[Today's post comes to us courtesy of Rituraj Choudhary from Commercial Technical Support]
After Small Business Server 2011 Standard has been updated with Update Rollup 2, some users may not be able to log on to the Remote Web Access with the following error:
“Remote Web Access is not allowed for your user account. Contact the person who manages your server.”
In the "C:\Program Files\Windows Small Business Server\Logs\WebApp\RemoteAccess.log" file, you will see the following:
[12468] 120419.103511.7516: RemoteAccess: [Identity] CheckUserInGroup hit exceptions: System.Runtime.InteropServices.COMException (0x80005000): Unknown error (0x80005000) at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) at System.DirectoryServices.DirectoryEntry.Bind() at System.DirectoryServices.DirectoryEntry.get_AdsObject() at System.DirectoryServices.PropertyValueCollection.PopulateList() at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName) at System.DirectoryServices.PropertyCollection.get_Item(String propertyName) at Microsoft.WindowsServerSolutions.Web.Security.SBSRoleProvider.IsGroup(String distinguishedName) at Microsoft.WindowsServerSolutions.Web.Security.SBSRoleProvider.CheckUserInGroup(String userDn, String groupDn, List`1 processedGroups) [12468] 120508.103511.7526: RemoteAccess: [Identity] CheckUserInGroup user:CN=April Reagan,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=Contoso,DC=local. group:CN=Windows SBS Admin Tools Group,OU=Security Groups,OU=MyBusiness,DC=Contoso,DC=local [12468] 120419.103511.8186:: RemoteAccess: [Identity] GetRolesForUser 'CONTOSO\AprilReagan': hasAccess=False, isAdmin=False, inLink=False, inAdminTools=False, allComputers=False
This happens due to the fact that some Active Directory User or Organizational Unit name contains a forward slash (‘/’) character. The current resolution is to remove the offending character (‘/’) from the name(s).
To find the offending user or OU, you may simply browse through the Active Directory Users and Computers console. If you are assisting someone, you may ask for a LDIFDE dump of the users and the Organizational Units as: ldifde -f users.txt -d "dc=contoso,dc=local" -p subtree -r "(objectCategory=User)" -l "cn" ldifde -f org.txt -d "dc=contoso,dc=local" -p subtree -r "(objectCategory=organizationalUnit)" -l "ou" (In the above examples, “dc=contoso,dc=local” is the distinguished name of the domain; change it as per your environment) Once you get the output, look for the user or organizational unit names with character ‘/’ in their name. Remove the character and modify it conventionally. That should take care of this issue.
In the following example, getting rid of the ‘/’ from the name of “Test o/u” will fix the issue:
dn: OU=Domain Controllers,DC=Contoso,DC=local changetype: add ou: Domain Controllers
dn: OU=MyBusiness,DC=Contoso,DC=local changetype: add ou: MyBusiness … … … dn: OU=Test o/u,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=Contoso,DC=local changetype: add ou: Test o/u … … …
Open Active Directory Users and Computers to rename the object and remove the ‘/’ character.
[Today’s post comes to us courtesy of Mohammed Sabir and Shammi Dua from Commercial Technical Support]
When migrating to Small Business Server 2011, you may experience Public Folder Replication failures and users unable to send mail to mail enabled Public Folders. In an environment where Microsoft Exchange Server 2000 or Microsoft Exchange Server 2003 previously existed, and all those servers have been removed during migration, there is a chance that an Administrative Group (First Administrative Group or another custom Administrative Group) remains with a Servers container, but no servers inside it.
During Public Folder replication, when the Exchange 2010 Store Driver sees the empty Servers container in Active Directory, it expects a System Attendant object inside the container and when it is not found, the following error is logged in the events: Source: MSExchange Store Driver Event ID: 1020 Level: Error Description: The store driver couldn’t deliver the public folder replication message "Hierarchy (PublicFolder@contoso.com)" because the following error occurred: The Active Directory user wasn't found.
In addition to above behavior, you may experience issue wherein you cannot send email to mail enabled public folders and receive an NDR as follows: “#554 5.2.0 STOREDRV.Deliver.Exception:ObjectNotFoundException; Failed to process message due to a permanent exception with message The Active Directory user wasn't found. ObjectNotFoundException: The Active Directory user wasn't found. ##”
Scenarios in which above behaviors can be seen:
In above scenarios, the Servers Container in Administrative Group (First Administrative Group or another custom Administrative Group from Exchange 2003) is left empty. To resolve this issue, follow these steps: Warning: If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall the Windows Server Operating System or Microsoft Exchange or both. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.
[Today’s post comes to us courtesy of Marie McFadden from Engineering, Community and Online]
The Microsoft Support for Small Business experience provides small businesses with easy solutions for technology issues.
To know more about the portal and its benefit, please visit http://smallbusiness.support.microsoft.com/en-us
[Today's post comes to us courtesy of Ashish Sukhija and Rituraj Choudhary from Commercial Technical Support]
In SBS Essentials the location of the log files is under C:\ProgramData\Microsoft\Windows Server\Logs. From a support perspective this can be very handy as you will always know where the log file will be located. We have compiled a list of important logs and their associated wizards below. Please note that there are a few wizards which refer to one or more logs. C:\ProgramData is hidden by default. Please use Folder Options in Windows Explorer to unhide it. Log files on the Windows SBS 2011 Essentials Server:
Dashboard.log
Dashboard.log, SharedServiceHost-DomainManagerServiceConfig.log
Few relevant log files on the Windows SBS 2011 Essentials Client: The log files for the Vista and later clients are located in C:\ProgramData\Microsoft\Windows Server\Logs. The log files on Windows XP clients are present under C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Server\Logs.
Windows Server Solutions Log Collector Tool is an efficient way to collect all of the logs and can be downloaded here.
[Today's post comes to us courtesy of Gagan Mehra from Commercial Technical Support]
Remote Web Access file sharing is the new feature added to the Small Business Server 2011 family. It allows users access shares and the files they contain on SBS server remotely. With file sharing in RWA you can:
File Sharing - Share List Exclusion
RWA will display every share on the server unless the share meets one of the following criteria, in which case they will be hidden. This list is not user modifiable:
* Note: In SBS 2011 UR1+, RWA no longer checks user permissions and will display shares you do not have access to. You cannot open them, but you will see their names.
Remote Web Access file sharing provides a tree view feature with which you can see the files and folders inside a share without even accessing it.
Easy File Upload Tool
The easy file upload tool streamlines the process of uploading files to your SBS 2011 server . With the easy file upload tool, you can drag and drop files to upload them to the Shared Folders in a single batch.
You can install the Easy File Upload Tool by clicking the Upload button and then click Install the easy file upload tool option as seen below.
File Sharing Permissions
Shares which are visible on the Remote Web Access page can be controlled via Sharing and NTFS permissions. Share-level permissions allow you to see the share on the RWA but do not guarantee you have access to interact with it. In order to access the share, the user must have both share-level and NTFS-level permissions to it.
Note: Due to interaction between RWA and UAC, built-in administrative accounts do not work as expected. If you have a share that is restricted to a built-in admin only (i.e. Administrators), you will not be able to access the share, even while logged on as an administrator. If you need this functionality, create your own custom admin account and lock permissions down on the share to that account.
Note: Network Service account must have read access to the folder or the parent folder in order for documents to appear.
File Sharing Limitations
Uploads are restricted to 2 GBs.
Additional Information
http://blogs.technet.com/b/sbs/archive/2011/03/10/introduction-to-sbs-2011-remote-web-access-rwa.aspx
[Today's post comes to us courtesy of Ning Kuang from Sustained Engineering]
A new wiki has been released that answers FAQs around deploying Windows Small Business Server 2011 Premium Add-on.
For more information, please visit http://social.technet.microsoft.com/wiki/contents/articles/8592.sbs-2011-premium-add-on-faq-en-us.aspx