Jane Lewis's Weblog

Women in Technology - A busy few weeks but inspiring and fun !

2012-03-17T00:42:30Z

One of the great things with my job is it gives me the ability to take part in activities outside of my normal job role. An area which I am passionate about is encouraging more girls , young women , returners to the workplace to consider a career in our industry. Plus in addition support activities across the industry that are aimed at attracting , retaining and developing women so that they can blossom and grow in their career.

So here are a few things I have been involved in with Microsoft. As you can see we work hard but we also get involved in stuff we believe in.

This month has been a particularly busy month of events surrounding and celebrating and supporting International Women’s Day which was on the 8^th of March this month

Female Networking T-Party Event @ Langham Hotel London England

On the 29^th of February Microsoft Human Resources and other invited Microsoft Ladies from across the business held an event in London which was both innovative , inspiring and empowering. The event “entitled” Mad Hatters T-Party invited 50 top female ladies from across the industry to a networking event with a difference. It invited them to open up their minds to…..

“Imagination is a powerful thing. It fuels new inventions; it unleashes new ideas. However, sometimes it can take a back seat to timescales, deadlines and inbox bombardments. Which is why we’re inviting you to take time out and immerse yourself in a world where the impossible becomes possible: our Mad Hatter’s Tea Party.

You can sample the delights of an afternoon tea like no other, and also hear from Martha Lane Fox – a woman who’s made incredible things happen in her career.”

The event was a great launch pad for a new and unique series of Networking event which in Microsoft’s own unique way we are looking to connect , amazing ladies from across our Industry.

On the 1^st of March we held our 8^th Connecting Women in Technology Event .

This organization has grown from strength to strength but The theme of this event was the “Power of the Network” and was hosted by Avaya at their Maidenhead offices. The whole premise of Connecting Women in Technology is

CWT is a joint initiative between Cisco, Dell, Google, HP, IBM, Intel, and Microsoft which aims to retain, inspire and empower women by developing a community to help women's contribution in IT.

We had a fantastic line up Agenda and developed the theme of different break- out sessions focusing in on Mentoring, Career Path, Face to Face Networking, Social Networking,

Our key note speaker was Heather White, of Smarter Networking who from our feedback was very well received from our Audience . We thoroughly enjoyed her session and I personally learnt loads about how to approach a room where I know absolutely no-one and be engaging and have an impact,

Our Panellists were senior female Executives from our partaking companies with myself (Jane Lewis) from Microsoft facilitating the Panel. The Panel was based on the theme of the “Power of the Network” and instigated some great discussions and debates.

We finally retired to more networking after the event with Wine and nibbles to send us on our way.

The overall feedback is that this style of event was very popular with all attendees loving the smaller group interaction and the ability to have time to discuss a range of different topics.

Date for your Diaries – The next CWT Event is being hosted by IBM at their South Bank Offices in London this Autumn. Date to be confirmed. So if you are a lady working at one of the above companies that is part of our group keep and eye on your inbox

Sit with Me and Mocktails !

To celebrate International Women’s day on the 8^th of March we held a couple of events in the UK at Thames Valley Park and also at Cardinal Place in London. (Plus the rest of the world )

We invited ladies (and men) along to a “Mocktail” party which were a delicious selection of non-alcoholic “cocktails” to network and discuss why they feel it is important to ensure we attract and retain and develop women into “Microsoft” and continue to endeavour to advance our efforts on this front.

We also took part in the “Sit With Me “ campaign that was being organized across the world of Microsoft. So what is the “Red Chair “ all about . Read here for full details but here is an extract.

“Why the Red Chair?

Challenge. Innovation. Creativity. Strength. Reinvention. Sustainability.

We think this is the perfect chair to represent the value of women in computing and IT.

The red chair is symbolic. When women and men “sit” to take a stand, they validate women in computing and IT and recognize them for the important role they play in creating future technology. The red chair gives all of us a constructive way to show our solidarity and invite others to participate. The bold red colour grabs attention and encourages action. By “sitting together” we hold space for an honest conversation and create a platform for online and offline discussions about our challenges and hopes for the future.”

The chair worked really well for us and we have produced a great set of pictures and stories that we are sharing here plus also are going to be available on the official site as part of a huge montage.

It was a great and inspiring day !

For more great events around International Women’s Day checkout Women at Microsoft on Facebook

Adventures in Education

2011-09-26T14:22:08Z

Some different things are going to be happening to me over the next few months but I have decided after quite a long hiatus that one of the things i should be doing is blogging again. I don’t know why I have been silent for so long. It is falling out of the habit of putting your thoughts to digital paper and posting . Once you get started doing it then it becomes addictive and you should keep it up. I have gone a bit too long to say the very least since my last post .

Well since my last post I have been very busy in lots of different areas within my job role technically. I have been retraining in the technology of App-V and also outside of my job role in the wider community. specifically in the area of Women in Technology events.

In this area I have been pretty active . I have been involved in lots of events both internally and externally to my Company. One of the really great things is that I have been supported by my divisions Premier Field Engineering and Microsoft as a whole in getting involved in many initiatives to encourage and support Women and Young ladies in looking at a career in I.T. as a serious option where they can achieve and fufill their aspirations. So as I move into a different role within Microsoft this will continue . I will endeavour to keep you up to speed with all of the different things my new role brings to me in the sense of technological challenges , plus hopefully keep you informed and educated in my own unique way.

So looking forward to sharing the next stage of my journey with you.

Calling all Technical Women - We want your C.V.

2010-05-16T15:27:06Z

World Wide Online Event

Hi Ladies,

We have an World Wide online event happening very soon here which gives you an opportunity to meet and talk to Technical Women working in in Services at Microsoft and find out what the job is actually like. Plus we are interested in you too. We would love to have lots of women who are considering job roles at Microsoft to send us your c.v. by simply clicking on the bottom link to register for the Webinar. So come on Ladies especially EMEA we want to hear from you !

Optimizing and reducing the noise on Admin Packs Scom

2010-05-14T10:43:31Z

I have been working with my customer around reducing the noise and also optimising SCOM 2007 R2. The main emphasis of my work has been around the Active Directory Managment pack, but some of the techniques that I have highlighted and the links that I have used can be used more generic

http://blogs.technet.com/momteam/archive/2010/02/19/opsmgr-2007-r2-mp-version-6-1-7599-0-is-released.aspx

Check whether you have Configured for any Clusters, Active Directory, & Exchange “Agent Proxying” The reason this should be set is as follows;

When deploying the AD or Exchange management packs you need to enable proxying on agents in order for discovery to work properly. This is further detailed in the blogs below. There is also listed a tool that can be used to enable this across multiple Domain Controllers at once, otherwise you have to go to each individual server.

a. http://blogs.msdn.com/boris_yanushpolsky/archive/2007/08/02/enabling-proxying-for-agents.aspx

b. http://blogs.msdn.com/boris_yanushpolsky/archive/2008/01/24/troubleshooting-event-id-33333-logged-by-the-data-access-layer.aspx

c. http://ops-mgr.spaces.live.com/blog/cns!3D3B8489FCAA9B51!1077.entry?wa=wsignin1.0&sa=673832820

d. http://cameronfuller.spaces.live.com/blog/cns!A231E4EB0417CB76!1152.entry

e. http://ops-mgr.spaces.live.com/blog/cns!3D3B8489FCAA9B51!1077.entry

2. Another good technique to reduce noise is to run the following reports from the ODR Reporting Library .

3. In addition we can be more specific by focussing in on a particular Management Pack.

By choosing the following under the Generic Report Library.

These above reports can then enable us to identify the most noisiest errors .We can then take this information and then go to the specific Monitor and modify or disable it in the following way;

4. Also certain Alerts even though their health has been restored do not close down the Alert view thus creating unnecessary noise. Therefore you can carry out the following to address this.

5. Also you may or may not be aware of this , which can cause noise from Domain Controllers if the agent is deployed manually . OOMADS

OOMADS.MSI which is the active directory helper object.
From Technet - "If an agent is manually deployed to a domain controller, and
an Active Directory management pack is later deployed, errors might occur
during deployment of the management pack. To prevent errors from occurring
before deploying the Active Directory management pack, or to recover from
errors that might have already occurred, you will need to deploy the Active
Directory management pack helper object. This is done by deploying the file
oomads.msi on the affected domain controller. The file oomads.msi can be
found on the computer hosting the agent at C:\Program Files\System Center
Operations Manager 2007\HelperObjects.
After an agent has been manually deployed to a domain controller, locate the
oomads.msi file and double-click the file to install the Active Directory
management pack helper object.
You need to manually deploy oomads.msi only to domain controllers that will
host an agent and will be monitored via the Active Directory management
pack. The Active Directory management pack helper object is automatically
installed when the agent is deployed using the Discovery Wizard."
Although the article talks about Domain Controllers, it will apply equally
to computers you want to use as Clients for AD monitoring as they also use
OOMADS.MSI

Installation Checklist for Active Directory Managment Pack

1.Import the Active Directory Server Pack
Create a Management Pack in which to store customizations, such as overrides (for details on why, see this post)
2.(Optional) Import the Active Directory Client Management Pack and override the AD Client 3.Monitoring Discovery Rule
4.Enable the Agent Proxy Setting on all Domain Controllers
5.Configure an account for Replication Monitoring (associated with the Active Directory 6.Management Pack Account Profile)
7.Create a RunAs account and associate it with the AD MP Account Profile

Optional Configuration
1.Configure the maximum time allowed for change to replicate across a forest
2.Disable collection of warnings, performance data, and miscellaneous noncritical events to decrease network traffic.

3. Enable data collection for the Replication Latency Report
Set parameters for tasks

Common Problems

Oomads not installed
Oomads 64-bit issues
Agent proxy settings enabled on all Domain Controllers
AD MP Account Profile Run As Account Password is not validated by the application when entered

Floppies 101 uses for plus other Random thoughts

2010-05-04T21:11:29Z

We have just had Long Bank holiday weekend in the U.K. so I have taken the opportunity to carry out some spring cleaning and have been clearing out a load of boxes . I came across a long forgotten box of floppy disks. It took be another 20 minutes to locate my USB Floppy drive reader. After going through the floppies which seemed so sloooow, as I was carrying this out I sat there reminiscing about my old dual floppy 720k non hard disk phillips pc , then my old 286 Olivetti pc came flashing into my brain. Then suddenly I started getting all romantic about my 520k ? orginal IBM pcs I used to support in a previous life, plus the excitement I felt when I took delivery of my first IBM PS2 machine with 4 mb of Ram and a 40mb hard drive. By this time I had looked through all my floppies and found some old photos and Sibelius arrangements my husband had done years ago. Then I realised with a start how long I had been working in this fascinating , changing, frustrating and exhilarating industry and then plugged in my shiny new 32gb USB stick to transfer the contents of my floppies to :)…..Happy days !

The following link will make you smile

http://news.bbc.co.uk/1/hi/magazine/8651750.stm

Giving Non Administrators permission to read Event Logs Windows 2003 and Windows 2008

2010-04-30T11:45:19Z

Apologies for not blogging for sometime. I have been away on vacation, out of the country on training plus work commitments so add that up and it equals and enforced hiatus. Plus of course do not forget the Volcano :).

Well I am back now and have an interesting information around Event Log access and the way thing have changed in Windows 2008 . This comes out of some work I have been doing with my customer.

So if you want to give Non-Administrator users access remotely to Event logs if the Servers or Domain Controllers they are accessing are Windows 2003 follow the steps below.

I have extrapolated the information contained in the following two KBarticles. It is not easy as it is using service discretionary access control lists.

http://support.microsoft.com/kb/323076 plus http://support.microsoft.com/kb/914392 .

This works for both Domain Controllers and Member servers. Therefore when it talks in the body of the steps around Default Domain Group Policies , this can be supplanted with the relevant Group Policy object.

You will also need to download a Name to Sid type utility. Details of this here.

http://support.microsoft.com/kb/276208

There are others around externally and internally to Microsoft. The internal one would only be available to you if you raise a Premier Support Call as part of your premier contract if you have one.

Plus of course you have the Windows Sysinternals

http://technet.microsoft.com/en-us/sysinternals/bb897417.aspx

As per the article follow the below steps;

Use Group Policy to Set Your Application and System Log Security for a Domain, Site, or Organizational Unit in Active Directory

Important: To view the group policy settings that are described in this article in the Group Policy editor, first complete the following steps, and then continue to the "Use Group Policy to Set Your Application and System Log Security" section:

1. Use a text editor such as Notepad to open the Sceregvl.inf in the %Windir%\Inf

folder.

2. Add the following lines to the [Register Registry Values] section:

MACHINE\System\CurrentControlSet\Services\Eventlog\Application\CustomSD,1,%AppCustomSD%,2 MACHINE\System\CurrentControlSet\Services\Eventlog\Security\CustomSD,1,%SecCustomSD%,2

MACHINE\System\CurrentControlSet\Services\Eventlog\System\CustomSD,1,%SysCustomSD%,2

MACHINE\System\CurrentControlSet\Services\Eventlog\Directory Service\CustomSD,1,%DSCustomSD%,2

MACHINE\System\CurrentControlSet\Services\Eventlog\DNS Server\CustomSD,1,%DNSCustomSD%,2

MACHINE\System\CurrentControlSet\Services\Eventlog\File Replication Service\CustomSD,1,%FRSCustomSD%,2

3. Add the following lines to the [Strings] section:

AppCustomSD="Eventlog:Security descriptor for Application event log"

SecCustomSD="Eventlog:Security descriptor for Security event log"

SysCustomSD="Eventlog:Security descriptor for System event log"

DSCustomSD="Eventlog:Security descriptor for Directory Service event log"

DNSCustomSD="Eventlog:Security descriptor for DNS Server event log"

FRSCustomSD="Eventlog: Security descriptor for File Replication Service event log"

4. Save the changes you made to the Sceregvl.inf file, and then run the regsvr32 scecli.dll command.

5. Start Gpedit.msc, and then double-click the following branches to expand them:

Computer Configuration Windows Settings Security Settings Local Policies Security Options

6. View the right panel to find the new "Eventlog" settings.

7. Open the relevant Policy for the member server. Open Computer Configuration -> Windows Settings Security Settings Local Policies Security Options Look for Event Log settings

3) Use a name2sid utilitily to find the SID of the group for which you want to give access to

the event viewer.

4) Open “Eventlog: Security descriptor for Application event log”. Click on Define

this policy setting.

Copy the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\CustomSD

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Directory

Service\CustomSD etc…

Copy the above value for each of the event logs (like application, system, security

etc…) & append respective event logs with (A;; 0x3;;;SID of the Group) in the above

policy

Here 0x3 indicates read & write privileges. The write privileges are required only

if the group needs to write events into the event logs (like an application service

using this user account)

Replace 0x3 with 0x1 - if this group needs only READ access to the event viewer

5) Run GPupdate

As an FYI see below for the explanation of the codes;

Replace 0x3 with 0x1 - If this group needs only READ access to the event viewer
5) Run GPupdate on the DC
Entry Meaning
O:BA Object owner is Built-in Admin (BA).
G:SY Primary group is System (SY).
D: This is a DACL, rather than an audit entry or SACL.
(D;;0xf0007;;;AN) Deny Anonymous (AN) all access.
(D;;0xf0007;;;BG) Deny Built-in Guests (BG) all access.
(A;;0xf0005;;;SY) Allow System Read and Clear, including DELETE, READ_CONTROL,
WRITE_DAC, and WRITE_OWNER (indicated by the 0xf0000).
(A;;0x7;;;BA) Allow Built-in Admin READ, WRITE and CLEAR.
(A;;0x7;;;SO) Allow Server Operators READ, WRITE and CLEAR.
(A;;0x3;;;IU) Allow Interactive Users READ and WRITE.
(A;;0x3;;;SU) Allow Service accounts READ and WRITE.
(A;;0x3;;;S-1-5-3) Allow Batch accounts (S-1-5-3) READ and WRITE.
The specific event log access mask bits are:
0x0001 ELF_LOGFILE_READ Permission to read log files.
0x0002 ELF_LOGFILE_WRITE Permission to write log files.

However for Windows 2008 Life gets much easier

Windows 2008 is much easier as long as you are giving the users and groups in question read access to all event logs. If that is the case just add them to the Built in Event Log Readers group.

However if you do not want to give access to ALL event logs you still have to resort to using SDDL

The location on the SDDL has changed in Windows 2008 and is no longer set it via the CustomSD in the registry. You now have to use the wevtutil utility.

For Example

If you need to define access to just the System event log on our Windows 2008 Server.

1. open the command prompt, and run the following command to dump out the SDDL for the System log out to a txt file.

wevtutil gl system > C:\temp\out.txt

2. Open the text file and copy out the channelAccess: entry

channelAccess: O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x1;;;AU)(A;;0x1;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;LS)(A;;0x2;;;NS)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573) )

3. Copy the Interactive User (IU) rights and add your user or group to them.

O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x1;;;AU)(A;;0x1;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;LS)(A;;0x2;;;NS)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573) (A;;0x1;;; S-1-5-3-3127463467463))

Last we need to apply the new SDDL. Just replace the O:BAG:XXXX with your SDDL String you created in the previous step.

wevtutil sl System /ca:O:BAG:XXXX

In addition you can remove access for the Event Log Readers group from event log in question by removing the (A;;0x1;;;S-1-5-32-573) entry from the respective log SDDL String.

Women in Technology Microsoft Career Webcast

2010-04-07T20:50:19Z

About the Event

Meet up to 12 different women from Microsoft Services and learn how they are helping our customers succeed. We are holding four webcasts to accommodate four different time zones on the three roles below. We hope you will join the one that works best for you.

The Consultant: Meet new customers. Help them assess their business needs. Design and deliver Microsoft technical solutions that allow them to get the maximum value for their business. Be a technical consultant. View job description.
The Technical Account Manager: Support a Microsoft Premier customer. Deliver Microsoft technical solutions that allow them to have the best operational health possible. Be a technical liaison across Microsoft. View job description.
The Premier Field Engineer: Active travel to reach many Enterprise customers. Provide proactive and reactive support to the most technically complex and business critical situations. Be the technical expert. View job description.

Who should attend

We are looking for women with great technical experience who have a passion for working with customers. While our event is open to anyone interested in considering roles at Microsoft, our focus on the above three roles is targeted to those individuals with strong technical expertise, 3-5 years in the technology industry, a Computer Science/Engineering degree or equivalent experience. You must have a proven record of delivering business value to customers preferably on the Microsoft platform, technologies, and products.

REGISTER TODAY for the webcast which best fits your region and time zone: http://www.careernomics.com/microsoft1004.

Looking for a New Career – How about Premier Field Engineering

2010-04-07T08:43:58Z

Hi Everyone,

I am really excited to tell you that due to our continued success Premier Field Engineering in the U.K. is looking to recruit some more Engineers to join our ranks.

If you are interested in joining a dynamic and exciting team, and working for a great Company, and love working with a wide variety of Enterprise Customers then we are looking for Engineers with experience in the following technologies.

Premier Field Engineers Role

SCOM (System Centre Operations Manager

SCCM (System Centre Configuration Manager)

Platforms (Application Virtualisation)

Platforms (Active Directory)

SQL

These roles will be posted on our Official U.K. Website over the next week or so, so keep your Eyes peeled. Alternatively you can also contact me direct on janelewi@microsoft.com with your C.V, which I can then forward on to the relevant hiring managers.

Carry out a search for Premier Field Engineer https://careers.microsoft.com/search.aspx?gl=GBR#&&p4=GB&p0=Premier+Field+Engineer&p5=all&p1=all&p2=all&p3=all

Microsoft Desktop Player This has potential !

2010-04-06T19:34:48Z

Apologies for not blogging recent weeks. I have been tremendously busy plus working out of the country

My good friend Justin Zarb showed me this the other day.

Microsoft Desktop Player

This is a great utility that gives you a platform to search for technet content based around . You can either use the online version or download the desktop client version. It is currently in Beta so not all the features such as putting in your postcode to find local Technet events are available as yet outside USA

Kevin Remde gives a great explanation of the tool http://blogs.technet.com/kevinremde/archive/2010/04/05/introducing-microsoft-desktop-player-find-technical-content-and-useful-microsoft-resources-easily.aspx

Explaining Close_Wait

2010-03-09T23:17:11Z

I have been working with a customer recently who has a print server that has had its spooler crashing after a 3rd Party service running on it was locking up and freezing and falling over.

One of the signs it was about to fall over was running the following command against the server and seeing lots and lots of Close_waits. This was observed by running the

Netstat –an command. Example output below.

So what do the “State” actually mean. And what is the significance of Close_Wait.

Understanding the TCP sequence of steps for socket closing

As the TCP conversation is a ports and sockets sequence, to understand how to troubleshoot it and carry out root cause analysis. This was an excellent blog that explains this tcp socket conversation very well

http://j2eedebug.blogspot.com/2008/12/difference-between-closewait-and.html

Also see below for the explanation of the different states sockets can enter into as part of that conversation.

State Description

http://support.microsoft.com/kb/137984

CLOSED
Indicates that the server has received an ACK signal from the client and the connection is closed

CLOSE_WAIT
Indicates that the server has received the first FIN signal from the client and the connection is in the process of being closed

So this essentially means that his is a state where socket is waiting for the application to execute close()

A socket can be in CLOSE_WAIT state indefinitely until the application closes it.
Faulty scenarios would be like filedescriptor leak, server not being execute close() on socket leading to pile up of close_wait sockets

ESTABLISHED
Indicates that the server received the SYN signal from the client and the session is established

FIN_WAIT_1
Indicates that the connection is still active but not currently being used

FIN_WAIT_2
Indicates that the client just received acknowledgment of the first FIN signal from the server

LAST_ACK
Indicates that the server is in the process of sending its own FIN signal

LISTENING
Indicates that the server is ready to accept a connection

SYN_RECEIVED
Indicates that the server just received a SYN signal from the client

SYN_SEND
Indicates that this particular connection is open and active

TIME_WAIT
Indicates that the client recognizes the connection as still active but not currently being used

So the explanation for a close_wait situation is as below;

CLOSE is an operation meaning "I have no more data to send." that is the

client/server has chosen to treat CLOSE in a simplex fashion. The user who CLOSEs

may continue to RECEIVE Until he is told that the other side has CLOSED also. Thus,

a program/application could initiate several SENDs followed by a CLOSE, and then

continue to RECEIVE until signalled that a RECEIVE failed because the other side has

CLOSED. We assume that the TCP will signal a user, even if no RECEIVEs are

outstanding, that the other side has closed, so the user can terminate his side

gracefully. A TCP will reliably deliver all buffers SENT before the connection was

CLOSED so a user who expects no data in return need only wait to hear the

connection was CLOSED successfully to know that all his data was received at the

destination TCP. Users must keep reading connections they close for sending until

the TCP says no more data.

Adjusting Registry Settings

Registry keys to look at which can sometimes help to configure and adjust this conversation.

MaxUserPort

TcpTimedWaitDelay

http://support.microsoft.com/kb/137984

TCP Connection States and Netstat Output

http://support.microsoft.com/kb/328476

http://technet.microsoft.com/en-us/library/cc938196.aspx

HKEY_Local_Machine\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

• MaxUserPort

This entry makes more ports available.

• TcpTimedWaitDelay

Reducing this value from its default setting of 240 seconds will make ports expire sooner. This parameter determines the length of time that a connection stays in the TIME_WAIT state when it is being closed. While a connection is in the TIME_WAIT state, the socket pair cannot be reused. This is also known as the 2MSL state because the value should be double the maximum segment lifetime on the network. See RFC 793 for more details.

Powershell script to help check WMI setting has been configured

2010-02-27T22:26:00Z

We all know how powerful Powershell is, so it is great to highlight an example of where it was showed to be very effective and really quick to create a positive result.

Recently I highlighted and issue that affected 2003 Domain Controllers which caused High CPU on WMIprvse.exe caused by a memory leak dnsprov.dll.

http://blogs.technet.com/janelewis/archive/2009/12/18/high-cpu-on-wmiprvse-exe-caused-by-memory-leak-dnsprov-dll-windows-2003.aspx

Well with my customer I work with we implemented the change across the entire estate and wanted to check and verify whether this change had been implemented successfully.

Well one of the guys I was working with had recently attended a Premier workshop on Powershell and was eager to try out powershell instead of the vbscript that I had put together.

The powershell script is as below; This checked all the domain controllers to verify that the DNSPROV.DLL is now running within its own isolated wmiprvse.

Powershell line to check DNS shared provider on DCs (note WMI query requires admin rights)

$DCs = [ADSI] $DCs ='LDAP://OU=Domain Controllers,DC=ABC,DC=DEF=Local'; $wmi = foreach($DC in $DCs.psbase.get_children()) {gwmi -namespace Root\MicrosoftDNS -class __Win32Provider -computer $DC.Name}; $wmi | ft __SERVER,HostingModel –au

So if you are applying the workaround mentioned in my previous blog. Please use this powershell script to checkout it has applied across your environment. It certainly worked a treat in our case. Plus also my customer colleague was pleased as punch that he could immediately apply his knowledge from the course. He now has bragging rights as the resident Powershell guru :).

Ladies if you are interested in a Career at Microsoft read on

2010-02-12T13:06:27Z

8th of March 2010

HI Everyone,

I have just come back from a busy week in Amsterdam and my Colleague Charna Westerhold has given me some more details about an exciting event I am taking part in . The event is entitled

No Boundaries Only Unlimited Potential!

International Women’s Day is a global day celebrating the economic, political and social achievements of women past, present and future.

Annually on 8th March, thousands of events are held throughout the world to inspire women and celebrate achievements. A global web of rich and diverse local activity connects women from all around the world ranging from political rallies, business conferences, government activities and networking events.

Microsoft Services will be celebrating International Women’s day by holding an International event to talk about why Diversity and Inclusion is a priority for our business and why here at Microsoft there are no Boundaries only unlimited Potential.

	88 countries, 44 languages, the latest technology, and 54 million customer touch points per year.

On the 8^th March join us to explore a career with no boundaries only unlimited potential. Learn why Diversity and Inclusion is one of Microsoft top priorities through online presentation and webcasts. Participate at online chats with company representatives. Times to be announced shortly. To find out more please visit: http://www.careernomics.com/microsoft

Microsoft Services is the consulting, technical support, and customer service arm of the world’s leading software company. The Microsoft Services professional helps customers and partners discover and implement high-value Microsoft solutions that generate rapid, meaningful, and measurable results

Safer Internet Day 9th February 2010

2010-02-08T19:41:33Z

Being a Mum of two young boys who avidly use the Facebook, MSN, Online Gaming, Mobile phones I am very aware of the importance of keeping them safe online and clear about what to do if they feel uncomfortable in any way. On the 9th of February Microsoft are taking part in Safer Internet Day . We have a whole range of volunteers who have been trained by Ceops to train Parents and Children on how to safely use the Internet.

This year as part of the “Click Clever Click Safe” campaign UKCCIS will be launching a new digital safety code for children– “Zip It, Block It, Flag It”.

Download the CEOP (Child Exploitation and Online Protection Centre) IE8 toolbar Click Clever, Click Safe, Click CEOP add on.

http://www.ceop.gov.uk/ie8/

Remember be informed and be safe. Plus IMHO do not let children use the Internet alone on their own in their bedrooms. Have the Computer\Laptop in a public family area where you can keep a friendly eye on what is going on.

Also make yourself aware of the Language being used. For Example

POS = Parent over shoulder ! :)

Great Videos to help you learn Cool Stuff

2010-02-05T20:21:51Z

I was reading an internal Newsletter and I found some great information about some great funky videos to help you learn lots about Windows 7 and Office.

These are a little bit different from our normal corporate videos. But I found them cool informative .

Check them out here http://www.microsoft.com/showcase/en/us/channels/officecasual

Also I think I must be the only person in the world who has not seen AVATAR yet. I was also did not realise how much Microsoft was involved in the making of the Movies special effects !. We even get a “special thanks” in the credits :).

Have a great weekend. !

Enterprise Domain Controllers Group and Group Policies

2010-01-31T21:40:00Z

Myself and a colleague Mark Empson have been developing a New Service entitled a GPO Health Check that looks at every aspect of the health of your Group Policies. Well one of the tests involved was checking for any Group Policies that had only the Read Group Policy Object permission and not the Apply Group Policy Permission.

Once this test had run through we found we had virtually every group policy in our test environment registering as having this Read only permission set against a group called the

“Enterprise Domain Controllers “ Group. On further investigation this proved to be absolutely correct and is the default setting for a Windows 2003 and Windows 2008 and Windows 2008 R2 environment.

This Read only access is required for Group Policy Modeling which is a feature of the Group Policy Management Console (GPMC) that simulates the resultant set of policy for a particular configuration. The simulation is performed by a service that runs on domain controllers. To perform the simulation across domains, the service must have read access to all Group Policy objects (GPOs) in the forest

However an important proviso is associated with this which I was blissfully unaware of .

If you are upgrading from a 2000 Forest to 2008 or 2008r2 only NEW group policies will have this “Enterprise Domain Controllers” permission of Read applied to them. All group policys created previously will not have this permission applied to them.

This will be exhibited by the Group Policy GPMC snap –in informing you that the “Enterprise Domain Controllers “ does not have Read access to the Group Policy.

To remove this error message all you need to do is use a script to update the Group Policy permissions across your Enterprise.

The details of this script , plus also details to run this from the command line are available here.

http://technet.microsoft.com/en-us/library/cc753453(WS.10).aspx

Well I did not realise the above until just the other day, so another tidbit to store away :).

Changing you Colour Scheme in Office and Outlook 2010

2010-01-18T16:50:38Z

Well my friend and Colleague Justin Zarb showed me something funky in Office2010 beta today. He was running his installation with a great “Black” colour scheme in Outlook, similiar to below;

The way he set this up was to go into options in word and choose optimize ribbon.

Then you have a choice of either Black , Silver or Blue.

Note this not only affects Word but also all your other suite of Office 2010 Applications including Outlook.

It is funny how the small things like that can make me happy !

Busy first day at Bett2010 despite the Snow !

2010-01-13T21:21:41Z

Well I was busy working at Bett 2010 today at Olympia despite the snow. I left for Olympia at 6.30am this morning and I was quite suprised when I stepped outside my door into 4 inches of snow.

Our Stand at Olympia has been very busy all day. See Below;

There has been a tremendous amount of interest in our Office 2010 suite of products , Sharepoint 2010 plus also Win 7 , HyperV . Plus also there was some really good demos and presentations happening on our Lecture Theatre Stand and our Demo Pods.

One of the products I was particularly interested in with a view to possibly using it at the next Digigirlz event we are holding in June 2010 was KODU .

Kodu is a visual programming language made specifically for creating games. It is designed to be accessible for children and enjoyable for anyone. It can be used on an Xbox 360 or on a pc with or without xbox 360 controller. this is available for free download from as a Technical preview copy from http://fuse.microsoft.com/kodu/. There is some great information around it here.

http://community.research.microsoft.com/blogs/kodu/default.aspx.

In addition to this was actually seeing Semblio in action which was raising alot of interest from the teachers and also Dreamspark.

Well I am back on duty tomorrow at BETT all day so please come along and talk to me. I have answered questions ranging from Xbox360 through to Movie Maker, Photostory and Windows 7 and Office 2010, and event Windows Live & hotmail accounts……mmmm not bad for a days work !

Lets give Barbie and interesting Career

2010-01-12T22:06:08Z

Well this is a bit of a fun post . One of my colleagues told me about this website .

Where there is a contest going on to choose Barbie’s next career… and computer engineering is one of the options!

If you have a moment, go to the link below and vote for Computer Engineering

http://www.barbie.com/vote/

Mind you I was not a very good Barbie\Sindy owner. I can definitely remember taking a pair of scissors to her hair and the results were not pretty :)……..

A couple of cool downloads for your Win 7 Platform

2010-01-12T10:42:11Z

I had a couple of informative emails today bringing my attention to some great new tools and utilities.

The first one is the Windows System State Analyzer as blogged about by the Ask the Performance team. I never realise this functionality existed . As they state on their blog.

“The basic functionality of the System State Analyzer tool is to allow you to compare two snapshots taken at different points in time. This allows you to compare the state of a machine both before and after an application install for instance.”

This tool is available as a free download from

· Server Logo Program Software Certification Tool x86: http://go.microsoft.com/fwlink/?LinkID=140110

· Server Logo Program Software Certification Tool x64: http://go.microsoft.com/fwlink/?LinkID=140109

Note: You must have the .NET Framework 2.0 installed for Windows System State Analyzer to work correctly

The second useful tool is that AD LDS ( Active Directory Lightweight Directory Services) is now available for download for Windows 7.

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=a45059af-47a8-4c96-afe3-93dab7b5b658

Overview

AD LDS is a Lightweight Directory Access Protocol (LDAP) directory service that provides flexible support for directory-enabled applications, without the dependencies that are required for Active Directory Domain Services (AD DS). AD LDS provides much of the same functionality as AD DS, but it does not require the deployment of domains or domain controllers. In environments where AD DS exists, AD LDS can use AD DS for the authentication of Windows security principals. You can run multiple instances of AD LDS concurrently on a single computer, and have an independently managed schema for each AD LDS instance.

Thanks to John Gregson for bringing my attention to the above.

A great initiative and offer Home Access

2010-01-08T10:30:00Z

As part of my training for BETT I learnt about the HOME ACCESS programme.

This looks a really fantastic initiative to open up access to computing to children and parents who are less privileged.

As I sat at home watching my two boys using Xbox 360, ps3 etc . Plus moving through applications and surfing online with ease it really strikes home to have this potentially available to children who come from less privileged circumstances. Some of the key takeaways for this are;

Home Access is unlike other PC programmes

-It doesn’t measure success by the number of PCs shifted

-It focuses the benefits of sustained and meaningful use in the family

-It recognises that families who benefit will have limited ICT experience

Home Access focuses on sustainability

-The PC package includes PC / Software / Tech Support and Broadband

-All software is installed and pre-activated

-Significant assistive technologies have been included

Home Access promises a “safe out of the box” experience

-With user accounts for parents and students set up

-And parental controls and filtering installed and activated

-And training offered as part of the package

All the suppliers will provide information packs for new owner

Check out our website for more details.

http://www.microsoft.com/uk/education/schools/home-access-programme/default.aspx

We are going to be making all our visitors to the Microsoft stand at BETT aware of this great Initiative so I encourage you all to let all your schools and friends know about this initiative.

Happy New Year ! from Chilly Britain and looking forward to BETT

2010-01-07T21:08:27Z

Well I am back to work and have now found some spare time to blog a little. Well we have been in the grips of a snow freeze here in the U.K. with temperatures dropping to –13C yes Celsius not Farenhite. Because we are not used to such weather we have had road chaos as we ( I include myself in this) are not great at driving in such treacherous conditions.

Well this certainly did not stop us from working. Even though Microsofts Office at TVP has been closed because of the treacherous driving conditions. We all reverted to using our remote home working facilities and Microsoft Live Meeting and Office Communicator worked really well. I spent alot of today on a Live Meeting training session for next Weeks BETT conference at Olympia. BETT is the world’s largest educational technology event. I am really looking forward to it and will be there next Weds and Thursday.The Live Meeting had over 65 attendees and It worked really well . As a diverting interlude to all the training every so often we had webcam views of snowy scenes from everyones Home Office :) . The organiser of the Live Meeting did have the foresite to warn us first before he switched to our webcams !

See below for a view of SNOWY Microsoft Thames Valley Park HQ

I thought below was a striking picture . This was taken from the BBC website as a picture from a NASA satellite http://news.bbc.co.uk/2/hi/in_depth/8447023.stm…….Brrrr. Reaching for the thermals as I type.

What a fantastic picture !

Merry Xmas Everyone

2009-12-18T17:12:48Z

Well I Know 2009 has been a busy busy year. And for some of you a tough year too. Therefore I wish you all the best and I am taking a break for the Christmas Holidays. I would like to wish Everyone a Very Merry Christmas and a very Happy New Year. Below is a Christmas scene from the back garden of my good friend Eileen Brown. They had alot of snow in Colchester !. Mind you 1 snowflake in the U.K. and we come to a standstill :). Read more about that on Eileens blog.

High CPU on Wmiprvse.exe caused by memory leak DNSPROV.DLL Windows 2003

2009-12-18T12:46:00Z

Certain customers have recently been experiencing an issue which I wanted to bring to your attention.

Issue with Domain Controllers Windows 2003 sp2

Wmiprvse.exe consistently consumes a high percentage of CPU on Domain Controllers and svchost.exe has a a high handle count of around 75000 and another svchost.exe hosting rpcss has 23000 handles.
Impact: Servers need to be restarted on a scheduled basis.

On Investigation of this issue I discovered that there have been other similar reported instances of this type of issue with other customers within the last 6 months.

Note: this does not occur in Windows Server 2008.

Cause

This has been traced to a problem with dnsprov.dll see below for more details;

“A windows Server 2003 (R2) SP2 machine, which implements a DNS role (usually true for many DCs), might become unreliable, unstable and misbehaving because of this problem. Manual intervention is needed to restore the server to its stable state each time administrators become aware of the problem going on, which can occur about once per week per DC, in an environment that implements SCOM/SCOM 2007 R2.

A windows Server 2003 server implementing the DNS role, when it receives certain WMI queries against the DNS WMI provider, will leak a TLS slot in the WMI process that hosts the DNS WMI provider. TLS slots are a finite resource (64+1024 slots available per process) so they can be quickly exhausted if leaked. A process that has its TLS slots exhausted doesn't behave normally and can incur in any kind of problem and unexpected behaviours.

Currently observed odd behaviours caused by this specific leak are:

- 100% CPU usages in the WMI host process that incurred the exhaustion.

- Other WMI providers sharing the same WMI host process not working as expected/misbehaving

Since WMI is a system service supporting many OS functions and application, having one of its processes in an unstable state makes the entire server unreliable, as mentioned and the problem needs to be resolved manually (DC reboot or WMI subsystem restarted).

SCOM 2007 happens to have a pattern of WMI queries that triggers the problem systematically after a few days monitoring a Windows Server 2003/DNS role.”

Workaround

On investigation of the issues 3 workarounds have proved successful in several of the previous reported cases.

Considering that:

1. The TLS slot is leaked each time a load/unload cycle occurs on the WMI DNS provider dnsprov.dll

2. A WMI provider is unloaded after 5 minutes it is idle

3. SCOM issues DNS queries at a rate that allows it to unload and reload between two queries

There are 3 possible workarounds see details below;

a. Execute a WMI script that uses the DNS provider to create an object and then never terminates, hence preventing the provider itself to become idle and then being unloaded. (Script is below).

' This script changes HostingModel property to run Microsoft DNS WMI provider
' in an isolated wmiprvse and allowing a workaround to a TLS leak.

strComputer = "."
strInstance = "__Win32Provider.Name='MS_NT_DNS_PROVIDER'"
strNewHostingModel="NetworkServiceHost:DNSSharedHost"
dim oMicrosoftDNSNamespace 'IWbemServices
dim oWMIProvider

Set oMicrosoftDNSNamespace = GetObject("winmgmts:"_
& "{impersonationLevel=impersonate, (Security)}!\\" _
& strComputer _
& "\root\MicrosoftDNS")

set oWMIProvider=oMicrosoftDNSNamespace.Get(strInstance)
Wscript.echo "Provider : " & oWMIProvider.Name

'updates the HostingModel property
Wscript.echo "Current value for HostingModel: " & oWMIProvider.HostingModel
If oWMIProvider.HostingModel=strNewHostingModel Then
Wscript.echo "No need to update DNS WMI Provider HostingModel property"
Else
oWMIProvider.HostingModel=strNewHostingModel
Wscript.echo "New value for HostingModel : " & oWMIProvider.HostingModel
'updates the object in the repository
oWMIProvider.Put_
End If

This needs to be renamed to .vbs. Also of course fully tested prior to being applied to the live production servers. The advantage of this is that this could be implemented via a Group Policy across the estate.

Note: This Script is provided with provided "AS IS" with no warranties, and confers no rights.

b. Isolating DNS prov. In a private wmiprvse. This can be done via the following steps;

1. Run WBEMTEST.

2. Click Connect and input root\microsoftdns in the Namespace.

3. Click Enum Classes..

4. Select Recursive and click OK.

5. From the classes list, select __Win32Provider and double click it.

6. Click Instances.

7. Select the instance and double click it.

8. Select HostingModel from the properties list and double click it.

9. Change the value from “NetworkServiceHost” to “NetworkServiceHost:DNSProvHost”

(without double quotation marks)

10. Click Save Property.

11. Click Save Object.

12. Click close to quit WBEMTEST

The obvious disadvantage of this is that the above steps for workaround b are manual and impractical across a large enterprise environment.

c. Write a simple rule in OpsMgr rule to keep the DNS provider from unloading by calling on it very frequently – this appears to keep the provider from unloading, and therefore leaking TLS slots.

Please see the following Blog which details this final workaround more specifically;

http://blogs.technet.com/kevinholman/archive/2009/06/29/errors-alerts-from-the-dns-mp-script-failures-wmi-probe.aspx

In most cases it will not be a problem if you are regularly patching and rebooting your servers on a regular basis. However if you are experiencing issues hopefully this information will help. If you are a Premier customer however I would advise raising a support case via Premier to double-check and validate the advice offered here. Plus also it gives you a documented escalation path.

Jane

How to modify a system owned object

2009-12-11T13:10:28Z

Hello,

I had an interesting customer request recently that I thought I would share with you. Prior to an upgrade to 2003 they had an account which was used for Remote Desktop Users. On upgrading to 2003 this account became replaced by a System Owned Object with exactly the same name. So their question to me was how do we rename a System Owned account without getting the following error.

"The attribute cannot be modified because it is owned by the system"

Carry out the following steps.

Warning: Make sure you fully test these in a pre-production environment before applying them to your live environment.

1 Launch LDP.exe and bind to the DS server you want to modify. Make sure you are
schema admin, and admin over the partition you are modifying
2. After connecting and binding navigate to the browse menu and select the
"Modify" option.
3. Leave the DN blank, type 'schemaUpgradeInProgress' into the Attribute field and
in the values field type 1.
4. Click the Add operation and then click the enter button. This will add this
command to the entry list.
5. Click the Run button. If you are successful you should see a successful modify
message.
6. Go to View -> Tree. Connect to the appropriate base DN.
NOTE: If your goal is to delete an object in AD that has child objects, then you
will need to remove the child objects first.
7. Find the object, right click and select modify
8. In the attribute field, type "systemflags"; in the Values field, leave it
blank; in the operation radio options, select delete
9. Then click Enter, then click Run to remove the system flags values
10. Perform the modification or deletion of the object
11. Set the systemflags value back to the original value, to make it owned by the
system again
11. Once finished, run LDP again with the above steps, changing the
schemaUpgradeInProgress value to 0 (to prevent unwanted schema/system changes)

What a day Digigirlz Part Two

2009-12-01T23:37:13Z

Well once again we had a fantastic day at Microsoft on the 27th of November. We held our second Digigirlz event of the year. We had over 200 girls and teachers who attended our event here in Reading. It was a packed day full of interactive presentations . We had Andy Sithers and Mark A’Bear doing some great presentations around Digital Photography and Surface. Our main challenge of the day was to encourage the girls to come up the

“Design the Next big IT Accessory”. The schools were divided down into teams of around 10 and given 2 1/2 hours to come up with their ideas. There were some really truely great ideas and it never ceases to amaze me the imagination and energy that these girls show.

Congratulations goes to Queen Annes School whose idea was ICQ which was based around some digital sunglasses which enabled you to have a multimedia internet based Sunglasses !. Brilliant Idea that was executed and presented using PhotoStory.

In the afternoon we had a really fantastic and interesting session delivered by Peter MCowan of the University of London

“The Magic and intelligence of Computer Science”

He has a brilliant website which I recommend you check out.

I always feel completely shattered but on an incredible high after each event. Roll on the next event in June 2010.

We are going to put our heads together to think up a completely new type of challenge :)

See below for some pictures from the day ;