Windows Server 2008 CAs and Server 2003 DCs – are you seeing event ID 13 popping up every eight hours?

Posted on March 15th, 2011 in Deployment, Security, Server 2003, Server 2008 by alt-92

Be careful when implementing a Windows 2008 based Certificate Authority in a mixed 2003R2 and 2008(R2) environment. By default, the installation of the ADCS Role on a 2008 Server selects SHA2 type algorithms which are not quite compatible with Server 2003R2 SP2 or XP SP3.
You will need a hotfix.

While waiting for a new hardware setup I decided to jump the gun and upgrade my old 2003CA to 2008 in advance – a pretty straightforward process of decommissioning and deploying a new CA on a fresh 2008 install.  Both my Home Theatre setup and laptop are running Vista or 7, and there’s a virtualized Core 2008 Domain Controller as well. No problems there.
However, there is still one slight snag as I’m still using a 2003 machine as second physical DC (which hosts my DFS namespace and I haven’t gotten around to upgrading that one).
After a couple of days, that machine started spewing Event ID 13 errors every eight hours in the Application log: 

Event Type:    Error
Event Source:    AutoEnrollment
Event Category:    None
Event ID:    13
Date:        28-2-2011
Time:        18:14:37
User:        N/A
Computer:    MYDC
Description:
Automatic certificate enrollment for local system failed to enroll
for one Domain Controller Authentication certificate (0x80092009).
Cannot find the requested object.

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.

Secure Channel for LDAP over SSL also breaks because of this, so you’ll see those warnings as well.

A quick look in the ADCS Snapin confirmed both the Directory Email Replication and Domain Controller Authentication certificates were trying to autoenroll but failing every 8 hours.

A search for "cannot find the requested object" quickly resolved that, pointing the way to http://support.microsoft.com/kb/968730.

After requesting the hotfix and rebooting, AutoEnroll properly processes the request again, and SSL enabled LDAP connections are restored.

More information is also available on the Windows PKI Technet Blog: http://blogs.technet.com/b/pki/archive/2011/02/08/common-questions-about-sha2-and-windows.aspx

Managing DFS namespaces from the command line

Posted on February 10th, 2010 in Server 2003, Server 2008, Storage by alt-92

Last year, I posted about the  DFS Modlink utility which you need if you want to manipulate DFS link states against DFS-N  – Windows 2003 didn’t have any non-GUI tooling to do that, except for the Win32_DFSnode WMI properties.
Windows XP however does not support that particular interface, which leaves only modlink as a way to disable or enable a DFS link.

From Windows 2008 onward, that sorely missing functionality is available in the revamped dfsutil commandline tool. And as an added bonus, changing the TTL for a link is also possible.
Even more, dfsutil in 2008R2 (and therefore Windows 7 clients with RSAT installed) lets you set the Access Based Enumeration property.

Below are the property commands:

   1: E:\>dfsutil property

   2:  

   3: DESCRIPTION:

   4: Displays or modifies the properties of a folder target (link target) or

   5: namespace server (root target).

   6:  

   7: ------ PROPERTY Commands Supported ------

   8:  

   9: Sitecosting           Displays or modifies site costing for a namespace.

  10: RootScalability       Displays or modifies the namsespace polling mode.

  11: ABE                   Enable/Disable/View ABE property of a namespace.

  12: Insite                Displays or modifies the in-site property.

  13: TargetfailBack        Displays or modifies client fail back.

  14: SD                    Set/Get Security Information on the folder.

  15: State                 Displays or modifies a folder target or namespace server.

  16: TTL                   Displays or changes client referral caching.

  17: PriorityRank          Displays or changes the ordering method (priority rank).

  18: PriorityClass         Displays or changes the target priority.

  19: Comment               Sets or displays the comment for a namespace or link.

 

So, what do we do with this? Let’s say you’re migrating your DFS-Namespace enabled* Datashares to a newer fileserver with more storage capacity.

*no DFS-R , in case you’re wondering, because the original server might be a Windows 2003 non-R2 install.

A default link timeout is 7200 seconds or 2×60x 60 seconds = 2 hours, meaning your DFS client will check for changes in state after that time. During your migration window, you’ll want to ensure that any changes are picked up within a shorter time.

   1: E:\>dfsutil property ttl \\alt-92.net\data\share1

   2: The timeout for \\alt-92.net\data\share1 is 7200

First, we’ll change the timeout setting to a 5 minute setting:

   1: E:\>dfsutil property ttl set \\alt-92.net\data\share1 300

   2:  

   3: Done processing this command.

   4:  

   5: E:\>dfsutil property ttl \\alt-92.net\data\share1

   6: The timeout for \\alt-92.net\data\share1 is 300

Then, using both dfscmd and dfsutil, we’ll add our new fileshare to the link AND set it offline:

 

   1: dfscmd /add \\alt-92.net\data\share1 \\newserver\data\share1

   2: dfsutil property state offline \\alt-92.net\data\share1 \\newserver\data\share1

After syncing the content with robocopy (be sure to check the /MT switch for multithreading on Windows 2008R2 or Windows 7) we now flip the link state on both shares and restore the timeout value to its former setting:

   1: dfsutil property state offline \\alt-92.net\data\share1 \\oldserver\data\share1

   2: dfsutil property state online \\alt-92.net\data\share1 \\newserver\data\share1

   3: dfsutil property ttl set \\alt-92.net\data\share1 7200

After that, we’ll decommission the old fileserver, by taking the shares offline and removing the old links from the DFS Namespace with dfscmd:

   1: dfscmd /remove \\alt-92.net\data\share1 \\oldserver\data\share1

Et voila: we’ve migrated our DFS enabled fileshares to a new server with minimal downtime.

Fully scripted, its now feasible to migrate a DFS Namespace root with hundreds of links in just a few hours (including the final replication with robocopy – the bulk copy we’ve started a couple of days in advance) .

DFS namespace query tool

Posted on July 29th, 2009 in Server 2003, Server 2008, Storage by alt-92

For quick lookups to find out where DFS links are pointing to, I’ve built dfsquery.exe in C++.
standalone executable, 64bits support and works on NT5.1 and up (including Windows 7).

Based on MSDN code sample from http://msdn.microsoft.com/en-us/library/bb524791(VS.85).aspx

01
02
#define UNICODE
03
#include <stdio.h>
04
#include <windows.h>
05
#include <lm.h>
06
#include <lmdfs.h>
07
 
08
void wmain(int argc, wchar_t *argv[ ])
09
{
10
   PDFS_INFO_4 pData;
11
   PDFS_STORAGE_INFO ps;
12
   DWORD er=0, tr=0, res, j;
13
 
14
   //
15
   // Check command line arguments.
16
   //
17
   if (argc<2)
18
      wprintf(L"Syntax: %s DfsEntryPath\n", argv[0]);
19
   else
20
   {
21
      //
22
      // Call the NetDfsGetInfo function, specifying level 4.
23
      //
24
      res = NetDfsGetInfo(argv[1], NULL, NULL,  4, (LPBYTE *) &pData);
25
      //
26
      // If the call succeeds, print the data.
27
      //
28
      if(res==0)
29
      {
30
 printf("Report for: %-30S\nStorages: %u\nComment: %S\n",pData->EntryPath, pData->NumberOfStorages, pData->Comment, pData->Timeout);
31
 printf("Timeout: %u\n",pData->Timeout);
32
 ps = pData->Storage;
33
         //
34
         // Loop through each target.
35
         //
36
         for(j=1;j<=pData->NumberOfStorages;j++)
37
         {
38
            //
39
            // Print the status (Offline/Online) and the name 
40
            // of each target referenced by the DFS link.
41
            //
42
 printf("Target %S  ", (ps->State == DFS_STORAGE_STATE_OFFLINE) ? TEXT("Offline:"): TEXT("Online :"));
43
            printf("\\\\%S\\%S\n",ps->ServerName,ps->ShareName);
44
            ps++;
45
         }
46
         //
47
         // Free the allocated memory.
48
         //
49
         NetApiBufferFree(pData);
50
      }
51
      else
52
         printf("Error: %u\n", res);
53
   }
54
   return;
55
}
56


It’s quick, it’s probably dirty, but it works just fine (and no admin privileges needed as it does the same as your average DFS client code).


Sample output:


D:\>dfsquery \\alt-92.net\files\0054

Report for: \\ALT-92\files\0054

Storages: 2

Comment:Department 54 data store

Timeout: 300

Target Online :  \\ENDEAVOUR\data\0054

Target Offline:  \\Equinoxe\data\0054


It shows timeout value, comments (description field in DFS console) the number of link targets and their individual link state.


					




				



				

		

	




	



	
		

					


				
IIS 6.0 running PHP 5.2.10 / FastCGI on Windows 2003 R2



				

					Posted on  July 13th, 2009 in Server 2003 by alt-92 				



				

					
This server is now running PHP 5.2.10 using FastCGI.


FastCGI is a high-performance alternative to the Common Gateway Interface (CGI), a standard way of interfacing external applications such as PHP with Web servers.    
Compared to the ISAPI PHP module, PHP and FastCGI are much faster and definitely the way to go.


FastCGI is available from IIS.NET ( http://www.iis.net/downloads/default.aspx?tabid=34&i=1521&g=6 ) and takes very little configuration. A good installation instruction is at http://learn.iis.net/page.aspx/247/using-fastcgi-to-host-php-applications-on-iis-60/ including a manual setup.     
As always, you’ll need to properly secure the application directories and don’t forget to tweak the php.ini settings file as well.    
I prefer to do a manual PHP setup in a custom path. That way, all the binaries and extensions are in a self-contained environment which allows for easy version upgrading, switching between versions or running differrent versions side by side for compatibility reasons.


phpversioning


					




				



				

		

	




	



	
		

					


				
Mounting VHD files in Vista



				

					Posted on  July 9th, 2009 in Server 2003, Server 2008, Storage, Virtualisation, Vista, Windows 7 by alt-92 				



				

					
Windows 7 features include attaching and detaching Virtual Harddrive files (.VHD) via Disk Management.

This allows you to mount and dismount your Complete PC Backup .vhd file to restore a single item from backup or prestage a Virtual PC/Server diskfile,  or even your HyperV disks.


Vista does not have this feature, but there is a workaround available. Installing the VHDMount utility from Virtual Server 2005R2 SP1 lets you use the VHD storage driver and the vhdmount utility.


    

  1. Download the Virtual Server 2005 R2 SP1 setup from http://www.microsoft.com/windowsserversystem/virtualserver/downloads.aspx .
    2. 

  2. Run setup and choose Custom Setup type:

    vhdmount1
    
vhdmount2
    3. 

  3. Verify the default selection for VHD Mount is marked:

    vhdmount3
    

    Click Next to install and finish the setup.      
    

    vhdmount4
    4. 

  4. You can use the command line vhdmount utility to attach a .VHD file, or alternatively, use these registry entries to create a context menu for the four actions.

          
    01
    Windows Registry Editor Version 5.00
    02
     
    03
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Virtual.Machine.HD]
    04
    @="Virtual Machine Hard Drive Image"
    05
     
    06
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Virtual.Machine.HD\DefaultIcon]
    07
    @="C:\\Program Files\\Microsoft Virtual PC\\Virtual PC.exe,-327"
    08
     
    09
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Virtual.Machine.HD\shell]
    10
    @="Mount"
    11
     
    12
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Virtual.Machine.HD\shell\Commit]
    13
     
    14
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Virtual.Machine.HD\shell\Commit\command]
    15
    @="\"C:\\Program Files\\Microsoft Virtual Server\\Vhdmount\\vhdmount.exe\" /c \"%1\""
    16
     
    17
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Virtual.Machine.HD\shell\Discard]
    18
     
    19
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Virtual.Machine.HD\shell\Discard\command]
    20
    @="\"C:\\Program Files\\Microsoft Virtual Server\\Vhdmount\\vhdmount.exe\" /d \"%1\""
    21
     
    22
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Virtual.Machine.HD\shell\Dismount]
    23
     
    24
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Virtual.Machine.HD\shell\Dismount\command]
    25
    @="\"C:\\Program Files\\Microsoft Virtual Server\\Vhdmount\\vhdmount.exe\" /u /d \"%1\""
    26
     
    27
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Virtual.Machine.HD\shell\Mount]
    28
     
    29
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Virtual.Machine.HD\shell\Mount\command]
    30
    @="\"C:\\Program Files\\Microsoft Virtual Server\\Vhdmount\\vhdmount.exe\" /p \"%1\""
      The result is a context menu on right-clicking a .VHD file like this.        
    

    vhdmount5        
    

    Mounting your disk file is now as easy as a right-click away, and the VHD will show up as a new disk in Explorer.
    5. 



					




				



				

		

	




	



	

	

		Next Page »