We’ve been seeing more and more issue regarding DNS with Server 2008. It seemed like if you restarted the cache/ or restarted the DNS service everything would start working right away. I later found that if you pinged the domain you were having trouble with on the client machines directly from the DNS server, that too would correct the connection issues for that one domain.

I later figured I would use forwarders for all external DNS requests as the company wasn’t having any issue before I setup their SBS. I hadn’t heard back from them.

After some investigation I found the cause of the problem to be a bug in the DNS cache information, where the Time To Live (TTL) on certain top level domains is incompatible with the minimum TTL allowed by Windows Server 2008 DNS, the information would expire but not be removed from the cache, making the information unusable by the DNS server, but not make it fetch new information, because it was still in the cache.

Basically there is two fixes. Either use DNS forwarders or edit a registry setting.

1. Start Registry Editor (regedit.exe).
2. Locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters
3. On the Edit menu, click New, click DWORD (32-bit) Value, and then add the following value:
4. value: MaxCacheTTL
5. Data Type: DWORD
6. Data value: 0x2A300 (172800 seconds in decimal, or 2 days)
7. Click OK.
8. Quit Registry Editor.
9. Restart the DNS Server service.

The next thing I did was to go look in the Error Event Log on the server. When I went to open the MMC for the server manager it came back with the error: 18ea3f92-d6aa–41d9-a205-2023400c8fbb. I tried a few other things that used MMC’s and almost all of them came back with that same error: 18ea3f92-d6aa–41d9-a205-2023400c8fbb.

After doing some searches most people gave up and redid their servers if they got this error. Some of the things they had suggested I tried. Still nothing.

I thought, I wonder if I remotely opened up the event viewer. I entered the server name.Voila! I could see all the errors.

After further inspections I found what seemed to be the error that started them all. It was Event 5173 – WAS. The error read:

• The Windows Process Activation Service encountered an error trying to read configuration data for config section ‘system.applicationHost/webLimits’ from file ‘\\?\C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config’, line number ’146′.  The error message is: ‘The configuration section ‘system.serviceModel’ cannot be read because it is missing a section declaration
  ‘.  The data field contains the error number.

I went to that folder and opened the machine.config file. It’s an XML file that contains a bunch of configuration information about the machine for .net. When I saw that file I figured that there was going to be some crazy ASCII characters in it. Everything seemed to be fine.

According to this Microsoft KB the server supposedly backs up files in another location. Don’t even bother. No dice.

I did notice in the C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG folder that there was a machine.config.default file. It was from several years ago and it was 2kb smaller then the current file which was 22kb. I renamed the current machine.config file  and called it machine.config.old and made a copy of the “default” file. I renamed it to machine.config.

I went into services and started World Wide Web service. It took a few seconds but it started! I then proceeded to go and start the rest of the services that should have auto started with the machine. They all started! I went and checked my Outlook client. The emails in the outbox had already left. Within about 20 minutes the mail was flowing again like it should have been.

Hopefully this helps anyone who had the same issues I had.

Following the successful installation of System Center Essentials 2007 SP1 on Windows Server 2008 Standard x86, we typically install Remote Web Workplace on the server as part of our System Center Remote Operations Manager deployment.

Just as with installing SCE on Windows Server 2008, there are a few tricks to installing RWW.

Conventions

In this post I use the terms <server> to indicate the NETBIOS name of the server on which we are installing RWW and <domain> to indicate the FQDN of the domain that the server belongs to.

Install Remote Web Workplace

1. Log on to your server as an administrator 
2. Run remoteww.msi from the Remote Operations Manager CD
3. Click Next at the welcome screen
4. Click Next after accepting the license agreement
5. Click Install
6. Click Finish after installation succeeds

Create an Application Pool to Support Remote Web Workplace

1. Start > Run > Inetmgr
2. Expand <server> and select Application Pools
3. Click Add Application Pool… in the right pane
4. Click OK after specifying the following settings:
   1. Name: Remote AppPool
   2. .NET Framework Version: .NET Framework v2.0.50727
   3. Managed pipeline mode: Classic
   4. Start application pool immediately: Checked
5. Click Advanced Settings… in the right pane
6. Change Idle Time-out (minutes) to 480 and click OK

It took me about a month to figure out why my Remote Web Workplace sessions were being dropped after 20 minutes.  Setting the idle timeout for the application pool is critical when using Remote Web Workplace with IIS7 on Windows Server 2008.  This value determines the maximum duration of a remote session.  If left at the default of 20 minutes, your connection will be dropped after 20 minutes and you will receive an error VBScript: an internal error has occurred.

Secure Remote Web Workplace 

1. Expand Sites > Default Web Site in the left pane
2. Select Remote and click Basic Settings… in the right pane
3. Click the Select… button
4. Select Remote AppPool in the Application pool dropdown and click OK
5. Click OK
6. Double click Authentication in the middle pane
7. Select Anonymous Authentication and click Enable in the right pane
8. Highlight Default Web Site in the left pane and click Bindings… in the right pane
9. Click Add…
10. Select https… in the Type dropdown
11. Select <server>.<domain> in the SSL certification dropdown
12. Click OK
13. Click Close

Test Remote Web Workplace

1. Open https://<server>/remote in a web browser
2. Accept any certificate warnings that may be issued by your browser
3. Log on to Remote Web Workplace using your network logon
4. Verify that you can connect to a server or desktop on your network

1. Open the Internet Information Services (IIS) Manager.

2. Double-click “Handler Mappings” from the main IIS screen.

3. Click on “Add Script Map.” to add "script mappings" handler for for c:\PHP\php5isapi.dll with extension *.php and answer "yes" to create "isapi and cgi restrictions" when prompted

4. Set your web site application pool to "Classic mode"

5. Add ISAPI filters to point to c:\PHP\php5isapi.dll

Done !!

Service Pack Cleanup Tool In Vista SP2 To Clean up Old RTM & SP1 Backup Files

The recently released Windows Vista SP2 has shown significant enhancement and improvement in terms of compatibility, reliability, performance, and speed compared to the earlier SP1. If users had noticed, after installing the Vista SP2, the hard disk’s space had been taken up substantially. This was mainly because a lot of old Vista RTM and SP1 backup files and components were not deleted upon the installation of new SP2.

To housekeep your hard disk and clean up those old and unused SP1 backup files, users probably can try the new Service Pack Cleanup Tool which is also named as compcln.exe. This successor for SP1 cleanup tool, Vsp1cln.exe, can easily remove all the system files (RTM & SP1) inherited from the older versions but replaced by Vista SP2.

Running this compeln.exe tool is pretty simple:

1. Click Start>All Programs>Accessories>Command Prompt or click Start>Run and type cmd to open Command Prompt Windows
2. Execute the command “Compcln.exe”. The path is “c:\Windows\System32 \compcln.exe”.
3. Users will be prompted a question whether to keep Vista SP2 permanently in the system.
4. Once users type “Y” and press enter, the system will start performing the windows components clean

After the cleansing process, users will notice the free hard disk space has increased substantially.

Depending on your background, you may find different sections of the newly published Microsoft Security Intelligence Report (SIR) to be of more interest.  In today’s post, we would like to highlight the section on infection rates based on the operating system (OS) version and the service pack level.  Microsoft has consistently observed that machines with newer OS and with more recent service packs are less likely to be infected by malware.  The graph below shows the number of computers having malware removed per 1,000 executions of the MSRT on that OS/SP during the second half of 2008 (2H08).

In the SIR, you will find the the following conclusions based on this data:

• The infection rate for Windows Vista is significantly lower than that of its predecessor, Windows XP, in all configurations.
• Comparing the latest service packs for each version, the infection rate of Windows Vista SP1 is 60.6 percent less than that of Windows XP SP3.
• Comparing the RTM versions of these operating systems, the infection rate of the RTM version of Windows Vista is 89.1 percent less than that of the RTM version of Windows XP.
• The infection rate of Windows Server 2008 RTM is 52.6 percent less than that of its predecessor, Windows Server 2003 SP2.
• The higher the service pack level, the lower the rate of infection. This trend can be observed consistently across client and server operating systems.

There are two reasons for this:

1. Service packs include all previously released security updates. They can also include additional security features, mitigations, or changes to default settings to protect users.
2. Users who install service packs generally maintain their computers better than users who do not install service packs and may also be more cautious in the way they browse the Internet, open attachments, and engage in other activities that can open computers to attack.

Server versions of Windows typically display a lower infection rate on average than client versions. Servers tend to have a lower effective attack surface than computers running client operating systems as they are more likely to be used under controlled conditions by trained administrators and to be protected by one or more layers of security. In particular, Windows Server 2003 its successors are hardened against attack in a number of ways, reflecting this difference in usage.

Continue http://blogs.technet.com/mmpc/archive/2009/04/21/malware-distribution-across-operating-systems.aspx

The first command installs the Server Key

start /w slmgr.vbs -ipk ABCDE-FGHIJ-KLMNO-PQRST-UVWXY

The second command activates

start /w slmgr.vbs -ato

There are two main things that you have to do to schedual Powershell scripts.

1. Allow Interactive Commands using set-executionpolicy command.
2. Put Powershell script in a ".ps1" file. You can use any text editor to make this.

The first thing you need to do is make sure that Powershell is set to execute Powershell scripts, instead of only allowing interactive commands to be run in the Powershell environment.

Type the following at the Powershell command prompt:

set-executionpolicy RemoteSigned

This will allow the system to run Powershell scripts that are created locally (Remote Powershell scripts that may be downloaded must be signed).

Once this is done, you can create your Powershell script using notepad. Just make sure you name the file with an extension of .ps1 . Now to run the script outside of its Powershell environment you type a command similar to the following:

powershell -command "& 'MyScript.ps1' "

Just put the above command into a .bat or .cmd file and schedule it like you would normally schedule a script to be run with Windows task scheduler.

At the command prompt type:

CD\Windows\System32
cscript scregedit.wsf /ar 0

If you typed it correctly it will display:

Microsoft Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.

Registry has been updated..

Next type:

cscript scregedit.wsf /ar /v

If you did things correctly the server will output:

Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.

System\CurrentControlSet\Control\Terminal Server fDenyTSConnections
View registry setting.
0

Next you will have to make sure that the firewall on the server has the propper ports opened to allow remote connections through. You do this by running another command.

C:\Windows\System32>netsh firewall set service type=remotedesktop mode=enable

If done correct it will output: ok

Netsh can accomplish many tasks, and one of those is to set a system’s IP address and DNS servers. Like the IPv4 Properties GUI that you’ll find in the full Server 2008 installation, Netsh lets you choose to either assign a static IP address or get IP information from a DHCP server. Using DHCP makes for a simpler command, so let’s start with that:

netsh interface ipv4 set address name="Local Area Connection" source=DHCP

DHCP is the default setting, so it’s more likely that you’ll want to set a static IP address. To do so, assemble a Netsh command on one line as follows:

netsh interface ipv4 set address name="Local Area Connection"
source=static address=X.x.x.x mask=255.255.255.0 gateway=X.x.x.x

Notice that the gateway is now optional. Some older versions of Netsh complained if you left the default gateway’s IP address off a Netsh command.

For example, to assign a static IP address of 192.168.2.2 on a /24 network with a default gateway address of 192.168.2.1, you’d type:

netsh int ip set address “local area connection” static 192.168.2.2 255.255.255.0 192.168.2.1

Finally, you’ll want to specify one or more DNS servers’ IP addresses that your Server Core system can use for resolving names. Netsh can do that, but the syntax is a bit unexpected: You use netsh int ip set dns to set the preferred DNS server and netsh int ip add dns to specify your additional choices. The syntax for setting the first DNS server is easier than for setting the IP address:

netsh int ip set dns “local area connection” static 10.50.50.4