Archive | April 2012

Check Windows Machine Account Status / Reset Machine Password

Quick one for troubleshooting domain communications with a local machine.

Checks the domain a machine is registered to:

nltest.exe /parentdomain

Tests Machine Health with Domain Controller:

nltest.exe /sc_query:fqdn.domain.name

Reset Machine Password:

nltest.exe /sc_reset:fqdn.domain.name

Installing SCCM 2012 RTM the hard way | Thoughts and Notes

I needed to get a SCCM 2012 lab setup for my company. As this was a newer MS product I figured the install wouldn’t be that bad. Well it’s a pre-req / pre-configure nightmare.

Here is my loose and possibly incorrect way that I got a lab running.

Few notes about my deployment

  • Dedicated Server for SQL Server
  • Dedicated Server for CAS Site

 

Prep SQL Server box:

  1. Installed SQL 2008 R2
  2. Installed SQL 2008 R2 SP1
  3. Installed SQL 2008 R2 SP1 CU5
  4. Add the Machine account for the CAS server to the local admin’s group of your SQL server (only needed if installing on dedicated SQL Server).
    • net localgroup administrators tprod\tmem03$ /add
      • Where tprod\tmem03$ is domain\machinename$

Prep CAS Box:

  1. Setup IIS (all checkboxes including ASP), .NET 3.5.1, and RSAT Tools on CAS Box
  2. Run the commands listed on this page:

image

I had the above mentioned pre-reqs after going through the installer. I will list out the things I did to reslove these so you don’t have to go through the installer only to cancel out and reslove this requirements. (I wish Microsoft had done a better job at this installer. I thought they had learned, I thought wrong)

Failed Items:

  1. Microsoft Remote Differential Compression (RDC) library required
    • Simply check off “Remote Differential Compression” under features in Server Manager.
  2. Site server computer account administrative rights
    • Self resolved after installing items 1 and 3 on this list.
  3. Minimum .NET Framework version for Configuration Manager
    • Resolved by installing .Net 4.0 Full Installer

Warning Items:

  • Schema Extensions
    • Resolved by installing Schema
      • Found here: mu_system_center_2012_configuration_manager_x86_x64_dvd_816412\SMSSETUP\BIN\I386
      • Run from command prompt: extadsch.exe
      • Then check log file at root of c:\ExtADSch.log
      • Look for:
        • <04-10-2012 13:26:53> Successfully extended the Active Directory schema.
  • WSUS SDK on Site Server
  • Verify site server permissions to publish to Active Directory
    • Get ready for this one….
    • OK first, open ADSIEdit.msc (if not installed, install it)
      • Right Click, Connect To
      • Take the detaults and click OK
      • Expand Default Naming context
      • Expand your domain
      • Expand CN=System
      • Right Click -> New -> Object
      • “Container” as the class

image

      • in VALUE put “System Management”

image

    • Then Click Finished
    • Right Click on new “CN=System Management” Folder -> Properties -> Security [TAB]
    • Click ADD
    • Click OBJECT TYPES
    • Uncheck everything, check only computers click ok

image

    • Type the NETBIOS name of the SCCM Server with a $ sign at the end of it. (Example: tmem03$)

image

    • Check off Full Control
    • Click APPLY (don’t close window)
    • Click Advanced
    • Find new ACL for our Computer Object

image

    • Click Edit
    • Change Apply To: from “This Object only” to “The object and all descendant objects”

image

    • Click OK three times to exit pop up windows.
    • Close ADSI Edit

 

  • SQL Server security mode
    • It was just warning me about SQL authentication, I ignored as it’s a lab
  • Configuration for SQL Server memory usage
    • It wants me to set a max limit on memory, I resolved this warning by setting the limit to 2GB (out of 4GB in my lab).
  • SQL Server process memory allocation
    • It tells me Configuration Manager 2012 REQUIRES that I set a minimum of 8GB for CMS and Primary sites (4GB for Secondary). I am just going to ignore it as it’s a “warning” and not a error.

 

Installing Configuration Manager:

  1. Run the unified installer
  2. Selected Custom Local Install
  3. Selected to install Configuration Manager
  4. Selected to install a Configuration Manager Central Administration Site
  5. Used Eval Licensing
  6. Accepted EULAs
  7. Selected a path for downloads
  8. Selected all Server Languages
  9. Selected all Client Languages
  10. Selected to use all Languages for mobile devices
  11. Setup CAS site code for a site named “Lab Central Admin Site”
  12. Kept default install folder
  13. Checked Install the Configuration Manager Console
  14. I put the dedicated SQL server
  15. Named the DB, “CM_CAS”
  16. Left the SSB Port at default
  17. Left the SMS Provider on the box I am going to install SCCM to.
    • I was debating if I should install directly to SQL or not.
  18. And clicked Next to install

image

Fix: The WinRM settings are not configured correctly | SCCM Unified Installer

Microsoft just released SCCM 2012 to VL customers. Very excited to tear into it. However I got stuck right in the beginning of the installer with:

The WinRM settings are not configured correctly

image

Well looking at the logs here:

\Users\<user>\AppData\Local\Microsoft System Center 2012\Unified Installer\LOGS

I discovered:

[4/10/2012 9:20:08 AM] DEBUG – Server: localhost, winrm\client\auth\CredSSP = False

All you need to do to fix this is run the following commands on the computer you are running the installer from:

winrm set winrm/config/client/auth @{CredSSP="True"}

winrm set winrm/config/client @{TrustedHosts="*"}

Also run these commands on the computer you are installing too (if it’s the same box just run all commands)

winrm qc -q
winrm set winrm/config/service/auth @{CredSSP="True"}
winrm set winrm/config/winrs @{AllowRemoteShellAccess="True"}
winrm set winrm/config/winrs @{MaxMemoryPerShellMB="2048"}

That should take care of you. Just in case it doesn’t the old other thing I had done was to add .Net 3.5.1, all RSAT Tools, and IIS from Roles and Features.

Hope it helps. If it does please leave a comment below and let me know this was worth my time posting 😉

Windows 8 | Task Manager Performance Monitor

While I have to write a longer post about my overall feeling of Windows 8 and Metro I wanted to toss this one out there.

THANK YOU Microsoft for the Task Manager Performance Monitoring built it. Look how sexy and plan English my transfer rate is for copying a number of large files to my desktop (click for larger version):

image

Just fantastic, shows me the CPU is doing fine as it decompresses directly from network share and shows me that Network is in fact the bottleneck as the Disk I/O is not maxed.

Installing Exchange 2010 in a Child Domain

If you are reading this its likely you googled for the answer to this very questions. “How do I install Exchange 2010 in a child domain?” Its almost like every step of the way you get another ambiguous error message.

Well if you know what to do its fairly easy.

1) Make sure you have an account that is NOT the administrator account that has Enterprise Admin, and Domain Admin of the ROOT domain.

2) Logon to a Windows 2008 x64 / or 2008 R2 x64 box that is a member of the ROOT domain. If you don’t have one just build one or temporarily move the new exchange server into the ROOT domain long enough to preform the following steps.

3) Logged in as your service account with Enterprise Admin and Domain Admin rights to the root open a command prompt (run as administrator if UAC is enabled).

4) Go to the directory you have the Exchange 2010 install located. I recommend using a direct Exchange 2010 SP1 install build.

5) Run the following command

ServerManagerCmd -i RSAT-ADDS

6) Reboot

7) Run the following command (Prep Legacy Permissions)

setup /pl

image

8) Run the following command (Prep Schema)

setup /ps

image

9) Run the following command (Prep Domain and Name Org)

setup /p /on:TestlaCorp

Note: TestlaCorp is my test domain org name, please enter your desired org name.

image

9) Run the following command (Prep all Domains)

setup /preparealldomains

image

10) Follow these directions from the ROOT DC Domain Controller: (not totally sure this is required or not, skip and only do if you run into an issue)

http://support.microsoft.com/kb/978776

11) Now go to your new exchange server box (rejoin it to the child domain if you had moved to the ROOT domain for the above commands).

10) Logon as that ROOT account with Enterprise Admin and Domain Admin for the ROOT domain. You will need to grant it local admin rights on the new child domain server you are planning on installing Exchange 2010 to ahead of logging in.

11) Run the setup as you normally would do. I usually follow this blog for those steps:

http://www.enterprisenetworkingplanet.com/datacenter/Installing-Exchange-2010-Step-by-Step-3877601.htm 

Final Notes: I noticed after installing that I was getting an error opening the EMC and it turns out it was just that the installer some how didn’t install any of the roles. Re-running the install fixed that.

Windows NPS Stops Authenticating Wireless Users

Had a funny issue raised from the helpdesk today. All of a sudden all of our Wireless users were no longer to connect to the internal wifi network that was protected by 802.11x PEAP via Merkai -> RADIUS -> NPS (Network Policy Server) -> Active Directory.

We had errors like this:

“Network Policy Server discarded the request for a user.”

“An internal error occurred. Check the system event log for additional information.”

And of course the logs at c:\windows\system32\logfiles had nothing of value in them.

Another thing was that Event Logging from NPS stopped although the service was still running.

CAUSE:

It turns out it was just because the certificate NPS uses was renewed automatically thanks to GPO / AD. NPS doesn’t handle the transition well.

FIX:

All you have to do is change the certificate to another certificate and back to the one that was auto renewed. if you only have one then create another, change it to that, then swap back to the correct auto renewed on.

If you don’t know where to select it, it is under Policies -> Network Policies -> <your policy that grants users access) -> Constraints tab -> Authentication Mode -> Microsoft: Protected EAP (PEAP) [EDIT]

image