Performance Analysis of Logs Tool

http://blogs.technet.com/b/spencervelastegui/archive/2010/09/01/performance-analysis-of-logs-pal-tool-version-2-0-released.aspx

SCCM OS Deployment via Web Page

Great article by Steve Rachui on creating a web page so that config choices can be made without needing access to the SCCM Console. Example and scripts are included

Get it here

Images : File based Vs Sector Based; What's Best?

Good Series of blog posts over on the Springboard blog detailing a for / against comparison for the various deployment methods

Part 1 : The terms and WIndows tools primer

Part 2 : The pros and cons

Part 3: Deploy-time Build Automation and Recommendations

SMS / SCCM Client push scenarios

Different scenarios when installing SMS / SCCM client in secondary sites.

Core Configurator 2.0 released

Core Configurator 1.0 was a god-send when setting up my Win 2008 R2 Server Core Hyper-V cluster. v 2.0 has been released and looks even better, due to it being written in Powershell 2 and uses Winforms, to give it that GUI some people seem to like :)

Getting Google Calendar Sync tool working with Outlook 2010

This one requires a bit of hacking using a hex editor, so only do it if you feel confident/competent/brave enough to do :)

You'll need HxD for this one.

And instructions are here http://www.addictivetips.com/microsoft-office/sync-google-calendar-outlook-2010-quick-fix/

ConfigMgr OSD: Always including certain files in your Boot Images -think Trace32

From 1e.com. How to include files in your OSD boot images

SCCM 2007 : OSD build and capture Task Sequence fails when applying OS

Found a great article when researching a problem I had trying to run a Build and Capture task sequence in SCCM 2007 SP2. Basically, when the sequence comes to apply the image, if the advertisement is set to run from the DP, it will fail with a 0x80004005 error. This is due to a NIC driver being installed, thus breaking the connection to the DP. One solution is to set the advertisement properties to download the content locally from the Distribution Points tab.

Article

Windows : Teracopy

Nice utility to speed up copying files from within Windows Explorer

Teracopy

Windows : Account Lockout Tools

Just had a nice error that had me a little stumped. I changed the password on the admin account that I use on to remote on servers around site, but it kept locking out. I've never had the problem before, so I was a little peeved. Anyway, using a combination of the linked Account Lockout Tools and Event Viewer on the originating DC to search for event 644 (User account successfully locked out), I managed to trace down the originating server.

1. From the extracted download, run LockoutStatus.exe
2. type in user to query
3. Check if account is locked. If it is, check Orig Lock column to determine DC that locked account
4. Connect to Security log of the DC in question
5. Filter output to search for event ID 644
6. Check through output to find the server/workstation performing lockout

If it isn't obvious when you log on to the offending machine what is causing the lockout, use the security event log on that system and search for failure events (id 529). Looking at these entries, you should be able to find the Caller Process ID, from which you can use Task Manager or Process Monitor from Sys Internals to track down the process concerned.

In my instance, it turned out to be a process called xf.exe, which in turns is the HP Management Infrastruture service, used for managing HP EVA's. I had a disconnected RDP session open to Command View, and it was this using the old credentials, which subsequently kept locking me out :(

Giving the session did the trick :)

SCOM 2007 R2 : Updated Documentation

The updated Managment Pack Authoring guide is now available for download from here

Resurrection

After nearly 2 years inactivity, I've decided to get back to bloging.

I didn't realise how much time bringing up a young one was, must say, it's the most enjoyable thing in the world :)

We'll see how long I kkep it up for !

Windows 2008 VM's and hiberfile.sys

I found that one of the Windows 2008 VM's on ESX VI3 was running out of space, and so I investigated. It turns out that there was a hiberfile.sys lurking on the system drive. I tried to delete, but wouldn't let me, I tried to find the option in Control Panel\Power Options, but nothing there. Turns out the following command needs to be run

powercfg.exe /hibernate off

Low and behold, the file is gone, and a few GB of disk storage is returned :)

Checked this on the Hyper-V W2K8 VM's, and it says that hibernation is not supported by the firmware, so not an issue.

Negative Ping Time on HP Proliant DL385 G2

Encountered an issue where installing W2K3 on a HP DL385 G2 caused some funnies. When trying to ping from the server, you'd get negative ping times. I didn't think too much about it as performance was OK and this was the only noticable issue. However, it turns out that there are issues with the timing on the AMD Opteron chipsets when using 2 or more cores. Windows 2003 uses the Time System Counter for timing, and this was being affected. Adding "/usepmtimer" to the BOOT.INI fixes this problem.

Find further discussion on the problem here.

PS. it looks like it could affect VM's on Hyper-V using 2 or more AMD processors assigned to it, installed with W2K3. I've added the switch to one such VM and it *appears* to have resolved the issue

Installing Windows Updates on Server Core

Here's a wonderful script that'll check what updates are required for your system, prompt if you want to install and go and do it if you so wish.

It's very handy for people like me, running Hyper-V on Server Core, who want to control when updates take place. On systems other than SC, it was easy to do, just run up the WUA client, but this script is a godsend for the SC devotee :)

If you want to see what Hotfixes are install on your system, try this

wmic qfe list (if you want better formatting, run wmic first, then enter qfe list)
WUA_SearchDownloadInstall.vbs

ESX 3.5 Update 2 Problem

It looks like users who've upgraded to Update 2 for ESX server 3.5 are having problems powering on or Vmotioning their VM's. It looks like a bug was introduced to the licensing code with update 2 that knackers up operations on VM's when the clock strikes 12 August 08 ! Already powered on VM's are OK, and although MS Patch day is today, with a nice raft of fixes, if the systems are set to auto update, it *should* be OK, as the system won't be powered off, just rebooted, but I would turn off DRS.

Turning off NTP on the host and setting the calendar to prior to the 12th fixes the issue, and it shouldn't affect the time on the VM's, apart from the fact the time could drift.

I bet MS are rubbing their hands together, you wouldn't get this kind of snafu with Hyper-V !:-0

More on this here.

Windows Media Player 11 install problems

I had a pretty tricky problem tring to install Windows Media Player 11 onto a couple of clients recently. Basically it kept failing, with the error code 0xc0000005 in the %systemroot%\wmsetup.log. To troubleshoot this, I extracted the setup files to a temp directory and tried to install each component separately to see what was causing the problem. Amongst the extracted files were a couple of exe's, umdf.exe and wmp11.exe. When I tried to run these I got the following errors every time. (extracted from the installer log file)


Hotfix started with following command line: /log:c:\temp\umdf.log
In Function GetBuildType, line 1170, RegQueryValueEx failed with error 0x2
CreateUserInterface: GetProcAddress for DefineInstallCustomUI failed: 0x7f
.
.
.
In Function TestVolatileFlag, line 12013, RegOpenKeyEx failed with error 0x2
.
.
In Function GetBuildType, line 1170, RegQueryValueEx failed with error 0x2
.
SetupFindFirstLine in LoadExclusionList Failed with error: 0xe0000102
.
Failed to query DriverPath of ROOT\LEGACY_AFD\0000 0x2
.
Waiting For watson First time ...


I tried all sorts of stuff after searching on Google, such as renaming Catroot2 dir, checking and resetting permissions on files and registry using the SubinACL tool and scripts as found here, but it didn't work.

I could have easily fixed the problem by reinstalling the system, but where's the fun in that, so I logged a call with MS PSS. After 1.5 weeks of trying various things, they sent me a link to the following www.support.microsoft.com/kb/822798. I tried the methods in order, the only one that worked for me was method 9, extracted from the support document...

To clear the temporary file and restart the hotfix installation or the service pack installation, follow these steps:
1. Delete all the tmp*.cat files in the following folders:%systemroot%\system32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE} %systemroot%\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
2. Delete all the kb*.cat files in the following folders:
%systemroot%\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}%systemroot%\System32\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}
3. Delete all the oem*.* files from the %systemroot%\inf folder.
4.
At the command prompt, type the following commands. Press ENTER after each command.
net stop cryptsvc ren %systemroot%\System32\Catroot2 oldcatroot2net start cryptsvcexit
5. Restart the failed hotfix installation or service pack installation.


Bingo, worked like a dream :)

Amazing Guitarist

Check out the skills of this guy.  I'll be watching out for him in future.

Restrict User Access to Null Pipes and Shares

There is the well known method of securing a Windows system from null session access http://www.sans.org/reading_room/whitepapers/windows/286.php, but there are additional steps that can be taken.

As part of a security mandate at work, we've been advised to delete the following values from the registry to further secure systems from anonymous access.

HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\NullSessionPipes
HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\NullSessionShares
HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\RestrictNullSessAccess

It can't be done via GPO, which is a shame, but can be done by a script. Easiest way is to do the following.

reg delete HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /v NullSessionShares /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /v NullSessionPipes /f
reg delete HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /v RestrictNullSessAccess /f

If you use Trend Server Protect, you can't delete the values TMRPC\AgentRPC or TMRPC\SPNTSVC from the NullSessionPipes or it won't work. I'm sure some nice VBScript could do the trick to get arounf this, but I don't need anything sophisticated.

I've done the registry mods on my system, and everything works OK, so happy days.

Quantum Of Solace

Great new trailer for the latest 007 film, Quantum of Solace, has been published. Can't wait for Nov 7 :)

See it here