• Volume Shadow Copy Volsnap Event 25

     

    問題描述︰
    您想解決 Volsnap Event 25 事件

    Event Type:            Error
    Event Source:        VolSnap
    Event ID:                25
    Description:          The shadow copies of volume D: were deleted because the shadow copy storage could not grow in time.  Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
    Data:
    0000: 00000000 00580002 00000000 c0060019
    0010: 00000003 00000000 00000003 00000000
    0020: 00000000 00000000

    c0060019 = ERROR_SEEK The drive cannot locate a specific area or track on the disk.

    說明與方法︰
    CAUSE
    ================
    以下兩篇 KB 描述當伺服器 I/O 高時,會遺失 Shadow Copy 的問題

    925799 Error message when a Windows Server 2003-based computer has a high level of I/O activity: "The shadow copies of volume Volume_Name were aborted because the diff area file could not grow in time"
    http://support.microsoft.com/kb/925799

    826936 Time-out errors occur in Volume Shadow Copy service writers, and shadow copies are lost during backup and during times when there are high levels of input/output
    http://support.microsoft.com/kb/826936

    (826936 is replaced by 833167, 833167 is included in Windows Server 2003 SP2)

    RESOLUTION
    =================
    1. 我們建議您先安裝以下 Hotfix 來更新 VOLSNAP 驅動程式
    Rollup update for the volsnap.sys driver in Windows Server 2003 http://support.microsoft.com/kb/967551
    After 967551 hotfix is installed, you must change the value of the UseTopDownAlloc registry entry to 1 to resolve the Stop code 0x0000006B issue.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VolSnap\UseTopDownAlloc

    2. 設定 MinDiffAreaFileSize 機碼
    Registry path: HKLM\SYSTEM\CurrentControlSet\Services\VOLSNAP\MinDiffAreaFileSize

    Compute a value that is five percent of the smallest shadow copy storage space on any one volume on the system.

    Use the following guidelines to set the MinDiffAreaFileSize value:
    If you compute a value that is less than or equal to (<=) 600 megabytes (MB), set the MinDiffAreaFileSize value to 600. If you continue to receive event ID 25, incrementally increase the value until the value exceeds 3,000.
    If you compute a value that is more than or equal to (>=) 3,000 MB, set the MinDiffAreaFileSize value to 3000.
    If you compute a value that is between 600 MB and 3,000 MB, set the value of MinDiffAreaFileSize to the value that you computed.

    MinDiffAreaFileSize controls the initial size of the shadow copy storage area for each shadow copy. The MinDiffAreaFileSize registry key uses the REG_DWORD data type.

    The MinDiffAreaFileSize registry key specifies the minimum size of the shadow copy storage area. The default size of the shadow copy storage area is 300 MB, and the maximum size is 3 gigabytes (GB). For an accurate setting, specify a value that is a multiple of 300 MB. Otherwise, the next multiple of 300 MB will be used. A value of 300 is equal to 300 MB, and a value of 3,000 is equal to 3 GB.

    Shadow copies might not function correctly if the value of the MinDiffAreaFileSize registry key is larger than the maximum size of the shadow copy storage area. Before you change this registry entry, run the vssadmin list shadowstorage command. Make sure that the shadow copy storage area is larger than 300 MB or that the shadow copy storage area is larger than the value that is set in the registry. Also, make sure that you have at least 300 MB of free space on the shadow copy storage volume.

    ADDITIONAL CONSIDERATION
    =================
    As time passes, the allocated space may increase as more data is modified on the original volume. However, when you have high input/output traffic on the original volume, the shadow copy storage area cannot grow fast enough to hold all the copy-on-write changes. This causes deletion of all the shadow copies on the original volume. This problem is more noticeable in domain controller configurations. By default, the disk write cache is disabled in domain controller configurations.

    If you continue to receive event ID 25, follow these steps to resolve the issue:
    a. Put the shadow copy storage on another volume, even if the volume is located on the same hard disk.
    b. Make sure that the volume that causes event ID 25 is not the same volume that contains the paging file. If the volume that causes event ID 25 contains the paging file, consider putting the paging file on another volume.
    c. Make sure that the volume that causes event ID 25 is not used as the shadow copy storage for any other volume.

    使用 VSSADMIN 指令修改 Storage 位置以及大小
    Method 1)
    Run "vssadmin resize shadowstorage /for=c: /on=d: /maxsize=2500mb"
    This will set Partition D: for Storage area for Partition C: with size limit of 2500mb (This valve will vary according to your requirement)
    Method 2)
    Run "vssadmin delete shadowStorage /for=C: /on=C:"
    Run "vssadmin add shadowstorage /for=C: /on=D: /maxsize=2500mb"

  • How to Limit the Size of the ACS Database by filtering the Security Events

    How to Limit the Size of the ACS Database by filtering the Security Events

    After adding the following ACS filter, the new incoming events cannot be reflected in ACS reports.

    adtadmin /setquery /query:"SELECT * FROM AdtsEvent WHERE (HeaderUser='SYSTEM' OR HeaderUser='LOCAL SERVICE' OR HeaderUser='NETWORK SERVICE') AND (EventID=671 OR EventID=675 OR EventID=681 OR EventID=529 OR EventID=531 OR EventID=532 OR EventID=535 OR EventID=536 OR EventID=539 OR EventID=517 OR EventID=624 OR EventID=627 OR EventID=628 OR EventID=630 OR (EventID>=631 AND EventID<=639) OR (EventID>=641 AND EventID<=668) OR EventID=684 OR EventID=685)"

    clip_image002

    Problem Description
    ==================
    ACS(Audit Collection Services) Database can quickly fill up due to unwanted security events,
    Resolution

    Solution
    ======
    The Solution is to avoid unwanted events by uing AdtAdmin along with WQL Query as listed below
    An ACS collector can use Windows Management Instrumentation (WMI) Query Language (WQL) queries as filters to limit the events that are stored in the ACS database.
    The /SetQuery parameter implements the filter before events are saved to the ACS database.
    For more information about WQL and WQL queries,see Retrieving Managed Resources Using WMI Query Language at http://go.microsoft.com/fwlink/?LinkId=74151 and Querying with WQL at
    http://go.microsoft.com/fwlink/?LinkId=74152.
    AdtAdmin.exe /SetQuery [/Collector:CollectorName] /Query:QuerySyntax

    Example
    This example uses the /SetQuery parameter to define a WQL query that filters out specified events. When applied, this query filters out events generated by System, Local Service, and Network Service services, and it also filters events that have specified event ID numbers.
    adtadmin /setquery /collector:"Collector Name" /query:"SELECT * FROM AdtsEvent WHERE NOT ((HeaderUser='SYSTEM' OR HeaderUser='LOCAL SERVICE' OR HeaderUser='NETWORK SERVICE') OR (EventId=538 OR EventId=566 OR EventId=672 OR EventId=680) OR (EventId>=541 AND EventId<=547))"

  • DC NETLOGON 服務無法自動啟動

    問題描述

    Windows Server 2008/重新啟動電腦後,NetLogon服務無法自動啟動並且啟動後馬上又停用

    解決方法

    記錄檔名稱:         Directory Service

    來源:            Microsoft-Windows-ActiveDirectory_DomainService

    日期:            2009/7/26 下午 05:32:52

    事件識別碼:         2103

    工作類別:          服務控制

    等級:            錯誤

    關鍵字:           傳統

    使用者:           ANONYMOUS LOGON

    電腦:            DC.msft.com

    描述:

    已經使用不支援的還原程序來還原 Active Directory 網域服務資料庫。

    此狀況持續時,Active Directory 網域服務將無法登入使用者。因此,已暫停 Net Logon 服務。

    根據提供的log請備份以下登錄值

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\

    請點選Parameters右邊視窗確認”Dsa Not Writable” 是否存在?

    若該值存在,請參考 KB875495
    How to detect and recover from a USN rollback in Windows Server 2003
    http://support.microsoft.com/kb/875495/en-us

     

  • 2008 Active Directory 建立不同的密碼原則

    一、前言:
    Windows Server 2008提供了新的 [Fine-Grained Password Policies]來處理這類的需求。要使用這個功能必須網域的功能等級先提昇為Windows Server 2008等級,接著透過AD網域中新的[Password Settings Container]的位置來進行設定,這個位置可使用[AD Users and Computers]管理工具,使用[Advanced Features]來開啟System位置就可看到,不過您必須要使用[Adsiedit.msc]或[Ldifde]工具來設定!

    二、做法:
    1. 請先建立一個全域安全性群組,例如:GSGroup1.
    2. 將您想要排除的Account加為GSGroup1的成員.
    3. 建立PSO

    4. To create a PSO using ADSI Edit

    1. Click Start, click Run, type adsiedit.msc, and then click OK.
    2. In the ADSI Edit snap-in, right-click ADSI Edit, and then click Connect to.
    3. In Name, type the fully qualified domain name (FQDN) of the domain in which you want to create the PSO, and then click OK.
    4. Double-click the domain.
    5. Double-click DC=<domain_name>.
    6. Double-click CN=System.
    7. Click CN=Password Settings Container.

    All the PSO objects that have been created in the selected domain appear.

    1. Right-click CN=Password Settings Container, click New, and then click Object.
    2. In the Create Object dialog box, under Select a class, click msDS-PasswordSettings, and then click Next.
    3. In Value, type the name of the new PSO, and then click Next.
    4. Continue with the wizard, and enter appropriate values for all mustHave attributes.

    Attribute sample:

    Attribute name

    Description

    Acceptable value range

    Example value

    msDS-PasswordSettingsPrecedence

    Password Settings Precedence

    Greater than 0

    10

    msDS-PasswordReversibleEncryptionEnabled

    Password reversible encryption status for user accounts

    FALSE / TRUE (Recommended: FALSE)

    FALSE

    msDS-PasswordHistoryLength

    Password History Length for user accounts

    0 through 1024

    24

    msDS-PasswordComplexityEnabled

    Password complexity status for user accounts

    FALSE / TRUE (Recommended: TRUE)

    TRUE

    msDS-MinimumPasswordLength

    Minimum Password Length for user accounts

    0 through 255

    8

    msDS-MinimumPasswordAge

    Minimum Password Age for user accounts

    · (None)

    · 00:00:00:00 through msDS-MaximumPasswordAge value

    1:00:00:00 (1 day)

    msDS-MaximumPasswordAge

    Maximum Password Age for user accounts

    · (Never)

    · msDS-MinimumPasswordAge value through (Never)

    · msDS-MaximumPasswordAge cannot be set to zero

    42:00:00:00 (42 days)

    msDS-LockoutThreshold

    Lockout threshold for lockout of user accounts

    0 through 65535

    10

    msDS-LockoutObservationWindow

    Observation Window for lockout of user accounts

    · (None)

    · 00:00:00:01 through msDS-LockoutDuration value

    0:00:30:00 (30 minutes)

    msDS-LockoutDuration

    Lockout duration for locked out user accounts

    · (None)

    · (Never)

    · msDS-LockoutObservationWindow value through (Never)

    0:00:30:00 (30 minutes)

    msDS-PSOAppliesTo

    Links to objects that this password settings object applies to (forward link)

    0 or more DNs of users or global security groups

    “CN=u1,CN=Users,DC=DC1,DC=contoso

    12. On the last screen of the wizard, click More Attributes.

    13. On the Select which property to view menu, click Optional or Both.

    14. In the Select a property to view drop-down list, select msDS-PSOAppliesTo.

    15. In Edit Attribute, add the distinguished names of users or global security groups that the PSO is to be applied to, and then click Add.

    16. Repeat step 15 to apply the PSO to more users or global security groups.

    17. Click Finish.

    5. To apply PSOs to users or global security groups using the Windows interface

    1. Open Active Directory Users and Computers. To open Active Directory Users and Computers, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
    2. On the View menu, ensure that Advanced Features is checked.
    3. In the console tree, click Password Settings Container.

    Where?

      • Active Directory Users and Computers\domain node\System\Password Settings Container.
    1. In the details pane, right-click the PSO, and then click Properties.
    2. Click the Attribute Editor tab.
    3. Select the msDS-PsoAppliesTo attribute, and then click Edit.
    4. In the Multi-valued String Editor dialog box, enter the Distinguished Name (also known as DN) of the user or the global security group that you want to apply this PSO to, click Add, and then click OK.
      請選擇您在先前已定義好的群組(GSGroup1)。

    clip_image001

    三、注意事項:
    透過PSO物件的屬性設定來套用,極可能會有衝突的情形產生(多個PSO設定到單一物件),因此PSO有一個重要屬性[msDS-PasswordSettingsPrecedence]!
    這屬性是一個1以上的整數值,越低的數字代表有較高的排序(優先權),例如有兩個PSO分別的屬性值為10與20,10的優先權比較高因此會真的套用到物件上;此外,如果屬性值一樣的話,那就以PSO的GUID比較小的會套用!
    另外如果有分別的PSO設定到使用者帳戶與使用者所隸屬群組的話,則套用到使用者帳戶的才是結果PSO!


    參考資訊連結:
    AD DS Fine-Grained Password and Account Lockout Policy Step-by-Step Guide
    http://technet.microsoft.com/en-us/library/cc770842.aspx

  • Not able to isntall DPM Agent on Windows 2008

    Problem
    ========

    SCDPM 2007,DPM Agent installation failed
    We can check the log MSDPMagentinstall.log in folder c:\windows\temp
    MSDPMAgentInstall.LOG

    ===================================

    MSI (s) (24:B4) [16:44:06:980]: Note: 1: 1708

    MSI (s) (24:B4) [16:44:06:980]: Note: 1: 2205 2:  3: Error

    MSI (s) (24:B4) [16:44:06:980]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1708

    MSI (s) (24:B4) [16:44:06:980]: Note: 1: 2205 2:  3: Error

    MSI (s) (24:B4) [16:44:06:980]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709

    MSI (s) (24:B4) [16:44:06:980]: Product: Microsoft System Center DPM 保護代理程式 -- Installation failed.

    MSI (s) (24:B4) [16:44:06:980]: Windows Installer 已安裝該產品。產品名稱: Microsoft System Center DPM 保護代理程式。產品版本: 2.0.5820.0。產品語言: 1033。安裝成功或錯誤狀態: 1603。

    MSI (s) (24:B4) [16:44:06:980]: Cleaning up uninstalled install packages, if any exist

    MSI (s) (24:B4) [16:44:06:980]: MainEngineThread is returning 1603

    MSI (s) (24:F0) [16:44:06:980]: Destroying RemoteAPI object.

    MSI (s) (24:48) [16:44:06:980]: Custom Action Manager thread ending.

    MSI (s) (24:F0) [16:44:06:980]: RESTART MANAGER: Session closed.

    MSI (s) (24:F0) [16:44:06:980]: No System Restore sequence number for this installation.

    === Logging stopped: 2009/8/28  16:44:06 ===

    MSI (c) (1C:30) [16:44:06:980]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1

    MSI (c) (1C:30) [16:44:06:980]: MainEngineThread is returning 1603

    Resolution:
    ============

    Had stopped the Windows Firewall service and set the service to disabled, once complete the DPM Agent was able to install successfully.

    Please also apply last DPM hotfix 970867.
    http://support.microsoft.com/?Id=970867

    More Information
    ==============

    970090 You receive error messages about communication issues on a System Center Data Protection Manager 2007 agent

    http://support.microsoft.com/kb/970090/en-us
    A DPM agent failed to communicate with the DPM service on <server> because of a communication error. Make sure that <server> is remotely accessible from the computer running the DPM agent. If a firewall is enabled on <server>, make sure that it is not blocking requests from the computer running the DPM agent

    947682 The DPM protection agent service cannot start in System Center Data Protection Manager 2007

    http://support.microsoft.com/kb/947682/en-us

    Data Protection Manager 2007 and protected servers open connections over TCP port 5718 and over TCP port 5719 to enable Data Protection Manager operations, such as synchronization and recovery. The current problem may occur on protected servers that are running the Microsoft Exchange System Attendant service. This service uses TCP ports dynamically. This service may take one or both of the required ports.
    Data Protection Manager 2007 also uses the following ports:

    · TCP 135 dynamic

    · User Datagram Protocol (UDP) 53

    · UDP 88

    · TCP 88

    · UDP 137

    · UDP 138

    · TCP 139

    · TCP 389

    · UDP 389