Add/Remove Snap-in from the File menu
      iii. Select the Certificates Snap-in and click Add
      iv. Select the Computer Account radio button and click Next
      v. Select the Local Computer radio button is selected and click Finish
      vi. Click Close and then click OK

B. Export the certificate to a PFX file
      i. In the MMC, expand the Certificates (Local computer) node
      ii. Expand the Personal node and select Certificates
      iii. Locate the certificate for the OpsMgr server FQDN
      iv. Right-click on the certificate and choose All Tasks -> Export…
      v. Click Next on the Welcome page

vi. Select Yes, export the private key and click Next

vii. Click Next on the Export File Format page

viii. Enter a secure password and click Next

ix. Enter a valid path and file name with a PFX extension and click Next

x. Click Finish and verify that The export was successful is displayed

C. Run MOMCertImport.exe to import the certificate PFX file
      i. Open a CMD prompt and change directory to SupportTools\i386 on the SCOM 2007 CD
      ii. Execute: MOMCertImport.exe <path to PFX file> /password <password specified during export of PFX file>
      iii. Use the Services MMC to stop and restart the OpsMgr Health Service
5. Install the Certificate Authority Certificate Chain on each intended agent and the Management Server.
NOTE: Instead of executing step 5 on each agent, you can download and save the chain to a .p7b file .

Copy to each agent and install. Then proceed to step 6.

A. Browse to http://<CA_Server>/CertSrv from the intended agent
B. Click the Download a CA certificate, certificate chain, or CRL link
C. Click the Install this CA certificate chain link.
D. Select Yes to the security dialog popup.

i. Select Yes if presented with a second security dialog popup
E. You should now see The CA certificate chain has been successfully installed

F. Open the Certificates snap-in for Local Computer
      i. Launch MMC.exe from the Run box
      ii. Select Add/Remove Snap-in from the File menu
      iii. Select the Certificates Snap-in and click Add
      iv. Leave My user account selected and click Finish
      v. Select the Certificates Snap-in and click Add again
      vi. Select the Computer Account radio button and click Next
      vii. Select the Local Computer radio button is selected and click Finish
      viii. Click Close and then click OK
G. Copy the Trusted Root Certificate from Current User to Local Computer
      i. Expand the Certificates - Current User node
      ii. Expand the Trusted Root Certification Authorities node
      iii. Select Certificates and locate the new trusted Root CA
      iv. Right-click the certificate and choose Copy

      v. Expand the Certificates (Local Computer) node
      vi. Expand the Trusted Root Certification Authorities node
      vii. Right-click on Certificates and select Paste

6. Obtain and import a certificate for the intended agent using its NetBIOS name
A. Browse to http://<CA_Server>/CertSrv from the intended agent
B. Click the Request a Certificate link
C. Click the Advanced Certificate Request link.
D. Click the Create and submit a request to this CA link.
E. In the Name field, enter the NetBIOS name of the intended agent
F. In the Type of Certificate Needed drop down select Other…
i. In the OID field, enter 1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2
G. Check Mark keys as exportable.
H. Check Store certificate in the local computer certificate store.
I. In the Friendly Name field enter the NetBIOS name of the intended agent (must exactly match the Name field).
J. Click Submit.
K. Click the Yes button in the security pop-up.
7. Get the certificate request approved by the appropriate authority
8. Install the new certificate on the intended agent
A. Revisit http://<CA_Server>/CertSrv from the OpsMgr server
B. Click the View the status of a pending certificate request link.

C. Click the link for newly issued certificate.
D. Click the Install this certificate link.

E. Select Yes to Security Warning dialog.
F. You should now see Your new certificate has been successfully installed.
9. Export the new certificate on the intended agent and import it with MOMCertImport.exe
A. Open the Certificates snap-in for Local Computer
      i. Launch MMC.exe from the Run box
      ii. Select Add/Remove Snap-in from the File menu
      iii. Select the Certificates Snap-in and click Add
      iv. Select the Computer Account radio button and click Next
      v. Select the Local Computer radio button is selected and click Finish
      vi. Click Close and then click OK
B. Export the certificate to a PFX file
      i. In the MMC, expand the Certificates (Local computer) node
      ii. Expand the Personal node and select Certificates
      iii. Locate the certificate for the intended agent NetBIOS name
      iv. Right-click on the certificate and choose All Tasks -> Export…

v. Click Next on the Welcome page
vi. Select Yes, export the private key and click Next

vii. Click Next on the Export File Format page

viii. Enter a secure password and click Next

ix. Enter a valid path and file name with a PFX extension and click Next

x. Click Finish and verify that The export was successful is displayed

C. Manually install the SCOM 2007 agent on the intended agent machine

i. Install MSXML 6.0

ii. Install MOMAgent.msi

D. Run MOMCertImport.exe to import the certificate PFX file
      i. Open a CMD prompt and change directory to SupportTools\i386 on the SCOM 2007 CD
      ii. Execute: MOMCertImport.exe <path to PFX file> /password <password specified during export of PFX file>
      iii. Use the Services MMC to stop and restart the OpsMgr Health Service

E. Check Pending Management

F. Check Agent Managed