SSL Certificates: CSR Decoder to Verify Settings

When it comes to creating a certificate request sometimes we can miss a character or typo something.

If the processing takes longer than expected and the certificate provider does not provide much more than a "Processing" status it may be a good idea to verify the settings in the CSR file.

The CSR Decoder site can do that:

• CSR Decoder – Check CSR to verify its contents

We hit a snag with a CSR that was taking too long and sure enough there was a typo in the common name that caused it to hang up.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Hyper-V Cluster: An error occurred while creating the cluster: Unknown error (0xc0000133)

We had just finished walking through all of the steps to set up two nodes for a Server 2012 RTM Hyper-V cluster when we got hit with the following error:

Create Cluster Wizard

An error occurred while creating the cluster.

An error occurred while creating the cluster 'TD-12Cluster'.

Unknown error (0xc0000133)

Our initial searches turned up very little when we included Hyper-V and Cluster in our terms.

The error code however turned up a tie into time synchronization.

These nodes were set up using Windows Server 2012 Standard in Server Core mode. And, we had missed step 9 in SConfig: Date & Time!

The time zone was incorrect on both nodes.

We also noticed that the time on the test network was about 9 minutes out from our own. So, we had missed configuring the time service on the physical DC to poll the Canadian pool.ntp.org servers.

• Blog post here: Preparing A High Load VM For Time Skew
1. Elevate a command prompt
2. w32tm /config /syncfromflags:manual "/manualpeerlist:0.ca.pool.ntp.org,0x1 1.ca.pool.ntp.org,0x1 2.ca.pool.ntp.org,0x1 3.ca.pool.ntp.org,0x1"
3. w32tm /config /update
4. net stop w32time && net start w32time
5. w32tm /resync /force
6. w32tm /query /source
1. Should be 0.ca.pool.ntp.org

Once we had the domain time in order and the nodes synchronized to the DC we were able to successfully stand up the cluster in Failover Cluster Management.

In the end not referring to our process manuals was the key. ;)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

SMB Kitchen Crew Chat Today

Sharing here because the #1 chat topic is always virtualization so thought some here might be interested.

We're holding one of our regular SMBKitchen Crew chats at 1600Hrs MST today.

At this chat we'll talk about the latest small business IT issues, answer your questions and make sure that you're aware of the latest stuff that we've published. Hope you can join us!

Click this link https://meet.lync.com/harborcomputerservices/amy/C2YB9SVC

I will be involved in this public chat today to talk a bit about what has been published by me already and to answer any questions that you may have along with the rest of the Crew!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Attitude and Gratitude

To date I don’t believe I’ve ever crossed the line into political commentary.

No, this is not about what is happening South of the border (being in Canada that).

This is about our own little world here in St. Albert. We have been supporting the St. Albert Youth & Community Centre for quite a few years now.

In fact, we did what we could for them in the way of time and product as the service they provided to the youth of St. Albert touched very close to home for me.

Attitude

The attitude is in how we take full and complete responsibility for what we do in our business, in our community, and within our own personal lives.

This attitude seems to be a direct antithesis to the prevalent “blame anyone but me” we see in the news, politics, and unfortunately in business.

We seem to live in an era where the word “responsibility” is a four letter one.

The local St. Albert administration pulled a significant chunk of the Youth Centre’s (YC) funding last year. So, when the YC got into a bit of a spat with the landlord over who should fix the very leaky roof (not drips but _gallons_ the standoff ended with the YC needing a new home.

When the City Council pulled funding last year the YC decided to keep in trying to serve the Youth of St. Albert. They worked very hard to build funding from other sources to replace the well over $110K they lost from the City.

Unfortunately, due to the pulled funds when the row with the landlord came to a finish the YC did not have sufficient funds in place to find a new location.

The City Council’s and Mayor’s spin on the loss of the YC was sad to see. At no point did this council or mayor take responsibility for the fact that they pulled the funding needed for the YC to survive in a new location. It was the landlord’s fault that the YC needed to close.

We picked up the last of their equipment this Monday as they closed up shop. It was a sad day for the both of us but most especially for the youth that no longer have a safe place to go.

And, it was a first-hand experience of how folks in politics can seemingly spin anything to defer responsibility for something they were a party to. This truly saddens me as well.

Gratitude

And finally, when we receive a referral either from a client or fellow IT Provider we make a point of offering some form of thanks.

Gratitude, that is being thankful for the business referred to us is a very important thing. Folks did not have to reach out to us in the first place or could have gone somewhere else with the business.

Thus, when we reach out and bring another IT firm, or specialized service firm, or whatever they may be doing into the mix one would expect at least a “Thank you” or even a small finder’s fee to toss in the company coffee fund.

When that does not happen then what are we to think?

Suffice it to say we would probably be taking those kinds of needs to another company a lot more willing to “partner” in the true meaning of the word.

Author’s node: Yeah, it’s been a bit of a tough week.

Thanks for reading. Our clients and you make things all the more worth it to keep plugging along. :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

CryptoLocker Word Of Caution

One of the things we have done from the get-go when it comes to setting up ShadowProtect to stream backups to either a drive set connected to a standalone Hyper-V host or to the standalone DC in a Hyper-V cluster setting is to set the shares to allow the Domain Admin MOD.

Inheritance on the folder’s NTFS permission set is removed/copied out then Domain Users/Machine Users group will get removed altogether.

We do this for a number of reasons

• Users cannot connect to the ShadowProtect images
• They are password protected and are using at least AES128bit
• Users cannot delete the images

While we are into our client’s servers on a regular basis sometimes the occasional domain admin account password will expire in the interim.

ShadowProtect will start failing to back up to the shared folder as a result of not being able to log on so a small bonus in the mix.

We are seeing CryptoLocker problems abound lately where someone clicks on a link in an e-mail or is drawn to a compromised site. What that means is that _any_ file/folder set the user has permissions to access and modify may end up encrypted by the malware.

The _only_ way to “recover” from this situation is via Shadow Copies or backup.

If the backup drive and/or backup folder destinations for those ShadowProtect backup files, or any other product that lays down files for backup, is open for users to access then we all know what can happen.

Point of order: Any backup product that uses the volume snapshot service should have its backup times staggered over the Volume Shadow Copy snapshots as having two snapshots running simultaneously could end up with data toast on both sides.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

System Uptime on an SQL Server

We are in the process of running some maintenance on a series of servers we rarely get to touch.

We have the LoBs offline or in limited usage at the moment:

This particular physical server’s sole purpose in life is to host SQL database instances.

So, while it is has been a good run for the server we are about to terminate the close to two year run. :)

For obvious reasons it is our preference to keep things up to date in the server operating system and the server services running on top of that OS. However, sometimes business dictates that we do not touch unless there is a very good reason to.

We do have a number of such situations. In this case, the LoBs provided us with the opportunity to reboot, run some updates, reboot, and then service pack the various SQL instances.

We now have a fairly happy SQL server that will probably keep running for another year or so until we move this particular client over to a Hyper-V failover cluster.

Have a great weekend everyone and thanks for reading. :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Microsoft ID 2 Factor Authentication

If you have not already implemented the newly available 2FA for your Microsoft IDs then maybe it is time to look at doing that.

We’ve all seen the plethora of Yahoo and iTunes accounts compromised.

So, why not take a moment to update all Microsoft IDs used both within the business and personally to have up to date cell phone numbers for text verification and then download and configure the Microsoft Authentication App.

Once the app is on the smartphone enable and confirm 2FA in the Microsoft ID profile.

From then on any Microsoft ID protected property will prompt for the code that is presented in the Authentication App.

There is a check mark for don’t bug me here on those 2FA pages but it kind of defeats the purpose to check those on pretty much any online property now doesn’t it?

IMNSHO, this feature rocks!

Hopefully the banks catch up and start utilizing this kind of security beyond the second layer of personal question protection.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Why We Never Dedicate a NIC Port to a VM

We never dedicate a NIC port to a VM. We always _team_ NIC ports. Generally there are two teams in standalone and cluster setups.

Team0: Management (Port 0 on NIC 0 and 1)

Team 1: vSwitch (Ports 1+ on NIC 0 and 1) – Dedicated

I kinda understand the logic of doing that, that is dedicating a NIC port to a VM. However, the whole purpose of virtualization is to separate the guest operating system from the hardware. So, one needs to break from that mindset.

There is no reason why the dual Intel quad-port configurations (8 ports total with 6 for the vSwitch) we do would have a problem with the in some cases 20+ VMs running on the host.

Team configuration exception to the rule would be for CAD/CAM/High Bandwidth needs:

• Team0: Management (Port 0 on NIC 0 and 1)
• Team1: vSwitch High I/O (Port 1 on NIC 0 and 1)
• Team2: vSwitch General VMs (Ports 2+ on NIC 0 and 1)

That leaves a dedicated pair to the higher network bandwidth VM or VMs. We would leave VM density on Team1 at two or three maximum.

BTW, in a disaster recovery scenario having things teamed makes recovery a lot simpler. Trying to keep track of all of those vSwitch names mapped to what VM would be a real PITA when things were tense. Plus, getting all that configured would be that much more time wasted getting things back. Keep It Simple Sir

Oh, and one more thing: Why would one use a dedicated physical port on each node in a cluster for a highly available guest hosted on that cluster?

That leaves a single point of failure and yet we see that it is quite common for NIC teaming to not be used.

With NIC teaming now built into Windows Server 2012 RTM and newer there is no real reason to avoid teaming NICs or NIC Port groups to avoid that single point of failure.

So, when architecting a cluster setup please use NIC Teaming.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Office Pro Plus: Setup Error - Files necessary to run the Office Customization Tool were not found. Run Setup from the installation point of a qualifying product.

That was the error we had when we ran setup /admin from our Office 2013 Pro Plus distribution point.

It turns out that we do need to download some additional files from Microsoft's download site.

• Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool

We downloaded the 32-bit version of the tools and extracted them to a folder.

Once the extraction is complete copy the Admin folder to the root of the Office distribution point.

We could then run the setup /admin command from the distribution point and voila:

We can now go on and create our MST file to allow for automatic installation, activation, and base configuration of the products.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Windows Features Error: Windows couldn't complete the requested changes 0x800F0906

We hit this today:

Windows Features

Windows couldn't complete the requested changes.

Windows couldn't connect to the Internet to download necessary files. Make sure that you're connected to the Internet, and click "Retry" to try again.

Error code: 0x800F0906

Our search turned up the following KB:

• Microsoft Support: KB2734782 Error codes when you try to install the .NET Framework 3.5 in Windows 8 or in Windows Server 2012

The OS affected was Windows 8 Enterprise on a greenfield Windows Server 2012 Essentials virtualization setup.

The relevant point for us was in the WSUS settings as we set up WSUS in Group Policy with the appropriate WMI Filters for each operating system. We did _not_ make the respective changes recommended in the KB article though.

We made the necessary change to allow for the required files to be pulled down:

We then ran GPUpdate /Force on W2012E and the affected system.

We were then able to click the Retry button on the error window and the needed content was downloaded.

We were then able to move on with our tasks!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Outlook: Cannot open this item. Outlook has already begun transmitting this message

We had a strange one this morning:

A couple of messages were stuck in the Outbox.

This site has some good troubleshooting tips:

• HowTo-Outlook: Message stuck in Outbox

However, after running through all of the steps Outlook eventually did step up and send the messages. Though, that happened when Outlook was _in_ Offline Mode.

It turns out that we now know why the Send/Receive process is being hung up:

Our Office 365 account was stuck?

Apparently there were no issues? Hmmm...

We tried to add the O365 account to a different system's Outlook and we hit this:

Using Men&Mice's awesome freebie online DIG tool we checked to make sure that AutoDiscover was indeed set up (which it was when we configured things back when).

So, at least at this point it is looking like the service is indeed having an issue.

And finally, after a huge pause Outlook's Send/Receive coughed up an error:

With the volume of e-mail we have flowing about right now having Outlook getting hung up on one of the mailboxes during Send/Receive is outright frustrating! :S

We removed the O365 account and sure enough Outlook has started sending and receiving without a hiccup.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Windows Server 2012 and Essentials: Error 80073718 on Update(s)

We may be seeing some issues in Windows Server 2012 and W2012E:

• TechNet Forum: Problems Installing WSE2012 Updates, Including Update Rollup 1
• TechNet Forum: Windows Server 2012 - Windows Update Error 80073718 on 5 updates
• TechNet Forum: server 2012 windowsupdate (sic) error 80073718

In the end the problem points to a "servicing stack corruption" with the OP needing to re-install the operating system from scratch.

While this may be a possible suggestion for a new server setup, those that have had their systems in production for any amount of time are left in a bit of a conundrum.

At this time there is no "fix" for the "problem".

So given that Microsoft would not recommend a third party action, our suggestion for those that have a full server setup in production is to look into running a Swing Migration. Fellow MVP Jeff Middleton's methodologies will preserve Active Directory, Group Policy, and more.

If the setup is a VM then there are a number of options one can pursue to Swing the AD off and back on again.

This method would save a good chunk of time as one would not need to migrate the local profiles over to the rebuilt domain nor have to deal with Group Policy Tattoos if one rebuilds with the same domain name. Plus, if there are on-premises services running in Exchange, SQL, and other Line of Business applications the time savings would be _huge_.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

BitLocker Encrypted Drive: Unable to Unlock

We have a number of external BitLocker encrypted drives that we use to tote around our business data with.

After plugging one of the drives into our newly stood up system with Windows Server 2012 RTM being slowly configured as a desktop we hit this:

Normally, a BitLocker encrypted drive gets plugged into any Windows Vista and above operating system and a prompt happens to unlock it for full access.

Double clicking on the drive in Explorer did nothing. Nada. Zippo.

In the end we had missed installing the BitLocker components on the machine:

Note that a restart would be required once the installer routine completed.

Sure enough, after the reboot we were prompted for the pass phrase after double clicking on the drive’s icon:

With BitLocker now included in Windows 8 Pro there is no reason why organizations that do move their desktop operating system platforms over to Windows 8 should not use BitLocker to encrypt every system and external storage device by default.

In fact, for any organization that has sensitive data housed on their systems the only thing stopping the migration to Windows 8 Professional would be Line of Business applications ... maybe. One could work around that with application virtualization or RemoteApps depending on the LoB.

The tools for BitLocker management are also available in Windows Server as well as a part of the Desktop OS Software Assurance and MDOP offering.

And one more thing: With the horsepower that today’s systems offer whole disk encryption as opposed to encrypting only contents is always the best option. BitLocker Content Only Encryption is a new feature in Windows 8.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

SharePoint: Enable Check-In and Check-Out plus Major and Minor Versions

We posted a little video on how to enable the check-in/check-out system and version tracking for SharePoint Libraries on our YouTube Channel.

Enabling Check-In/Check-Out and Versioning in a SharePoint Library

Note that one needs to be signed in as site owner/admin in order to make these changes.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

A Small Windows Server 2012 Issue

This issue is by no means business critical or threatening to bring down a Hyper-V Cluster or the like.

However, someone somewhere in Quality Control seems to have missed the boat on selecting items in the Roles & Features wizard:

Note how there is a Check Mark that seemingly indicates the full Role feature set has been installed.

Yet, when we click into that option we get:

It seems to us that since there are features within that Role that have not been installed the top level indicator should be the same as the one beside File and iSCSI Services (Installed) no?

This may be a minor thing, but most certainly indicators should indicate the correct status.

We don’t have a Windows Server 2012 R2 version up and running right now so can’t compare the two. Hopefully this little oversight has been fixed in the soon to be released product.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer