Skip Ribbon Commands
Skip to main content

The Doc's Pensive

:

Home
This is my collection of (mostly Microsoft product related) thoughts, notes, and stuff I don't want to forget
March 05
Error 1730: But I am an administrator!
by  Jeff SheenNo presence information  on 3/5/2011 9:28 AM

When attempting to uninstall programs on a Windows Vista or Windows 7 PC, I'd been getting a 1730 error which claimed that I needed to be an administrator to uninstall the program.

One problem: I am an administrator.

According to this post, the problem is our old friend, the User Account Control (UAC).  It needs to be turned down to a minimum, then the machine reboots, then I could uninstall the programs normally.

I'm still a fan of the UAC -- it's helped me a few times to navigate away from a web page that was trying to install something I didn't want -- but this is somewhat annoying. :) ​

Permanent Link to Post | Email Post Link | Number of Comments 0 Comment(s)
June 13
Hyper-V Virtualization Rig
by  Jeff SheenNo presence information  on 6/13/2010 9:55 PM

Inspired in part by Andrew Connell's journey into building his own virtualization rig, I decided to do one for my own use.  I was using two Dell PowerEdge 2400 servers, from circa ~2000, that sounded like a pair of jet engines in my basement.  My requirements were:

  • To do Hyper-V.  I have experience with VMWare and some Citrix at work, and wanted to round out my experience.  In addition, I have an MSDN license.
  • To be able to run a Windows 2008 domain at home, along with a web server (that hosts this blog, among other things).
  • To be able to create virtual machines on the fly, for the reviews I do at Biztech Magazine.
  • I was once a hardware guru, but I haven't built my own PC in a very long time.  I wasn't going to go to the lengths Andrew did, but I didn't mind putting in hard drives, programming raid controllers, etc.
  • I wanted it to be quiet, or as quiet as a server could be.
  • I wanted to keep it under $2000.

This blog is running in a VM on the new server.  I ended up spec'ing out the following, all from newegg.com:

 

​HP Proliant ML150 G6 $699.99​ ​1 ​$699.99
Four 1TB WD Hard Drives​ $69.99​ ​4 $279.96​
Three 4GB Kingston Memory​ $182.99 3​ $548.97​
Three 2GB Kingston Memory​ $104.99​ 3​ $314.97​
​ ​ ​ $1843.89​
 ​

 So for under $2000, I end up with a single proc E5504 quad core Xeon processor with 18GB or RAM and 2TB of hard drive space.  (I used the b110i RAID controller inside the box to do a 1+0 RAID array -- it's not capable of RAID5, and that's good enough for me anyway.)

Installation of memory and hard drives went very well.  I had to turn on the virtualization features in the BIOS, and the b110i wanted to do a 1+0 RAID by default, so I let it.  I needed to download the RAID card's Windows 2008 x64 driver from HP and put it on a USB stick so I could install the Operating System, but that went just fine.

It took me just over the weekend to transfer all the data, FSMO roles in AD, DNS, and SharePoint (WSS 3.0 to 4.0) over to my new rig, and I couldn't be happier.  It runs pretty darn quiet -- enough so that it's under my desk next to my main PC, and really doesn't cause me much concern.  It's not all that Andrew has, but for my money and peace of mind, it's working out very well.

 

Permanent Link to Post | Email Post Link | Number of Comments 0 Comment(s)
February 02
SharePoint Backup to Remote Server Gotcha
by  Jeff SheenNo presence information  on 2/2/2010 1:56 PM
Category: SharePoint

It is important to note that the SQL Server Agent service is used in the SharePoint backup... so make sure it has rights to wherever you're backing up the data!  Otherwise you'll only get a partial backup and errors in the log file.  If it's running as Local System, add the computer account (SERVER$) to the access list of the backup directory with modify permissions.
 
See this helpful post:
 
​

Permanent Link to Post | Email Post Link | Number of Comments 0 Comment(s)
December 20
Scheduling the Backup of SQL Express 2005
by  Jeff SheenNo presence information  on 12/20/2009 1:55 PM
Category: SQL Server

This nice blog post by Katie Koepke on Brian Madden's site sums it up nicely.  It doesn't matter than it's for Citrix Presentation Server, just insert your own SQL Express instance.
 
 
Reposting here in case his gets lost:
 
I recently built a Presentation Server 4.5 (PS 4.5) farm where the decision was made to use a SQL Server 2005 Express database as the IMA data store. When it came time to create an automated backup of the data store, I soon realized the process was not at simple as creating a SQL job in a friendly GUI as with a full-blown SQL Server install, or running DSMAINT BACKUP. This article describes how automate the backup a SQL Server Express data store without having to purchase a third-party tool or without having to learn SQL programming. That said, this document is intended for the non-SQL savvy administrator unfamiliar with creating T-SQL statements.
As you may know, it’s very easy to install and use a SQL Server Express database as your data store since Citrix provides at custom batch file in the PS 4.5 Support folder. Running \Support\SqlExpress_2005_SP1\SetupSqlExpressForCPS.cmd automatically installs and configures a SQL Server Express instance named CITRIX_METAFRAME. By default, three SQL Server Express configuration tools (SQL Server Configuration Manager, SQL Server Error and Usage Reporting, and SQL Server Surface Area Configuration) are also installed on the server, but none of these can be used to configure a backup.

Creating the Database Backup Script

For further SQL Server Express management options download and install SQL Server Management Studio Express .  This is a free tool from Microsoft and will be used to create a script to backup your data store.
  1. Once the tool is installed, launch Microsoft SQL Server Management Studio Express and connect to the CITRIX_METAFRAME instance.
  2. Expand Databases and you will see the MF20 database. (This is the default name of the database that was created when creating the Presentation Server farm.)
  3. Right click the MF20 database and select “Tasks | Backup”.  A dialog box appears allowing you to define different options such as what type of backup (full or differential) you want to do, backup destination etc. Configure the available options as desired then click the “Options” page on the left-hand column. Continue configuring options accordingly. For example, you may want to select “overwrite all existing backup sets.”
  4. Once all desired options are set, select “Script | Actions to File” and enter a desired file name, for example, “DatastoreBackup,” and specify the location where to save the file.
This creates a .SQL file which scripts the options you defined in the prior step. The contents of your .SQL file may look like this:
 

 
BACKUP DATABASE [MF20] TO  DISK = N'C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Backup\MF20.bak' WITH NOFORMAT, INIT,  NAME = N'MF20-Full Database Backup', SKIP, NOREWIND, NOUNLOAD,  STATS = 10
GO
To test your .SQL file run the following from a command prompt.
sqlcmd -S .\CITRIX_METAFRAME -i "C:\<enter path to .sql file>\DatastoreBackup.sql"
If the MF20.bak file was created with the correct data and time stamp then you know your script works. By default the MF20.bak is located in C:\Program Files\Microsoft SQL Server\MSSQL\MSSQL\Backup. (This folder might be “MSSQL.1” or “MSSQL.x” depending on what else is on your server.)

Automating the Database Backup

You can automate the backup process by creating two Scheduled Tasks.

SQLCMD Scheduled Task

  1. First, create a Scheduled Task to automate the .SQL script created above. Use the Scheduled Task Wizard and when asked to select a program browse to use browse to C:\Program Files\Microsoft SQL Server\90\Tools\binn\ SQLCMD.exe. Define the Schedule Task parameters accordingly and click “Finish”.
  2. Go the properties of the newly created Scheduled Task and edit the Run command as such.
"C:\Program Files\Microsoft SQL Server\90\Tools\Binn\SQLCMD.EXE" -S .\CITRIX_METAFRAME -i "C:\Program Files\Microsoft SQL Server\DatastoreBackup.sql"

Copy MF20.bak Scheduled Task

Next, create a simple batch file to copy the MF20.bak from the local server to a network share located on server being backed up regularly.  For example, create a file named, “CopyMF20bak.cmd”, with the following contents.  
copy "C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Backup\MF20.bak" "\\<servername>\<sharename>\"
Lastly, create a simple Command Prompt Scheduled Task and configure accordingly. (Make sure to run this Scheduled Task after the SQLCMD Scheduled Task.)  Go to the properties of the newly created Scheduled Task and edit the Run command to point to the location of CopyMF20bak.cmd (or your respective batch file name).

Resources

​

Permanent Link to Post | Email Post Link | Number of Comments 0 Comment(s)
September 03
IP Address Leak in IIS and WSS or SharePoint
by  Jeff SheenNo presence information  on 9/3/2009 1:55 PM
Category: SharePoint

Recently, my security team got on the trail of TCP headers and what was released by IIS 6.0.  In particular:
 
 
"When Microsoft Internet Information Services (IIS) receives a GET request without a host header, the Web server may reveal the IP address of the server in the content-location field or the location field in the TCP header in the response. This problem may occur if the request does not contain a specific page or if IIS must redirect the original request to another page."
 
They decided to deploy Option 1 to all IIS servers in the company:
 

Option 1: Set the UseHostName property

To set the UseHostName property, follow these steps:
  1. Click Start, click Run, type cmd, and then click OK to open a command prompt.
  2. Change to the folder where the Adsutil.vbs tool is located. By default, this folder is the following:
    %SYSTEMROOT%\Inetpub\AdminScripts
  3. Type the following command, where x is your site identifier:
    cscript adsutil.vbs set w3svc/x/UseHostName true
Unfortunately, this seems to cause an issue in SharePoint for us internally.  We use an alias to specify our internal Sharepoint site as a non-FQDN, so that Internet Explorer prompts users for authentication at odd times. Specifically:
  • When you try to upload a file, you get prompted for credentials at the FQDN of the front-end WSS or SharePoint server.
  • You are unable to edit anything in the datasheet view, though you can view items.
  • Some sites are no longer accessible (not sure why yet), and if they aren't, you get prompted again for credentials using the FQDN of the server.
The fix is... essentially don't apply that fix. :)  Take out the UseHostName metabase flag (or set it to zero).
​

Permanent Link to Post | Email Post Link | Number of Comments 0 Comment(s)
August 05
OCS 2007 and Digital Certificates
by  Jeff SheenNo presence information  on 8/5/2009 1:54 PM
Category: Office

There are several posts on the Internet about Microsoft Office Communications Server 2007 and digital certificates.  You're told that OCS uses secure transmission between its servers, and can use TLS to communicate to clients (if you so choose).
 
And that all works even without a perfect internal Certificate Authority (CA).  However, there are certain elements that, for whatever reason, also require your CA to have proper Certificate Revocation Lists (CRLs), including:
  • Expansion of distribution groups in OC
  • Full Outlook Integration in OC
You might notice this first when going to Vista for the first time, or a new version of Internet Explorer, where "Check for Server Certification Revocation" is on by default in IE.  (See Internet... Tools... Advanced tab.)  Turning this checkbox off does 'fix' the problem, but really, you should fix the root of the problem, the CA.
In my case, I have a 2-Tier CA and both the Root and Issuing CA servers had bad CRLs.  That is to say, the CRL itself was fine, but how it was being published and how it was being referenced in the certificates themselves was bad.  Like I said, you won't notice this problem in a standard SSL web connection... but OCS knows.
To fix it, I did the following:
  • Edited the Root CA extensions for the CRLs
    • Put in a local file location for publishing
    • Put in a well-known HTTP location for use in the certificates.
    • Force publication of the certificate -- the command is CERTUTIL -CRL
    • Copy the CRL to the well-known HTTP location
  • Verify Root certificates
    • Create a new cert request and submit it to the Root CA, get the certificate, and then run the following command:

      certutil -verify -urlfetch {certfile.cer}

      where certfile.cer is your recently-produced certificate file.  It should now verify correctly.
  • Edit the Issuing CA's extensions in exactly the same way.  You can have it publish the CRL in the same HTTP location, because the Issuing CA stays online (whereas the Root CA goes offline).  Verifying the certificate will not work... yet.  The certificate the Issuing CA has is as old Root certificate with a bad CRL. So...
  • Use the Issuing CA to request a new certificate from the Root CA, have the Root CA issue it.
    • You will now have two certificates on the Issuing CA
    • You should now be able to produce a new certificate from the Issuing CA and have it verify perfectly.
  • Force group policy update or wait.  Your Issuing CA's certificate is considered an "Intermediate CA" by clients, and eventually via Group Policy they will get a second new Issuing CA cert.  Or just do a gpupdate /force and watch it appear.
At this point, your CA hierarchy is fixed, and you're issuing certificates with good, solid CRL pointers to real, solid, good CRLs.  Now you need to update OCS:
  • Go through the Certificate Wizard to get a new certificate.  You may have to do this on each server, I am unsure because my deployment has only one server.
  • Restart all the OCS services, including the Front End service.
  • Validate your OCS deployment.
​

Permanent Link to Post | Email Post Link | Number of Comments 0 Comment(s)
April 27
Oldie but Goodie
by  Jeff SheenNo presence information  on 4/27/2009 1:54 PM
Category: Virtualization

 

Nothing quite like watching VDI provision 150 workstations with 4 different operating systems... in just seconds.
 
​

 

Permanent Link to Post | Email Post Link | Number of Comments 0 Comment(s)
April 10
Editing Windows Mobile Registry
by  Jeff SheenNo presence information  on 4/10/2009 1:53 PM
Category: OWA-OMA-Mobile

Sometimes, you just need to hack your mobile phone's registry.  The PHM Registry Editor will nearly do the trick, but you really only need one CAB file on your device to do the trick, regedit.MRln_ARM.CAB
 
Now as to why you'd ever want to do that?  Tamir Khason gives some ideas in his blog post: (recopied also here)
 
Direct Push pushes email into your Windows Mobile device and it’s good. However it pushes you security policy as well, that sometimes make you unable to set password that you want and sometimes, lock your device after one minute of inactivity. How to disable this useful feature? How to cancel autolock feature of your WM machine, connected to Microsoft Exchange server?
As everything in WM, you should patch registry, but what to patch? Well, it’s simple
  • Enable/Disable the Exchange security policy - HKLM\Security\Policies\00001023: 0 = Enabled; 1 = Disabled
  • Inactivity time
  • HKLM\Comm\Security\Policy\LASSD\AE\{50C13377-C66D-400C-889E-C316FC4AB374}\AEFrequencyType: 0 = No inactivity time; 1 = Activity time enable
  • HKLM\Comm\Security\Policy\LASSD\AE\{50C13377-C66D-400C-889E-C316FC4AB374}\AEFrequencyValue: number of minutes before timeout
  • Password strength
    • Minimum number of characters: HKLM\Comm\Security\Policy\LASSD\LAP\lap_pw\MinimumPasswordLength
    • Password complexity: HKLM\Comm\Security\Policy\LASSD\LAP\lap_pw\PasswordComplexity: 0 = Require Alphanumeric; 1 = Require numeric (PIN); 2 = No restriction
  • Wipe settings
    • Number of failed attempts before all your information will go: HKLM\Comm\Security\Policy\LASSD\DeviceWipeThreshold: -1 = disabled; other failed attempts
    • Number of failed attempts before displaying codeoword: HKLM\Comm\Security\Policy\LASSD\CodewordFrequency: number of failed attempts
    Well, that all. After you’ll fix it, just go to Lock settings in your device manager and you’ll be able to unmark and change whatever you want. I hate, when program denies me from doing anything in my device.
    • ​

    Permanent Link to Post | Email Post Link | Number of Comments 0 Comment(s)
    April 03
    Columbus Windows & Exchange User Group to Host Hyper-V
    by  Jeff SheenNo presence information  on 4/3/2009 1:53 PM

    Microsoft, Citrix and Avanade all in one place, discussing VDI, Hyper-V, XenDesktop.  Should be a darn good time.
     
    When: April 22nd, 6pm
    Where: 8800 Lyra Drive, Columbus, OH 4th Floor (MS Office up near Polaris Pkwy and I-71)
     
    ​

    Permanent Link to Post | Email Post Link | Number of Comments 0 Comment(s)
    November 01
    Printing from Vista through Windows XP
    by  Jeff SheenNo presence information  on 11/1/2008 1:52 PM

    I've had an issue with getting a Vista x86 box to print to a Dell 1100 printer on Windows XP.  Trying to connect to the share produces a so-called Memory Error, and clearly the machine is not out of RAM.  My troubleshooting went as follows:
     
    1) First, I downloaded the latest drivers from Dell for the 1100, which included Vista x86 support.  In my case, the driver came out in 2007 and is named "R146848.exe."  You'll need this on both machines.
     
    2) I installed the driver on the Windows XP machine.  Still, "Vista" was not in the list of "other operating systems" in the printer's device properties.  Make sure you share it out.
     
    3) On the Vista machine, I then added a new printer, but not as you'd expect:
    - Add a local printer
    - Create a new local port
    - When asked for the name, type in the network path to the printer, ala \\windowsxpmachine\dell1100
    - You probably won't have the driver installed yet (browse through the lists).  If you don't, hit the Have Disk option and browse to:  C:\dell\drivers\R146848\Driver_UG_Vista(32bits)\1100\PRINTER\GDI\WINXP_2000_VISTA_32.  It will find one file, let her fly.
     
    4) Presto!  You can now print.
    ​

    Permanent Link to Post | Email Post Link | Number of Comments 0 Comment(s)
    1 - 10Next
     

     About this blog

    		 
     jeff-alex.bmp

    Greetings!  My name is Jeff Sheen and I've been working in Microsoft and infrastructure technologies since 1999.  Before that, I played with quarks and gluons, finishing my Ph.D. at Wayne State University under Dr. Rene Bellwied.  This is my collection of stuff I don't want to forget, mostly for my own "Hey didn't I fix that once before" moments.
     

     External Links

    		 
    URLUse SHIFT+ENTER to open the menu (new window).
      
    expand Category : Communications ‎(5)
    expand Category : Infrastructure ‎(1)
    expand Category : Mobility ‎(1)
    expand Category : SharePoint ‎(2)
    expand Category : Virtualization ‎(3)