"Mark, I've Made A Huge Mistake..."

What I’ve Been Doing And What I’ve Been Reading

Mark Morowczynski [MSFT] — Sun, 13 May 2012 01:11:01 GMT

Well I haven't really posted in a while but I have good reasons, sort of. March went by quickly as I had to finish up an MBA class and moved apartments across the city of Chicago. April I really don’t know what happened but I’ve been working on some very good internal stuff and then here we are. I also do have some very cool stuff in the works for public consumption but that will have to wait. However I do have some other good stuff for you until I get it all going.

Stuff

Ask PFE Platforms- http://blogs.technet.com/b/askpfeplat/ This is a new team blog myself and a few other folks started. We post every Monday and sometimes more than that. As you can see I have a few posts I’ve written over there so I haven’t been completely worthless. If you aren’t already reading this you should it’s a great spot.

A collection of Slow Boot Slow Logon links

http://social.technet.microsoft.com/wiki/contents/articles/10130.root-causes-for-slow-boots-and-logons-sbsl.aspx

http://social.technet.microsoft.com/wiki/contents/articles/10128.tools-for-troubleshooting-slow-boots-and-slow-logons-sbsl.aspx

http://social.technet.microsoft.com/wiki/contents/articles/10123.troubleshooting-slow-operating-system-boot-times-and-slow-user-logons-sbsl.aspx

What I’ve Been Reading For Work

Windows Internals 6th ed Part 1- http://shop.oreilly.com/product/0790145305930.do I’m slowly but surely working my way through this. The more Xperf performance tracing I do the more I need to understand this. There should be some other xperf related posted on Ask Pfe Plat in the next month…ish.

Windows Sysinternals Admin Reference- http://shop.oreilly.com/product/0790145316974.do If you are not familiar with the Sysinternal tools, you should be. This is a great book.

What I Will Be Reading for Work

Windows NT File System Internals and Windows NT Device Driver Development- https://www.osronline.com/custom.cfm?name=index_fullframeset.cfm&pageURL=https://www.osronline.com/store/index.cfm Because I just cannot get enough of low level stuff. I just ordered these today.

Inside Windows Debugging- http://shop.oreilly.com/product/0790145335500.do This should be out next week sometime.

Programming Windows 6th ed- http://blogs.msdn.com/b/microsoft_press/archive/2012/04/21/mark-your-calendars-programming-windows-sixth-edition-is-coming.aspx This one actually is $10 if you get it before June 1st. How can you not pick this up?

What I’m Reading for Fun

Team of Rivals: The Political Genius of Abraham Lincoln - http://www.amazon.com/gp/product/0743270754/ref=s9_simh_gw_p14_d2_g14_i1?pf_rd_m=ATVPDKIKX0DER&pf_rd_s=center-2&pf_rd_r=0K2RHAPJ6GZY5CGHEQ3Q&pf_rd_t=101&pf_rd_p=470938631&pf_rd_i=507846

I just finished reading this long long book. It’s extremely interesting and extremely long. Get yourself an edition that you don’t have to lug around.

Ready Player One- http://www.amazon.com/Ready-Player-One-A-Novel/dp/0307887448/ref=sr_1_1?s=books&ie=UTF8&qid=1336871267&sr=1-1

Set in the future but about today and the 80s current geek culture. I’m in.

DC The New 52- http://en.wikipedia.org/wiki/The_New_52 I’ve been really reading stuff in Comixology http://www.comixology.com/ since DC restarted all their series at issue #1. Warning its dangerously easy to just keep clicking buy on the next comic. I guess there are worst habits to have.

That’s all for now.

Mark “Why Aren’t There More Gambit Comics?” Morowczynski

Windows 7, Solid State Drives and Why A WinSAT Score Matters

Mark Morowczynski [MSFT] — Sun, 19 Feb 2012 21:33:00 GMT

I was doing a WDRAP and I ran across an interesting case that required me to do some digging that I thought I’d share this out in one source. When we took an xbootmgr trace which we do with all our WDRAPs we saw broken readyboot that was identical to what I talked about here. http://blogs.technet.com/b/markmoro/archive/2011/11/28/xbootmgr-part-2-readyboot-basics.aspx. No cache hits and a lot of cache misses. I explained what readyboot does and how it’s suppose to work and the hotfix that we can roll out to help remediate this in their environment. Then they asked me a great question, “Does this still matter if it is a solid state drive (SSD)?” The answer is no when an SSD is detected the following things are not used, readyboot, readyboost, Superfetch and disk defragmentation. http://blogs.msdn.com/b/e7/archive/2009/05/05/support-and-q-a-for-solid-state-drives-and.aspx . The disk defragmentation service will be set to still run but no disks will be selected.

So now the next question is why is Windows not detecting that the hard drive is a SSD. The first thing we attempted was to update the firmware of the SSD as it was out of date. We rebooted and checked the Superfetch service which was still running meaning that the OS still hasn’t picked up the disk as a SSD. Ok clearly this was something else. After doing some research I learned the following. The Superfetch service looks at the following registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\DiskScore every 30 minutes. If the regkey is 65 or greater, which means the disk has the performance of an SSD, it sets the Superfetch service to manual. This score is populated by the actual WinSAT Primary Hard Disk score. Our next step was to check the WinSAT score for this machine. This is what we found.

Ok so that explains it, the WinSAT has never run on this computer. When is this suppose to run? It runs initially on start up to determine Aero performance and the rest is suppose to fully populate when the machine is idle via a scheduled task. The schedule tasks is under Microsoft\Windows\Maintenance\WinSAT. We found that during the image process this tasks was being disabled so it never ran and thus, never detected the machine had an SSD. Once we kicked of that scheduled task, it rated the Hard Disk at 7.1 the reg key had a value of 71, we waited about 20 minutes and all services were stopped and set appropriately. Case closed.

Mark “my hard disk score goes to 11” Morowczynski

Slow Windows 7 Boot? One ReadyBoot Fix (that you'll want to apply probably anyways)

Mark Morowczynski [MSFT] — Thu, 08 Dec 2011 04:45:00 GMT

In my last post I described a little bit about ReadyBoot and when looking at a xbootmgr trace what to look for when viewing the ReadyBoot data. I also described one method on how to fix it if there are no cache hits. So great, you fixed the one machine you looked at when following along in the blog but you want to make sure all the machines are healthy and if not fix them. Taking traces on every single machine in your environment and forcing 6 reboots is just not feasible. This is an alternate way.

It goes back to our old friend that we seem to always forget, the event log. You'll want to navigate to Microsoft-Windows-ReadyBoost/Operational and look for Event ID 1016 about 1 minute after boot. This is logged every time the bootplan is calculated. The result should be 0x0. If you're having the issue, the data will be 0x57.

Ready broken

How do I fix this for all my machines? Well, so far in the cases I've seen were able to fix this with this http://support.microsoft.com/kb/2555428. Now to be CLEAR about this, System Restore Points is not the ONLY way this file can hit its 512 KB size restriction. Other things such as a heavily loaded boot process(lots of apps, drivers, registry, etc) can cause this to occur as well. After applying the update go ahead and reboot. You should be all set. To confirm you can look for the same Event ID above but with 0x0 value.

Ready fixed!

I want to send a thanks to my down under, right near the end of the world Australian PFE Roger Southgate, hotlanta's own PFE Jeff Stokes(whose blog you should also read http://blogs.technet.com/b/jeff_stokes/) , Eugene from the Product Group and Scott Ladewig for his help with testing.

Mark "I want to go on vacation to where Roger lives" Morowczynski

Xbootmgr Part 2: ReadyBoot Basics

Mark Morowczynski [MSFT] — Mon, 28 Nov 2011 13:00:00 GMT

The more I work with the xperf/xbootmgr the better I get with it. I still feel like I have a lot to learn though. I wrote a previous post, http://blogs.technet.com/b/markmoro/archive/2011/08/20/dipping-my-toe-into-the-xbootmgr-water.aspx , about troubleshooting my own machine with slow boot. Lately I've been doing some WDRAPs where we do a deep dive analysis on 1 or 2 machines. One area that seems to be overlooked as we are always looking for the service or script that is slowing the machine down is ReadyBoot.

Readyboot is boot acceleration technology that maintains an in-RAM cache used to service disk reads faster than a slower storage medium such as a disk drive. ReadyBoot reads (prefetches) data into the cache before it is requested. Prefetching optimizes disk access patterns by taking data locality and hard drive's performance characteristics into account. Read requests from system processes, services and user applications are then serviced out of the ReadyBoot RAM cache.

ReadyBoot plays a HUGE role on how fast Windows is able to start. If ReadyBoot is broken, the rest of your data can be skewed entirely. I check ReadyBoot first to see how it's looking before I move on to other areas.

Here is an example

There are 3 different colors I want to focus on. The first is blue are write requests to the disk. The second is black, these are misses which means a read requests was serviced from the disk instead of the ReadyBoot cache. This is ReadyBoot death. The third color is green. These are ReadyBoot hits which means the read request was satisfied from the ReadyBoot cache. Notice there is NO green in this picture. ReadyBoot is essentially broken in this trace. The boot performance reflects this as ReadyBoot is finishing after 130 seconds, there is still much more disk activity taking place after that.

So now we need to fix this. We run the following command.

xbootmgr -trace boot -prepsystem

This will cause the system to reboot 6 times and order the files in the best order for performance. Now let's look at the trace after this was run.

Notice all the green. ReadyBoot is done loading fully 70 seconds into the boot. A full 1 minute earlier then the previous trace which drastically cut down the boot time.. In a future post I'll talk about the other colors, red and orange.

Now I'm sure you are thinking, "How do I massively detect for this in my environment?" and "How do I massively fix this in my environment?" I don't have a good answer to those questions.....yet

Update: There is a better way, I spell it out here, http://blogs.technet.com/b/markmoro/archive/2011/12/07/slow-windows-7-boot-one-readyboot-fix-that-you-ll-want-to-apply-probably-anyways.aspx

Mark "ReadyBoot me some Great Lakes Christmas Ale" Morowczynski

RSS Feed Product Index

Mark Morowczynski [MSFT] — Tue, 22 Nov 2011 15:15:36 GMT

Hello from Austin/Dillion!

Here is a quick post. A question I get semi frequently is "how do I stay up to date on the latest hotfixes for 'insert product name' ?" Great question. The best way I can think to do it is through RSS. Here is a listing of a ridiculous amount of Microsoft products and their RSS feeds. Happy KB hunting,

http://support.microsoft.com/selectindex/?target=rss#top

Mark "clear eyes, full hearts" Morowczynski

Hotfix for RID Pool Depletion! KB 261869

Mark Morowczynski [MSFT] — Mon, 14 Nov 2011 19:07:00 GMT

A few months back I thought I was going to write a blog post about how to look for RID Pool depletion in environments. Then I got side tracked with something (probably finding out why Mad Men isn't on yet) and Ned Pyle wrote an awesome post that would of put anything I would have wrote to shame anyways.

If you haven't read it I recommend you stop what you are doing and read it! So now you see how important that is to manage. There is a new KB Hotfix I recommended highly reading through it and then going through the proper testing channels for your environment.

MS KB 2618669

Some key highlights directly from the KB

Cause:

In certain rare circumstances, a domain controller may issue recurring requests for RIDs from the global RID pool every 30 seconds.

If repetitive requests for RID pool updates are unchecked for a significant time, the global RID pool may experience too much consumption, and in extreme cases, may experience complete exhaustion of the global RID pool.

Resolution:

To prevent too much consumption of the global RID pool, we recommend that you take the following actions:

Install this hotfix on all existing Windows Server 2008 R2 domain controllers.
Integrate the update into the Windows Server 2008 R2 installation media. It guarantees that future domain controllers also have this update.

Happy testing!

Mark "No Diving In the Shallow End Of The RID Pool" Morowczynski

"What's Your Stratum Baby?" aka The Worst Pickup Line Ever

Mark Morowczynski [MSFT] — Wed, 05 Oct 2011 12:29:00 GMT

Hello from Chattanooga,

Where my luggage got here a full day later then me. I'm here to deliver an Active Directory Risk Assessment Program or an ADRAP which does an exhaustive check of the health/risk of Active Directory. If you've never had one I suggest contacting your TAM it will be an eye opening experience. One area of focus is how is time configured for the AD Forest? I want to touch on a not always seen scenario quickly. Hopefully everyone has read this article http://technet.microsoft.com/en-us/library/cc773013(WS.10).aspx,. To summarize the PDC in the root domain should get it's time from a reliable external NTP server. All DCs in the parent domain get their time from their PDC. The PDC in a child domain can get it's time from the PDC in the root domain or any other DC in the root domain. Any child DC can get their time from the PDC in their domain or any DC in the parent. Workstations get their time from any DC in their domain. Check out the nice diagram in the previous link.

We can check this by running the W32TM /monitor. I'll use my MSPaint skills to protect the innocent.

Let's talk about the stratum quickly. This is ripped directly out of the previous link, I told you to read it "The degree to which a computer’s time is accurate is called a stratum. The most accurate time source on a network (such as a hardware clock) occupies the lowest stratum level, or stratum one. This accurate time source is called a reference clock. An NTP server that acquires its time directly from a reference clock occupies a stratum that is one level higher than that of the reference clock. Resources that acquire time from the NTP server are two steps away from the reference clock, and therefore occupy a stratum that is two higher than the most accurate time source, and so on. As a computer’s stratum number increases, the time on its system clock may become less accurate. Therefore, the stratum level of any computer is an indicator of how closely that computer is synchronized with the most accurate time source."

As we can see in our picture above the PDC has a stratum of 3 and the other DCs have a stratum of 4. The PDC is closer to the most accurate time source such as a hardware clock so it's stratum is closer to 1 than the other DCs. This exactly what we are seeing.

What if this scenario happens however, your root PDC is not configured to get from an external time source but is getting it's time from itself and advertising itself as stratum level 1. Your other DCs now have a stratum level of 2. You realize the error of your ways you reconfigure your root PDC and now his stratum level now becomes 4 like the picture above. How do the other DCs behave? How do the other clients behave? Do they accept this stratum change? For those that say that will never happen, it happened to a customer last week. When the stratum number of a time server increases, clients will refuse to accept any new time samples from them. This is by design and in the NTP protocol. So now your clients can drift out of sync! The way around this is the time service would need to be restrated on all clients. This resets the state and the clients will then begin to work normally after. Thanks to Sarath Madakasira for this tip. That's all for now.

Mark "can deliver ADRAPs in jeans and a mouserat tshirt" Morowczynski

Dipping My Toe Into The Xbootmgr Water

Mark Morowczynski [MSFT] — Sat, 20 Aug 2011 05:14:00 GMT

Greetings from the mothership aka rainy Seattle,

I spent this past week in Windows Desktop Risk Assesment Program (WDRAP) training which was actually pretty fantastic. If you are a Premier customer talk to your TAM about getting one scheduled. A large portion of ours was taught by a Senior PFE Yong Rhee. One of the areas I'm starting to pick up on is a tool called xPerf and xBootmgr. It's fantastic and I need to spend far greater time on it. One of the things we do is analyze a boot trace and look for improvements. I'm horrible at this today but I'm getting better everytime I look at them. Smash cut to my own laptop that for at times seems to be taking forever on boot up. Time to investigate.

1.) run xbootmgr -trace boot

Wait for my laptop to reboot and the traces to merge and let see what is going on. So after looking to see what time services start up and how long they take to start up something jumps out immediately.

That arrow pointing up is to the service starting called sftlist.exe which is Microsoft's App-V. The arrow pointing down is to how long it's taking to start, that counter is in seconds. It's currently taking 195 seconds to start. While it's trying to start up, all the rest of the services to the right aren't able to which is part of the reason I'm having a long login delay. There must be some way to fix this. Perhaps this is a known issue?

Bam!

This seems to be describing the behavior I'm having. Let me apply the update and try the xbootmgr again and see if it gets any better.

I had to zoom in so far to see now how long it's taking that it cut off the time axis. It is now taking 14 seconds. I just saved 181 seconds off my boot time with that one update. Umm holler! There is still plenty of work that I can do on my machine to speed it up and I'll continue to post more as I dive deep down into the world of xPerf and xBootmgr.

Mark "it can't rain all the time" Morowczynski

You Are Not Smarter Than The KCC

Mark Morowczynski [MSFT] — Fri, 05 Aug 2011 20:37:00 GMT

I had this discussion with a fellow PFE David Gregory , who use to be out of Chicago but now has moved to a better place (read Southern California), at a Polo Loco in Compton, CA. The same one 2Pac rapped about, you know the one I'm talking about. This is what us PFEs do sometimes, eat at fast food places (In-N-Out) and discuss odd technology issues. The topic came up was how often do we see customers that have manually configure connections objects for their DCs? The answer was way too much. If you have properly defined your AD sites and site costing, you shouldn't have to create manual connection objects. Most of the time you just end up making more of a problem for yourself by defining this. Let the KCC automatically create and remove connection objects as it needs to. A manual created connection object is not managed by the KCC at all. If you really want to know how the KCC does decide what to connect I highly recommend you read this, http://technet.microsoft.com/en-us/library/cc755994(WS.10).aspx.

(This is what it should look like if you would just stop monkeying with it)

Ok so what does it look like if "someone" actually made a manual connection object?

(It's horrible looking)

Ok so the next thing we discussed was how do help customers fix this is the best way possible. The easiest way is pretty straight forward, right click the connection object, delete. Seems pretty simple. But there is a better way to do this. And this is what David and I talked about. What if that manual connection object was correct? The KCC will then see that it needs a connection and re-make one. So what. The problem is that when a new connection object is made a VVJoin has to be done http://technet.microsoft.com/en-us/library/cc758169(WS.10).aspx. This can be a semi-painful process. If you have to do it thats fine but why do it if you dont have to do it? So the solution you really want to do is make that manual connection object to be managed by the KCC.

To do this follow these steps

1.) Open ADSIEdit and go to the Configuration partition.

2.) Drill down to Sites, the site where the manual connection object is, Servers, the server where the manual connection object is created, NTDS Settings

3.) Right click on the manual connection object and go to properites

4.) Go to the Options attribute and change it from 0 to 1

5.) Either wait 15 minutes (that's how often the KCC runs) or run repadmin /kcc to manually kick it off

Just like that it will be managed by the KCC. If that is the best connection object it will continue to use it with no VVJoin, if not it will tear it down and then make the best connection object.

UPDATE: Fellow PFE Tom Moser blogs.technet.com/b/tommos let me know that if you have an RODC manual connection object the options attribute will need to be changed from decmial value 64 to 65. It will then show up as IS_GENERATED | RODC_TOPOLOGY

Mark "Insert Your Favorite 2 Pac Lyric" Morowczynski

Can I Virtualize That and Still Get Support?

Mark Morowczynski [MSFT] — Wed, 27 Jul 2011 21:20:52 GMT

Bet you thought there would be no post for July didn't you. Well I threw this one together right quick.

I had a fellow TAM ask me that quesion the other day. They had a customer that wanted to run a Microsoft application in Hyper-V. They had no idea if it was fully supported. Now you can!

http://www.windowsservercatalog.com/svvp.aspx?svvppage=svvpwizard.htm

You are now able to select the product, the VM platform, and see what support you get!

Mark "I promise to write more content as soon as I get a hot minute" Morowczynski

Moving The PDC Role And Testing NTP Server Connectivity

Mark Morowczynski [MSFT] — Sun, 22 May 2011 18:39:00 GMT

Hello from Chicago,

I am actually at home here in Chicago here for a hot minute while I'm on critsit duty. I look forward to getting a call tonight while I'm at my good friend Dave Hazekamp's house watching the Bulls playoff game. Lately I've been helping a few customers go through an Active Directory upgrade to 2008 R2 of their production systems. One of the processes we go through is transfering the FSMO roles to the new 2008 R2 DC. One of the most overlooked aspects when transfering the PDC role is setting up this new PDC to sync with an external time source http://support.microsoft.com/kb/816042. I highly recommend everyone read How Windows Time Works if you are not familar with this, http://technet.microsoft.com/en-us/library/cc773013(WS.10).aspx. Time keeping is one of the most crucial aspects of an Active Directory domain. If time is more than 5 minutes off many things will start to fail, specifically kerberos. Large time jumps forward or backward can also cause major issues.

No problem so we go to verify connectivity to make sure the firewall team has updated the IP address to allow outbound connectivity of our new PDC server using our new favorite tool Port Query.

So is it working or not? It says both listening and filtered. Portquery is unable to tell us the answer I believe since it is a UDP packet (Connectionless) vs TCP packet (Connection) that is being sent and this protocol is not defined in the config.xml so it does not know how to properly display it. Let's use another tool for this.

By running the W32tm /stripchart /computer:IP we can query that NTP server to see what the offset time is. So here we can clearly see that yes NTP connectivity is working on our new PDC server.

Mark "my other car is a DeLorean" Morowczynski

Knock Knock Is That Port Open?

Mark Morowczynski [MSFT] — Mon, 18 Apr 2011 22:22:00 GMT

Hello from Toronto,

Here is a quick post. What are the ports that are needed by AD? How can you verify they are open from a client? How can you test this? Port Query!

This will run through all the pre-defined AD ports and verify the client is able to connect. There are serveral built in categories including Exchange, SQL as well as allowing you to manually define your own range. The best part this is just a GUI on top of another tool portqry.exe. This should replace the need to install the Telnet client as this is not available by default in Windows Vista/2008 and greater.

Download- http://www.microsoft.com/downloads/en/details.aspx?familyid=8355e537-1ea6-4569-aabb-f248f4bd91d0&displaylang=en

Mark "Goodnight Canada" Morowczynski

Migrating Printers On The End User Machine via VBScript

Mark Morowczynski [MSFT] — Thu, 17 Mar 2011 18:27:00 GMT

Greetings from Anchorage! In a former life I use to be a systems engineer just like you. One of my responsiblities was our print environment. One of the final things I had to do before I left was to migrate all the end users printers to the new printer environment. A disclaimer, this architecture design and script worked for that enviornment, your mileage may vary. Please test, test and test again.

Background

At my last job we didn't have a hard and fast rule of what printer types people or departments could purchase so we would have printer drivers from all walks of life. And those walks of life loved to crash the print spooler. One rouge driver could take the whole thing down (this was on Server 2003 before print driver isolation). The new printer environment was broken out into three different categories for printer drivers.

1.) Print drivers that shipped with the OS (Server 2008 and Server 2008 R2), these are called Inbox drivers. These are the most stable. Also to note we needed to install both 32-bit/64-bit drivers on the print servers. http://blogs.technet.com/b/askperf/archive/2010/06/04/installing-cross-architectural-print-drivers-32bit-on-64bit-and-vice-versa-from-the-server-locally.aspx

2.) Print drivers that were universal from a manufacture. Think of this as the HP Universal Print Driver, Xerox, Lexmark, etc.

3.) if you didn't fit into the first two, you went to the third print server. Here be dragons.

Printers would follow this order as well, we would first try to see if that printer model had an inbox driver for it, if not then did a universal print driver work and finally it would use its own driver on the last print server.

The Script

Alright don't get too excited it was written sort of hastily and print queue names were hardcoded as I had a very specific number of queues. Feel free to modify this for your own use though.

Function PrinterMigrated()

'Mark Morowcznski

'Migrates the current printers for the local user 



On error resume next

'needed for first run if no regkey exists, will throw an error, need script to continue to run

  



Dim ojbFSO, shell, objNetwork, serialnumber, scriptrun, printername



Set ObjFSO = CreateObject("Scripting.FileSystemObject")

set shell =CreateObject("wscript.shell")

Set objNetwork = CreateObject("WScript.Network")  

set shell =CreateObject("wscript.shell")



 

'Getting SID for current logged in user as printers are user specific

Set oUserAccount = GetObject("winmgmts://./root/cimv2") _ 

.Get("Win32_UserAccount.Domain='" & objNetwork.UserDomain & "'" _ 

& ",Name='" & objnetwork.UserName & "'") 



sUserSID = oUserAccount.SID 

'Debug

'msgbox sUserSID 

 



'We write to a registry key for this script to run once

reglocation = "HKEY_USERS\" & sUserSID & "\Software\WhateverKey\PrintersMigrated"





'Debug

'Msgbox reglocation



'Current Version

serialnumber = "20101017"



'Registry Key Location

scriptrun = shell.regread(reglocation)



'Debug

'Msgbox ScriptRun







if scriptrun = serialnumber Then

'Current Version already run on machine, nothing left to do in this function 

	'Debug	

	'Msgbox "Script already ran, exiting function"

	Exit Function



End if



strComputer = "." 

Set objWMIService = GetObject("winmgmts:" _ 

    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") 

 

Set colInstalledPrinters =  objWMIService.ExecQuery _ 

    ("Select * from Win32_Printer") 

 



strPrintServerOld = "\\print"  'old print server

strPrintServerPSPRD01 = "\\PSPRD01" 'inbox   

strPrintServerPSPRD02 = "\\PSPRD02" 'universal

strPrintServerPSPRD03 = "\\PSPRD03" 'misc

strIsDefault = "False"



strUserName = objNetwork.UserName 





strDirectory = "C:\Cabs"

strFile= "\Print_" & strUserName & ".txt"

strTotal = strDirectory & strFile

'output for logging





Set objFile =ObjFSO.CreateTextFile(strTotal)



'Set objTextFile = objFSO.OpenTextFile(strDirectory & strFile)



Dim psprd02Array (2) 'change this value for your queues 

psprd02Array (0) = "printqueue1"

psprd02Array (1) = "printqueue2"





Dim psprd03Array (3)

psprd03Array (0) = "printqueue4" 

psprd03Array (1) = "printqueue5"

psprd03Array (2) = "printqueue6"





For Each objPrinter in colInstalledPrinters 

    'Wscript.Echo "Name: " & objPrinter.Name 

    'Wscript.Echo "Location: " & objPrinter.Location 

    'Wscript.Echo "Default: " & objPrinter.Default

    'Wscript.Echo "Server: " & objPrinter.Servername

    'Wscript.Echo "Sharename: " & objPrinter.Sharename

    

    If objPrinter.ServerName = strPrintServerOld Then

     	

     strPrintMoved = "False" 'used to jump out of current print queue if already moved.

     strPrintShare = CStr(objPrinter.ShareName)

     objFile.WriteLine("Current Printer is: " & strPrintShare) 		

		if objPrinter.Default = True Then 'Checking for Default printer

 	 		strIsDefault ="True"

                        objFile.WriteLine(strPrintShare & " is the default Printer.")

                        'Msgbox "Default Printer: " & strPrintShare

      		End If 

     



     for x=0 to 2

       if objPrinter.Sharename = psprd02Array(x) Then

         objNetwork.AddWindowsPrinterConnection strPrintServerPsPRD02 & "\" & strPrintShare

         strPrintMoved = "True"

        

        objFile.WriteLine(strPrintShare & " added queue from PSPRD02")  

	if strIsDefault = "True" Then

            objNetwork.SetDefaultPrinter(strPrintServerPSPRD02 & "\" & strPrintShare)

	     'Msgbox "PSPRD02 Default"

             strisDefault = "False"

         End if 

         

        objNetwork.RemovePrinterConnection strPrintServerOld & "\" & StrPrintShare

        objFile.WriteLine(strPrintShare & " removed queue from PS01")   

        Exit for

        End if

     next



     

     if strPrintMoved = "False" Then

     for y=0 to 3

 	if objPrinter.Sharename = psprd03Array(y) Then

        	 objNetwork.AddWindowsPrinterConnection strPrintServerPsPRD03 & "\" & strPrintShare     

         	strPrintMoved = "True"

                 objFile.WriteLine(strPrintShare & " added queue from PSPRD03")  

         

		if strIsDefault = "True" Then

            		objNetwork.SetDefaultPrinter(strPrintServerPSPRD03 & "\" & strPrintShare)

                        'Msgbox "PSPRD03 Default"

 			strisDefault = "False"

         	End if 

         

        objNetwork.RemovePrinterConnection strPrintServerOld & "\" & StrPrintShare

         objFile.WriteLine(strPrintShare & " removed queue from PS01")     

        Exit for

        End if

     next

     End If





     if strPrintMoved = "False" Then

        objNetwork.AddWindowsPrinterConnection strPrintServerPsPRD01 & "\" & strPrintShare

        objFile.WriteLine(strPrintShare & " added queue from PSPRD01") 

        'MsgBox strIsdefault



        if strIsDefault = "True" Then



            		objNetwork.SetDefaultPrinter(strPrintServerPSPRD01 & "\" & strPrintShare)

			'Msgbox "PSPRD01 Default"

			strisDefault = "False"

        End if

        objNetwork.RemovePrinterConnection strPrintServerOld & "\" & StrPrintShare

        objFile.WriteLine(strPrintShare & " removed queue from PS01")      

     

     End If 

     

    'WScript.Sleep(5000)

    

    End If	    



   

    

    

Next 



objTextFile.Close



shell.RegWrite reglocation,serialnumber, "REG_SZ"



End Function

Special thanks to Mike Barbush for helping with the migration and testing of this script. Alright that's all for now folks, happy scripting

Mark "Brian Zoucha Print Cluster Master in training" Morowczynski

Group Policy Management Scripts....The Ones You Meant To Write But Don't Have Time

Mark Morowczynski [MSFT] — Tue, 01 Mar 2011 02:58:14 GMT

Greetings from Charlotte,

Last day of the month so you know what that means...I should probably write a blog post so I can say I've done at minimum one a month. I've been working with a few customers on various aspects of Group Policy. One thing that comes up frequently is how do I back up GPOs, how do I look for unlinked GPOs, how do I get all settings from all GPOs? The answer to that is simple, script it. Well what about if your scripting skills are more along the lines of searching through the Script Repository for something close and then doing the tried and true method of copy and paste? That's ok these scripts are written for you already on the server that you have the Group Policy Management Console. They are stored in where you installed the GPMC\Scripts folder. A full list of the scripts can be found here.

Look at all those scripts you "wrote"

Many people install the Group Policy Management Console on their domain controllers. What if you've upgraded your domain controllers to the shinny new 2008 R2 to get that AD Recycle Bin which is the new hotness? Well there are some built in powershell scripts too!

Group Policy Cmdlets

But there is a slight problem. Not all the scripts have made the conversion from script to cmdlet. So you still may want to use the old script for listing all unlinked GPOs for example. Don't worry you don't have to find a 2003 or XP box to install the old Group Policy Management Console to get these. The scripts themselves are available for download. So go forth and show management all your scripting skills!

Mark "black belt in copy and paste scripting" Morowczynski

Capturing Network Logon Without Spanning A Port (Part 2 of 2)

Mark Morowczynski [MSFT] — Sun, 23 Jan 2011 22:05:00 GMT

When I first started this blog I thought I'd be blogging all the time. Then life got in the way. Flights to both coasts, what seems like only two outlets in every terminal in O'Hare, and an MBA class later, it's been a month before I sat down to write this out. Alright folks well in the first bog post we talked about how to make a network capture in Windows XP without having to span a port. For Windows Vista/7 we really have two different ways to do this.

The first way or the messy way. You can install Network Monitor as a service. I hate this way.

How To Configure network monitor started as a service

a. Install network monitor

b. Download instsrv.exe and srvany.exe http://www.microsoft.com/downloads/en/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en

c. Copy srvany.exe to c:\netmon (create a new folder named c:\netmon)

d. Run the following command (run as administrator) to add a service Instsrv NetmonService c:\netmon\srvany.exe

e. Run services.msc and ensure that NetMonService will start automatically.

f. Run regedit.exe, unfold HKLM\System\CurrentControlSet\Services\NetMonService, add a sub Key: Parameters

g. Under Parameters, add the following value

h. Type: REG_SZ, name: Application, value: <path to program files folder>\Microsoft Network Monitor 3\nmcap.exe

i. Type: REG_SZ, name: AppParameters , value: /network * /capture /file c:\netmon\netmon.cap:100M /DisableConversations /stopwhen /timeafter 900 (NOTE: 900 means netmon would stop capturing after 15 minutes)

j. Restart the machine to reproduce the problem, after you log on, hold on for about 15 minutes, then find out netmon.cap under c:\netmon.

Look at all that. Are you serious, I'll just go find a hub. Fair enough.

The second way, use built in tool that you've ignored, netsh

1.) open a command prompt and enter netsh trace start capture=yes persistent=yes

(That's what took you a month to write about? I know I'm sorry.)

That's it, log out and log back in with the problem user, load that .elt file up into network monitor and you are good to go. That's actually where I saw this amazing hint from last year. http://blogs.technet.com/b/netmon/archive/2009/05/13/event-tracing-for-windows-and-network-monitor.aspx

Mark "can I get me some of that sweet sweet outlet action" Morowczynski

Capturing Network Logon Without Spanning A Port (Part 1 of 2)

Mark Morowczynski [MSFT] — Sun, 26 Dec 2010 23:02:00 GMT

Hey Everyone,

Sorry for the delay in posts. I was traveling a bit and not prepared to write a post from the road (aka I forgot my lab's IP address/I was out of ideas.) Then the Holidays hit and you know how that goes. Alright on to the fun stuff. Today I want to talk about a creative way to capture some network logon traces. Sometimes when you are troubleshooting a problem you just need a network trace of what is happening. The trace never lies. Most of the time you just install Netcap from the Windows Support Tools , start and stop your capture, and call it a day. But what if you are trying to get a capture for some sort of logon event? For example you are trying to login but it is somehow timing out. How could you get a capture of what is happening before you are even logged into Windows? There are three different ways.

1.) Ask your network team very nicely to span the port for that client machine to capture the traffic while you try to reproduce this.

2.) Go find a hub, plug a laptop in and do a capture using Network Monitor in Promiscuous mode and then once again try to reproduce the problem.

Both 1 and 2 will work fine but sometimes the network team isn't around and sometimes you cant find the hub in the bottom drawer of your desk. The user is getting a little worked up and needs this solved. Time to get creative.

3.) Run Netcap in a command prompt in interactive mode.

So this one is actually pretty slick. Interactive mode switch will launch the app in the context of the system, which will stay running after the current user logs out. First things first login with your account and install the Windows Support Tools if you already haven't. Then open a command prompt. Run the following command. "at 15:43 /interactive /next: cmd.exe" Replace the 15:43 for whatever time you want the new cmd.exe window to open at. As you can see below I'm logged in as Mark1.

At that designated time a new command prompt should open up running under the system context. Perfect time to start the capture. In this new cmd.exe window, CD over to Support Tools. Run the following command. Netcap /N:1 /B:100 /C:C:\yourfilename.cap . The N/:1 is for whatever network adapter you want to do the capturing of. After this has started running, logout and have the other user try to login.

(Who needs a Hub?)

For illustration purposes I've logged in as another user (Mark2) and you can see the command prompt and network capture are still running.

(Capturing like a champ)

When you are all done just stop the network capture and start investigating. Keep in mind this only works for XP. You have to go about it differently for Windows 7 which will be an upcoming post.

Mark "I think I ate too much holiday joy" Morowczynski

Connecting Server 2008 R2 Wirelessly And The Service You Never Knew You Needed

Mark Morowczynski [MSFT] — Tue, 07 Dec 2010 15:35:00 GMT

Hey Everyone,

I figured it's probably a pretty good idea to be able to boot into a few test VMs off my laptop if I was to ever get stuck at an airport for a long period of time without a good Internet connection (4 Hrs layover in SFO Feb 2011, it will be faaaaaaanatstic). I was in the process of dual booting my work laptop with Win 7 and Server 2008 R2 when I ran across this problem.

When I'm using Windows 7, my laptop is able to connect to wireless networks without a problem. This is expected out of the box behavior, duh.

(All on board the Serenity)

After installing 2008 R2 on my laptop and booting into it I did the whole driver dance where you try to get workstation drivers to work on a server operating system, which is always a challenge and surprising when it really shouldn't have to be. If you've done this dance you know what I'm talking about. I was able to load up a wireless network card driver without too much trouble. Alright time to connect to my network and start doing some updates.

(Where did all those networks go?)

There seems to be no networks for my laptop to connect to when it's booted into 2008 R2. That cannnot be possible since today you cannot go 20 feet without hitting some random wireless network. Let's talk about a wonderful service called the Wireless LAN service. Here is a description of what this busy little guy does.

" The Wireless LAN Service configures the WLAN AutoConfig service to start automatically, regardless of whether the computer has any IEEE 802.11 wireless adapters installed. When enabled, WLAN AutoConfig enumerates every wireless network adapter installed on the computer, manages IEEE 802.11 wireless connections, and manages the wireless connection profiles that contain the settings required to configure a wireless client to connect to a wireless network. WLAN AutoConfig allows you to connect to an existing wireless network, change wireless network connection settings, configure a connection to a new wireless network, and specify preferred wireless networks. WLAN AutoCofig also notifies you when new wireless networks are available. When you switch wireless networks, WLAN AutoConfig dynamically updates your wireless network adapter settings to match the settings of that new network and a network connection attempt will be made."

source: http://technet.microsoft.com/en-us/library/cc730957.aspx

Translation, basically everything one would need to view, connect to and mange wireless network connections on your server. This is installed by default on Windows Clients (XP, Vista, and Windows 7). This is NOT installed by default on the server platforms. Secure by default FTW! Don't worry I've never tried to connect a server OS wirelessly either. This seems to be our problem though. This is installed by adding a new Feature from the Server Manager tool.

(There you are, thought you could get away didn't you)

After installing that you are now able to connect to the wireless networks but there is a minor gui bug maybe? The icon in the tray still shows you aren't connected even though you really are.

(Why must this icon shake my monkey tree?)

I'm not totally sure why it does that to be honest. If I ever find out I'll re-post something. So I had to use the number one tool in any techs tool kit and what I always tell my dad if he calls with a problem, reboot it and see if that fixes it. I'll tell him that for anything it doesn't even have to make sense. "Reboot the lawnmower see if that fixes it." He'll do it every time. I don't know how he reboots a lawnmower but that's his problem. (See Dell's Patent, I wish I was joking, http://www.bbspot.com/News/2003/08/dell_tech_support.html)

(Browncoats Rejoice!)

What do you know, it worked! I think I owe Dell a nickle or something.

So hopefully this saves all of you that are trying to do a similar mobile lab some connectivity troubleshooting. Until next time.

Mark "Man I Miss That Show" Morowczynski

I Liked The Old OS Better This Is Too Many Clicks

Mark Morowczynski [MSFT] — Sat, 04 Dec 2010 19:31:00 GMT

Hey Everyone,

Has anyone worked with anyone that always liked the last version of whatever product better? A good friend and former colleague of mine sometimes fell into that category. And by sometimes I mean all the time. One of his complaints was the Network and Sharing Center in 2008/2008 R2. It drove him mad when he just wanted to get to the network adapter properties and set the IP address info, etc. Here is how we do it in 2003.

(1 Click Goodness)

(Oh 2003 how I love you)

So when we do the same procedure in 2008 or 2008R2 (same for Vista/Win7) we get to the Network and Sharing Center. You need to click "Manage network connections" to get to the network adapaters

(Who are you and where are my network adapters? Mark!)

Fair point I guess, it's an extra click every time settings this up, this adds up over time. But we do have a solution. To the cloud!! Oh wait I mean to the command prompt!

Simply run ncpa.cpl to launch the beloved Network Connections control panel using absolutely no clicks at all! It's like magic you must be some sort of magician!

(Hooray!)

That's all for today folks. Future posts will hopefully be more technical as I go. I promise to get better at taking screen shots or at least I'm trying to.

Mark "The Great Houdini" Morowczynski

Wait Is This Thing On?

Mark Morowczynski [MSFT] — Fri, 03 Dec 2010 00:36:42 GMT

Hey Everyone,

I'm a Premier Field Engineer or PFE here at Microsoft focusing on Platforms(Active Directory, etc) out of the central region. Anyways life before I was a blue badge, about a whole month ago, one of the things I really valued was finding a really good technical blog, such as Ask the Directory Services Team. It was and still is a fantastic resource of information for me that I couldn't seem to get anywhere else. My hope for this blog is to provide that same feeling of value to the community. I'll do my best to write technically interesting posts as often as I can. Feel free to comment or email me with suggestions ideas for posts. I look forward to trying to catch up with Ned Pyle on the number of posts he has written over the years. Mark-1 Ned-10,000 but probably much more.

Mark "I think I might of accidentally just published that" Morowczynski

PS. Ned I'm stealing your various signatures.