Windows 7 Federated Search

2011-09-19T23:06:00.000-07:00

Windows 7 has a new federated search feature that queries remote data stores through Web servers, via the OpenSearch protocol, and enumerates the results as RSS or Atom XML feeds. Everything you need to know about extending the Windows 7 search index can be found on this MSDN article. To add Federated Searches to your computer you need to run .osdx files. Below is a osdx for flicker search.

A quick way to determine your bridgehead servers?

2011-09-19T18:47:00.000-07:00

You want to determine which bridgehead servers have been elected in each Active Directory site to troubleshoot replication issues? Use the following command: repadmin /bridgeheads

Forefront Threat Management Gateway - Workgroup Configuration with Exchange 2010

2011-09-14T01:34:00.000-07:00

In this post I will give you some information around publishing Exchange 2010 with Forefront Threat Management Gateway (TMG) or ISA 2006 and weather or not these servers should have domain membership. Microsoft's recommended deployment is that you add your TMG servers as members of your Active Directory domain. For the TMG setup whitepaper please see the following link. This whitepaper explains

Manipulating Text Strings in VBScript

2011-08-24T21:51:00.000-07:00

Here is a bunch of links that explain how to manipulate text strings in VBS. Mid Function: http://msdn.microsoft.com/en-us/library/wffts6k3(v=vs.85).aspx Right Function: http://msdn.microsoft.com/en-us/library/eh8fefz1(v=vs.85).aspx Left Function: http://msdn.microsoft.com/en-us/library/sk3xcs8k(v=vs.85).aspx These functions are to determine how many characters are in the string:

Connecting to the configuration partition of an LDS Instance

2011-08-10T23:03:00.000-07:00

LDS Instances like Active Directory also have a Configuration Partition and a Schema Partition. On TechNet it is documented: By default, the security principal that you specify as the AD LDS administrator during AD LDS setup becomes a member of the Administrators group in the configuration partition. http://technet.microsoft.com/en-us/library/cc731143.aspx How do I get to the configuration

ADAMSync Aging

2011-08-10T22:07:00.000-07:00

In this post I will describe Aging with ADAMSync. If you configure ADAMSync to replicate your Active Directory information to an LDS Instance, without aging deleted data from Active Directory will never be removed from LDS. For example if you delete a user object from your Active Directory database, this object will not be deleted from the LDS Instance when you run the next sync. The ADAMSync

How to find the server your DFS Namespace Client is talking to

2011-08-08T20:19:00.000-07:00

When setting up Distributed File System Replication (DFSR) between multiple file servers, you may want to know which file server your DFS namesace client is communicating with. To find this out use the DFSUTIL program with the pktinfo switch. Any ACTIVE TARGETSET servers are servers your workstation is currently talking to. dfsutil /pktinfo

Word Crashes Dell XPS 15z Laptop

2011-08-08T20:07:00.000-07:00

I just got a new Dell XPS 15z laptop. Microsoft word however continiously crashes generating the following error in event viewer: Log Name: Application Source: Application Error Date: 9/08/2011 9:42:22 AM Event ID: 1000 Task Category: (100) Level: Error Keywords: Classic User: N/A Computer: Clint-PC Description: Faulting application name: WINWORD.EXE, version: 14.0.4762.1000, time

AD Delegation - How to set default permissions for new group policy objects

2011-08-08T01:24:00.000-07:00

When setting up Active Directory delegation, you want administrators to be able to maintain Group Policy without being a Domain Admin. If you read TechNet, Microsoft tells you to use Group Policy Creator Owners, please see:http://technet.microsoft.com/en-us/library/cc776858.aspxLets test it. We have a user named Jess. Jess is only a member of the domain users group. We add Jess to "Group Policy

Single Instance Storage (SIS) gone

2011-08-03T22:08:00.000-07:00

In previous versions of Exchange 2003-2007 there was a feature called SIS (Single Instance Storage). This meant if an email was sent to multiple mailboxes in a distribution group, it would only get stored in a mailbox database once. When designing database layout it was recommended you group users of a similar operational role under the same mailbox database. This ensures when emails are sent

ADMT Unable to create or merge object

2011-07-28T21:10:00.000-07:00

I am performing domain migration and I ran into the following problem error in the migration logs for a user account:2011-07-29 13:37:35 WRN1:7665 Unable to create or merge object 'CN=Joe Blow,OU=My Users,DC=domain,DC=local' as another instance of ADMT is currently creating or merging the same object.I had started migrating Joe Blow to the new forest using ADMT but then realised I hadn't started

Making Domain Controllers cover more then one site

2011-07-27T22:33:00.000-07:00

When designing Active Directory sites and services, usually you decide which Active Directory site objects you want to place your domain controllers. Sites are usually mapped to physical locations but can also be logical depending on your design.However, there is a registry key on domain controllers that allows a domain controller to be authoritative for more then one site object in Active

ADMT is unable to connect to domain controller. 0x80070005

2011-07-27T22:16:00.000-07:00

I am performing cross forest migration from 2 AD forests, multiple domains into a new AD forest. When I added one of the domains within a source forest I received the following error:ADMT is unable to connect to domain controller\\domaincontroller.sourcedomain.local, in domain sourcedomain.local. Access is denied.(0x80070005)Morgan Che posted up multiple causes for this error on the following

Understanding how "Log On To" works

2011-07-21T22:36:00.000-07:00

In this article we will be having a look at how the Log On To list is populated. This is the list in windows XP/2003 where users can select which domain they are logging into from a drop down list.I decided to blog this as I spent a morning working out how this worked, and there is little documentation on the Internet.So where does this list come from?The logon list is stored from a DomainCache

Disable SID Filtering - Access is denied.

2011-07-21T01:04:00.000-07:00

I went and attempted to disable SID Filtering over some trust links to prepare for SID History during domain migration using the following command:netdom trust TrustingDomainName /domain: TrustedDomainName /quarantine:No /userD: domainadministratorAcct /passwordD: domainadminpwdhttp://technet.microsoft.com/en-us/library/cc772816.aspxWhen doing this I got the following error (click to enlarge):

Microsoft Sync Toy - Perfect for Home Users

2011-07-18T22:36:00.000-07:00

Today I stumbled across a fantastic little application called Sync Toy. Perfect for home users who want to backup data to a external drive on a regular basis, between computers or to mapped drive pointing to a cloud provider such as Windows Live.SyncToy 2.1 is a free application that synchronizes files and folders between locations. Typical uses include sharing files, such as photos, with other

Bind to AD using Alternative Credentials VBS

2011-07-07T18:27:00.000-07:00

Below is a VBS Script by MVP Richard L. Mueller which I found very useful. It shows you how to connect to Active Directory using alternative credentials.Please view his original post here:http://www.rlmueller.net/ADOAltCredentials.htmOption ExplicitDim objRootDSE, strDNSDomain, adoCommand, adoConnectionDim strBase, strFilter, strAttributes, strQuery, adoRecordsetDim strDN, strUser, strPassword,

List all OU's and Sub OU's using VBS

2011-07-07T18:23:00.000-07:00

Simple Script to list all OU's and Sub OU's using a VBScriptOn Error Resume NextConst ADS_SCOPE_SUBTREE = 2Set objConnection = CreateObject("ADODB.Connection")Set objCommand = CreateObject("ADODB.Command")objConnection.Provider = "ADsDSOObject"objConnection.Open "Active Directory Provider"Set objCommand.ActiveConnection = objConnectionobjCommand.Properties("Page Size") = 1000objCommand.Properties

The replication scope could not be set. For more information, see "DNS zone replication in Active Directory

2011-07-06T19:31:00.000-07:00

When configuring the DNS zones to replicate to all domains in the forest, instead of all domains just in the current domain the following error was experianced:"The replication scope could not be set. For more information, see "DNS zone replication in Active Directory" in Help and Support. The error was:There was a server failure.To understand where DNS is stored in Active Directory please see:

ILM Sample Code PrepareMoveRequest Exchange 2010 Cross Forest Mailbox Moves - Multi Forest

2011-07-06T00:19:00.000-07:00

Microsoft Identity Lifecycle Manager Service Pack 1 Feature Pack 1 (ILM 2007 SP1 FP1) can be used to pre-stage the user accounts with the appropriate attributes in a destination forest for cross-forest mailbox moves The out of the box GALSync MA cannot be used since it creates contact object instead of user object required for Online Mailbox Move. Microsoft has provided a sample code extension

stopped-error-limit

2011-07-06T00:09:00.000-07:00

I was using ILM (Identity Lifecycle Manager) to synchronize users cross forest to prepare for cross-forest mailbox moves using the sample code provided by Microsoft. Please see:http://www.microsoft.com/download/en/details.aspx?id=17741I was synchronizing over 5000 users to the new forest. Synchronization was failing with stopped-error-limit.I found out that MIIS / ILM and FIM only allow up to

Microsoft Office 2010 SP1 Released

2011-06-28T20:18:00.000-07:00

Microsoft Office 2010 Service Pack 1 has now been officially released by Microsoft as of June 28th 2011. The official KB for this release is 2460049 Download the 32bit version from here: http://www.microsoft.com/downloads/details.aspx?FamilyId=9D2E1282-8B69-418B-AFA0-9F61239EC8BE Download the 64bit version from here: http://www.microsoft.com/downloads/details.aspx?FamilyId=E9F3C2D0-C321-4910

WARNING: An unexpected error has occurred and a Watson dump is being generated: Failed to find the mailbox.

2011-06-22T00:02:00.000-07:00

In this post I'm going to address a very common problem many new Exchange 2010 Administrators face.When running commands such as Test-OutlookWebServices on an Exchange 2010 CAS you will receive the following error:[PS] C:\>Test-OutlookWebServicesWARNING: An unexpected error has occurred and a Watson dump is being generated: Failed to find the mailbox. Mailbox ='extest_0f9a03d82a6d4@

Error 49: ldap_simple_bind_s() failed: Invalid Credentials

2011-06-20T17:55:00.000-07:00

I have setup a Windows Server 2008 R2 server running LDS. I have an LDS Instance running on 10001 (LDAP) and 20001 (LDAPS).I added a user account using the following:dn: CN=testaccount,CN=Users,DC=domain,DC=ADAMchangetype: addobjectClass: useruserPrincipalName: testaccountcn: testaccountdisplayName: My Test AccountuserPassword: Passw0rdNote: As the requirement for special formatting of

Active Directory userAccountControl and LDS

2011-06-15T23:58:00.000-07:00

Active Directory user accounts have an attribute called userAccountControl which is used to control items such as Account Lockout, Account Disabled, Password Never Expires, User Cannot Change Password etc. This is determined by an integer value... based on the value the system knows which options are enabled and which are disabled. The value 512 is the base value for all normal user accounts.

0x2081 Multiple values were specified for an attribute

2011-06-15T22:55:00.000-07:00

I'm trying to import the following LDIF file into an LDS Instance using LDIFDE.dn: CN=SVCLDAPQuery,CN=Users,DC=testinstance,DC=ADAMchangetype: addobjectClass: useruserPrincipalName: SVCLDAPQuerycn: Service Now LDAP QuerydisplayName: Service Now LDAP QueryuserPassword: Passw0rdI am performing the import with the following command:ldifde -i -f SVCLDAPQuery.ldf -s localhost:10001This command throws

0x2077 Illegal modify operation. Some aspect of the modification is not permitted.

2011-06-15T21:50:00.000-07:00

I'm trying to import the following LDIF file into an LDS Instance using LDIFDE.dn: CN=SVCLDAPQuery,CN=Users,DC=testinstance,DC=ADAMchangetype: addobjectClass: useruserPrincipalName: SVCLDAPQueryuserPassword: Passw0rdNote: For ADAM, Microsoft enabled the userPassword attribute to function as a write-alias for unicodePwd and removed the requirement for the special formatting unicodePwd required.

Ldap error occured. ldap_add_sW: Object Class Violation

2011-06-13T01:13:00.000-07:00

I am performing ADAMSync from an Active Directory domain to an LDS Instance. My AD Domain Partition is called DC=Domain,DC=Local. My LDS Instance also has the same distinguished name of DC=Domain,DC=Local. When Syncing the following error is experienced:Processing Entry: Page 18, Frame 1, Entry 48, Count 1, USN 0Processing source entry Processing in-scope entry

LDS Active Directory Schema Status Unavailable

2011-06-13T00:13:00.000-07:00

Back when LDS (Lightweight Directory Services) was called ADAM (Active Directory Application Mode) there was a console known as "ADAM Schema" which was the ADAM version of the "Active Directory Schema" MMC console.Now with LDS the "ADAM Schema" no longer exists. Microsoft say to use "Active Directory Schema" for both LDS and Active Directory databases. For the TechNet article please see:http://

Allowing Domain Membership through a Cisco Firewall

2011-06-06T23:50:00.000-07:00

When setting up windows networks a DMZ must be created. This DMZ cannot contain any PC's that are a member of your internal Active Directory domain for security reasons. For your SME companies best practice is to generally configure all machines in your DMZ in a workgroup setup. For your enterprise companies best practice is to create a separate active directory forest for your DMZ. This allows

Alternate Witness Server in Database Availability Groups

2011-06-06T20:16:00.000-07:00

In this post we will look at the Alternate Witness Server - what is it? The Alternate Witness Server provides a replacement witness server for a DAG to use after a datacenter switchover. When you are performing a datacenter switchover, you’re restoring service and data to an alternate or standby datacenter after you’ve deemed your primary datacenter un-usable from a messaging service perspective

Exchange 2010 Max Message Size Precedence

2011-06-06T19:37:00.000-07:00

In Exchange 2007/2010 you can set SMTP message size quota's in 3 locations:- Global Settings (Set-TransportConfig)- Receive Connectors (Set-ReceiveConnector)- Send Connectors (Set-SendConnector)But which of these have Precedence?The more restrictive limits always take precedence.If you set the SMTP message size quota on a receive connector to 50MB but leave the TransportConfig quota to 10MB -

The security database on the server does not have a computer account for this workstation trust relationship

2011-06-02T01:24:00.000-07:00

After joining a new Windows Server 2008 R2 member server to the domain I was not able to log in, even with a Domain Admin account. The following error was experianced:The security database on the server does not have a computer account for this workstation trust relationshipAfter some investigation it turns out the computer new computer account did not have a SPN (Service Principal Name). This is

Continuous Replication Block Mode vs Continuous Replication File Mode

2011-05-31T19:58:00.000-07:00

Exchange 2010 RTM only supported Continuous Replication File Mode.Exchange 2010 SP1 now supports Continuous Replication Block Mode.Ok so whats the difference?Continuous Replication Block ModeA form of continuous replication that replicates blocks of ESE transaction data between the ESE log buffers on the active mailbox database copy to replication log buffers on one or more passive mailbox

TechEd North America 2011

2011-05-31T19:31:00.000-07:00

In case you missed TechEd North America 2011, or were there and missed some sessions, you can download slide decks and watch presentations from the following location:http://channel9.msdn.com/Events/TechEd/NorthAmerica/2011Here are a list of all Exchange presentations:EXL302 Archiving and Discovery in Microsoft Exchange 2010 SP1 and Exchange Online (Krish Sundaresan)EXL305 Best Practices for

Exchange 2010 Active Sync Feature Comparison

2011-05-31T19:23:00.000-07:00

I found an excellent article today listing all the features of Exchange Active Sync and which features are supported by what mobiles. Please check this article out here:http://en.wikipedia.org/wiki/Comparison_of_Exchange_ActiveSync_Clients

Exchange Active Sync Logo Program

2011-05-30T01:59:00.000-07:00

Customers have been telling Microsoft for quite some time that one of their top concerns is the increasing diversity of mobile devices that employees use to access company networks. While most mobile devices use EAS, the industry standard for mobile email, EAS policies are not consistently implemented by the mobile device manufacturers. This makes it challenging to know which EAS management

Advanced DNS Active Directory Questions

2011-05-30T00:59:00.000-07:00

One of my clients has 3 Active Directory forests each with multiple domains. Stub zones are in place for the forest root domain in each forest which are stored in each DomainDNSZone for each forest. When a DNS client wants to resolve a hostname for a host in a child domain in a different Active Directory forest it is using recursion referencing the root DNS server (from the Stub Zone) and

Initializing MAPI session object failed

2011-05-26T22:44:00.000-07:00

I had a user who upgraded from a previous version of Outlook to Outlook 2010. Whenever they open an Outlook email they recieve an error "Initializing MAPI session object failed." After clicking OK the email opens.This is resolved by going to C:\Windows\System32 and renaming mapi32.dll to mapi32.dll.old. Then run a tool called fixmapi.exe under C:\Windows\System32. This will generate a new

Pitfalls to Virtualizing Exchange 2010

2011-05-22T20:27:00.000-07:00

Exchange performs best when it can interact with the physical components of a server directly. If you disagree with this statement that’s usually a symptom exhibited right after a vmware conference - hopefully it will go away.Before I go into the pitfalls, let me say I love virtualization - most of my Exchange 2010 deployments are virtualized. Virtualization is fantastic for small deployments of

Insight into the Ignore Feature in Outlook 2010

2011-05-21T23:14:00.000-07:00

In this blog post we will take an insight into how the Ignore feature in Outlook 2010 works. The Ignore feature excludes you from conversation threads your not interested in. If your new to the Ignore feature please read the following URL:http://office.microsoft.com/en-us/outlook-help/ignore-all-e-mail-messages-in-a-conversation-HA010361232.aspxWhere are Ignore rules stored?Ignore rules are

MapiExceptionMailboxInTransit: Unable to open message store. (hr=0x80004005, ec=1292)

2011-05-02T18:41:00.000-07:00

ProblemI am performing cross-forest migration and I am having a had an issue when attempting to perform cross-forest mailbox moves.A "user" for each "mailbox user" in the source forest exists in the destination forest. These objects were created by Identity Lifecycle Manager. These "user" objects were then prepared to be "mail users" by using the Prepare-MoveRequest.ps1 script for each user using

NotifyChangeDirectory throws INSUFFICIENT RESOURCES

2011-05-02T07:40:00.000-07:00

We had an application called Kentico CMS which we deployed on Windows Server 2008 R2 with IIS 7.5.Looking in the event log for the app, it's getting "File change notification errors" and tracking (causing the restarts) it with ProcMon we see:NotifyChangeDirectory calls being made - for a while they succeed and then they start throwing INSUFFICIENT RESOURCES in the status.The following errors were

MSExchangeIS EventID 1121 and 5000

2011-04-24T23:25:00.000-07:00

I had an issue today where the Information Store service would not start on any Exchange 2010 server. When you went to start the Information Store service the following error appears:Windows could not start the Microsoft Exchange Information Store on Local Computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to

Exception: The Active Directory user wasn't found

2011-04-19T07:21:00.000-07:00

I was doing work for a client who recently just had their single Exchange 2003 server upgraded to an Exchange 2010 clustered environment.When trying to access a public folder database using the new ExFolders tool (the replacement for PFDavAdmin) the following error was experianced:An error occurred while trying to establish a connection to the Exchange server.Exception: The Active Directory user

Why is my server blue screening?

2011-04-14T00:18:00.000-07:00

Why is my server blue screening?Lets analyze that crash dump...How to analyze a dump fileVSApiNt.sys = Trend MicroWhy am I not surprised.Seriously over that product... the amount of Trend Micro related problems I have seen over the past few years I can honestly say if it was a choice between Trend Micro on your servers and no antivirus, I would take no antivirus.

How to Meet Payment Card Industry Data Security Standard Compliance

2011-04-13T19:36:00.000-07:00

Payment Card Industry Data Security Standard (PCI DSS) is a complex set of rules and requirements that applies to every person, business or organisation that handles credit card data. This includes any person, business or organisation that receives, stores, processes or transmits credit card details.The PCI DSS is a product of the Payment Card Industry Security Standards Council, an organisation

Exchange 2003 Mailbox Manager Policies

2011-04-10T20:50:00.000-07:00

Mailbox management recipient policies are a set of configurable rules that run on a schedule and that evaluate the mailboxes on the local server. The policy uses rules to filter all the recipient objects and to selectively apply mailbox management settings to messages in folders that go past the limit of the predefined rules.The mailbox management process detects folders in a mailbox that contain

Whats the difference between ACL, ACE, DACL and SACL?

2011-04-10T19:16:00.000-07:00

A security descriptor contains two access control lists (ACLs) used to assign and track security information for each object: the discretionary access control list (DACL) and the system access control list (SACL). Discretionary access control lists (DACLs). DACLs identify the users and groups that are assigned or denied access permissions on an object. If a DACL does not explicitly identify a

UserProxy Class and ADAM / LDS

2011-04-08T03:22:00.000-07:00

In this blog post I will be talking about the UserProxy Class which is used to create UserProxy Objects in ADAM / LDS Partitions.ADAM = 2003 and prior nameLDS = Windows Server 2008 nameADAM = Active Directory Application ModeLDS = Lightweight Directory ServiceThey are both the same thing!For LDS to forward authentication requests onto Active Directory we need to use UserProxy objects. These are

Exchange 2010 RPC Encryption

2011-04-03T21:13:00.000-07:00

Exchange 2010 RTM had RPC Encryption enabled on the Client Access Servers by default. This meant outlook 2003 clients needed to be configured to support MAPI Encryption by configuring the outlook profile.In Exchange 2010 SP1 RPC Encryption is now disabled by default.However if you upgrade an Exchange 2010 RTM server to Exchange 2010 SP1 RPC Encryption will remain enabled.Only fresh installs of

OWA 2010 - You don't have permission to open this page

2011-03-31T22:14:00.000-07:00

I just performed cross-forest migration of a number of mailboxes. Mailboxes come across as "linked" mailboxes linking to the account in the source forest. To link the mailboxes to the new user account in the destination forest I used the Disable-Mailbox command to unlink the mailbox from the old account followed by the Connect-Mailbox to link the mailbox to the new user account in the destination

computer share

Protecting Your Data

The Convenience of Tablets

Reasons to purchase Laptops and laptop computer Computers

Plug Computers Computers in the Socket

Get the Best Position with SEO Agency

Trend Micro - Find the Trend Server

Connecting to a single AD Object

Windows 7 Manageability and Performance Enhancements