Microsoft/Live ID in Windows 8 Actually Says, "Your password has expired. It's time to choose a new one."

This is a nice change:

Instead of this:

And a, "There is a problem with your Microsoft account".

Windows Messenger says that there is a problem with the connection.

We have all of our Microsoft/Live ID accounts set to expire their passwords after 72 days. It is an option available when changing the password.

So, at least the Microsoft account integration in Windows 8 _tells_ us what the problem is and how to fix it.

Now to figure out _what_ characters are allowed. :S

It's not allowing spaces. Special characters are okay but spaces are not. Oh well.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Video: Crack the Cred: Get into a Windows System/DC when the Domain Admin Password is Unknown/Lost/Changed

Fellow MVP Dana Epp goes through the steps to change the domain admin’s password on a DC where that password is not known or lost in episode 105 of Crack the Cred.

• Scorpion Software: Crack the Cred

If there is a newer episode on the site then hover over the Playlist to get to episode 105.
It is very easy to do.
This is five minutes of any IT administrator’s life that is well spent. Period.
As Dana notes, the only way to protect that DC is by having the system partitions encrypted by BitLocker. Physical security for that DC is a close second.
We explain this situation to all of our clients and potential clients as a part of our IT Solutions Vision. Securing their systems is always a part of the conversation especially since many folks have those servers running in closets that are shared with anything from copiers to stationary!
Awesome job Dana!
Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book
*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.
Windows Live Writer

Symantec EndPoint Protection Manager Console Admin Password Reset

To reset a lost admin password for the Symantec EndPoint Protection Manager console we run the ResetPass.bat file found in:

• C:\Program Files (x86)\Symantec\Symantec EndPoint Manager\Tools

The PDF for the batch file:

In our attempts to initially figure out the password we locked the account out:

The default lockout period is 15 minutes.

• Symantec Community: Endpoint Protection Management Console credentials lost?
• Symantec Community: The Administrator Account is locked

Once the lockout event was released we were able to log on. Note that we were first prompted to change the password prior to getting into the SEP Console.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Hyper-V Host in Workgroup and Management Client in Domain Error after Password Change: You do not have the required permission to complete this task . . .

The password for the domain account just rotated at one of our client sites where we have the beginnings of a two node cluster (1 node and 1 Promise VTrak).

After changing the password for the account on the node and then for the domain account we logged off the management machine. Once we logged back in we saw:

• Hyper-V Manager: Virtual Machines
• You do not have the required permission to complete this task. Contact the administrator of the authorization policy for the computer “HV_Node”

We used John Howard’s HVRemote utility to configure the node which is currently in a workgroup and the management Windows 7 desktop VM that is a member of the SBS 2011 DC running as a guest on the node.

To start with, we ran the following command on the Windows 7 desktop:

• cmdkey /add:HV_Node /user:HV_Node\FirstLast /pass
• Enter the password for 'HV_Node\FirstLast' to connect to 'HV_Node':
• CMDKEY: Credential added successfully.

We then opened the MMC that we created using the domain user’s credentials that was synchronized with the node and we saw the following in the Hyper-V Management node:

We were then good to go and manage the node and its features along with the VMs on it.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

SBS 2008 and 2011 Active Directory Password Complexity

To manage the password setup in SBS 2008 and SBS 2011 Active Directory we use the SBS Console:

1. Open the SBS Console.
2. Click on the Users and Groups tab.
3. If not already selected, click on the Users tab.
4. Under Tasks click on Change password policies.
• 
5. Set the password policy settings accordingly.
• 
6. Click Apply and OK.
1. NOTE: All users will be required to change their passwords on their next log on if any changes are made to these settings!

This wizard is normally used during the set up process only.

If this wizard is used somewhere in the middle of an SBS Migration or SBS Swing Migration the consequences may be dire. It is best left as the final step _after_ at least one week of the post-migrated server being in production.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Office for Mac Standard 2011 with Service Pack 1

We are in the process of getting ready to re-install the OS on our MacBook Pro.

Prior to doing so, we were looking for the newest Microsoft Office for Mac on the Microsoft Licensing Web site since we have our Office for Mac licensed under Open Value Agreement.

The download is a healthy 1,033MB or just a hair over 1GB in size!

The reason for the reload?

The MacBook Pro has been sitting on the shelf due to our being so busy for quite a while now. Guess what? It was not AD integrated and neither the user nor the master passwords were documented. It happens. :)

Fortunately it does not contain any critical data in the encrypted user setup.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Windows XP Mode – Boot From An ISO Instead Of XP

We set up a user’s Windows XP Mode a while back, ran updates and left it until it was needed.

One thing we neglected to do was to keep a record of the XPMUser local admin account.

Now, the setup process for Windows XP Mode takes a fair amount of time, so we dropped an ISO of ERD Commander onto the machine (our clients have MDOP) and hooked it into the Windows XP Mode VM.

One catch however was this: How do we boot from that ISO?

The answer was found after some searching here:

• Windows Seven Forums: How to Boot from a CD or DVD in a Windows Virtual PC

Essentially, we disable the Integration Features in the VM’s settings, reboot, and hit the DEL key until we get into the VM’s vBIOS. We can then change the boot order for the task at hand, make the password change, and set things back once into the OS.

Total time spent was about 5-10 minutes.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2003 – Enable Password Changing in OWA

One of the new features in SBS 2008 is the integration of the user’s password state into both the Remote Web Workplace (RWW) and Outlook Web Access (OWA.

A user would be prompted by RWW to change their password when it was approaching its expiry date. We set our SBS domains to warn users at 14 days.

Within RWW and OWA themselves the user can fine a link to initiate a password change.

With SBS 2003, we would be prompted to change our password after it had expired, but that was as far as it goes when it came to managing passwords.

There is a tweak that can be done on the Exchange and IIS side to enable users to change their password from with OWA:

• Microsoft Knowledgebase: KB297121: Implementing the Change Password feature with Outlook Web Access

Note that the implementation will take a number of steps and are quite invasive. Make sure to take a proper backup just prior to making any changes.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer