While waiting for a new hardware setup I decided to jump the gun and upgrade my old 2003CA to 2008 in advance – a pretty straightforward process of decommissioning and deploying a new CA on a fresh 2008 install.  Both my Home Theatre setup and laptop are running Vista or 7, and there’s a virtualized Core 2008 Domain Controller as well. No problems there.
However, there is still one slight snag as I’m still using a 2003 machine as second physical DC (which hosts my DFS namespace and I haven’t gotten around to upgrading that one).
After a couple of days, that machine started spewing Event ID 13 errors every eight hours in the Application log:

Event Type:    Error
Event Source:    AutoEnrollment
Event Category:    None
Event ID:    13
Date:        28-2-2011
Time:        18:14:37
User:        N/A
Computer:    MYDC
Description:
Automatic certificate enrollment for local system failed to enroll
for one Domain Controller Authentication certificate (0x80092009).
Cannot find the requested object.

For more information, see Help and Support Center at 
http://go.microsoft.com/fwlink/events.asp.

Secure Channel for LDAP over SSL also breaks because of this, so you’ll see those warnings as well.

A quick look in the ADCS Snapin confirmed both the Directory Email Replication and Domain Controller Authentication certificates were trying to autoenroll but failing every 8 hours.

A search for "cannot find the requested object" quickly resolved that, pointing the way to http://support.microsoft.com/kb/968730.

After requesting the hotfix and rebooting, AutoEnroll properly processes the request again, and SSL enabled LDAP connections are restored.

More information is also available on the Windows PKI Technet Blog: http://blogs.technet.com/b/pki/archive/2011/02/08/common-questions-about-sha2-and-windows.aspx

Notifications are presented by means of the little Action Center flag in the systray, and a popup window:

You can disable these messages normally in the Action Center either by clicking the links provided or by changing the Action Center settings on the left.

On most Corporate networks however, Control Panel entries are either limited to user specific settings or even blocked altogether, in which case Action Center is not available but the notification will still bug you about the settings  – like when you’re using SCCM for instance to install updates.

That’s not a bad thing per se, as Antivirus products also use the Action Center to notify you in case something is wrong.
Simply hiding the Action Center flag may not be the solution, that’s like sticking your head in the sand saying neenerneenerneener and waiting for that freighttrain to hit you head-on.

In that case, Group Policy Preference allows you to enter presets and disable the abovementioned prompts.
I’ve used Process Monitor to filter on the exact registry entries used to configure the settings.

Then, create a GP preference and snapshot* the disabled items.
*These are REG_BINARY keys, the valuefield is too short to enter the values manually.

For reference, these are the exact keys and binary values used.

Windows Update:

Windows Backup:
 

Once applied to your User OU, these settings ensure the Action Center will still prompt for any other mishaps but ignore Windows Update or Backup.

From Windows 2008 onward, that sorely missing functionality is available in the revamped dfsutil commandline tool. And as an added bonus, changing the TTL for a link is also possible.
Even more, dfsutil in 2008R2 (and therefore Windows 7 clients with RSAT installed) lets you set the Access Based Enumeration property.

Below are the property commands:

   1: E:\>dfsutil property

   2:  

   3: DESCRIPTION:

   4: Displays or modifies the properties of a folder target (link target) or

   5: namespace server (root target).

   6:  

   7: ------ PROPERTY Commands Supported ------

   8:  

   9: Sitecosting           Displays or modifies site costing for a namespace.

  10: RootScalability       Displays or modifies the namsespace polling mode.

  11: ABE                   Enable/Disable/View ABE property of a namespace.

  12: Insite                Displays or modifies the in-site property.

  13: TargetfailBack        Displays or modifies client fail back.

  14: SD                    Set/Get Security Information on the folder.

  15: State                 Displays or modifies a folder target or namespace server.

  16: TTL                   Displays or changes client referral caching.

  17: PriorityRank          Displays or changes the ordering method (priority rank).

  18: PriorityClass         Displays or changes the target priority.

  19: Comment               Sets or displays the comment for a namespace or link.

So, what do we do with this? Let’s say you’re migrating your DFS-Namespace enabled* Datashares to a newer fileserver with more storage capacity.

*no DFS-R , in case you’re wondering, because the original server might be a Windows 2003 non-R2 install.

A default link timeout is 7200 seconds or 2x60x 60 seconds = 2 hours, meaning your DFS client will check for changes in state after that time. During your migration window, you’ll want to ensure that any changes are picked up within a shorter time.

   1: E:\>dfsutil property ttl \\alt-92.net\data\share1

   2: The timeout for \\alt-92.net\data\share1 is 7200

First, we’ll change the timeout setting to a 5 minute setting:

   1: E:\>dfsutil property ttl set \\alt-92.net\data\share1 300

   2:  

   3: Done processing this command.

   4:  

   5: E:\>dfsutil property ttl \\alt-92.net\data\share1

   6: The timeout for \\alt-92.net\data\share1 is 300

Then, using both dfscmd and dfsutil, we’ll add our new fileshare to the link AND set it offline:

   1: dfscmd /add \\alt-92.net\data\share1 \\newserver\data\share1

   2: dfsutil property state offline \\alt-92.net\data\share1 \\newserver\data\share1

After syncing the content with robocopy (be sure to check the /MT switch for multithreading on Windows 2008R2 or Windows 7) we now flip the link state on both shares and restore the timeout value to its former setting:

   1: dfsutil property state offline \\alt-92.net\data\share1 \\oldserver\data\share1

   2: dfsutil property state online \\alt-92.net\data\share1 \\newserver\data\share1

   3: dfsutil property ttl set \\alt-92.net\data\share1 7200

After that, we’ll decommission the old fileserver, by taking the shares offline and removing the old links from the DFS Namespace with dfscmd:

   1: dfscmd /remove \\alt-92.net\data\share1 \\oldserver\data\share1

Et voila: we’ve migrated our DFS enabled fileshares to a new server with minimal downtime.

Fully scripted, its now feasible to migrate a DFS Namespace root with hundreds of links in just a few hours (including the final replication with robocopy – the bulk copy we’ve started a couple of days in advance) .

…get a saint to help you out. 

right…

And as soon as that happens, Windows (Advanced) Firewall kicks into Public mode effectively locking your box down. Which is A Good Thing  – mostly, just not always what you want.

VMware KB article 1004813  also describes possible solutions to fix this. Aside from disabling the NICs (hey, we wanted to use those, remember?)  or changing the NICs over to Private Network (which you would have to do every reboot), you can configure the VMware adapters as so called Endpoint Devices per the procedure listed.
More information on the Endpoint device configuration is available on MSDN:
http://msdn.microsoft.com/en-us/library/bb201634.aspx
Reverting to the normal behaviour is as easy as flipping the DWORD to 0 or deleting the entry.

There is also a useful side effect to the *NdisDeviceType  setting:
Remote Desktop connections will keep working even with enabled virtual NICs, whereas by default Remote Desktop (TS) binds itself to all available network connections.

Which means I can finally RD into my desktop machine from my laptop with Host-Only and NAT adapters enabled to run a proper multi-machine, multi-network test.
Yay

[edit]

Link to KB article fixed 

The problem with Server Core … there’s no way for you to see the “updates to install” notice in the system tray when you log on to the computer because, well, there’s no systray!

In comes a handy piece of VBscript that allows you to do a manual quick check and start off the installation process, using the in-box Windows Update Agent API.
http://msdn.microsoft.com/en-us/library/aa387102(VS.85).aspx

Although the MSDN article states it does not run against SUS 1.0 servers, you don’t have to worry because both Windows Update (site) and WSUS 3.x employ the WUA API.

Save and run the script in the command prompt as “cscript ” since the default script host is graphical (wscript) on a Core box.

Set updateSession = CreateObject("Microsoft.Update.Session")
Set updateSearcher = updateSession.CreateupdateSearcher()
 
WScript.Echo "Searching for updates..." & vbCRLF
 
Set searchResult = _
updateSearcher.Search("IsInstalled=0 and Type='Software'")
 
WScript.Echo "List of applicable items on the machine:"
 
For I = 0 To searchResult.Updates.Count-1
    Set update = searchResult.Updates.Item(I)
    WScript.Echo I + 1 & "> " & update.Title
Next
 
If searchResult.Updates.Count = 0 Then
WScript.Echo "There are no applicable updates."
WScript.Quit
End If
 
WScript.Echo vbCRLF & "Creating collection of updates to download:"
 
Set updatesToDownload = CreateObject("Microsoft.Update.UpdateColl")
 
For I = 0 to searchResult.Updates.Count-1
    Set update = searchResult.Updates.Item(I)
    WScript.Echo I + 1 & "> adding: " & update.Title 
    updatesToDownload.Add(update)
Next
 
WScript.Echo vbCRLF & "Downloading updates..."
 
Set downloader = updateSession.CreateUpdateDownloader() 
downloader.Updates = updatesToDownload
downloader.Download()
 
WScript.Echo  vbCRLF & "List of downloaded updates:"
 
For I = 0 To searchResult.Updates.Count-1
    Set update = searchResult.Updates.Item(I)
    If update.IsDownloaded Then
       WScript.Echo I + 1 & "> " & update.Title 
    End If
Next
 
Set updatesToInstall = CreateObject("Microsoft.Update.UpdateColl")
 
WScript.Echo  vbCRLF & _
"Creating collection of downloaded updates to install:" 
 
For I = 0 To searchResult.Updates.Count-1
    set update = searchResult.Updates.Item(I)
    If update.IsDownloaded = true Then
       WScript.Echo I + 1 & "> adding:  " & update.Title 
       updatesToInstall.Add(update) 
    End If
Next
 
WScript.Echo  vbCRLF & "Would you like to install updates now? (Y/N)"
strInput = WScript.StdIn.Readline
WScript.Echo 
 
If (strInput = "N" or strInput = "n") Then 
WScript.Quit
ElseIf (strInput = "Y" or strInput = "y") Then
WScript.Echo "Installing updates..."
Set installer = updateSession.CreateUpdateInstaller()
installer.Updates = updatesToInstall
Set installationResult = installer.Install()
 
'Output results of install
WScript.Echo "Installation Result: " & _
installationResult.ResultCode 
WScript.Echo "Reboot Required: " & _ 
installationResult.RebootRequired & vbCRLF 
WScript.Echo "Listing of updates installed " & _
"and individual installation results:" 
 
For I = 0 to updatesToInstall.Count - 1
WScript.Echo I + 1 & "> " & _
updatesToInstall.Item(i).Title & _
": " & installationResult.GetUpdateResult(i).ResultCode 
Next
End If

Based on MSDN code sample from http://msdn.microsoft.com/en-us/library/bb524791(VS.85).aspx

#define UNICODE
#include <stdio.h>
#include <windows.h>
#include <lm.h>
#include <lmdfs.h>
 
void wmain(int argc, wchar_t *argv[ ])
{
   PDFS_INFO_4 pData;
   PDFS_STORAGE_INFO ps;
   DWORD er=0, tr=0, res, j;
 
   //
   // Check command line arguments.
   //
   if (argc<2)
      wprintf(L"Syntax: %s DfsEntryPath\n", argv[0]);
   else
   {
      //
      // Call the NetDfsGetInfo function, specifying level 4.
      //
      res = NetDfsGetInfo(argv[1], NULL, NULL,  4, (LPBYTE *) &pData);
      //
      // If the call succeeds, print the data.
      //
      if(res==0)
      {
 printf("Report for: %-30S\nStorages: %u\nComment: %S\n",pData->EntryPath, pData->NumberOfStorages, pData->Comment, pData->Timeout);
 printf("Timeout: %u\n",pData->Timeout);
 ps = pData->Storage;
         //
         // Loop through each target.
         //
         for(j=1;j<=pData->NumberOfStorages;j++)
         {
            //
            // Print the status (Offline/Online) and the name 
            // of each target referenced by the DFS link.
            //
 printf("Target %S  ", (ps->State == DFS_STORAGE_STATE_OFFLINE) ? TEXT("Offline:"): TEXT("Online :"));
            printf("\\\\%S\\%S\n",ps->ServerName,ps->ShareName);
            ps++;
         }
         //
         // Free the allocated memory.
         //
         NetApiBufferFree(pData);
      }
      else
         printf("Error: %u\n", res);
   }
   return;
}

It’s quick, it’s probably dirty, but it works just fine (and no admin privileges needed as it does the same as your average DFS client code).

Sample output:

D:\>dfsquery \\alt-92.net\files\0054
Report for: \\ALT-92\files\0054
Storages: 2
Comment:Department 54 data store
Timeout: 300
Target Online : \\ENDEAVOUR\data\0054
Target Offline: \\Equinoxe\data\0054

It shows timeout value, comments (description field in DFS console) the number of link targets and their individual link state.