Microsoft GTSC Romania - Enterprise Platforms Support

Shared Nothing Migration fails (0x8007274C)

EMEA GTSC Platforms RO — Tue, 16 Oct 2012 15:57:00 GMT

Hi, my name ist Alex Mihai and I work in the Cluster/Virtualization Team at Microsoft. Today I wanted to talk to you about a problem with the Shared Nothing Live Migration in Windows Server 2012 that one of my customer recently encountered.

Shared Nothing Live Migration is a new functionality introduced in Windows Server 2012, that allows you to live migrate the virtual workloads in a non-cluster environment.

If you would like to know more, please have a look at:

Configure and Use Live Migration on Non-clustered Virtual Machines

http://technet.microsoft.com/en-us/library/jj134199.aspx

Ok, so having this explained, I will go ahead and describe my customers problem. His environment consisted of 3 Hyper-V 2012 Host (Non-cluster) with some virtual workloads split up between them. Let’s simply call them S1, S2 and S3.

At some point, my customer couldn’t live migrate any virtual machine to S1. The live migration between S2 and S3 could be done successfully, but not on S1.

When performing the live migration to S1, we got:

Virtual machine migration operation failed at the migration source.

Failed to establish a connection with host ‘S1’: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (0x8007274C)

The first thing we did, was to check if Live Migration on S1 was checked in Hyper-V Settings. It was. We could also ping S1 from S2 and S3 and back. S1 was also restarted.

I wanted to see if this is happening only with the already configured virtual machine’s or with newly created ones also. We created a TestVM on S2 and tried to live migrate. It didn’t work.

We then went ahead and created a TestVM1 on S1 and tried to live migrate it to S2 and it worked, but couldn’t set it again on S1.

Taken into account that we have a communication problem with S1, I asked the customer to check if the Hyper-V rules from the Windows Firewall are the same with those from server S2. They were the same.

We then disabled the Windows Firewall on S1 and tried to do a live migration. This time it failed with another error:

Virtual machine migration operation failed at migration source.

Failed to establish a connection with host ‘S1’: No connection could be made because the target machine actively refused it. (0x8007274D).

Knowing that system and application event log isn’t revealing any additional information about the above error message, we went ahead and looked in Microsoft-Windows-Hyper-V-VMMS-Admin and found the following:

Log Name: Microsoft-Windows-Hyper-V-VMMS-Admin

Source: Microsoft-Windows-Hyper-V-VMMS

Date: 08.10.2012 09:48:47

Event ID: 20408

Task Category: None

Level: Error

Keywords:

User: SYSTEM

Computer: S1

Description:

The Virtual Machine Management Service failed to start the listener for Virtual Machine migration connections: The requested address is not valid in its context. (0x80072741).

I couldn’t find any information regarding this error whatsoever, therefore had a look in a network trace during the live migration failure also.

The live migration is done on the port 6600 and the network trace showed us that the connection was simply reset-ed.

In a netstat –a, I could see that the process vmms.exe wasn’t listening on port 6600 on S1. S2 and S3 had the vmms process listening on port 6600.

With the above information, we could establish that this was our problem. We restarted the vmms process on S1 and then BINGO, a live migration was possible.

But wait...

The problem wasn’t gone. After S1 was restarted, my customer couldn’t do a live migration again. The vmms process didn’t listened on the port 6600.

What I would like to mention is, is that my customer used 2 NIC’s:

1 x Hyper-V Host NIC

1 x Teamed NIC

The IP for the live migration came from the Teamed NIC.

After discussing with one of my experienced virtualization colleague, we concluded that there seem to be a race condition when the server is restarted.

After setting the restart type for the process vmms.exe to Automatic “Delayed Start”, the problem didn’t appeared after a reboot of the server S1.

When the Virtual Machine Managment Service (vmms.exe) starts it tries to register this port to listen for incoming migration requests. When the underlying Network is not (yet) ready, the listening port cannot be registered.

This might happen on Teamed Networks that are not completely initalized during system startup.

Another workaround was to set the IP of the Hyper-V host for the live migration traffic.

Hope this will help you if you encounter the same simptoms.

Alex Mihai

GTSC Support Engineer

Installation Failures / CBS Store corruptions: Uncommon issues and troubleshooting

EMEA GTSC Platforms RO — Thu, 28 Apr 2011 13:41:00 GMT

I wanted to discuss some of the more uncommon CBS issues that Administrators might encounter when performing installations. Basically this article is for cases where all updates fail to install on a particular client or if for example you cannot install a Service Pack.

The logs relevant in these situations no matter if client or servers are:

1. C:\windows\logs\cbs\cbs.log

2. System Event log

3. C:\windows\logs\cbs\checksur.log (this is created after you run the System Update Readiness Tool)

The first log you need to analyze is the checksur.log:

If you see entries like:

Checking Package Manifests and Catalogs

(f) CBS MUM Corrupt 0x00000000 servicing\Packages\Package_for_KB2479628_RTM~31bf3856ad364e35~amd64~~6.1.1.4.mum Expected file name Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.mum does not match the actual file name

Unavailable repair files:

servicing\packages\Package_for_KB2479628_RTM~31bf3856ad364e35~amd64~~6.1.1.4.mum

servicing\packages\Package_for_KB2479628_RTM~31bf3856ad364e35~amd64~~6.1.1.4.cat

Then you need to follow instructions from:

http://blogs.technet.com/b/roplatforms/archive/2010/05/12/how-to-fix-server-manager-errors-after-installing-updates-hresult-0x800f0818-hresult-0x800b0100.aspx

IF the log is clear, you move on to the CBS Log. Here you first want to search for “, error”. This will search only for Error entries. Focus on the day the installation attempt occurred.

Now to the examples:

Ex.1: Servers or clients kept being in a pending reboot state, even after they were rebooted!

2011-03-09 09:37:36, Info CSI 00000040 Pending transaction content must be resolved, cannot begin another transaction yet

2011-03-09 09:37:36, Info CBS Failed to get transaction analysis because of pending operations. Disposition from Analyze: 0x1 [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info CBS Failed to get inventory. [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info CSI 00000041@2011/3/9:08:37:36.532 CSI Transaction @0x268ee0 destroyed

2011-03-09 09:37:36, Info CBS Failed to get inventory [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info CBS Failed to load current component state [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info CBS Failed to find or add the component family [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info CBS ComponentAnalyzerEvaluateSelfUpdate call failed. [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info CBS Failed to evaluate self update [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info CBS Failed to evaluate non detect parent update [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info CBS Failed to evaluate non parent [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info CBS failed to evaluate single applicability [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info CBS Failed to evaluate applicability [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info CBS Failed to get applicability on updates [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

Cause:

======

The TrustedInstaller service was set to manual using Group Policy (GPO), which prevented him to start to complete pending operations.

The TrustedInstaller service changes the default service startup type of Manual (3) to Automatic (2), when it encounters an update that has to process a transaction after a restart. When the value is set back to Manual before the restart the transaction that has to be applied after restart cannot be applied. This transaction will be pended. It will block all other update installations that might come up.

Resolution:

==========

The resolution is explained in the KB below. The reason I decided to also blog about it, is because the errors above are not described in the article, and it might be a bit hard to find if you run into it.

http://support.microsoft.com/kb/968440

Changing the policy back to default fixes the issue.

Ex.2: Here no installation worked anymore.

The CBS Log was full of errors, but none that would pinpoint the cause. So looking at the system.log we find:

Faulting application name: TrustedInstaller.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc4b0

Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b

Exception code: 0xc00000fd

Fault offset: 0x00000000000529f0

Faulting process id: 0x1368

Faulting application start time: 0x01cbdfd0e12ca3d6

Faulting application path: C:\Windows\servicing\TrustedInstaller.exe

Faulting module path: C:\Windows\SYSTEM32\ntdll.dll

Report Id: 27f28558-4bc4-11e0-9960-005056833879

Since the TrustedInstaller is the process that handles all installations, this is crucial for any installation. It was crashing. Ideally you will run the System Update Readiness Tool and find the files you need to replace in order for the TrustedInstaller to run again, but there are cases where the Manifest and Catalog files have not yet been merged into the Checksur Tool (System Updated Readiness Tool). In this case no missing mum/cat files will be found. I`m afraid here only a IDNA Trace and debugging will reveal which mum/cat files is missing.

Resolution:

==========

Run Checksur Tool (KB947821)

Ex.3: Error 0x800f081f when trying to install SP1 for Windows 2k8 R2

Here this was the premise: Error 0x800f081f. Looking at the CBS log very carefully we can find the highlighted area:

Line 2225: 2011-03-03 08:09:42, Info CBS Failed to get session package state for package: Package_6_for_KB2482017~31bf3856ad364e35~amd64~~6.1.1.1 [HRESULT = 0x80070490 - ERROR_NOT_FOUND]

Line 2288: 2011-03-03 08:09:42, Info CBS Failed to get session package state for package: Package_7_for_KB2482017~31bf3856ad364e35~amd64~~6.1.1.1 [HRESULT = 0x80070490 - ERROR_NOT_FOUND]

Line 2411: 2011-03-03 08:09:42, Info CBS Failed to get session package state for package: Package_6_for_KB2482017~31bf3856ad364e35~amd64~~6.1.1.1 [HRESULT = 0x80070490 - ERROR_NOT_FOUND]

2011-03-02 15:36:18, Info CBS Calling client to resolve source, cannot find file 'TsUsbGD.sys' at path: \\?\C:\Windows\Servicing\Packages\amd64_tsgenericusbdriver.inf_31bf3856ad364e35_6.1.7601.17514_none_9872c8452ac8f816\TsUsbGD.sys
2011-03-02 15:36:18, Error CBS Exec: Failed to pre-stage package: Package_for_KB976933~31bf3856ad364e35~amd64~cs-CZ~6.1.7601.17514, file: TsUsbGD.sys, source: \\?\C:\Windows\Servicing\Packages\amd64_tsgenericusbdriver.inf_31bf3856ad364e35_6.1.7601.17514_none_9872c8452ac8f816\TsUsbGD.sys

Cause:
======

KB976933 contained corrupted components which caused SP1 to crash on installation.

Although the checksur.log was clean and there might be other errors in the CBS Log you can remember to search for “failed to pre-stage” errors. If these appear then you have the most likely cause!

Resolution:

==========

We used the following command to uninstall the package that was causing the issue:

dism /online /remove-package /packagename:Package_for_KB976932~31bf3856ad364e35~amd64~~6.1.1.17514

Ex.4: 0x8007007f after installing SP1. System is in an inconsistent state. Shell Errors

This example is the case where the installation did go through (SP1 in my case) but after this different components sopped working. CBS Log shows

CBS Log:

2011-04-13 08:24:58, Info CBS SQM: Failed to start upload with file pattern: C:\Windows\servicing\sqm\*_std.sqm, flags: 0x2 [HRESULT = 0x8007007f - ERROR_PROC_NOT_FOUND]

2011-04-13 08:24:58, Info CBS SQM: Failed to start standard sample upload. [HRESULT = 0x8007007f - ERROR_PROC_NOT_FOUND]

2011-04-13 08:24:58, Info CBS SQM: Failed to start upload with file pattern: C:\Windows\servicing\sqm\*_all.sqm, flags: 0x6 [HRESULT = 0x8007007f - ERROR_PROC_NOT_FOUND]

2011-04-13 08:24:58, Info CBS SQM: Failed to start always sample upload. [HRESULT = 0x8007007f - ERROR_PROC_NOT_FOUND]

2011-04-13 08:24:58, Info CBS SQM: Warning: Failed to upload all unsent reports. [HRESULT = 0x8007007f - ERROR_PROC_NOT_FOUND]

Resolution:

==========

The solution here is not that easy.

1. Either uninstall and reinstall SP1 (this might fail)

2. Perform an inplace Upgrade

These are the more uncommon issues that might occur. Below I included several KB’s that all are solution to installation issues or CBS corruption problems:

Your computer may freeze or restart to a black screen that has a "0xc0000034" error message after you install Service Pack 1 on Windows 7 or Windows 2008 R2
http://support.microsoft.com/kb/975484

Error code 0x800f081f (CBS_E_SOURCE_MISSING)
http://blogs.technet.com/b/joscon/archive/2011/02/14/you-receive-exit-code-0x800f081f-when-attempting-to-install-sp1-for-win7-r2.aspx

Error code 0x800f0a12
http://blogs.technet.com/b/joscon/archive/2011/02/17/windows-7-2008-r2-service-pack-1-fails-with-0x800f0a12.aspx

Error code 0x8004a029
http://blogs.technet.com/b/joscon/archive/2011/02/21/windows-7-service-pack-1-fails-with-error-code-0x8004a029.aspx

Tudor Dimboianu
Platforms Core Team

Installation folder in which Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 will be installed

EMEA GTSC Platforms RO — Fri, 07 Jan 2011 11:50:37 GMT

Many customers used on Windows XP and Windows Server 2003 machines other names for the OS folder other than "Windows " (eg. WINNT) and now want to continue to use a different directory name for future OSes.

This was possible back then by using the setting TargetPath in the Unattend.txt.

Starting with Windows Vista / Windows Server 2008, this has changed and you can not change the Windows folder anymore. The hard-coded directory where the operating system is now installed is "Windows ".

In the WAIK documentation the "TargetPath" entry is now addressed as “deprecated”:

Section	Windows XP and Windows Server 2003	Windows® 7 and Windows Server® 2008 R2 setting
	TargetPath	Deprecated

Stefan Chivu

Platforms Core Team

KB981833 - STOP: 0x0000006B on Dell systems

EMEA GTSC Platforms RO — Fri, 29 Oct 2010 12:46:00 GMT

A very interesting case I worked on this week brought us on a new possible cause for blue-screens with STOP 0x6B, and I am now sharing this valuable information now :)

Symptom:

Your Windows 7 Dell Latitude E6510 systems are running in STOP 0x6B, although KB981833 is already installed.

Even if you delete the C:\Windows\system32\CodeIntegrity\bootcat.cache fie, the crashes persist.

Cause:

We found out that this is the result of some specific installation routines of an audio driver update with other system update components (not yet identified which exactly).

If a pack of several patches is installed, including Device IDT_92HDXXX-HD-AUDIO_A17_R278544.exe driver, the bootcat.cache might get corrupted (~11KB is size) and the systems run in STOP 0x6B.

If the pack is installed without the above mentioned driver, and the driver is installed only in the end, the system can be restarted successfully and the bootcat.cache file is updated accordingly.

Hint:

Should the system not boot after deleting the bootcat.cache file, try to copy the bootcat.cache file from an older backup image of the system. This might bring the system up.

If this article has helped, please add a comment.

Oni Sandru
Platforms Core Team

Supersedence problem with MS Office 2007 Updates KB974561 - KB2251419 and KB981715 - KB982312

EMEA GTSC Platforms RO — Thu, 28 Oct 2010 13:09:00 GMT

Scenario:

You have a WSUS Server in your environment and you are installing new Windows XP SP3 machines with Microsoft Office 2007.

You notice that after the first update installation cycle finishes, following window pops up:

No installation logs (KBxxxxxx.log) have been created under C:\Windows for these 2 Updates.

The 2 Office Updates are then never reoffered again or reported as missing.

After analyzing the Issue we were able to find out why these 2 Office Updates (KB974561 and KB981715) would get offered, downloaded but then failed when installing.

In the same Detectioncycle are also 2 newer Office Updates that replace the same files as the above mentioned updates, but with newer versions: KB982312 and KB2251419

	Mso.dll
http://support.microsoft.com/kb/981715	12.0.6529.5000
http://support.microsoft.com/kb/982312	12.0.6535.5002

	Msword.olb	Winword.exe	Wwlib.dll
http://support.microsoft.com/kb/974561	12.0.6501.5000	12.0.6501.5000	12.0.6501.5000
http://support.microsoft.com/kb/2251419	12.0.6541.5000	12.0.6541.5000	12.0.6541.5000

So in a nutshell, what happends is:

Both the old and the new updates are offered since in the beginning the fresh WinXP Machine has old versions of all these files, both the 2 old and the 2 new updates are downloaded, then the newer 2 updates are installed first, and then (obviously) the installation of the other 2 older update fails since the system already has newer versions than the ones these 2 updates intend to install.

We see that the new updates are being installed before the old ones are installed:

2010-09-23 10:05:07:166 876 c4c Agent *************

2010-09-23 10:05:07:166 876 c4c Agent ** START ** Agent: Installing updates [CallerId = AutomaticUpdates]

2010-09-23 10:05:07:182 876 c4c Agent *********

2010-09-23 10:05:07:182 876 c4c Agent * Updates to install = 67

2010-09-23 10:05:07:636 876 c4c Agent * Title = Security Update for Microsoft Office Word 2007 (KB2251419)

2010-09-23 10:05:07:636 876 c4c Agent * UpdateId = {D9F49D05-AC6D-4A2A-8150-D2B4B730DEED}.100

2010-09-23 10:05:07:636 876 c4c Agent * Bundles 1 updates:

2010-09-23 10:05:07:636 876 c4c Agent * {799B38A3-2BEE-4040-A391-FB3A54B87040}.100

2010-09-23 10:05:07:714 876 c4c Agent * Title = Security Update for the 2007 Microsoft Office System (KB982312)

2010-09-23 10:05:07:714 876 c4c Agent * UpdateId = {330D3AC6-6D35-4F03-9483-AFBA749884FB}.100

2010-09-23 10:05:07:714 876 c4c Agent * Bundles 1 updates:

2010-09-23 10:05:07:714 876 c4c Agent * {F4EDE0D0-1DC7-488F-9290-1542FB99B30F}.100

2010-09-23 10:05:07:714 876 c4c Agent * Title = Update for Microsoft Office PowerPoint 2007 Help (KB963669)

2010-09-23 10:05:07:714 876 c4c Agent * UpdateId = {DDA60FCC-6280-458F-BE92-D400947094CC}.103

2010-09-23 10:05:07:714 876 c4c Agent * Bundles 4 updates:

2010-09-23 10:05:07:714 876 c4c Agent * {5686E931-30D0-4E6A-A750-3CB333C0DD07}.103

2010-09-23 10:05:07:714 876 c4c Agent * {943E39FA-3F8E-4571-A674-14008394F353}.103

2010-09-23 10:05:07:714 876 c4c Agent * {EAC21B7D-26F7-4784-8E9F-020FA5A519B3}.103

2010-09-23 10:05:07:714 876 c4c Agent * {94AA4564-A1B3-4C86-A9CA-131154CBD847}.103

2010-09-23 10:05:07:714 876 c4c Agent * Title = Security Update for Windows XP (KB2115168)

2010-09-23 10:05:07:714 876 c4c Agent * UpdateId = {872236CF-BCDD-413C-AA70-F1EF4DE58294}.102

2010-09-23 10:05:07:714 876 c4c Agent * Bundles 1 updates:

2010-09-23 10:05:07:714 876 c4c Agent * {B5F24232-B8E2-429C-BAFF-0DFF3D1B7722}.102

2010-09-23 10:05:07:714 876 c4c Agent * Title = Microsoft .NET Framework 1.1 SP1 Security Update for Windows 2000 and Windows XP (KB979906)

2010-09-23 10:05:07:714 876 c4c Agent * UpdateId = {18072BD1-84D7-4CEF-A069-808512A8A76D}.108

2010-09-23 10:05:07:714 876 c4c Agent * Bundles 1 updates:

2010-09-23 10:05:07:714 876 c4c Agent * {C3486200-3186-4B48-A012-A2DDABE91034}.108

2010-09-23 10:05:07:714 876 c4c Agent * Title = Cumulative Security Update for ActiveX Killbits for Windows XP (KB980195)

2010-09-23 10:05:07:714 876 c4c Agent * UpdateId = {185315D8-AA13-43C9-AB29-0CCB562471DC}.107

2010-09-23 10:05:07:714 876 c4c Agent * Bundles 1 updates:

2010-09-23 10:05:07:714 876 c4c Agent * {74D2347B-682E-4F68-B881-1E9FA7B45FFD}.104

2010-09-23 10:05:07:729 876 c4c Agent * Title = Update for Microsoft Office Word 2007 (KB974561)

2010-09-23 10:05:07:729 876 c4c Agent * UpdateId = {9452E2DD-399E-430C-A7F6-81065B8BD447}.105

2010-09-23 10:05:07:729 876 c4c Agent * Bundles 1 updates:

2010-09-23 10:05:07:729 876 c4c Agent * {CEBBE511-0B1D-493F-B9B0-32FFABD36B46}.105

2010-09-23 10:05:07:729 876 c4c Agent * Title = Update for the 2007 Microsoft Office System (KB981715)

2010-09-23 10:05:07:729 876 c4c Agent * UpdateId = {AC4180ED-FA59-470C-B7BE-9C94A878634E}.101

2010-09-23 10:05:07:729 876 c4c Agent * Bundles 1 updates:

2010-09-23 10:05:07:729 876 c4c Agent * {E21FB04E-716E-45A3-BC0A-47D83182010D}.101

Installation of the 2 old updates then fails with:

KB981715:

-------------

2010-09-14 17:39:51:550 828 bac DnldMgr Preparing update for install, updateId = {E21FB04E-716E-45A3-BC0A-47D83182010D}.101.

2010-09-14 17:39:51:566 2240 e80 Handler :::::::::::::

2010-09-14 17:39:51:566 2240 e80 Handler :: START :: Handler: MSI Install

2010-09-14 17:39:51:566 2240 e80 Handler :::::::::

2010-09-14 17:39:51:566 2240 e80 Handler : Updates to install = 1

2010-09-14 17:39:51:597 2240 e80 Handler Extracting MSP file stored in CAB mso.cab

2010-09-14 17:39:52:097 2240 e80 Handler MSP update {00000000-0000-0000-0000-000000000000}.0 using full-file patch

2010-09-14 17:39:52:097 2240 e80 Handler : Batch installing 1 updates

2010-09-14 17:39:54:581 2240 e80 Handler : WARNING: Operation failed at update 0, Exit code = 0x80240017

2010-09-14 17:39:54:581 2240 e80 Handler :::::::::

2010-09-14 17:39:54:581 2240 e80 Handler :: END :: Handler: MSI Install

2010-09-14 17:39:54:581 828 264 AU >>## RESUMED ## AU: Installing update [UpdateId = {AC4180ED-FA59-470C-B7BE-9C94A878634E}]

2010-09-14 17:39:54:581 2240 e80 Handler :::::::::::::

2010-09-14 17:39:54:581 828 264 AU # WARNING: Install failed, error = 0x80240017 / 0x00000000

KB974561:

--------------

2010-09-14 17:38:57:034 828 bac DnldMgr Preparing update for install, updateId = {CEBBE511-0B1D-493F-B9B0-32FFABD36B46}.105.

2010-09-14 17:38:57:066 2240 e80 Handler :::::::::::::

2010-09-14 17:38:57:066 2240 e80 Handler :: START :: Handler: MSI Install

2010-09-14 17:38:57:066 2240 e80 Handler :::::::::

2010-09-14 17:38:57:066 2240 e80 Handler : Updates to install = 1

2010-09-14 17:38:57:097 2240 e80 Handler Extracting MSP file stored in CAB word.cab

2010-09-14 17:38:57:738 2240 e80 Handler MSP update {00000000-0000-0000-0000-000000000000}.0 using full-file patch

2010-09-14 17:38:57:738 2240 e80 Handler : Batch installing 1 updates

2010-09-14 17:38:59:706 2240 e80 Handler : WARNING: Operation failed at update 0, Exit code = 0x80240017

2010-09-14 17:38:59:706 2240 e80 Handler :::::::::

2010-09-14 17:38:59:706 828 264 AU >>## RESUMED ## AU: Installing update [UpdateId = {9452E2DD-399E-430C-A7F6-81065B8BD447}]

2010-09-14 17:38:59:722 828 264 AU # WARNING: Install failed, error = 0x80240017 / 0x00000000

After discussing the issue with our product group we were informed that they didn’t supersede these Non-security Updates (KB974561 and KB981715) with the next security updates (KB982312 and KB2251419), so both updates will be shown as applicable on a machine with older files if both pairs of updates are approved on the WSUS Server.

Workaround: On the WSUS Server decline KB974561 and KB981715

Solution: We’re currently in progress of resolving KB981715 issue in the November release. KB974561’s fix is scheduled to be released in February 2011.

Stefan Chivu

Platforms Core Team

Svchost.exe uses 100% CPU when Windows XP updates via WSUS

EMEA GTSC Platforms RO — Mon, 04 Oct 2010 16:12:00 GMT

Although this problem will diminish in time with more powerful PC’s being released to the market, there are still situations where you might run into a performance problem when a client scans against WSUS.

By default a client will scan every 22 hours for updates when connected to a WSUS Server. This default time can be changed

Next I will discuss the factors that can influence scanning performance on a client:

1. Hardware. Single Core machines are more likely to take longer to finish detection.

Recommendation: Use Dual Core Machines

2. MSI Version. MSI is used during the scanning. Office updates have the detection logic within the MSI package, so the Windows Update Agent hands the metadata off to MSI where MSI then checks for the products\features installed and will see if the update is applicable. So it’s a known performance issue when MSI 3 is scanning against a bunch of Office updates.

Recommendation: always use the latest MSI Agent. You can check the version of MSI.DLL to find out what engine is installed:

[C:\WINNT\SYSTEM32\MSI.DLL]

Company Name: Microsoft Corporation

File Description: Windows Installer

Product Version: 3.1.4001.5512

File Version: 3.1.4001.5512

URL to download MSI 4.5 http://support.mirosoft.com/kb/942288

3. The detection data is saved into the DataStore which is located here: c:\windows\softwaredistribution. During a detection data is written constantly into the Store. This is why you should add the SoftwareDistribution Folder into the exclusion list of your AntiVirus Software.

4. Windows Update Agent. This handles the detection logic of the updates that are about to be installed. This update is crucial because detection logic is revised with every version by our product team and performance is tweaked regularly.

Recommendation: Download and install the latest WUA: http://support.microsoft.com/kb/949104

5. The amount of updates available on the WSUS Server.

This is a very important concept to understand. On the WSUS Server we have Updates which can have 3 states. DECLINED, NOT APPROVED, APPROVED

Detection on a client works like this: The client (Wuaueng.dll) initiates a Metadata sync with the Server. Basically it asks for a list of updates that are available on the WSUS Server (For this the Client Web Service is used). The Server compiles a list of those updates and sends them back to the client. Then the actual detection takes place. MSXML3.DLL and MSI.DLL go through the XML Data for updates that are needed on the client. Once he is done, he will compile a new list and send this to the WSUS Server which will trigger the download.

This whole process takes time and computing power. The client will ONLY parse APPROVED and NOT APPROVED Updates. This means that if updates are not specifically declined the Client needs to touch each update to check if it is applicable for him or not.

Recommendation:

1. Declined all Superseeded Updates. Superseeded updates have newer updates that replace them, thus making them obsolete. This is the most important tweak. Pay special attention to Office 2003 Updates. There is a great number of these updates, which are the primary source for bad client performance

2. Try to minimize the amount of Updates that have a NOT APPROVED state. Either decline them or approve them.

6. WSUS Server Maintenance:

A good Server Maintenance will also improve performance on the clients.

Running monthly cleanup scripts will help eliminate expired updates and will also decline superseeded ones.

Here are a few tools to help with the process:

1. The clean-up wizard in WSUS should be run at least once per month. This can be automated using scripts:

WSUS 3.0
http://wsus.codeplex.com/releases/view/17612

Powershell script

http://www.peetersonline.nl/index.php/powershell/wsus-cleanup-with-powershell/

2. Below is a reindexing script that will help WSUS search faster through the database (also ran once a month):

http://www.microsoft.com/technet/scriptcenter/scripts/sus/server/susvvb01.mspx?mfr=true

These steps should offer noticeable improvements to the detection time of your clients.

If you have any questions, please use the comment section below.

Tudor Dimboianu

Platforms Core Team

Tips for improving the performance of Hypervisor-based virtual machine images

EMEA GTSC Platforms RO — Tue, 25 May 2010 15:09:57 GMT

There are several improvements that can be made on the Hypervisor Host machine and on the virtual machines running on this host machine (guest machines). If possible the host machine should run Windows 2008 Server R2 since the latest version of Windows Server does offer significant performance improvements over Windows Server 2008

1. Settings on the host machine
(Windows Server 2008 SP2 or Windows 2008 Server R2)

- The latest hardware drivers should be installed on the host machine (Chip set, storage, network, etc.). Please check the website of the vendor for the latest updates.
- Check for updates for the hypervisor component and update if available
- Install the latest storage driver
- Install the chip set drivers
- If possible set up the storage on which the virtual machine hard disks are located as a stripe set (Raid 0). Windows should be installed on a disk which is separated from those disks on which the virtual machine disks are located
- If virtual machines are running there should be at least 1 GB Memory of available physical memory left for the operating system.

Here is an example (see picture 1)

On this machine there is 8 GB of physical RAM installed. At the moment the screenshot was taken 1.02 GB of physical RAM were allocated to various processes. This is the amount of memory consumed by Windows 2008 R2 when there are no other processes running apart from the OS processes. As more and more virtual machines are started up on a host machine the more physical memory is consumed. When an amount of approx. 7 GB is consumed by processes one will see that the performance of the host AND guest machines will become sluggish as the operating system starts to make more and more use of the page file which will drive down the performance of all processes. It might get to the point where the guest machines do not run properly anymore.

If the amount of available memory drops below 1 GB one should turn off all virtual machines which are not needed until the amount of available memory rise above 1 GB.

Picture1: Memory consumption on Windows 2008 R2 OS

2. Settings on the virtual machines (guest machines)

For all Guest machines:

- Turn off the screensaver!

2.1.) Settings for Windows 2003 Server:

- Tools –> Folder Option –> View –> Advances Settings –> Uncheck the "Automatically search for network folders and printers” option

- Display properties –> Settings –> Advanced –> Troubleshoot –> Hardware acceleration –> Set to Full and check “Enable Write combining”

- Control Panel –> Power Options –> Power Schemes –> Set Power scheme to "Presentation"
- Turn off monitor –> Set to "Never"

- Start –> Settings –> Control Panel –> System –> Advanced System Settings –> Advanced tab –> Performance -> Visual effects –> select and check "Adjust for best performance"

- Start –> Settings –> Control Panel –> System –> Advanced System Settings –> Advanced tab –> Performance –> Processor Scheduling –> Adjust for best performance of "Background services" (see image below)

2.2.) Windows Server 2008 / Windows Server 2008 R2

- Turn off the screensaver
- Control Panel –> Power Settings –> Set power plan to "High Performance"
- Start –> Settings –> Control Panel –> System –> Advanced System Settings –> Advanced tab –> Performance -> Visual effects –> select and check "Adjust for best performance"
- Start –> Settings –> Control Panel –> System –> Advanced System Settings –> Advanced tab –> Performance –> Processor Scheduling –> Adjust for best performance of "Background services" (same as image above)

2.3.) Windows XP

- Turn off the screensaver
- Tools –> Folder Option –> View –> Advances Settings –> Uncheck the "Automatically search for network folders and printers” option
- Display properties –> Settings –> Advanced –> Troubleshoot –> Hardware acceleration –> Set to Full and check “Enable Write combining”
- Control Panel –> Power Options –> Power Schemes –> Set Power scheme to "Presentation"
- Turn off monitor –> Set to "Never"

- Start –> Settings –> Control Panel –> System –> Advanced System Settings –> Advanced tab –> Performance -> Visual effects –> select and check "Adjust for best performance"
- Start –> Settings –> Control Panel –> System –> Advanced System Settings –> Advanced tab –> Performance –> Processor Scheduling –> Adjust for best performance of "Background services"

- Disable the balloon tips:

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Name: EnableBalloonTips
Type: REG_DWORD –> set the value to 0

2.4.) Recommendation for all Hyper-V guest machines:

Ensure that the latest Hyper-V integration services are being installed on the guest machines.

Open a Virtual machine connection to a guest machine. Go to the menu of the Virtual Machine connection window and select: Action –> Insert integration services setup disk. If the integration services on the guest machine are outdated you will get this pop-up.

Run the installation and reboot the guest machine in order to finalize the installation of the updated integration services.

Windows Server services packs and updates do include upgrades to the integration services. These upgraded integration services result in substantial performance improvements of the guest machines. When older guest machines/virtual disks are integrated into a Windows 2008 R2 Hypervisor Host machine the update of the integration services will result in a significant performance improvement. The hyper-V integration services in Windows Server 2008 R2 have the version number 6.1.7600.16385. This can be checked in “Add or remove programs” in the control panel.

*** The following procedure will show no-longer-connected devices in Device Manager for Server 2008 ***

- Open a command window with elevated privileges (Start –> Right-click "Command Prompt", select "Run as Administrator")
- In the command window, execute the following command:

SET DEVMGR_SHOW_NONPRESENT_DEVICES=1

Start –> type DEVMGMT.MSC
Go to View –> Show hidden devices
Under Network Adapters uninstall any network cards that are no longer used.

Last but not least, you need to correctly configure your antivirus software on the host machine to exclude the Hyper-V processes as well as VHD / ISO / Configuration files and folders from real-time scan. These are the processes and file types you need to add to the exclusion list:

Inspectvhddialog.exe
Vmconnect.exe
Vmms.exe
Vmwp.exe

File types : *.iso, *.vhd, *.avhd

Thanks and i hope you found this article useful!

Florian Alin Noaghea
- Support engineer / Enterprise Messaging (Exchange) team

How to fix Server Manager Errors after installing updates (HRESULT:0x800F0818 / HRESULT:0x800B0100)

EMEA GTSC Platforms RO — Wed, 12 May 2010 14:20:27 GMT

Symptoms
You install several Updates. After the successful installation, you notice you cannot add or remove features/roles in the Server Manager.

Error: Unexpected error refreshing Server Manager: Exception from HRESULT:0x800F0818

Alternatively you can also get:
Server Manager: Unexpected error refreshing Server Manager: No signature was present in the subject. (Exception from HRESULT: 0x800B0100)

Resolution

First you run the Microsoft Update Readiness Tool located here: http://support.microsoft.com/kb/947821
After the scan has completed check: C:\Windows\logs\CBS\Checksur.log. You should see the following errors:

Checking Package Manifests and Catalogs
(f) CBS MUM Corrupt 0x00000000 servicing\Packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum Expected file name Package_for_KB978601_server~31bf3856ad364e35~amd64~~6.0.1.0.mum does not match the actual file name
(f) CBS MUM Corrupt 0x00000000 servicing\Packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.mum Expected file name Package_for_KB979309_server~31bf3856ad364e35~amd64~~6.0.1.0.mum does not match the actual file name

Or

(f) CBS MUM Corrupt 0x800B0100 servicing\Packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum servicing\Packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.cat Package manifest cannot be validated by the corresponding catalog
(f) CBS MUM Corrupt 0x800B0100 servicing\Packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.mum servicing\Packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.cat Package manifest cannot be validated by the corresponding catalog

(f) CBS MUM Missing 0x00000002 servicing\packages\Package_114_for_KB955839~31bf3856ad364e35~amd64~~6.0.1.0.mum
(f) CBS MUM Missing 0x00000002 servicing\packages\Package_83_for_KB955839~31bf3856ad364e35~amd64~~6.0.1.0.mum

Further down you will see:

Unavailable repair files:
servicing\packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum
servicing\packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.mum
servicing\packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.cat
servicing\packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.cat

These files need to be copied into: %systemroot\Windows\Servicing\Packages

1. You first need to gain control over that folder. In order to do this use the following commands:

This makes the current logged on user (needs to have Administrative privileges) owner of that folder:
takeown /F c:\Windows\Servicing\Packages /D y /R

Then assign full control using:
cacls c:\Windows\Servicing\Packages /E /T /C /G "UserName":F

This will grant you full control over the directory.

Optionally you can download this ZIP. Inside you have 2 REG Files. If you install TakeOwnership.reg you will have a handy Take Ownership entry in the right click menu every time you use it on a Folder.

2. Now you need to gather the missing or corrupted files from the checksur log:

- Download the KB Files for the missing files:
servicing\packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum

- Unpack them using the following command:
Expand -F:* UpdateKBXXXX.msu x:\DestinationDirectory

After you expand you will see a UpdateKBXXXX.cab File. Expand it as well:
Expand -F:* UpdateKBXXXX.CAB x:\DestinationDirectoryCAB

Inside of this cab you will need to grab 2 files: update.mum and update.cat

3. Rename the gathered update.mum and update.cab files exactly as they are specified in the checksur.log:
Ex.: update.mum for KB978601 will be:

Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum

Do the same for all the other missing/corrupt files and place them into the directory specified in checksur.log (/servicing/packages)
After these steps the problem should be fixed. No reboot required.

If the Server Manager is not working even after doing these steps, run the Update Readiness Tool again and double-check the steps described above.

Tudor Dimboianu
- Support Engineer / Enterprise Platforms Support (Core)

Creating a custom Data Collector Set with SQL x86 counters on an x64 OS

EMEA GTSC Platforms RO — Mon, 03 May 2010 15:24:50 GMT

In one of our recent CSS cases, we noticed a strange difference between the Windows Small Business Server (SBS) 2008 x64 and Windows Server 2008 x64. One could create a Data Collector Set (DCS) with SQL Server x86 counters, collect and view the samples just fine on the SBS 2008 x64, out of the box. However, on Windows Server 2008 x64 this proved to be not possible.

This workaround will be provided “as-is”, with no support whatsoever or liability from Microsoft. For use in a productive environment, we recommend you to install the x64 version of SQL Server especially when running on a x64 OS.

First let’s take a look at the two scenarios:

Windows SBS 2008 x64 with SQL Server 2005 SP2 x86 installed by default

- You can see that by default, there are two SQL Server processes running, one 64bit the other 32bit.

- The x64 Process is running from this directory:

- The x86 process is running from here:

- You can see here the two Services associated with the two SQL Processes:

The x86 service is MSSQL$SBSMONITORING and the x64 service is MSSQL$MICROSOFT##SSEE

- The SQL Performance counters are stored in a DLL called sqlctr90.dll.
Here you see that on a SBS 2008 server, there are two DLLs installed by default: one 32bit in c:\windows\syswow64 and 64bit in c:\windows\system32

Windows Server 2008 SP2 x64 with SQL Server 2005 SP3 x86

- You see that there is only one 32bit SQL Server process running (no 64bit process running like on SBS 2008)

- We see here the file location of the running process:

- We see only one SQL Service running, named after the test instance I created on the virtual machine (TEST32)

- If we search now for the sqlctr90.dll, we only see one file: the 32bit version in c:\windows\syswow64

The workaround is to simply copy the 64bit version of “sqlctr90.dll” from another machine running a x64 SQL instance, to the “c:\windows\system32” directory of the Server 2008 x64 OS machine running SQL Server 2005 x86. We recommend using the DLL from similar SP levels of SQL Server (SP3 since SP2 is actually not supported any more!)

Once you copy the DLL, you can proceed with creating a custom DCS with SQL Server 32bit counters:

1. Choose a name for the DCS and select “create manually (advanced)”

2. Choose “Performance counter” and click “Next”

3. Choose any SQL related counters (here you see General Statistics for example):

4. Here you select the location, wrap up the DCS creation and start the collection.
After a chosen amount of time, you can stop the collection.

5. To view the counters, in Perfmon you select and open the created BLG file of the custom DCS

6. You now select which objects you would like to see displayed:

7. As you can see, sample collection works fine.

As always, i hope you find this post useful and feel free to rate it or drop some comments, we love to hear back from you!

Bogdan Palos
- Technical Lead / Enterprise Platforms Support (Core)

The case of the server who couldn’t join a cluster – operation returned because the timeout period expired

EMEA GTSC Platforms RO — Wed, 28 Apr 2010 14:05:45 GMT

Hi everyone! Today I am going to present a very interesting case which we recently handled in EMEA CSS. The customer wanted to build a Windows Server 2008 SP2 x64 Failover Cluster but wasn’t able to add any nodes to it. The “Add Node” wizard timed out and the following error was visible in the “addnode.mht” file in the %SystemRoot%\Cluster\reports directory:

The server “nodename” could not be added to the cluster. An error occurred while adding node “nodename” to cluster “clustername”. This operation returned because the timeout period expired.

First of all let me give you some details of the setup:

- Windows Server 2008 SP2 x64 Geospan Failover Cluster
- Node + Disk majority quorum model
- EMC Symmetrix storage
- Powerpath 5.3 SP1
- EMC Cluster Extender 3.1.0.20
- Mpio.sys 6.0:6002.18005 / Storport.sys 6.0:6002.22128 / Qlogic QL2300 HBA with v 9.1:8.25
- Broadcom NetXtreme II NICs v. 4.6:55.0

We initially saw some Physical Disk related errors/warnings in the validation tests:

- SCSI page 83h VPD descriptors for the same cluster disk 0 from different nodes do not match
- Successfully put PR reserve on cluster disk 0 from node “nodename” while it should have failed
- Cluster Disk 0 does not support Persistent Reservation
- Cluster Disk 1 does not support Persistent Reservation
- Failed to access cluster disk 0, or disk access latency of 0 ms from node “nodename” is more than the acceptable limit of 3000 ms status 31

The following was also noticed in the cluster log file:

00000f94.00001690::10:21:48.502 CprepDiskFind: found disk with signature 0xa34c96dc
00000f94.00001690::10:21:48.504 CprepDiskPRUnRegister: Failed to unregister PR key, status 170
00000f94.00001690::10:21:48.504 CprepDiskPRUnRegister: Exit CprepDiskPRUnRegister: hr 0x800700aa

As described in the “Microsoft Support Policy for Windows Server 2008 Failover Clusters”, this behavior can be ignored for this particular (geographically dispersed) cluster due to the data replication model in use.

"Geographically dispersed clusters - Failover Cluster solutions that do not have a common shared disk and instead use data replication between nodes may not pass the Cluster Validation storage tests. This is a common configuration in cluster solutions where nodes are stretched across geographic regions. Cluster solutions that do not require external shared storage failover from one node to another are not required to pass the Storage tests in order to be a fully supported solution. Please contact the data replication vendor for any issues related to accessing data on failover"

From this point on, what we needed to focus on was a pure connectivity issue between the nodes. As we cross referenced several cluster related log files, we noticed this particular error from the Cluster Server, approximately at the same time the wizard gave up due to timeouts:

000012f8.00000758::2010/04/09-13:15:44.518 INFO [NETFT] Disabling IP autoconfiguration on the NetFT adapter.
000012f8.00000758::2010/04/09-13:15:44.518 INFO [NETFT] Disabling DHCP on the NetFT adapter.
000012f8.00000758::2010/04/09-13:15:44.518 WARN [NETFT] Caught exception trying to disable DHCP and autoconfiguration for the NetFT adapter. This may prevent this node from participating in a cluster if IPv6 is disabled.
000012f8.00000758::2010/04/09-13:15:44.518 WARN [NETFT] Failed to disable DHCP on the NetFT adapter (ethernet_7), error 1722.
[…]
00001460.00001038::2010/04/09-13:16:44.987 ERR [CS] Service OnStart Failed, WSAEADDRINUSE(10048)' because of '::bind(handle, localEP, localEP.AddressLength )'

In addition, we caught this warning Event ID 1555 from Failover Clustering in the system event log of the node:

A good description of this event can be found on TechNet:

Event ID 1555 – Cluster Network Connectivity
http://technet.microsoft.com/en-us/library/cc773407(WS.10).aspx

A failover cluster requires network connectivity among nodes and between clients and nodes. Problems with a network adapter or other network device (either physical problems or configuration problems) can interfere with connectivity. Attempting to use IPv4 for '%1' network adapter failed. This was due to a failure to disable IPv4 auto-configuration and DHCP. IPv6 will be used if enabled; else this node may not be able to participate in a failover cluster.

The following troubleshooting steps were implemented, settings were checked but unfortunately the behavior did not improve:

· IPV6 was un-checked as a protocol -> re-enabled it
· Disable Teredo as per KB969256 -> doesn’t apply to SP2
· Disable Application Layer Gateway service as per KB943710 –> done
· Stop / Disable service & uninstall Sophos Antivirus software from both nodes –> done
· Virtual MAC of the NetFT adapter was different on both nodes (they are identical when the nodes are sysprepped after installing the Failover Cluster feature)
· Disabled all physical NICs except one on both nodes & configured it as “allow cluster to use this network” as well as “allow clients to connect over this network”
· Disabled TCP Chimney, RSS and NetDMA manually via netsh as per KB951037

netsh int tcp set global RSS=Disabled
netsh int tcp set global chimney=Disabled
netsh int tcp set global autotuninglevel=Disabled
netsh int tcp set global congestionprovider=None
netsh int tcp set global ecncapatibility=Disabled
netsh int ip set global taskoffload=disabled
netsh int tcp set global timestamps=Disabled
[Dword] EnableTCPA=0 in “HKLM\SYSTEM\CCS\Services\Tcpip\Parameters\”

· Rebooted several times in the process and even disabled the HBAs in Device Manager to completely cut off from the storage.

At this point we decided to bump the cluster debug log level to 5, reproduce the problem and hope we get more details than with default logging:

· Stopped the cluster service
· Rename the “%SystemRoot%\Cluster\reports” directory to “reports_old”
· Created a new reports directory
· Started back the cluster service
· Enabled log level 5 by cluster . /prop clusterloglevel=5
· Added a node by cluster . /add /node:”nodename”
· Generate the cluster log with cluster log /g after add node timed out.

What we saw was that the counter went up to 100% and remained stuck at this last phase, which was somewhat expected…important was to catch the timeout in more detailed logs:

“Waiting for notification that node “nodename” is a fully functional member of the cluster”
“This phase has failed for cluster object “nodename” with an error status of 1460 (timeout)".

ERR [IM] Unable to find adapter[….] DBG [HM] Connection attempt to node failed with WSAEADDRNOTAVAIL(10049): Failed to connect to remote endpoint

This information didn’t bring any groundbreaking clues to the case, so we decided to sit back for a minute, recap everything we did and knew so far and try to find the “missing link”:

· The customer had other Windows Server 2008 x64 SP2 clusters in production with no issues
· They used storage from the same IPV6 is enabled by default on every adapter in Windows Server 2008 but the customer decided to “unclick” it because they didn’t really have the infrastructure ready for it
· IPv4 IPs were static on both nodes, gateway and DNS servers manually assigned
· Everything looked fine and yet…the NetFT adapter seemed to have a problem.

The fact that they used static configuration coupled with the tendency to disable features that are not implemented or needed, led us to check the DHCP Client service….well, it was actually stopped and disabled! We also took a look at the TCP/IP parameters in the registry and noticed that IPv6 was also (globally) disabled.

We used the information in KB929852, removed the DisabledComponents in HKLM\SYSTEM\CCS\Services\Tcpip\Parameters\and rebooted the servers. Previously we manually started the DHCP Client service as well as changed the start type to automatic and as soon as the nodes were up and running, we initiated another node join and the other node joined successfully in less than 10 seconds!

The customer was thrilled to have his cluster ready in time for production go-live and we were happy to have played the decisive role in reaching the deadline.

As always feel free to comment/rate this article if you think this information was helpful to you as well.

Bogdan Palos
- Technical Lead / Enterprise Platforms Support (Core)

Windows deployment - WSUS installation explained

EMEA GTSC Platforms RO — Tue, 27 Apr 2010 14:26:35 GMT

After 3 years working in the deployment industry I still see customers hitting some basic roadblocks when using WSUS. For this very reason I decided to write one or more articles that would cover:

1. The installation of WSUS
2. The options explained
3. Windowsupdate.log troubleshooting

Let’s start with the Installation of WSUS:

1. These are the Pre-Requirements for WSUS:

· Microsoft Management Console 3.0
· Microsoft Report Viewer Redistributable 2008
· Internet Information Services (IIS) 6.0 or later versions

Under the following list you can find the full List:
http://www.microsoft.com/downloads/details.aspx?familyid=ba94a0d3-f22a-4e24-877e-6be6ce5da6d7&displaylang=en#filelist

2. Download WSUS 3.0 SP2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=a206ae20-2695-436c-9578-3403a7d46e40&displaylang=en#filelist

3. Next we start the setup. I will only go through the relevant screens with you:

- The above screen shows you the location of the Database. This DB contains Information, Metadata, and History of all the synced updates. This DB can be part of either the WID (Windows Internal Database) which comes bundled with WSUS or it can be installed under at least SQL 2005 SP3. If you have a remote SQL Server you could also use this to host your Database.

For this article I will use the WID.

- I will install the server on port 8530. The default port is 80, but in certain scenarios this might be already in use if the server is not a dedicated WSUS Server.

After WSUS finishes the installation it will present you with a screen to setup the initial sync and options.

Next we will look at most of the options available to us:

The first radio box will turn this server into an USS (Upstream Server). This means all the updates are being synced down and downloaded from Microsoft Update. The underlying servers can be of 2 types: DSS and DSS Replica. The difference between the 2 can be viewed as following:

DSS:

- Receives it’s updates from an USS using either the WAN or LAN
- Updates are approved manually
- Basically a DSS is the same as an USS. The difference is the location from which they download their updates.

Replica:

- Receives it’s updates from an USS using either the WAN or LAN
- Updates/approvals and some settings are synced down from its master server.

You can change the role of a WSUS Server without reinstalling!

The options explained:

1. Update Source and Proxy Server

Here you can configure the role of the server as well as the proxy server should one be used

2. Products and Classifications

Under this option you specify which updates will be distributed by WSUS. The more updates you distribute the longer a detection will take on any given client take. This can represent problems for single core CPUs, and you may see 100% loads on svchost.exe during the detection.

The 2 main update groups that can cause this issue are:

a. Office 2003 Updates
b. Driver Updates

Should you need to distribute any of these, be sure to DECLINE the updates that have been superseeded or the ones that have expired, as the declined updates are ignored during a detection. The ones with NO STATUS are still checked for applicability.

3. Update Files and Languages

a. Download update Files to this server only when updates are approved

This option means that updates are downloaded ONLY when they are approved. If you notice that your WSUS Content folder is bigger than usual, you might want to check this option.

b. Download Express Installation Files

This options is what you are looking for if you have a slow WAN. The amount of data that a client receives over the wire is much smaller. The tradeoff for this feature is the size of the actual files that are being downloaded onto the USS (x2.5 times more data)

What actually happens is: During a detection the file that is supposed to be replaced with a newer version is analyzed and instead of the entire file being exchanged, only the delta is pulled from the USS which makes the load on the network considerable smaller.

The other options on the screenshot are straight forward.

4. Synchronization Schedule

This is used for planning automatic synchronizations of the Server

5. Automatic Approvals

Here you can setup automatic approvals and other conditions for different updates that might be critical for you environment. One example are the Forefront Definition Updates.

The default settings in the Advanced TAB have all the boxes checked.

6. Computers

A feature that most of my customers were not aware of is:

- Client Side Targeting
- Server Side Targeting

When new computers check into WSUS you can either move them manually into groups or you can have them automatically move themselves into a predestinated group. In big corporations with lots of clients this is the desired method. A group Policy is defined that tells a client to move into group x once they have synced with WSUS. The trick behind this is to also tell the WSUS Server which kind of targeting he should use. For this you need to set the option below:

7. Server Cleanup Wizard

The wizard should be run at least once per month in order to get rid of all the expired and superseded updates. If the server is under big load you might experience timeouts during this procedure.

Below I attached link to scripts that perform the same action. This is for companies which want to automate the cleanup process:

Normal Script with switches:
http://wsus.codeplex.com/releases/view/17612

Powershell Script:
http://www.peetersonline.nl/index.php/powershell/wsus-cleanup-with-powershell/

8. Reporting Rollup

Lets you view the status of computers that belong to a replica server on the USS.

9. E-mail Notifications

This option lets you setup to be notified of different events happening on the server.

I hope this article made some things clearer. If you have any questions, feel free to ask.

Tudor Dimboianu
- Support Engineer / Enterprise Platforms Support (Core)

Services.exe terminated unexpectedly (Ops Mgr 2007)

EMEA GTSC Platforms RO — Wed, 07 Apr 2010 15:01:34 GMT

A system running OpsMgr might run in a restart loop, caused by services.exe crashes. In this case, you might see the following error message being displayed:

· C:\windows\System32\services.exe terminated unexpectedly with status code -1073741819. The system will now shutdown and restart.

As a workaround, you can pause the shutdown process by executing the following command in a Command Prompt: "shutdown /a"
The problem appears because the reg path pointing to the event-log is not correct or complete:

· HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Operations Manager\File

To resolve this issue, configure the registry entry to point to a complete and correct path as described in KB970219

OpsMgr 2007: Backup programs may fail to backup the event log when the 64-bit agent is installed
http://support.microsoft.com/kb/970219

Important: please make sure to perform a backup of the registry before modifying this, as described in KB322756

How to back up and restore the registry in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;322756

In the described situation, you might find the following trap in services.exe:

00000000`0620eae8 00000000`77ef3202 ntdll!ZwRaiseException+0xa
00000000`0620eaf0 000007ff`7fc51dbb ntdll!KiUserExceptionDispatcher+0x52
00000000`0620f090 000007ff`7c3e296c msvcrt!wcsicmp+0x8b
00000000`0620f0c0 000007ff`7c3e2efb eventlog!ElfpOpenELW+0x16d
00000000`0620f150 000007ff`7fd69a75 eventlog!ElfrRegisterEventSourceW+0x2b
00000000`0620f1a0 000007ff`7fe96cc9 rpcrt4!Invoke+0x65
00000000`0620f210 000007ff`7fe9758d rpcrt4!NdrStubCall2+0x54d
00000000`0620f7d0 000007ff`7fd697b4 rpcrt4!NdrServerCall2+0x1d
00000000`0620f800 000007ff`7fd6990d rpcrt4!DispatchToStubInCNoAvrf+0x14
00000000`0620f830 000007ff`7fd69766 rpcrt4!RPC_INTERFACE::DispatchToStubWorker+0x50d
00000000`0620f9a0 000007ff`7fd6b214 rpcrt4!RPC_INTERFACE::DispatchToStub+0x2ec
00000000`0620fa20 000007ff`7fd6b9e3 rpcrt4!LRPC_SCALL::DealWithRequestMessage+0x63b
00000000`0620fae0 000007ff`7fd7007c rpcrt4!LRPC_ADDRESS::DealWithLRPCRequest+0x3bf
00000000`0620fba0 000007ff`7fd45369 rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+0x710
00000000`0620feb0 000007ff`7fd65996 rpcrt4!RecvLotsaCallsWrapper+0x9
00000000`0620fee0 000007ff`7fd65d51 rpcrt4!BaseCachedThreadRoutine+0xde
00000000`0620ff50 00000000`77d6b6da rpcrt4!ThreadStartRoutine+0x21
00000000`0620ff80 00000000`00000000 kernel32!BaseThreadStart+0x3a

Oni Sandru
- Support Engineer / Enterprise Platforms Support (Core)

System State backup nu functioneaza – CAPI2 Event ID 513

EMEA GTSC Platforms RO — Fri, 29 Jan 2010 16:33:41 GMT

Astazi va prezentam un caz mai rar intalnit, dar foarte interesant!

- Windows Server 2008 SSB (System State Backup) nu poate fi efectuat cu success
- Comanda ‘vssadmin list writers’ nu listeaza system writer
- In Application Eventlog observam ca este logata eroarea CAPI2 de fiecare data cand o operatiune de backup este incercata
- Daca executam ‘vssadmin list writers’ intr-un CMD, eroarea CAPI2 este logata din nou.

Log Name:      Application
Source:        Microsoft-Windows-Backup
Date:          1/19/2009 9:22:40 AM
Event ID:      517
Task Category: None
Level:         Error
Keywords:
User:          SYSTEM
Computer:      example.ro
Description:
Backup started at '1/19/2009 7:22:20 AM' failed with following error code '2155348226' (System writer is not found in the backup.). Please rerun backup once issue is resolved.

Log Name:      Application
Source:        Microsoft-Windows-CAPI2
Date:          1/19/2009 9:22:39 AM
Event ID:      513
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      example.ro
Description:
Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
Details:
AddCoreCsiFiles : BeginFileEnumeration() failed.

Informatii aditionale

Intr-un Procmon trace se poate observa un access denied la accesul pe C:\Windows\winsxs\FileMaps

6:00:00.4414783 PM          svchost.exe         1100      IRP_MJ_CREATE    C:\Windows\winsxs\FileMaps           SUCCESS           Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened
6:00:00.4416639 PM          svchost.exe         1100      IRP_MJ_DIRECTORY_CONTROL         C:\Windows\winsxs\FileMaps           SUCCESS            Type: QueryDirectory, 1: .
6:00:00.4417860 PM          svchost.exe         1100      IRP_MJ_DIRECTORY_CONTROL         C:\Windows\winsxs\FileMaps           SUCCESS            Type: QueryDirectory, 1: ..
6:00:00.4418619 PM          svchost.exe         1100      IRP_MJ_DIRECTORY_CONTROL         C:\Windows\winsxs\FileMaps           SUCCESS            Type: QueryDirectory, 1: $$.cdf-ms
>> 6:00:00.4421635 PM          svchost.exe         1100      IRP_MJ_CREATE    C:\Windows\winsxs\FileMaps\$$.cdf-ms         ACCESS DENIED            Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a
-> svchost.exe (PID 1100) este procesul care gazduieste serviciul ’Cryptographic Service‘ si executa in contextul Network Service-ului; Network Service nu are acces èCAPI2 (eroare de service de criptografie) este logat
6:00:00.4423713 PM          svchost.exe         1100      IRP_MJ_CLEANUP C:\Windows\winsxs\FileMaps           SUCCESS
6:00:00.4424520 PM          svchost.exe         1100      IRP_MJ_CLOSE     C:\Windows\winsxs\FileMaps           SUCCESS
6:00:00.4427127 PM          svchost.exe         1100      Thread Create                  SUCCESS            Thread ID: 6112
6:00:00.4447237 PM          svchost.exe         212        RegOpenKey        HKLM     SUCCESS            Desired Access: Maximum Allowed, Granted Access: Read
6:00:00.4448050 PM          svchost.exe         212        RegOpenKey            HKLM\SYSTEM\CurrentControlSet\Services\eventlog\Application\Microsoft-Windows-CAPI2      REPARSE Desired Access: Query Value
6:00:00.4448784 PM          svchost.exe         212        RegOpenKey            HKLM\System\CurrentControlSet\Services\eventlog\Application\Microsoft-Windows-CAPI2      SUCCESS            Desired Access: Query Value
6:00:00.4449652 PM          svchost.exe         212        RegCloseKey        HKLM     SUCCESS
6:00:00.4454629 PM          lsass.exe 584        RegOpenKey        HKLM\SECURITY\Policy       SUCCESS            Desired Access: Read/Write
6:00:00.4455197 PM          svchost.exe         212        RegQueryValue            HKLM\System\CurrentControlSet\Services\EventLog\Application\Microsoft-Windows-CAPI2\ProviderGuid            SUCCESS            Type: REG_SZ, Length: 78, Data: {5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}
6:00:00.4455348 PM          lsass.exe 584        RegOpenKey        HKLM\SECURITY\Policy\SecDesc       SUCCESS            Desired Access: Read
6:00:00.4456024 PM          lsass.exe 584        RegQueryValue     HKLM\SECURITY\Policy\SecDesc\(Default)      BUFFER OVERFLOW            Length: 12
6:00:00.4456184 PM          svchost.exe         212        RegOpenKey        HKLM     SUCCESS            Desired Access: Maximum Allowed, Granted Access: Read
6:00:00.4456615 PM          lsass.exe 584        RegCloseKey        HKLM\SECURITY\Policy\SecDesc       SUCCESS
6:00:00.4456896 PM          svchost.exe         212        RegOpenKey            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}        SUCCESS            Desired Access: Read

Intr-un IDNA trace pe serviciul de criptografie se observa ca la incercarea de citire a System writerului se acceseaza FileMaps, iar ‘vssadmin list writers’ sau Backup propriu-zis, esueaza cu Access Denied:

0210ea80 73d36efb sfc_os!CFilemapEnumerationLookupContext::OpenRelativeFile+0x49
0210eab0 73d372f2 sfc_os!CCiFileMapEnumContext::MoveToNextFileMapFile+0xa4
0210eae8 73d3699c sfc_os!BeginFileMapEnumerationInternal+0xae
0210eaf8 732916f3 sfc_os!BeginFileMapEnumeration+0x2b
0210eb4c 73293224 cryptsvc!CSystemWriter::AddCoreCsiFiles+0xf5
0210eb70 73293350 cryptsvc!CSystemWriter::AddCoreFiles+0x33
0210eb88 74fc5f45 cryptsvc!CSystemWriter::OnIdentify+0x7e
0210ebc8 74fce400 vssapi!CVssWriterImpl::OnIdentifyGuard+0x24
0210ecfc 74fd32cb vssapi!CVssWriterImpl::RequestWriterInfoInternal+0x8ff
0210ed44 76d631eb vssapi!CVssWriterImpl::RequestWriterInfo+0x3a
0210ed6c 76dd184f rpcrt4!Invoke+0x2a
0210f198 76dd2006 rpcrt4!NdrStubCall2+0x27b
0210f1e8 76a427f7 rpcrt4!CStdStubBuffer_Invoke+0xa0
0210f20c 77479759 oleaut32!CUnivStubWrapper::Invoke+0xc7
0210f254 774796f3 ole32!SyncStubInvoke+0x3c
0210f2a0 77399d67 ole32!StubInvoke+0xb9
0210f37c 77399c5c ole32!CCtxComChnl::ContextInvoke+0xfa
0210f398 774787a4 ole32!MTAInvoke+0x1a
0210f3c8 77479498 ole32!AppInvoke+0xaa
0210f4a4 77478780 ole32!ComInvokeWithLockAndIPID+0x32c

Solutie

Permisiunile pe FileMaps au fost corupte intr-un fel sau altul…pentru a le reseta, cea mai simpla varianta ar fi fortarea inherit-ului:

takeown /f %windir%\winsxs\filemaps\* /a
icacls %windir%\winsxs\filemaps\* /inheritance:e

Oni Sandru
- Support Engineer / Enterprise Platforms Support (Core)

Top 3 Issues when deploying a KMS infrastructure

EMEA GTSC Platforms RO — Mon, 25 Jan 2010 15:59:04 GMT

Windows 7 and Windows Server 2008 R2 activation in a Corporate network / Top 3 of the most common issues of Deploying a KMS infrastructure

1. 0xc004C008

Q: KMS Client Keys? What are those? We only received a KMS Host Key and installed this Key on all our machines.

We now receive the error code 0xc004C008 when trying to install the KMS Host Key on more machines:

A: As a first step you have to understand that we have 2 Types of KMS Keys: KMS Host Keys and KMS Client Keys. The KMS Host Key should be installed only on the Server designated to be the KMS Host and the KMS Client Keys are used for all the other machines in your network.

You receive the KMS Host Key through http://www.microsoft.com/licensing/ .

All the other machines from your network should not need a KMS Client Key specified manually since these are already “baked in” into the VL Image.

The most frequent case when you need to re-enter the KMS Client Key is when you used a MAK Key to activate the machine and you now need to switch to a KMS-Based activation.

You can find a list with the keys below:

For Windows Vista and Windows Server 2008 you can find the list with the KMS Client Keys at:
http://technet.microsoft.com/en-us/library/cc303280.aspx

For Windows 7 and Windows Server 2008 R2 you can find the list with the KMS Client Keys at:
http://technet.microsoft.com/en-us/library/dd772269.aspx

You then receive the error message 0xc004C008 because the KMS Host Key has been installed on more than 6 different HW Machines and the Key has been “blocked”.

Solution:

You have to unblock the Key to be able to use it again. You can find more info on how to do that at:
http://download.microsoft.com/download/6/9/5/695ba00d-c790-4c90-813a-f10539d97991/Volume_Activation_2.0_MAK_KMS_Key.doc

2. 0xC004F074

Q: We now have Windows 7 and Windows Server 2008 R2 machines but when we try to activate these with the existent KMS Host we get following error message: 0xC004F074

A: It’s very likely that there still is a Windows Server 2008 KMS Host Key installed on the KMS Host which cannot activate Windows 7 and Windows Server 2008 R2 machines.

If you don’t have a Windows Server 2008 R2 KMS Host Key yet, you have to request one through the Volume License Center to be able to activate Windows 7 and Windows Server 2008 R2 machines.

Solution:

Step 1:

-If the KMS Host is installed on a Windows Server 2003 SP2 machine you have to install the following update:
http://support.microsoft.com/kb/968915 and restart the Server.

- If the KMS Host is installed on a Windows Server 2008 SP2 machine you have to install the following update:
http://support.microsoft.com/kb/968912 and restart the Server.

-In case the KMS Host is on a Windows Server 2008 R2 machine you don’t need to install any additional updates.

Step 2:

You have to install the new KMS Host Key. You have to run the following commands:

1. slmgr -upk (uninstalls the old key)

2. slmgr -ipk < KMS Host Key>

3. slmgr -ato (activates the key)

Now the Windows 7 and Windows Server 2008 R2 KMS Clients should be able to activate successfully with the KMS Host.
If the same Error Code 0xC004F074 persists you will have to restart the Software Licensing Service:

1. Net Stop slsvc

2. Net Start slsvc

3. 0xC004F050

Q: We installed KMS 1.2 on our KMS Host to be able to install our new Windows Server 2008 R2 KMS Host Key but when executing “slmgr –ipk <KMS Host Key>” we still receive the error code 0xC004F050 and the new key is not installed.

Please verify that the Server has been restarted after the installation of the KMS Update.
If the Error persists then you need to restart the Software Licensing Service and then try again to install the new KMS Host key.

The commands are:

1. Net Stop slsvc

2. Net Start slsvc

3. slmgr -ipk <KMS Host key>

Stefan Chivu
- Support Engineer / Enterprise Platforms Support (Core)

Hotfix-uri actuale pentru DFS-N si DFS-R

EMEA GTSC Platforms RO — Mon, 18 Jan 2010 16:10:03 GMT

In echipa de Active Directory tratam, printre altele, si replicarea DFS. In aceasta privința recomandam tuturor clienților sa instaleze ultimele hotfixuri pentru DFS-R, daca folosesc aceasta funcționalitate. In acest articol voi lista cele mai importante hotfixuri.

Deoarece aceste hotfixuri rezolva probleme care ar putea apărea intr-un mediu DFS-R, este recomandat sa fie instalate pe toate serverele de DFS-R. Niveluri diferite de hotfixuri nu sunt recomandate in general, nu doar in legatura cu DFS-R-ul. Daca serverele au hotfixuri diferite instalate pot apărea probleme care sunt greu de urmărit si depistat. De aici recomandarea de a instala toate fixurile pe toate sistemele DFS-R.

Deoarece majoritatea clienților folosesc DFS-R-ul in legătura cu DFS-N-ul, sunt listate si actualele hotfixuri pentru DFS-N. Suplimentar sunt listate si fixuri care sunt relevante atât pentru DFS-R cat si pentru DFS-N (de exemplu RPC-Hotfixes, SNP etc.). Lista poate sa nu fie completă, și are ca scop enumerarea celor mai importante hotfixuri.

O sa încercam sa ținem acest articol up-to-date, așa încât sa puteți afla daca au apărut noi fixuri printr-o simpla verificare a acestuia.

In mod normal fixurile pentru un service pack anterior sunt conținute în service pack-ul actual sau viitor, deci de exemplu fixurile post Windows Server 2003 SP1 sunt integrate in Windows Server 2003 SP2. Pentru Vista si Windows Server 2008 aceste limitări nu sunt valabile așa încât sunt listate (in cazul in care exista) atât fixuri RTM cat si fixuri SP1.

Deoarece unele hotfixuri pentru Windows XP si Windows server 2003 sau Vista / Windows Server 2008 se suprapun, nu s-a făcut o împărțire după versiunea service pack-ului. Este de ajuns sa aruncați o privire in articol pentru a afla daca hotfixul respectiv este necesar pentru sistemul de operare in cauza.

DFS-N:

925066 In a domain environment, Windows Explorer may stop responding on a client computer that is running Windows XP or Windows Server 2003, and CPU usage is very high on the primary domain controller
http://support.microsoft.com/default.aspx?scid=kb;EN-US;925066

941133 The Properties dialog box of a DFS share takes several minutes to appear on a Windows XP-based client computer
http://support.microsoft.com/default.aspx?scid=kb;EN-US;941133

903651 You cannot create more than one domain-based DFS namespace on a computer that is running Windows Server 2003, Standard Edition
http://support.microsoft.com/default.aspx?scid=kb;EN-US;903651

898900 An update is available to support the DFS Namespaces Client failback feature on Windows Server 2003 SP1-based computers and on Windows XP SP2-based computers
http://support.microsoft.com/default.aspx?scid=kb;EN-US;898900

936469 When you use DFS together with the Volume Shadow Copy Service (VSS) in Windows Vista, VSS does not show whether the DFS path is the same as the physical path
http://support.microsoft.com/default.aspx?scid=kb;EN-US;936469

938666 Event ID 2019 is logged in the System log when a DFS domain root server stops responding on a Windows Server 2003-based server
http://support.microsoft.com/default.aspx?scid=kb;EN-US;938666

917417 The DFS root server cannot do the site costing correctly and local DFS client computers are referred to remote DFS share location after you install Windows Server 2003 Service Pack 1 on the domain controller
http://support.microsoft.com/default.aspx?scid=kb;EN-US;917417

944505 DFS clients may access the DFS root server in the remote site even though the DFS root server in the local site is available in a Windows Server 2003-based domain
http://support.microsoft.com/default.aspx?scid=kb;EN-US;944505

812680 DFS Manager Does Not Show DFS Roots
http://support.microsoft.com/default.aspx?scid=kb;EN-US;812680

932982 You cannot use the DFS Management snap-in to create a DFS folder in Windows Server 2003 R2 if the folder path contains a dot (.) character
http://support.microsoft.com/default.aspx?scid=kb;EN-US;932982

945050 The private bytes that the DFS service consumes continue to increase on a Windows Server 2003-based domain controller that hosts the PDC emulator role
http://support.microsoft.com/default.aspx?scid=kb;EN-US;945050

913835 The Windows Server 2003 redirector component limits the number of files that can be open at the same time to 16,383, even when multiple connections are pooled in DFS
http://support.microsoft.com/default.aspx?scid=kb;EN-US;913835

945435 You experience a long delay when you try to access files on a WebDAV site for the first time on a Windows Vista-based computer or access Office files
http://support.microsoft.com/default.aspx?scid=kb;EN-US;945435

945222 On a Windows XP Service Pack 2-based computer, you cannot access the correct DFS share after information about the link target is updated
http://support.microsoft.com/default.aspx?scid=kb;EN-US;945222

937357 Error message after you try to access a mapped network drive when you work offline on a Windows XP-based computer: "Drive_Letter:\ is not accessible"
http://support.microsoft.com/default.aspx?scid=kb;EN-US;937357

935741 The DFS service and the Lsass.exe process appear to jointly consume more than 80 percent of system resources on a Windows Server 2003-based domain controller
http://support.microsoft.com/default.aspx?scid=kb;EN-US;935741

954037 Error message when you try to copy a file to a DFS shared folder from a Windows Vista-based computer or from a Windows Server 2008-based computer: "The selected files could not be copied There is not enough free space on the device"
http://support.microsoft.com/default.aspx?scid=kb;EN-US;954037

953537 The contents of a DFS share do not appear if you access the share by using a shortcut to the DFS link from a Windows Vista-based computer or from a Windows Server 2008-based client computer
http://support.microsoft.com/default.aspx?scid=kb;EN-US;953537

DFS-R:

912850 FIX: You cannot access performance counters in the Distributed File System (DFS) Replication health report on a computer that is running Windows Server 2003 R2
http://support.microsoft.com/default.aspx?scid=kb;EN-US;912850

920335 You cannot create a replication group for data collection when the root of a drive is selected as the source on a Windows Server 2003 R2-based computer
http://support.microsoft.com/default.aspx?scid=kb;EN-US;920335

931685 Replicated files are copied over the network when you use the Distributed File System (DFS) Replication feature on a Windows Server 2003 R2-based computer
http://support.microsoft.com/default.aspx?scid=kb;EN-US;931685

919633 You may receive an error message when you try to run the DFS Management snap-in on a Windows Server 2003 R2-based computer
http://support.microsoft.com/default.aspx?scid=kb;EN-US;919633

912154 You cannot create a diagnostic report for DFS replication on a Microsoft Windows Server 2003 R2-based computer during the month of December
http://support.microsoft.com/default.aspx?scid=kb;EN-US;912154

După Windows Server 2003 SP2 sunt recomandate următoarele hotfixuri marcate cu roșu. Deoarece cea mai noua versiune DFSR.EXE este inclusa in hotfixul KB958876, nu trebuie, de exemplu, instalat hotfixul KB943661 neapărat. De aceea nu este scos in evidenta in mod deosebit.

933061 An update is available that improves the stability of the Windows Management Instrumentation repository in Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;EN-US;933061

944804 Distributed File System Replication in Windows Server 2003 R2 performs unnecessary replication when an antivirus application is installed
http://support.microsoft.com/default.aspx?scid=kb;EN-US;944804

943661 Replication may fail after a "dirty" system shutdown on a Windows Server 2003 R2-based computer that has DFSR installed
http://support.microsoft.com/default.aspx?scid=kb;EN-US;943661

948833 Distributed File System Replication may not replicate a folder on a Windows Server 2003 R2-based computer if the folder was previously a member of a replication group that was removed
http://support.microsoft.com/default.aspx?scid=kb;EN-US;948833

958876 When you try to update a file that has a newer version on a Windows Server 2003 R2-based DFSR server, the operation fails, the original file is deleted from the replication partners, and event 4412 and event 4502 are logged
http://support.microsoft.com/kb/958876/en-us

962969 Error message when you run Dfsradmin.exe to set membership properties in Windows Server 2008: "The property MemberSubscriptionReadOnly cannot be used"
http://support.microsoft.com/default.aspx?scid=kb;EN-US;962969

967357 Some files are missing on a Windows Server 2003 R2-based computer after a DFSR replication
http://support.microsoft.com/default.aspx?scid=kb;EN-US;967357

956123 Files that are copied into replicated file shares may not be replicated for an unexpectedly long time when antivirus software is installed on the originating server
http://support.microsoft.com/default.aspx?scid=kb;EN-US;956123

Hotfixuri adiacente recomandate:

908521 Office Outlook 2003 may stop responding on a computer that is running Windows Server 2003 or Windows XP because of a problem in the RPC engine
http://support.microsoft.com/default.aspx?scid=kb;EN-US;908521

917953 MS06-032: Vulnerability in TCP/IP could allow remote code execution
http://support.microsoft.com/default.aspx?scid=kb;EN-US;917953

948496 An update to turn off default SNP features is available for Windows Server 2003-based and Small Business Server 2003-based computers
http://support.microsoft.com/default.aspx?scid=kb;EN-US;948496

905700 You may receive an "RPC server is too busy to complete this operation" error message when you try to log on to a computer that is running Windows Server 2003 with Service Pack 1
http://support.microsoft.com/default.aspx?scid=kb;EN-US;905700

928569 FIX: The first CLR thread pool worker thread is never initialized for COM+ in an ASP.NET Web application that is configured to run under the .NET Framework 2.0
http://support.microsoft.com/default.aspx?scid=kb;EN-US;928569

938751 On a Windows Server 2003-based computer, an application experiences an access violation, and then it exits unexpectedly
http://support.microsoft.com/default.aspx?scid=kb;EN-US;938751

922972 You may experience poor performance when you use a program that transmits small data packets on a computer that is running Windows Server 2003 with Service Pack 1 or Windows Server 2003 with Service Pack 2
http://support.microsoft.com/default.aspx?scid=kb;EN-US;922972

913034 The Chkdsk.exe utility incorrectly identifies and resets security descriptors in Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;EN-US;913034

Nu sunt hotfixuri dar totuși relevante pentru unele medii:

244380 How to configure DFS to use fully qualified domain names in referrals
http://support.microsoft.com/default.aspx?scid=kb;EN-US;244380

302934 Disabling the "Make Available Offline" Functionality for DFS Shares
http://support.microsoft.com/default.aspx?scid=kb;EN-US;302934

947726 How to use the Backup program to prestage data before DSFR synchronization in Windows Server 2003 R2
http://support.microsoft.com/default.aspx?scid=kb;EN-US;947726

951010 The ConflictAndDeleted folder size may exceed its configured limitation in Windows Server 2003
http://support.microsoft.com/kb/951010/en-us

Sebastian Ticusan
- Support Engineer / Enterprise Platforms Support (AD)

Probleme de conectivitate si Clustere Microsoft , EventID 1122/1123

EMEA GTSC Platforms RO — Fri, 20 Mar 2009 15:23:00 GMT

Ne-am confruntat de-a lungul timpului cu un numar mare de cazuri legate de pierderea conectivitatii intr-un cluster.
Acest efect se poate observa in System Event Log prin aparitia urmatoarelor event-uri:

Event ID: 1123
Source: ClusSvc
Description:
The node lost communication with cluster node ComputerName on network 'Public Network'.

Event ID: 1122
Source: ClusSvc
Description:
The node (re)established communication with cluster node ComputerName on network 'Public Network'.

Acest articol prezinta un overview al acestor event-uri pe Windows Server 2000/2003:

Overview of event ID 1123 and event ID 1122 logging in Windows 2000-based and Windows Server 2003-based server clusters
http://support.microsoft.com/kb/892422/en-us

In afara de pasii si sugestiile prezentate in articolul de mai sus, as vrea sa mai adaug urmatoarele:

* Verificati setarile “spanning tree and trunking” pe switch-uri si deactivati-le

* Activati functia “Fast detect” pe switch-uri.

* Setati manual viteza si duplex-ul retelei de heartbeat, cit si pe switch-uri (http://support.microsoft.com/kb/258750/en-us)

* Deactivati software-ul de teaming pe reteaua “public” pentru o perioada (http://support.microsoft.com/kb/254101/)
(atentie! teaming pe reteaua Private/Heartbeat nu este o solutie suportata de Microsoft)

* Daca aveti mai mult de 3 noduri in Cluster, deactivati multicast-ul (http://support.microsoft.com/kb/307962)
(cluster CLUSTERNAME /priv MulticastClusterDisabled=1:DWORD)

In cazul in care aveti switch-uri Cisco in environment-ul dvs., puteti consulta articolul de mai jos pentru mai multe detalii specifice:

Using PortFast and Other Commands to Fix Workstation Startup Connectivity Delays
http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a00800b1500.shtml

Bogdan Palos
- Technical Lead / Enterprise Platforms Support (Core)

Aveti probleme cand incercati sa distribuiti programe/aplicatii prin politici?

EMEA GTSC Platforms RO — Thu, 22 Jan 2009 15:38:25 GMT

Salut, astazi vreau sa vorbesc despre un subiect cu care m-am intalnit in unul dintre cazurile mele si m-am gandit ca ar putea fi relevant pentru cititorii nostri. Clientul vroia sa distribue programe/aplicatii prin polictici, asa incat, atunci cand un utilizator se loga la statia lui, instalarea trebuia sa inceapa.

In majoritatea cazurilor nu ar trebui sa intalniti probleme in aplicarea unei astfel de politici daca limba sistemului de operare este aceeasi cu cea a software-ului/aplicatiei care trebuie instalat. Insa cand doriti, de exemplu, sa instalati un program/aplicatie in limba romana pe statii cu sisteme de operare in limba engleza veti constata, ca instalarea softului respectiv nu a fost efectuata la logarea utilizatorului. Aceasta cu toate ca ati bifat casuta “Install this application at logon” (in Group Policy Object Editor sub proprietatiile pachetului .msi –> tab-ul Deployment).

Dacă faceți o verificare ruland comanda “gpresult /z” veți putea observa ca politica respectivă este incadrată la poiticile aplicate cu succes. Acelasi lucru puteti vedea si daca rulati “Resultant Set of Policies” din Group Policy Management Console (GPMC). Daca verificati si in Control Panel puteti vedea aplicatia ca instalata si puteti sa o deinstalati. Cu toate acestea programul nu poate fi gasit in Program Files (locatia default unde ar trebui sa fie instalat).

Aceasta problema este din pacate destul de slab documentata. De fapt nu se poate spune ca este o problema in sine, ci se trage de la o configurare gresita a politicii de distribuire a soft-ului/aplicatiei. In astfel de cazuri (cand programul/aplicatia are alta limba decat sistemul de operare) pentru ca instalarea sa fie parcursa cu succes, trebuie bifata casuta “Ignore language when deploying this package”. Aceasta poate fi gasita sub proprietatile pachetului .msi –> tab-ul Deployment –> Advanced. Si bineinteles nu uitati casuta “Install this application at logon”.

Sebastian Ticusan
- Support Engineer / Enterprise Platforms Support (AD)

Advisory-uri 3rd Party

EMEA GTSC Platforms RO — Wed, 21 Jan 2009 16:18:53 GMT

Acest post va fi actualizat in permanenta cu articole pe care le consideram esentiale pentru clientii nostrii.
Nota: Toate aceste advisory-uri sint externe (3rd party), insa au fost cruciale in rezolvarea unor probleme de performanta si stabilitate pe Windows Server 2003/2008

Non Paged Pool memory leak - CA eTrust Antivirus 7.1 (ino_fltr.sys)
http://supportconnect.ca.com/sc/kb/problemdetail.jsp?docid=415307&productcd=ETRAV&problemnbr=1057

Updating the symevent Files
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/1998092408260848

Endpoint Protection 11 / Symantec Antivirus 10.2
”Windows Server 2008 network shares become unresponsive with Symantec Endpoint Protection 11 or Symantec AntiVirus 10.2 client installed and Auto-Protect enabled”
http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/acb1ac0cabfc43278825746c006bc61a?OpenDocument

Microsoft Cluster Resource Monitor terminates unexpectedly
http://seer.entsupport.symantec.com/docs/295473.htm
(related) http://support.microsoft.com/kb/948701/en-us

Microsoft Cluster Resource Monitor terminates when starting to monitor the SAP Resource
Issue affects only the x64 Windows Server version, not x86 or IA64
Please obtain the patched NTCLUST.SAR patched version (containing saprc.dll and saprcex.dll) from SAP Marketplace, note 1043592

Windows Servers 2003 stop accepting network connections with Symantec Endpoint Protection 11.0 installed
After installing Symantec Endpoint Protection 11.0 on a Windows 2003 server you notice that network shares appear to become inaccessible after some period of time.
You notice cluster File Share Resources failing with Event “Clussvc 1055/1069” and Error code 64 (specified network name is no longer available)
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007102613484948

Bogdan Palos
- Technical Lead / Enterprise Platforms Support (Core)

Best Practices / Documentatie pas cu pas – Windows Server 2008 Failover Clustering

EMEA GTSC Platforms RO — Mon, 19 Jan 2009 16:25:23 GMT

What's New in Failover Clusters in Windows Server 2008
http://technet2.microsoft.com/windowsserver2008/en/library/13c0a922-6097-4f34-ac64-18820094128b1033.mspx

Availability and Scalability
http://technet2.microsoft.com/windowsserver2008/en/servermanager/availabilityandscalability.mspx

Windows Server 2008 Events and Errors Database
http://technet.microsoft.com/en-us/library/cc754424.aspx

Failover Clustering and NLB Team Blog
http://blogs.msdn.com/clustering/

Failover Cluster Step-by-Step Guide: Migrating Cluster Settings from Windows Server 2003 to Windows Server 2008
http://technet2.microsoft.com/windowsserver2008/en/library/6820ae3f-1ecc-43fd-8a76-fe8c2125cfe61033.mspx?mfr=true

Failover Cluster Step-by-Step Guide: Configuring a Two-Node File Server Failover Cluster
http://technet2.microsoft.com/windowsserver2008/en/library/6820ae3f-1ecc-43fd-8a76-fe8c2125cfe61033.mspx?mfr=true

Failover Cluster Step-by-Step Guide: Configuring a Two-Node Print Server Failover Cluster
http://technet2.microsoft.com/windowsserver2008/en/library/6820ae3f-1ecc-43fd-8a76-fe8c2125cfe61033.mspx?mfr=true

Bogdan Palos
- Technical Lead / Enterprise Platforms Support (Core)

Cazul serviciilor care nu mai puteau fi oprite

EMEA GTSC Platforms RO — Thu, 15 Jan 2009 11:31:24 GMT

Va vom prezenta un caz interesant de performanta: Pe un Windows Server 2003 cluster serviciile nu mai puteau fi oprite. De exemplu Automatic Updates, Network connections si Windows Management Instrumentation ramaneau in status-ul de "stopping"

Dupa o discutie cu clientul, am descoperit ca in momentul in care se problema era prezenta, intreaga performanta a server-ului era afectata. Dupa un restart, problema dispare pentru 24 ore. Poate un posibil Memory leak?!

Iata configuratia:

- Windows 2003, Enterprise Edition, EN-US, 5.2.3790 SP2
- Software: MS SQL Server Enterprise Edition, Version 9.00.3228.00, English
- 4 Node Cluster
- 32bit system

Pool Tag: _Total Pool Paged Bytes
Type: Pool_Paged
First/Average/Last/High Values: 48.18 MB / 97.81 MB / 94.48 MB / 116.73 MB

Pool Tag: _Total Pool Non-Paged Bytes
Type: Pool_Non-Paged
First/Average/Last/High Values: 40.31 MB / 51.58 MB / 52.48 MB / 62.41 MB

In Boot.ini nu avem /3gb :

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows Server 2003, Enterprise" /fastdetect /NoExecute=OptOut

Deci Paged/Nonpaged Pool pareau in regula, la fel si perfmon, in afara de cateva discuri care se miscau cam greu. Dead end! Nu astept mult si primesc un mail de la client ca problema se intampla chiar in acel moment. Initializez un remote desktop si puteam observa cum serverul abia se misca. Ce poti face? Task manager:

Acesta instanta de svchost(pid 800) a cam luat-o razna.hmm...Sa vedem ce zice prietenul nostru Process Explorer (a.k.a Super Task Manager!)

La prima vedere totul in regula...pana la sectiunea Handles: 38,693 !!-----> Sub instanta acea de Svchost rulau mai multe servicii. Am hotarat sa facem un user mode dump pe acest PID folosind Adplus.

Comment: 'Full dump in Hang Mode for SVCHOST.EXE_running_on_XXX'

Windows Server 2003 Version 3790 (Service Pack 2) MP (8 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer SingleUserTS
Machine Name: Debug session time: Thu Nov 20 20:02:02.000 2008 (GMT+2)System Uptime: 20 days 23:02:01.609
Process Uptime: 20 days 23:01:44.000

0:000> ~

. 0 Id: 320.324 Suspend: 1 Teb: 7ffdf000 Unfrozen
   1 Id: 320.340 Suspend: 1 Teb: 7ffdc000 Unfrozen
   2 Id: 320.344 Suspend: 1 Teb: 7ffdb000 Unfrozen
   3 Id: 320.350 Suspend: 1 Teb: 7ffd7000 Unfrozen

....

3725 Id: 320.53b4 Suspend: 1 Teb: 7f87e000 Unfrozen
3726 Id: 320.24bc Suspend: 1 Teb: 7f87c000 Unfrozen
3727 Id: 320.4cd0 Suspend: 1 Teb: 7fa22000 Unfrozen
3728 Id: 320.23e4 Suspend: 1 Teb: 7fa00000 Unfrozen

3728 de threaduri....asta da svchost! Majoritatea acestor thread-uri aveau urmatoarea structura, drept urmare in acest user mode dump nu am putut gasi prea multe informatii suplimentare.

24fbf718 77ce252f rpcrt4!NdrProxySendReceive+0x43
24fbfb00 77ce25a6 rpcrt4!NdrClientCall2+0x206
24fbfb20 77c64f87 rpcrt4!ObjectStublessClient+0x8b
24fbfb30 58b75d19 rpcrt4!ObjectStubless+0xf
24fbfb5c 752ef4c2 wmiprvsd!CInterceptor_IWbemProvider::Query+0x53
24fbfbbc 752ef3d1 wbemcore!CWbemNamespace::DynAux_ExecQueryExtendedAsync+0xf1
24fbfc78 752e4896 wbemcore!CQueryEngine::ExecComplexQuery+0x1f4
24fbfd84 752e460b wbemcore!CQueryEngine::ExecQlQuery+0x37
24fbfe28 752efbaf wbemcore!CQueryEngine::ExecQuery+0x2ad
24fbfe6c 752f026b wbemcore!CWbemNamespace::Exec_CreateInstanceEnum+0x107
24fbfeac 752e9750 wbemcore!CAsyncReq_CreateInstanceEnumAsync::Execute+0x32

Am hotarat sa obtinem un full dump al acelei masini, resursele vor face automat failover pe celalalt node (failover cluster,nu?). Acest server avea switch KVM, era remote si fara functionalitate NMI (vezi post-ul despre NMI).

Am decurs la vechiul truc, omoram csrss.exe cu pskill:

pskill \\computer -u username -p passwort PID

Perfect, acum avem un dump complet. Dupa 8 ore de transfer, am putut incepe debugging-ul:

!PROCESS 8ed9e020 SessionId: 0 Cid: 0320 Peb: 7ffdb000 ParentCid: 01a4
DirBase: bff51160 ObjectTable: e1ee2e20 HandleCount: 46853.
Image: svchost.exe

Thread-urile s-au inmultit:

5620 !lp 8ed9e020 0320 01a4 8 3866195 10.718 20.843
4:18:49:33.999* 46853 1620 57896 1437732 478136 svchost.exe

Dupa verificarea catorva thread-uri (alese chiar aleator), se putea observa cum SQL WMI Provider era sursa acestui handle leak.
Discutand cu echipa de SQL, aceasta problema este cunoscuta si a fost prima oara adresata aici:

Cumulative update package 7 for SQL Server 2005 Service Pack 2
http://support.microsoft.com/kb/949095/en-us

In aceeasi seara a fost programat un Change Window si patch-ul a fost instalat pe toate nodurile. Problema nu a mai reaparut, iar dupa 1 luna de monitorizare cazul a putut fi inchis.

Yet another happy customer!

Dan Andrus
- Support Escalation Engineer / Enterprise Platforms Support (Core)

How-To...Cum se poate genera un Crash Dump folosind NMI (Non Maskable Interrupt)

EMEA GTSC Platforms RO — Tue, 13 Jan 2009 15:10:00 GMT

In acest post, va voi arata cum puteti genera un memory dump pe un server HP, folosind functia NMI prin interfata ILO.
Inainte de toate, pe server trebuie modificat registry-ul, exact asa cum este descris in KB927069 (http://support.microsoft.com/kb/927069)

Urmariti acesti pasi pentru modificarea registry-ului si generarea crash dump-ului:

1. Conectati-va la server GUI folosind interfata grafica HP BladeSystem / sau Remote Desktop
2. Accesati Regedit prin Start -> Run -> regedit
3. Navigati la urmatorul subkey: HKLM\SYSTEM\CurrentControlSet\Control\CrashControl
4. Right-click pe CrashControl, selectati "New", apoi selectati "DWORD Value"
5. Introduceti "NMICrashDump", apoi apasati Enter pentru a salva noul entry
6. Right-click "NMICrashDump", apoi selectati "Modify"
7. In "Value" data box, introduceti 1, apoi apsati OK
8. Inchideti Registry Editor, apoi restartati server-ul
9. Folositi browser-ul pentru a va loga la interfata Web Integrated Lights Out (iLO)
10. Selectati "Server and iLO Diagnostics", apoi apasati "Virtual NMI Button" pentru a genera un crash dump.

Pentru o descriere amanuntita a interfetei ILO, accesati document-ul de mai jos:
http://bizsupport.austin.hp.com/bc/docs/support/SupportManual/c00797875/c00797875.pdf

Bogdan Palos
- Technical Lead / Enterprise Platforms Support (Core)

LooksAlive/IsAlive & Pending timeout

EMEA GTSC Platforms RO — Tue, 13 Jan 2009 13:54:00 GMT

The role and behavior of the first two functions (IsAlive & LooksAlive) is related to the type of resource they are serving. A detailed description of these particular roles is here:

Behavior of the LooksAlive and IsAlive functions for the resources that are included in the Windows Server Clustering component of Windows Server 2003

http://support.microsoft.com/kb/914458/en-us

As you can see, the functions perform different actions for a generic service resource, as compared to a file share resource for example. (Remember, a generic service cluster resource is nothing more than a wrapper for a particular service. It basically enables it to be "cluster-aware")

Generic Service resource (ClusRes.DLL)

• LooksAlive - The LooksAlive test for the Generic Service resource queries SCM to see whether the specified service is in a "Running" state.
• IsAlive - The IsAlive test is the same as the LooksAlive test in this context.

Example of using SCM to check a service state:

c:\>sc query spooler

SERVICE_NAME: spooler

TYPE : 110 WIN32_OWN_PROCESS (interactive)

STATE : 4 RUNNING

(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)

WIN32_EXIT_CODE : 0 (0x0)

SERVICE_EXIT_CODE : 0 (0x0)

CHECKPOINT : 0x0

WAIT_HINT : 0x0

File Share resource (ClusRes.DLL)

• LooksAlive - The LooksAlive test for a File Share resource retrieves the properties of the share from the Server service as a basic test that the share exists.
• IsAlive - The IsAlive test for a File Share resource does the same thing as a LooksAlive test. If the MaxUsers property is set to -1 (unlimited), the IsAlive function opens the first file on the share by using the share name. Otherwise, the IsAlive function tests that the directory path that is associated with the share is still valid.

Having seen how LooksAlive/IsAlive act differently depending on the resource type, we now focus on the "Pending timeout" value: all it does is to stop the resource if no response has been passed by the LooksAlive/IsAlive functions within the specified timeout value. It has a default value of 180 seconds and can be changed.

Bogdan Palos
- Technical Lead / Enterprise Platforms Support (Core)