Implementing Account Lockout Policy SBS 2011

To implement/edit account lockout policy in Small Business Server do the following.

1. Start/Administrative Tools/Group Policy Management

2. Forest/Domains/<Your Domain>

3. Right-Click “Windows SBS User Policy” /Select “Edit”

4. Computer Configuration/Policies/Windows Settings/Security Settings/Account Policies/Account Lockout Policy

5. Double-Click the items in the right hand pane to enable and set the Account Lockout Parameters.

Inbound Ping through the Firewall WS2K8R2 / W7

Start / Control Panel / Windows Firewall / Advanced Settings / Inbound Rules

New Rule / Custom / Protocols and Ports / Protocol type / ICMPv4

Customize / Specific ICMP types / Echo Request / OK

Keep pressing Next until you are asked for a rule name



Type a name for the rule. Press finish.

Change Password from the Command Line

c:\>net user <Username> <New Password> / <optional domain>

Technorati Tags: Win 7,password,dos prompt,CLI

DCOM 10009 Error on SBS2011 after upgrade

In Control Panel/Credentials I found a link to a Terminal Server saved password on a long defunct server. After I deleted the saved credential my 10009 errors disappeared.

SBS 2011 BPA No DNS Records

In the end, using DNS Manager, I deleted _msdcs.<YourDomain>.local from the Forward Lookup Zones, restarted the DNS Service, and ran Fix My Network from the SBS console. Again using DNS Manager I recreated _msdcs.<YourDomain>.local, restarted the DNS Service, and reran Fix My Network. This time when I ran the BPA there were no errors.

The DNS errors may have been there since the migration from SBS 2008 a few months ago but only came to light with the latest release of BPA.

Technorati Tags: SBS 2011,VMware,BPA,No DNS Records

SBS 2011 BPA Shows IPv6 Disabled

The SBS 2011 BPA was showing a bunch of network errors including the IPv6 disabled warning. This is an extremely annoying error because there is not enough information to track where it comes from so it caused a bit of head scratching before I found the root cause.

I am using Fortinet Client Lite and it had installed a miniport network adapter which I was unable to configure nor delete even after un-installing the Fortinet Client. The adapter is visible with device manager. A search of the registry for “Fortinet” uncovered the Fortinet Miniport Adapter which I deleted. I re-ran BPA and the annoying IPv6 message was gone.

If you are not using Fortinet Client and still face this problem. Check the Network Adapters in Device Manager and make sure that they are all configured correctly. BPA seems to check all adapters even the disabled ones.

Technorati Tags: SBS 2011,IPv6,enabled,disabled,BPA,Fortinet

SBS2011 as VMware Guest Loses Router

Occasionally, on restarting SBS2011, after upgrade, I found that it had lost Internet connectivity. The connections to local devices were still perfectly good. I could ping other PCs, connect to shares, use and control network printers, but I couldn’t ping the router/gateway and couldn’t get through to the Internet.

I chased a few red herrings before I came across an article on the VMware forums somewhere referring to IP4 Checksum Offload. The article didn’t directly relate to VMworkstation 8 but it pointed me in the right direction.

Connectivity seems to be quite sensitive and if you face intermittent connectivity issues then here are a couple of recommended steps relating to NIC setup that worked for me.

1. Switch off Auto-negotiate, manually change connection speed until you make the connection, then switch on Auto-negotiate.

2. On all NICs, real and virtual, disable IP4 Checksum Offload.

Technorati Tags: SBS 2011,VMware,Router,No Connectivity,lost Internet,Checksum Offload.

SBS2011 Backup Not Working

 

Apparently, nowadays patching SharePoint is a two stage process. After running the update you need to run the PSCONFIG command from an Administrative Command Prompt. I’ve attached the article with the fix. http://social.technet.microsoft.com/Forums/pl-PL/smallbusinessserver/thread/94c5f178-f020-4d0f-ba7c-11c415d0d862.

I got neither TRUE nor FALSE when I ran the test command but I ran the PSCONFIG command anyway and it fixed my backup problems.

*Excerpt from the article

1. Open an Administrative command prompt.
2. Change directory to C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN
3. Run PSConfig.exe -cmd upgrade -inplace b2b -force –cmd applicationcontent -install -cmd installfeatures

*End of Excerpt

Technorati Tags: SBS 2011,Backup,VSS,VSS Writer,Inconsistent shadow copy,VMware,Broken,Not Working,Stopped

Anti-Virus Removal – Browser Redirection (Solved)

The virus was in a pop-up entitled “PC Repair”. The user was scared by the pop-up which looked like a very genuine Anti-Virus scan. It showed numerous infections and the easy way out was to click the repair button. The virus disabled Task Manager, Hid all the Desktop Icons, the Start Menu items, the Taskbar, and said that my remote control software, CentraStage, had been disabled. It also cleared all valid Restore Points and set some invalid Restore Points.

I could see from the history that MSSE did catch the initial infection but the user was confused by the believable PC Repair notice. I booted to safe mode and MSSE was able to remove parts of the virus but I was left with Browser Redirection to random advertising and sales sites. Turns out that this was caused by a TDSS RootKit which I was able to remove with TDSSKiller from Kapersky.

I failed to find the rootkit with the following spyware / AV programs:-

1. SpyBot
2. SpyDoctor
3. MalwareBytes
4. HijackThis
5. ComboFix
6. MSSE

I found and removed the virus with TDSSKiller from Kapersky. I also found the virus with Hit Man Pro but they wanted a subscription in exchange for virus removal. Hit Man Pro would have been worth it but TDSSKiller is free.

ISPConfig 3 – Increase simultaneous ftp connections

Whilst transferring a site to ISPConfig3 via FTP and FileZilla I kept getting a disconnect with the error “Maximum number of connections from this IP (3) exceeded”. The default number of ftp connections in ISPConfig3, The Perfect Server, is 10. The default number of simultaneous ftp connections from one specific IP address is 3. To change these values you need to edit the Pure-ftpd configuration file. On my server this is /etc/pure-ftpd/pure-ftpd.conf. Edit the following lines with values suited to your application.
MaxClientsNumber        10
MaxClientsPerIP            3

Unable to close EMC/MMC with IE9 installed

When you try to close the EMC for Exchange 2010 you may see the following message box:-



If all dialog boxes are actually closed then this is a known bug and Microsoft are actively working on a fix.

Meantime, the cleanest workaround I have found is to press Logoff. This immediately throws up a message box advising you about saving changes, closing open dialog boxes, and then pressing OK. Don’t be in a hurry to press OK.



Wait a few seconds and you will get the opportunity to cancel Logoff:-



Press Cancel and you will be returned to the console. Now press OK:-



The message box will close and your EMC/MMC will also close gracefully without recording an application hang event.

Cannot start Microsoft Outlook (2010) Win 7 Pro

Cannot open the Outlook window.


This annoying message plagued me for a couple of days during a migration to SBS 2011. I knew the root cause was because there was a pointer to the old SBS2008 server but I couldn’t find it. I googled plenty of potential fixes, mostly involving resetting “offline files” and the CSC folder. None of them worked for me. In the end I found that %appdata% was set to the old server. You can’t delete it nor change it because it is refreshed from the registry on restart.

Type “echo %APPDATA%” in a command box to see the path:-


If you want to see all your variables then type “set” in a command box:-


I scanned the registry for \\<OldServerName> and was amazed at how many places it appeared.

NOTE: If you decide to mess about with the Registry then please remember to set a restore point before you start. It’s quick and can save you hours of agony if you delete or edit the wrong keys.

I changed the following keys to point from the deleted network connection to point to the user’s local disk.

HKEY_CURRENT_USER\ControlPanel\Desktop\Wallpaper
From: \\<OldServerName>\Users\FolderRedirections\<UserName>\AppData….
To: C:\Users\<UserName>.<Domain>\AppData….

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\
Make the same changes. i.e. replace the network reference with a local user reference.
I had to change quite a few references in here.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\
Make the same changes. i.e. replace the network reference with a local user reference.
I had to change quite a few references in here, also.

HKEY_CURRENT_USER\Volatile Environment\APPDATA
Make the same changes. i.e. replace the network reference with a local user reference.

NOTE: If you decide to mess about with the Registry remember to set a restore point before you start. It’s quick and can save you hours of agony if you delete or edit the wrong keys.

Initially this user was facing issues with slow Network Connectivity, Word, Excel, Outlook, Recycle Bins, and Wallpaper. After I changed the above-mentioned keys these issues are now fixed. This user was the only user to face problems after the migration and I strongly suspect that it was because he was the only user who had “Enabled Offline Files” and “Folder Redirection” operating at the same time.

SBS 2008 (physical) to SBS 2011 (virtual)

I’ve just completed my first migration to a virtual environment. It’s running well with a solid feeling to it but it took much longer than I expected - 12 days measured on the FSMO compliance countdown clock. I could’ve saved a few days if I had realised that 100Mbs is really slow for Network Attached Storage. Once I upgraded the central components to 1Gbs we picked up speed and finished quite quickly but it was far from smooth. I followed the Microsoft published migration guide religiously and uncovered some issues that should be clarified or even changed. All the problems I faced are known events. A quick internet search on the error message with an added SBS2011 tag produced immediate results but not always immediate solutions. I still can’t run the SBS console from the special admin account created specifically for the migration but it runs perfectly from another admin account so I’m not devoting too much time to solving that issue. I have to give a detailed write up of the migration to the business owner so expect to see that posted here in a couple of weeks. If you feel I may be able to help you don’t hesitate to post your questions. Meantime here is a list of the central components.
Dell Workstation T1600, 8GB RAM, 1TB Hard Drive, Windows 7 Pro, VMware Server 2.0
Netgear ReadyNAS 1500
Netgear 8port Gb switch
SBS 2011 Standard

Problems removing a Domain Controller

Near the end of an SBS 2008 to SBS 2011 migration I ran into issues on the Source Server. I couldn’t get dcpromo to finish correctly.I was logged in as the special admin user created for the migration. In the end I logged in with the old original administrator account for that server and dcpromo ran smoothly and finished correctly.

Remove Orphaned Routing Group Connectors

Hunting down how to do this took far longer than actually doing it.

1. Run the Exchange Management Shell
2. At the prompt:
       [PS] C:\Windows\system32>get-routingGroupConnector | ft name, guid
3. System responds with a list of Connectors by name and guid
4. At the prompt:
       [PS] C:\Windows\system32>remove-routingGroupConnector <actual guid >
5. System responds with Y/N
6. Task accomplished, woot - at last.

No Favicon Icon - Internet Explorer

If your favicon displays in Firefox but not Internet Explorer then delete your browsing history in Internet explorer.

I came across many threads on this topic but basically if it is showing in Firefox then you have a good favicon image and it is in the right place in your website. Apparently IE has a mind of its own as to when it refreshes the favicon for a stored page and from what I can gather it is every 2 weeks or so. The easiest way around this is to delete your browsing history.

Internet Crawls After Adding a VPN Connection

If your internet slows to a crawl after adding a VPN connection then it is most likely because all internet traffic is being routed via the default gateway on the VPN connection. Change this via:-

Control Panel/Network and Sharing Center/Change Adapter Settings/<Your VPN Connection>/Properties/Networking/Internet Protocol Version 4 (TCP/IPv4)/Properties/Advanced – Untick Use Default Gateway on Remote Network. (You may also have to change the same setting for TCP/IPv6). Restart the connection. This solution works for connecting Outlook to Exchange Server on the remote network.

Outlook 2010 Constantly Crashing

This was an absolute pain. I found the cause by creating a new profile and adding the accounts that Outlook “front ends” for me one at a time. Eventually I found the offending account. It was an issue with the server for that particular account and nothing to do do with the Outlook side of things. During the troubleshooting I came across a very useful tool, http://www.howto-outlook.com/products/outlooktools.htm.

“No such interface supported” Windows 7

I started getting this error after I did the Windows Anytime Upgrade. I found a neat solution here, Pyrocam.com. I had issues with 3 files – fpacutl.dll, fpcutl.dll, and sdsrvc.dll - which I ignored and have had no other issues so far.
The solution is to register all the dll files in your Windows directory and all its sub-directories except for winsxs. The solution neatly lists all the dlls into a file and then uses search and replace to add the registration command.

edit. Over the following week I noticed occcasional unexpected errors so I did a clean re-install.