Proxy policy issue

I need to have one object of the Zenworks "Windows Group Policy" not pushed
to the user machine. I do need to utilize the rest of the group policies
on my Windows XP workstations though.
The policy, on Windows group policy manager, is:
-User Configuration
-Windows Settings
-Internet Explorer Maintenance
-Connection
-proxy settings
Is there a way to have this particular or at least the -Connection policies
not pushed?

[email protected],
>I need to have one object of the Zenworks "Windows Group Policy" not pushed
>to the user machine. I do need to utilize the rest of the group policies
>on my Windows XP workstations though.
No, there is no way to filter policies as you can in Domain Group Policies
with AD.
Jared Jennings - Data Technique, Inc.
Novell Support Forums Sysop
My Blog and Wiki with Tips, Tricks, and Tutorials
http://jaredjennings.org

Similar Messages

Exchange 2010 to 2013 Migration: Authentication/Proxy Settings Issue

I'm in the final stages of preparing for our Exchange 2010 to 2013 migration. I'm noticing minor authentication issues on mobile devices (android & ios) and proxy setting issues with Outlook that require user intervention. In an effort to make the migration
as smooth as possible for our internal users, I'd like to get these settings ironed out before starting the migration.
Symptoms:
Outlook - I'm aware that internal Outlook usage has changed its connection protocol from RCP/TCP to RCP/HTTP, but it appears that Outlook isn't updating its settings in the "Microsoft Exchange Proxy Settings" after a users mailbox has been migrated
from 2010 to 2013. Currently, 2010 users with Outlook 2013 have the following settings configured in Outlook's Exchange Proxy Settings:
URL to connect to my proxy server for Exchange: webmail.domain.com
Connect using SSL only: Checked
Only connect to proxy servers that have this principal name in their certificates: Unchecked
On fast networks, connect using HTTP first, then connect using TCP/IP: Unchecked
On slow networks, connect using HTTP first, then connect using TCP/IP: Checked
After migrating a user's mailbox from 2010 to 2013, the above settings remain the same in Outlook and their client disconnects from Exchange and isn't able to reconnect. After manually enabling the checkbox for "On fast networks, connect using HTTP
first, then connect using TCP/IP", Outlook clients are able to connect to Exchange via their newly migrated mailbox.
Is there a way to automatically updating these 2 proxy settings in Outlook during the migration instead of having to manually change each user's configuration in Outlook?
Android & iOS - Currently, users on Android & iOS with Exchange 2010 mailboxes have the following configuration:
domain: blank
username: their AD username
server: webmail.domain.com
After migrating a mobile users mailbox from 2010 to 2013, neither OS (Android or iOS) is able to connect due to an authentication failure. On iOS, if I manually change the domain from blank to my company's domain, authentication succeeds and their 2013 mailbox
begins to update. On Android, the option to change the domain name from null is grayed out, requiring the user to delete the Exchange profile and re-add it with the domain name intact. Is there a way to configure Exchange 2013 to not require the domain name
for mobile users in the same way that it's been working for us with Exchange 2010?
Please let me know if you require cmdlet print outs of my virtual directories to help troubleshoot the issue.

Hi,
Generally, when the user mailbox is moved from Exchange 2010 to Exchange 2013, the Autodiscover service would detect the changes and update the new configuration automatically.
Please make sure the autodiscover service in your new Exchange 2013 is configured correctly. We can create a new mailbox in Exchange 2013 and check whether the new Exchange 2013 user can setup account successfully in Outlook or not. If the new user works
fine, it indicates the autodiscover service in Exchange 2013 should be proper for internal user.
Please restart the following Exchange service to have a try:
Microsoft Exchange RPC Client Access
Microsoft Exchange Mailbox Replication
Restart IIS service by running IISReset in a Command Prompt window.
Then check whether the Outlook client can connect to Exchange 2013 or not.
As for Android & iOS issue, I suggest we can ask a question in ActiveSync forum for more suggestion:
https://social.technet.microsoft.com/Forums/en-US/home?forum=exchangesvrmobility
Regards,
Winnie Liang
TechNet Community Support

Access policy issues and daylight savings

I have the WRVS4400N. I have purchased a few Linksys routers in the past and have been happy with their operation. The wireless access however, was mediocre until I purchased this model. This model has great a great wireless connection. I like the fact that I can make many changes to the settings on the router without having to reboot the router. The performance of this router in combination with the cable modem has been excellent. It far outperforms the equipment that it replaced. I will normally pick a linksys product over another brand.
I am having 2 intermittent issues that are really causing me grief and an additional couple of annoying issues. I need help in fixing these issues. I have confirmed that I have the latest firmware version.
1) Some computers do not have connection to the internet. As if the security policy is confused about the time or connection. I really think this is a security policy issue, but I will let you decide.
2) There are some computers that I allow a 24/7 connection to the internet. For the rest I don’t want them to have access between the hours of 12a-6a. I have found that the connection doesn’t always shut-off. I have kids and do not want them to have access during those hours. I never had problems with my previous linksys router.
3) I am unable to set an access policy that spans the 5 min between 11:55p and 12a. In my previous linksys router I could.
4) The new daylight savings schedule is not part of my current firmware. This really threw off my security policies.
I have found that if I reboot or if I simply goto the security policy screen and click on save settings it seems to correct itself. But, I shouldn’t have to babysit it to make sure that it’s working correctly. When I am out of town I need to know that my security policies will continue to work while I am away.
Here’s my set up:
1) I have a linksys cable modem that connects me to the internet through my cable provider.
2) I have the linksys wireless (WRVS4400N) router that connects to the cable modem.
3) I have a 3Com Superstack II switch as the backbone of my network which connects to the router.
4) I have several devices connected to this router: computers, xbox, vonage phone line.

This is EXACTLY what my router is doing...
2) Access restrictions do not work, PERIOD...."ALLOW" will disable internet access for the entire subnet (regardless of the rule), and "DENY" will prevent uploading of file attachments to hotmail, myspace, facebook etc....for every computer on the subnet.
Message Edited by DSMKilla on 10-26-2008 11:08 AM
(Edited post for guideline compliance. Thanks!)
Message Edited by JOHNDOE_06 on 10-26-2008 11:39 AM

2008R2 IE 11 Group Policy Preference Proxy Configuration Issues

I've been mulling this problem over for a while and I finally have to accept I can't use IE Maintenance anymore for managing proxy settings. I've been reading up on how to make Server 2008 R2 work with GPP settings for IE 9 - 11. Everything I've
read says I need to install the .admx files (link below) or install IE 10+ to get the IE Preferences to show up for 9, 10, and 11. But when I look at my .admx files in %systemroot%/PolicyDefinitions it has the same exact .admx file that I download
from the Admin Templates. I can not see the policy preferences for IE 9, 10, or 11 and need these options so I can configure a Proxy server. How do I go about getting these preferences to become available in Server 2008 R2 SP 1?
#admx link
http://www.microsoft.com/en-us/download/details.aspx?id=36991
Note that I also tried the following to manually add support while testing but it didn't help me:
Open up the policy, and create an IE8 Preference: User Configuration --> Preferences --> Control Panel Settings --> Internet Settings --> New --> Internet Explorer 8 -> Set your proxy settings
Navigate to C:\Windows\SYSVOL\domain\Policies was an easier route, then sort by date for the recently created IE entry.
Navigate to User\Preferences\InternetSettings
Open up the "InternetSettings.xml file, and change the MAX value to something above 10.0.0.0 (I usually put 10.5.0.0). This way, the policy won't trip up later on if IE 11 comes out and doesn't support any of these policies, but at least you'll be safe
until 10.5.0, or until a hotfix is available. "
max="10.5.0.0"

> - Win 7 clients mysteriously show a configuration for IE 5 when I turned
> on the IE 10 GPP.
Although seemingly surprising, that's ok - Win7 GPP doesn't know that
IE10 GPP exists at all, so it defaults to whatever the programmer made
the default.
> It only displays a few items under it as being
> activated despite none of them being configured on the server side.
That I cannot confirm - here it displays exactly what is configured.
> - The home page option will not set on any version of windows.
Cannot confirm, too - that is what I tried with the IE10 GPP for Win7,
and it works. You know about the red/green lines and the F5...F8 thing?
> - From Win 8.1 RSAT GPO tools if you click ok on certain fields you'll
> get messages about check boxes on other screens then things like proxy
> settings will be permanently greyed out until you restart the GPO from
> scratch.
> - None of the advanced options for the proxy entries would take on the
> clients. Adding whitelist entries in the advanced option would blank
> out fields on other screens in the GPP.
That's a known bug in the proxy settings screen.
> My best explanation for this is that even though the 8.1 client has the
> options available the 2008 R2 server will not save and distribute them
> correctly.
Definitely - sorry - wrong. The Server (DC) doesn't know about the
contents of GPP, these are simple XML files the GP Editor writes to sysvol.
In fact, most CSEs store their settings in files on sysvol, and the DC
doesn't care about the contents of these. SOME of them (Wifi, eg) on the
other hand require AD objects, and this objects sometimes require a
specific schema version. But even in this case, the DC OS doesn't matter
- schema updates can be installed on downlevel OS versions, too.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Upstream proxy connectivity issue

Hi,
I have recently installed WSA S170 in one site which is pointing to one of the existing proxy. I have defined routing policy in new proxy through which some of the local domain is accessible through new proxy and rest of the domain will be through existing proxy.
User's are facing slowness when they are accessing other than local domain at the same time local domain is working fine.
I have disabled all scanning feature in new proxy for all other domain to avoid delay but still issue persist.
Connection flow.
For local Domain :
Client ----> New Proxy---> Internet
Other domain :
Client ---> new proxy---> Existing proxy---> Internet
Version information :
New proxy : cisco wsa s170 OS : 7.7.0 - 753
Exising proxy : cisco wsa s670 OS : 7.5.1 - 201
Is it becuse of dual proxy connection hapening for other domain?
Please suggest.
Regards
Chirag

Hi,
In cases wherein we have an upstream proxy, we need to make the following configuration on the WSA:
-- Go to 'Network' tab > 'Upstream Proxy' > Configure the Upstream Proxy
-- Go to 'Web Security Manager' > 'Routing Policy' > Configure a policy to use the Routing Destination pointing to the Upstream Proxy configured above.
-- If the upstream proxy is performing authentication, you will need to disable authentication on the Cisco Ironport Web Security Appliance.
Note: If the path to get to the software update site is also through the same upstream proxy, then Go to 'System Administration' > 'Upgrade and Update Settings' > Edit Update Settings > configure the Proxy Server section.
Do rate if Helpful----
Regards,
Kush

Group Policy issues

Hi All,
Am facing plenty of issues in Group policies.. Like when i run this command "gpresult /v" i could see the same policy applied in as thrice in applied group policy.. and that policy is default domain policy.. also trying to add one of intranet site
in Internet Group policy maintenance policy but its not reflected to users.. even i forced the policy.. Please advice me on this.
i have given the gpresult fyr.. some have a quick look and advice me accordingly.
Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001
Created On 3/6/2014 at 9:20:31 AM
RSOP data for OURDOMAIN\venkat2r on INBRLT141 : Logging Mode
OS Configuration: Member Workstation
OS Version: 6.1.7601
Site Name: N/A
Roaming Profile: N/A
Local Profile: C:\Users\venkat2r
Connected over a slow link?: No
USER SETTINGS
Last time Group Policy was applied: 3/6/2014 at 9:07:33 AM
Group Policy was applied from: INCHDC01.OURDOMAIN.com
Group Policy slow link threshold: 500 kbps
Domain Name: OURDOMAIN
Domain Type: WindowsNT 4
Applied Group Policy Objects
ourdomain_Policy_Customized
Global_Wallpaper
ourdomain_Policy_Customized
ourdomain_Policy_Customized
The following GPOs were not applied because they were filtered out
Local Group Policy
Filtering: Not Applied (Empty)
The user is a part of the following security groups
Everyone
BUILTIN\Administrators
BUILTIN\Users
NT AUTHORITY\INTERACTIVE
CONSOLE LOGON
NT AUTHORITY\Authenticated Users
This Organization
LOCAL
High Mandatory Level
The user has the following security privileges
Resultant Set Of Policies for User
Software Installations
N/A
Logon Scripts
N/A
Logoff Scripts
N/A
Public Key Policies
N/A
Administrative Templates
GPO: Global_Wallpaper
KeyName: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceActiveDesktopOn
Value: 1, 0, 0, 0
State: Enabled
GPO: ourdomain_Policy_Customized
KeyName: Software\Policies\Microsoft\Windows\Control Panel\Desktop\ScreenSaveTimeOut
Value: 54, 0, 48, 0, 48, 0, 0, 0
State: Enabled
GPO: Global_Wallpaper
KeyName: Software\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper
Value: 67, 0, 58, 0, 92, 0, 87, 0, 105, 0, 110, 0, 100, 0, 111, 0, 119, 0, 115, 0, 92, 0, 87, 0, 101, 0, 98, 0, 92, 0, 87, 0, 97, 0, 108, 0, 108, 0, 112, 0, 97, 0, 112, 0, 101, 0,
114, 0, 92, 0, 69, 0, 109, 0, 101, 0, 114, 0, 105, 0, 111, 0, 46, 0, 106, 0, 112, 0, 103, 0, 0, 0
State: Enabled
GPO: ourdomain_Policy_Customized
KeyName: Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage
Value: 1, 0, 0, 0
State: Enabled
GPO: ourdomain_Policy_Customized
KeyName: Software\Policies\Microsoft\Internet Explorer\Main\Start Page
Value: 104, 0, 116, 0, 116, 0, 112, 0, 58, 0, 47, 0, 47, 0, 115, 0, 116, 0, 97, 0, 114, 0, 46, 0, 101, 0, 109, 0, 101, 0, 114, 0, 105, 0, 111, 0, 99, 0, 111, 0, 114, 0, 112, 0, 46,
0, 99, 0, 111, 0, 109, 0, 47, 0, 83, 0, 105, 0, 110, 0, 103, 0, 97, 0, 112, 0, 111, 0, 114, 0, 101, 0, 47, 0, 100, 0, 101, 0, 102, 0, 97, 0, 117, 0, 108, 0, 116, 0, 46, 0, 97, 0, 115, 0, 112, 0, 120, 0, 0, 0
State: Enabled
GPO: ourdomain_Policy_Customized
KeyName: Software\Policies\Microsoft\Windows\Control Panel\Desktop\ScreenSaverIsSecure
Value: 49, 0, 0, 0
State: Enabled
GPO: Global_Wallpaper
KeyName: Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper
Value: 1, 0, 0, 0
State: Enabled
GPO: Global_Wallpaper
KeyName: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThemesTab
Value: 1, 0, 0, 0
State: Enabled
GPO: Global_Wallpaper
KeyName: Software\Microsoft\Windows\CurrentVersion\Policies\System\WallpaperStyle
Value: 52, 0, 0, 0
State: Enabled
Folder Redirection
N/A
Internet Explorer Browser User Interface
GPO: ourdomain_Policy_Customized
Large Animated Bitmap Name: N/A
Large Custom Logo Bitmap Name: N/A
Title BarText: ourdomain
UserAgent Text: N/A
Delete existing toolbar buttons: No
Internet Explorer Connection
HTTP Proxy Server: N/A
Secure Proxy Server: N/A
FTP Proxy Server: N/A
Gopher Proxy Server: N/A
Socks Proxy Server: N/A
Auto Config Enable: No
Enable Proxy: No
Use same Proxy: No
Internet Explorer URLs
GPO: ourdomain_Policy_Customized
Home page URL: http://star.OURDOMAIN.com/Singapore/default.aspx
Search page URL: N/A
Online support page URL: N/A
Internet Explorer Security
Always Viewable Sites: N/A
Password Override Enabled: False
GPO: ourdomain_Policy_Customized
Import the current Content Ratings Settings: No
Import the current Security Zones Settings: Yes
Import current Authenticode Security Information: No
Enable trusted publisher lockdown: No
Internet Explorer Programs
GPO: ourdomain_Policy_Customized
Import the current Program Settings: No
Thanks, Venkatesh. "Hardwork Never Fails"

Hi,
Before going further, I have to admit that I made a mistake and Paul is right.
>>But i am not able to change the security settings in IE like adding sites in Trusted sites its grayed out.
If we don’t want to allow users to change this setting, we can configure this setting via native policy and the following blog can be referred to as reference.
Internet Explorer 10 – Add Sites To The Trusted Sites Zone With Group Policy
http://johnfail.wordpress.com/2013/11/07/internet-explorer-10-add-sites-to-the-trusted-sites-zone-with-group-policy/
If we want to allow users to change this setting, we can configure this setting via GPP Registry.
Regarding this point, the following thread can be referred to for more information.
Add Trusted Sites Via GPO but still allow users to add trusted sites
http://community.spiceworks.com/topic/326140-add-trusted-sites-via-gpo-but-still-allow-users-to-add-trusted-sites
Best regards,
Frank Shen

ACE behind Reverse Proxy - performance issue

Hi,
I've got a config working to accommodate the required use of reverse proxy servers infront of my application servers. Traffic comes into the Front ACE and I insert a header "SRCIP" with the original client IP address which is preserved through the Rev Proxy servers and is then inspected on the Back ACE to create a sticky to a given application server/SRCIP pairing. The use of the RP's appears to require using the persistence-rebalance option otherwise the traffic get stuck to the wrong app server. The app functions perfectly with this config; however, there is a severe performance impact. Using load-runner, we see response times go from 1.5 seconds to 16 seconds for the same transactions comparing this config to a previous config which used static sticky to bind the RP to the app servers..
Question: Is there a better way to do this and remain dynamic, or some way to optimize this approach to reduce the performance impact.
Relevant Config for both ACE's here:
!!Front ACE
parameter-map type http HTTP_REBAL
persistence-rebalance
length-exceed continue
sticky ip-netmask 255.255.255.255 address source ALPHA-SRCIP-sticky
timeout 60
replicate sticky
serverfarm ALPHA
policy-map type loadbalance first-match vip-R1A-ALPHA
class class-default
    sticky-serverfarm ALPHA-SRCIP-sticky
    insert-http SRCIP header-value "%is"
policy-map multi-match PREP-VIP
class VIP-ALPHA-R1A
    loadbalance vip inservice
    loadbalance policy vip-R1A-ALPHA
    appl-parameter http advanced-options HTTP_REBAL
    ssl-proxy server SSL_ALPHA_R1A
!!Back ACE
parameter-map type http HTTP_REBAL
persistence-rebalance
length-exceed continue
sticky http-header SRCIP ALPHA-SRCIP-sticky
timeout 60
replicate sticky
serverfarm coresoms-ALPHAfarm
class-map type http loadbalance match-all SRCIP-MAP
2 match http header SRCIP header-value ".*"
policy-map type loadbalance first-match vip-lb-ALPHA
class SRCIP-MAP
    sticky-serverfarm ALPHA-SRCIP-sticky
policy-map multi-match lb-vip
class VIP-ALPHA
    loadbalance vip inservice
    loadbalance policy vip-lb-ALPHA
    appl-parameter http advanced-options HTTP_REBAL

Hi Joseph,
To achieve this you need to do stickiness based on some L7 parameter (either the header you are currently using or some cookie), so, whatever you do you will have to use persistence rebalance.
I have one possible theory for your issue.
The ACE has two different ways of treating the L7 connections internally, that we call "proxied" and "unproxied". In essence, the proxied mode means that the traffic will be processed by one of the CPU (normally to inspect/modify the L7 data), while, on the unproxied mode, the ACE sets up a hardware shortcut that allows forwarding traffic without the need to do any processing on it.
For a L7 connection, the ACE will proxy it at the beginning, and, once all the L7 processing has been done it will unproxy the connection to save resources. Before it goes ahead with the unproxying, it needs to see the ACK for the last L7 data sent. This wait, on a Internet environment can introduce around 100-200ms of delay for each HTTP request, which can end up adding into a very big delay. By default, if the ACE sees that the RTT to the client is more than 200ms, the connection will never be unproxied to avoid these delays, so I think we could fix your issue by tweaking this threshold.
From what you described, I asssume you don't have many connections (because they all come through a proxy) and that the connections will have a lot of HTTP requests inside. With that in mind, I would suggest setting the threshold to 0 to ensure to keep connections always proxied. To do this, you would nee to configure a parameter map like the one below and add it to your VIP
    parameter-map type connection
      set tcp wan-optimization rtt 0
Even though this setting may avoid your issue, it also has some drawbacks. The main one is that the ACE20 only supports up to 512K simultaneous L7 connections in proxied state (which includes also the connections towards the servers, so, it would be 250K for client connections), so, if the amount of simultaneous connections reaches that limit, new connections would be dropped. The second issue, although not so impacting, would be that the maximum number of connections per second supported would also go down slightly due to the increased processing needed.
I hope this helps
Daniel

Reverse Proxy + Policy Agent generates unwanted Basic Authentication

We have a policy agent installed on the SJWS 7.0u1. It's configured as a reverse proxy to a server running on another port on the same machine as the web server. The policy agent catches the request and redirects to the access manager, which authenticates fine. The access manager then redirects back to the web server, which then issues presents the basic authentication dialog. (We did not configure it for basic authentication).
In a previous post I was directed to check my DNS entries. Both servers can resolve each other without problem. I can type nslookup server.practicegreenhealth.org, nslookup server (these are the web server addresses) and they both resolve to the correct ip. I can type nslookup access.practicegreenhealth.org and nslookup access and they both resolve to the correct IP.
I had the application deployed as a JRuby application within the SJWS's servlet container and the setup worked fine. I switched back to using SJWS as a reverse proxy to application running as its own instance and am now presented with the basic auth dialog. I can hit the application fine both from the box it's running on and if I disable the policy agent. It's just the combination of the reverse proxy configuration + the policy agent that doesn't seem to work.
Edited by: phoehne on Jun 23, 2008 12:40 PM

what does the server error log say ? you might want to increase the log level to finest (config/server.xml change info to finest) and restart and look at the server error logs. this could provide us some insight on what is happening. most likely some config parameters in obj.conf need to be fine tuned.

ADFS 3.0 - Web Application Proxy configuration Issue

Hi All,
We are in the process of implementing ADFS 3.0 published to the internet for o365 Federation purposes.
The setup consists of the following
- 2 x windows 2012 R2 running ADFS 3.0 ( only one server presently installed and configured though)
- 2 x Windows 2012 R2 Running Web Application Proxy ( only one server presently installed and configured though ).
There is an F5 Big-IP load-balancer for both internal and external interfaces and it has been configured after a lot of issues with the SNI part on the F5.
So, in short the setup is now a single server hosting ADFS 3.0 using SQL and a single WAP server, however the traffic to these servers are still going through the LB.
Now the issue is that i cannot complete the installation/configuration of the Web Application Proxy server. There is a firewall in between our DMZ and the internal network. I can reach the internal services via the following url and telnet on port 443
to the federation service as well. (ports for 443 and 80) are opened to internal network on the load balancer ip . I can reach https://fs.domain.com/adfs/ls/idpinitiatedsignon.aspx and federationmetadata/2007-06/federationmetadata.xml location as well
from the Web APplication proxy server without any issues or certificate prompts at all.
When i do the configuration for WAP, i use the same account which was used as a service account for the ADFS service internally. If i use a local admin account, it errors out with another message stating the connection was closed.
The certificate on the internal server along with its private key was exported and has been imported on the WAP server . This is not internal CA, instead we are using DIGICERT SSL with SAN Names for enterprise registration and work folders. Hence the CA Chain
issue is ruled out and also this is not a wild card certificate.
When the wizard starts configuring, it does establish the trust with the federation service which is shown up in the event viewer with EventID 391 within 15 seconds i get another event id 422 which states that it cannot retrieve the proxy configuration
and eventid 276 on the Federation server which states the authentication failure. this continues until the servers stops to try configuring the wizard.
I have read all the available threads on the 3.0 WAP installation /configuraiton problem and tried all the steps possible but i am still stuck with this issue.
There is one more part that i noticed on the ADFS server, that the self signed services for the token-encrypting and token decrypting are self-signed certificates. Also, in the certificates it was showing up as not trusted. and i installed them to the TRUSTED
ROOT CERTIFICATION STORE after wich i cannot see any private key showing up when viewing the certificate which means i cannot get the MANAGE PRIVATE keys option when right clicking on the cert to assign read permissions for the ADFS service account.
Should i assign the same SSL sertificate (SAN based for enterpriseregistration & Workfolders) to the token-encrypting and token-decrypting services in ADFS console or should i leave them as self signed ? I did read that self-signed is not recommended for
production environment ? If not the same certificate what are the requirements for the certificate ?
I am not sure what I am missing in the configuration that is causing this issue. The WAP servers are not part of the domain and have also ensured the time synchronization between the domain machine as well.
The service name is fs.domain.com on both the internal and external DNS ( we have domain.com as a zone in DNS internally as well ). I am able to Authenticate inside and from the WAP server when accessing the link.
Could it be a Load Balancer Configuration ? [i will try eliminating this from the configuration]
Let me know if there are any options that i can try to resolve this and get the configuration working.
Cheers,

Does the load balancer pass the certificate session through to the ADFS server or are you offloading SSL. SSL offload does not work with WAP/ADFS integration (at least at the time of writing it does not).
Can you try through the load balancer with SSL pass through turned off please.
Also as ADFS 3.0 (Server 2012 R2) uses Server Name Indication (SNI) then any health checks that run on the load balancer must support this, so if they do not then you need to use TCP 443 checks for a listening port, as doing a standard HTTPS check will fail,
and if the load balancer fails its checks whilst you are configuring ADFS that might be a reason why it has gone offline for you (error 442 is to do with failure to swap client certificates between WAP and ADFS).
Finally, check the June update to Server 2012 R2 (http://support.microsoft.com/kb/2964735) as that has fixed some certificate issues with multiple servers for WAP and ADFS when you don't have the
2012 R2 AD schema in place.
Brian Reid
Exchange MVP and Exchange and Office 365 Certified Master
www.c7solutions.com
Brian Reid C7 Solutions Ltd (www.c7solutions.com)

Group policy issue

I have two Domain Controllers Main ( Main DC ) and Second DC.
the date of some policies is not out of date....
please check these files to know the problem.
dcdiag.txt output:
Directory Server Diagnosis
Performing initial setup:
   Trying to find home server...
   * Verifying that the local machine ASMDC, is a Directory Server.
   Home Server = ASMDC
   * Connecting to directory service on server ASMDC.
   * Identified AD Forest.
   Collecting AD specific global data
   * Collecting site info.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=buc,DC=edu,LDAP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......
   The previous call succeeded
   Iterating through the sites
   Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
   Getting ISTG and options for the site
   * Identifying all servers.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=buc,DC=edu,LDAP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......
   The previous call succeeded....
   The previous call succeeded
   Iterating through the list of servers
   Getting information for the server CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
   objectGuid obtained
   InvocationID obtained
   dnsHostname obtained
   site info obtained
   All the info for the server collected
   Getting information for the server CN=NTDS Settings,CN=BSMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
   objectGuid obtained
   InvocationID obtained
   dnsHostname obtained
   site info obtained
   All the info for the server collected
   * Identifying all NC cross-refs.
   * Found 2 DC(s). Testing 2 of them.
   Done gathering initial info.
Doing initial required tests
   Testing server: Default-First-Site-Name\ASMDC
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         Determining IP4 connectivity
         Determining IP6 connectivity
         * Active Directory RPC Services Check
         ......................... ASMDC passed test Connectivity
   Testing server: Default-First-Site-Name\BSMDC
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         Determining IP4 connectivity
         Determining IP6 connectivity
         * Active Directory RPC Services Check
         ......................... BSMDC passed test Connectivity
Doing primary tests
   Testing server: Default-First-Site-Name\ASMDC
      Starting test: Advertising
         The DC ASMDC is advertising itself as a DC and having a DS.
         The DC ASMDC is advertising as an LDAP server
         The DC ASMDC is advertising as having a writeable directory
         The DC ASMDC is advertising as a Key Distribution Center
         The DC ASMDC is advertising as a time server
         The DS ASMDC is advertising as a GC.
         ......................... ASMDC passed test Advertising
      Test omitted by user request: CheckSecurityError
      Test omitted by user request: CutoffServers
      Starting test: FrsEvent
         * The File Replication Service Event log test
         ......................... ASMDC passed test FrsEvent
      Starting test: DFSREvent
         The DFS Replication Event Log.
         ......................... ASMDC passed test DFSREvent
      Starting test: SysVolCheck
         * The File Replication Service SYSVOL ready test
         File Replication Service's SYSVOL is ready
         ......................... ASMDC passed test SysVolCheck
      Starting test: KccEvent
         * The KCC Event log test
         Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
         ......................... ASMDC passed test KccEvent
      Starting test: KnowsOfRoleHolders
         Role Schema Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Domain Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role PDC Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Rid Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Infrastructure Update Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         ......................... ASMDC passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         Checking machine account for DC ASMDC on DC ASMDC.
         * SPN found :LDAP/ASMDC.buc.edu/buc.edu
         * SPN found :LDAP/ASMDC.buc.edu
         * SPN found :LDAP/ASMDC
         * SPN found :LDAP/ASMDC.buc.edu/BUC
         * SPN found :LDAP/5e88f85b-15a6-4ff5-b0fd-6df748df06fd._msdcs.buc.edu
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/5e88f85b-15a6-4ff5-b0fd-6df748df06fd/buc.edu
         * SPN found :HOST/ASMDC.buc.edu/buc.edu
         * SPN found :HOST/ASMDC.buc.edu
         * SPN found :HOST/ASMDC
         * SPN found :HOST/ASMDC.buc.edu/BUC
         * SPN found :GC/ASMDC.buc.edu/buc.edu
         ......................... ASMDC passed test MachineAccount
      Starting test: NCSecDesc
         * Security Permissions check for all NC's on DC ASMDC.
         * Security Permissions Check for
           DC=ForestDnsZones,DC=buc,DC=edu
            (NDNC,Version 3)
         * Security Permissions Check for
           DC=DomainDnsZones,DC=buc,DC=edu
            (NDNC,Version 3)
         * Security Permissions Check for
           CN=Schema,CN=Configuration,DC=buc,DC=edu
            (Schema,Version 3)
         * Security Permissions Check for
           CN=Configuration,DC=buc,DC=edu
            (Configuration,Version 3)
         * Security Permissions Check for
           DC=buc,DC=edu
            (Domain,Version 3)
         ......................... ASMDC passed test NCSecDesc
      Starting test: NetLogons
         * Network Logons Privileges Check
         Verified share \\ASMDC\netlogon
         Verified share \\ASMDC\sysvol
         ......................... ASMDC passed test NetLogons
      Starting test: ObjectsReplicated
         ASMDC is in domain DC=buc,DC=edu
         Checking for CN=ASMDC,OU=Domain Controllers,DC=buc,DC=edu in domain DC=buc,DC=edu on 2 servers
            Object is up-to-date on all servers.
         Checking for CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu in domain CN=Configuration,DC=buc,DC=edu on 2 servers
            Object is up-to-date on all servers.
         ......................... ASMDC passed test ObjectsReplicated
      Test omitted by user request: OutboundSecureChannels
      Starting test: Replications
         * Replications Check
         * Replication Latency Check
            DC=ForestDnsZones,DC=buc,DC=edu
               Latency information for 1 entries in the vector were ignored.
                  1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            DC=DomainDnsZones,DC=buc,DC=edu
               Latency information for 1 entries in the vector were ignored.
                  1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            CN=Schema,CN=Configuration,DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            CN=Configuration,DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
         * Replication Site Latency Check
         ......................... ASMDC passed test Replications
      Starting test: RidManager
         * Available RID Pool for the Domain is 8604 to 1073741823
         * ASMDC.buc.edu is the RID Master
         * DsBind with RID Master was successful
         * rIDAllocationPool is 7604 to 8103
         * rIDPreviousAllocationPool is 7604 to 8103
         * rIDNextRID: 7640
         ......................... ASMDC passed test RidManager
      Starting test: Services
         * Checking Service: EventSystem
         * Checking Service: RpcSs
         * Checking Service: NTDS
         * Checking Service: DnsCache
         * Checking Service: NtFrs
         * Checking Service: IsmServ
         * Checking Service: kdc
         * Checking Service: SamSs
         * Checking Service: LanmanServer
         * Checking Service: LanmanWorkstation
         * Checking Service: w32time
         * Checking Service: NETLOGON
         ......................... ASMDC passed test Services
      Starting test: SystemLog
         * The System Event log test
         An Warning Event occurred. EventID: 0x825A0024
            Time Generated: 08/21/2014   00:22:16
            Event String:
            The time service has not synchronized the system time for 86400 seconds because none of the time service providers provided a usable time stamp. The time service will not update the local system
time until it is able to synchronize with a time source. If the local system is configured to act as a time server for clients, it will stop advertising as a time source to clients. The time service will continue to retry and sync time with its time sources.
Check system event log for other W32time events for more details. Run 'w32tm /resync' to force an instant time synchronization.
         An Warning Event occurred. EventID: 0x8000000E
            Time Generated: 08/21/2014   00:32:29
            Event String:
            There were password errors using the Credential Manager. To remedy, launch the Stored User Names and Passwords control panel applet, and reenter the password for the credential BUC.EDU\administrator.
         An Error Event occurred. EventID: 0x00000422
            Time Generated: 08/21/2014   00:32:29
            Event String:
            The processing of Group Policy failed. Windows attempted to read the file \\buc.edu\sysvol\buc.edu\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not
successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
            a) Name Resolution/Network Connectivity to the current domain controller.
            b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
            c) The Distributed File System (DFS) client has been disabled.
         ......................... ASMDC failed test SystemLog
      Test omitted by user request: Topology
      Test omitted by user request: VerifyEnterpriseReferences
      Starting test: VerifyReferences
         The system object reference (serverReference)
         CN=ASMDC,OU=Domain Controllers,DC=buc,DC=edu and backlink on
         CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         are correct.
         The system object reference (serverReferenceBL)
         CN=ASMDC,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=buc,DC=edu
         and backlink on
         CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         are correct.
         ......................... ASMDC passed test VerifyReferences
      Test omitted by user request: VerifyReplicas
   Testing server: Default-First-Site-Name\BSMDC
      Starting test: Advertising
         The DC BSMDC is advertising itself as a DC and having a DS.
         The DC BSMDC is advertising as an LDAP server
         The DC BSMDC is advertising as having a writeable directory
         The DC BSMDC is advertising as a Key Distribution Center
         The DC BSMDC is advertising as a time server
         The DS BSMDC is advertising as a GC.
         ......................... BSMDC passed test Advertising
      Test omitted by user request: CheckSecurityError
      Test omitted by user request: CutoffServers
      Starting test: FrsEvent
         * The File Replication Service Event log test
         ......................... BSMDC passed test FrsEvent
      Starting test: DFSREvent
         The DFS Replication Event Log.
         ......................... BSMDC passed test DFSREvent
      Starting test: SysVolCheck
         * The File Replication Service SYSVOL ready test
         File Replication Service's SYSVOL is ready
         ......................... BSMDC passed test SysVolCheck
      Starting test: KccEvent
         * The KCC Event log test
         Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
         ......................... BSMDC passed test KccEvent
      Starting test: KnowsOfRoleHolders
         Role Schema Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Domain Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role PDC Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Rid Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Infrastructure Update Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         ......................... BSMDC passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         Checking machine account for DC BSMDC on DC BSMDC.
         * SPN found :LDAP/BSMDC.buc.edu/buc.edu
         * SPN found :LDAP/BSMDC.buc.edu
         * SPN found :LDAP/BSMDC
         * SPN found :LDAP/BSMDC.buc.edu/BUC
         * SPN found :LDAP/93561cab-4fb3-421f-9a67-af6b4c280eca._msdcs.buc.edu
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/93561cab-4fb3-421f-9a67-af6b4c280eca/buc.edu
         * SPN found :HOST/BSMDC.buc.edu/buc.edu
         * SPN found :HOST/BSMDC.buc.edu
         * SPN found :HOST/BSMDC
         * SPN found :HOST/BSMDC.buc.edu/BUC
         * SPN found :GC/BSMDC.buc.edu/buc.edu
         ......................... BSMDC passed test MachineAccount
      Starting test: NCSecDesc
         * Security Permissions check for all NC's on DC BSMDC.
         * Security Permissions Check for
           DC=ForestDnsZones,DC=buc,DC=edu
            (NDNC,Version 3)
         * Security Permissions Check for
           DC=DomainDnsZones,DC=buc,DC=edu
            (NDNC,Version 3)
         * Security Permissions Check for
           CN=Schema,CN=Configuration,DC=buc,DC=edu
            (Schema,Version 3)
         * Security Permissions Check for
           CN=Configuration,DC=buc,DC=edu
            (Configuration,Version 3)
         * Security Permissions Check for
           DC=buc,DC=edu
            (Domain,Version 3)
         ......................... BSMDC passed test NCSecDesc
      Starting test: NetLogons
         * Network Logons Privileges Check
         Verified share \\BSMDC\netlogon
         Verified share \\BSMDC\sysvol
         ......................... BSMDC passed test NetLogons
      Starting test: ObjectsReplicated
         BSMDC is in domain DC=buc,DC=edu
         Checking for CN=BSMDC,OU=Domain Controllers,DC=buc,DC=edu in domain DC=buc,DC=edu on 2 servers
            Object is up-to-date on all servers.
         Checking for CN=NTDS Settings,CN=BSMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu in domain CN=Configuration,DC=buc,DC=edu on 2 servers
            Object is up-to-date on all servers.
         ......................... BSMDC passed test ObjectsReplicated
      Test omitted by user request: OutboundSecureChannels
      Starting test: Replications
         * Replications Check
         * Replication Latency Check
            DC=ForestDnsZones,DC=buc,DC=edu
               Latency information for 1 entries in the vector were ignored.
                  1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            DC=DomainDnsZones,DC=buc,DC=edu
               Latency information for 1 entries in the vector were ignored.
                  1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            CN=Schema,CN=Configuration,DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            CN=Configuration,DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
         * Replication Site Latency Check
         ......................... BSMDC passed test Replications
      Starting test: RidManager
         * Available RID Pool for the Domain is 8604 to 1073741823
         * ASMDC.buc.edu is the RID Master
         * DsBind with RID Master was successful
         * rIDAllocationPool is 8104 to 8603
         * rIDPreviousAllocationPool is 8104 to 8603
         * rIDNextRID: 8106
         ......................... BSMDC passed test RidManager
      Starting test: Services
         * Checking Service: EventSystem
         * Checking Service: RpcSs
         * Checking Service: NTDS
         * Checking Service: DnsCache
         * Checking Service: NtFrs
         * Checking Service: IsmServ
         * Checking Service: kdc
         * Checking Service: SamSs
         * Checking Service: LanmanServer
         * Checking Service: LanmanWorkstation
         * Checking Service: w32time
         * Checking Service: NETLOGON
         ......................... BSMDC passed test Services
      Starting test: SystemLog
         * The System Event log test
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:15
            Event String:
            Driver Send To Microsoft OneNote Driver required for printer Send To OneNote 2007 is unknown. Contact the administrator to install the driver before you log in again.
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:18
            Event String:
            Driver SolidPDF XChange required for printer SolidPDF XChange is unknown. Contact the administrator to install the driver before you log in again.
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:18
            Event String:
            Driver NRG SP 3400N PCL 6 required for printer !!net_pc5!NRG SP 3400N PCL 6 is unknown. Contact the administrator to install the driver before you log in again.
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:19
            Event String:
            Driver Send To Microsoft OneNote Driver required for printer !!BUCLAPTOP1!Send To OneNote 2007 is unknown. Contact the administrator to install the driver before you log in again.
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:20
            Event String:
            Driver NRG SP 3400N PCL 6 required for printer !!BUCLAPTOP1!NRG SP 3400N PCL 6 is unknown. Contact the administrator to install the driver before you log in again.
         An Warning Event occurred. EventID: 0x80000008
            Time Generated: 08/20/2014   23:52:20
            Event String:
            The jobs in the print queue for printer Microsoft XPS Document Writer (redirected 2) were deleted. No user action is required.
            To stop logging warning events for the print spooler, in Control Panel, open Printers, right-click a blank area of the window, click Run as Administrator, click Server Properties, click the
Advanced tab, and then clear the Log spooler warning events check box.
         An Warning Event occurred. EventID: 0x80000004
            Time Generated: 08/20/2014   23:52:20
            Event String:
            Printer Microsoft XPS Document Writer (redirected 2) will be deleted. No user action is required.
            To stop logging warning events for the print spooler, in Control Panel, open Printers, right-click a blank area of the window, click Run as Administrator, click Server Properties, click the
Advanced tab, and then clear the Log spooler warning events check box.
         An Warning Event occurred. EventID: 0x80000003
            Time Generated: 08/20/2014   23:52:20
            Event String:
            Printer Microsoft XPS Document Writer (redirected 2) was deleted, and users will no longer be able to print to this printer. No user action is required.
            To stop logging information events for the print spooler, in Control Panel, open Printers, right-click a blank area of the window, click Run as Administrator, click Server Properties, click
the Advanced tab, and then clear the Log spooler information events check box.
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:22
            Event String:
            Driver NRG SP 3400N PCL 6 required for printer !!BUCLAPTOP1!NRG SP 3400N PCL 6 (Copy 1) is unknown. Contact the administrator to install the driver before you log in again.
         ......................... BSMDC failed test SystemLog
      Test omitted by user request: Topology
      Test omitted by user request: VerifyEnterpriseReferences
      Starting test: VerifyReferences
         The system object reference (serverReference)
         CN=BSMDC,OU=Domain Controllers,DC=buc,DC=edu and backlink on
         CN=BSMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         are correct.
         The system object reference (serverReferenceBL)
         CN=BSMDC,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=buc,DC=edu
         and backlink on
         CN=NTDS Settings,CN=BSMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         are correct.
         ......................... BSMDC passed test VerifyReferences
      Test omitted by user request: VerifyReplicas
      Test omitted by user request: DNS
      Test omitted by user request: DNS
      Test omitted by user request: DNS
      Test omitted by user request: DNS
   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation
   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation
   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
   Running partition tests on : buc
      Starting test: CheckSDRefDom
         ......................... buc passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... buc passed test CrossRefValidation
   Running enterprise tests on : buc.edu
      Test omitted by user request: DNS
      Test omitted by user request: DNS
      Starting test: LocatorCheck
         GC Name: \\ASMDC.buc.edu
         Locator Flags: 0xe00013fd
         PDC Name: \\ASMDC.buc.edu
         Locator Flags: 0xe00013fd
         Time Server Name: \\ASMDC.buc.edu
         Locator Flags: 0xe00013fd
         Preferred Time Server Name: \\ASMDC.buc.edu
         Locator Flags: 0xe00013fd
         KDC Name: \\ASMDC.buc.edu
         Locator Flags: 0xe00013fd
         ......................... buc.edu passed test LocatorCheck
      Starting test: Intersite
         Skipping site Default-First-Site-Name, this site is outside the scope
         provided by the command line arguments provided.
         ......................... buc.edu passed test Intersite
====================================================================
Repadmin: running command /showrepl against full DC localhost
Default-First-Site-Name\ASMDC
DSA Options: IS_GC
Site Options: (none)
DSA object GUID: 5e88f85b-15a6-4ff5-b0fd-6df748df06fd
DSA invocationID: 1355f657-cd24-4ad4-b890-f04f5c624acd
==== INBOUND NEIGHBORS ======================================
DC=buc,DC=edu
    Default-First-Site-Name\BSMDC via RPC
        DSA object GUID: 93561cab-4fb3-421f-9a67-af6b4c280eca
        Last attempt @ 2014-08-21 00:43:56 was successful.
CN=Configuration,DC=buc,DC=edu
    Default-First-Site-Name\BSMDC via RPC
        DSA object GUID: 93561cab-4fb3-421f-9a67-af6b4c280eca
        Last attempt @ 2014-08-21 00:41:11 was successful.
CN=Schema,CN=Configuration,DC=buc,DC=edu
    Default-First-Site-Name\BSMDC via RPC
        DSA object GUID: 93561cab-4fb3-421f-9a67-af6b4c280eca
        Last attempt @ 2014-08-20 23:51:37 was successful.
DC=DomainDnsZones,DC=buc,DC=edu
    Default-First-Site-Name\BSMDC via RPC
        DSA object GUID: 93561cab-4fb3-421f-9a67-af6b4c280eca
        Last attempt @ 2014-08-21 00:45:39 was successful.
DC=ForestDnsZones,DC=buc,DC=edu
    Default-First-Site-Name\BSMDC via RPC
        DSA object GUID: 93561cab-4fb3-421f-9a67-af6b4c280eca
        Last attempt @ 2014-08-20 23:51:37 was successful.
Regards and thanks in advance
Mhiar

Hi,
Based on the description, the Sysvol is replicated by FRS service.
>>some policies at the main DC are not updated like same policies in second DC.
In this case, we can do a non-authoritative restore on the main DC.
To do so:
Click Start, and then click
Run.
In the
Open box, type cmd and then press ENTER.
In the
Command box, type net stop ntfrs.
Click Start, and then click
Run.
In the
Open box, type regedit and then press ENTER.
Locate the following subkey in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
In the right pane, double-click
BurFlags.
In the
Edit DWORD Value dialog box, type D2 and then click OK.
Quit Registry Editor, and then switch to the
Command box.
In the
Command box, type net start ntfrs.
Quit the
Command box.
Regarding reinitializing File Replication Service replica sets, the following article can be referred to for more information.
Using the BurFlags registry key to reinitialize File Replication Service replica sets
http://support.microsoft.com/kb/290762/en-us
Best regards,
Frank Shen

Windows 7 DNS and Group Policy Issues

Hi,
We have several suites of Windows 7 domain connected PC's.
In one of the suites I have been called into look at 3 different PC's where the users have not got mapped drives, desktop backgrounds, internet connectivity - because their group policies have not applied.
When I look at the error logs I find DNS 1014 errors, and Group Policy 1054 errors.
I have looked at the logs on the switches, and there is nothing on them - Could a pupil pulling the network cable out cause these errors?... Possibly they could have put it back in before I got back in the room.
The user logs off of the PC and back on again and are fine, as are the users that logon after them.
We have 2 DC's/DNS servers, which I would have thought would be able to cope with the load here.
Please let me know what you think the likely cause could be.

Hello John555444,
What is your current situation?
Is this issue resolved?
Best regards,
Fangzhou CHEN
Fangzhou CHEN
TechNet Community Support

Group Policy - Issues deploying software packages through GPO

Hello everyone,
I am having issues successfully deploying MSI packages through group policy. I have set my computer account up in its own test OU in my domain, but yet the software will not deploy. Example, I'm trying to deploy AVG Anti-Virus and make sure it
is installed on each and every PC in my domain. As for the GPO, I set it up as an assigned package and pointed to the location of the package with the UNC file path (visible to both the DC and my computer that is part of the affected OU)
On the domain controller, I get these messages in application event logs:
Beginning a Windows Installer transaction: \\hs-dc2\software\avg\installavg.msi. Client Process Id: 9048.
Ending a Windows Installer transaction: \\hs-dc2\software\avg\installavg.msi. Client Process Id: 9048.
This shows up when I refresh GP on my computer. I run gpresult /h GPReport.html and get the following message:
Software Installation failed due to the error listed below.
Fatal error during installation.
Additional information may have been logged. Review the Policy Events tab in the console or the application event log for events between
The software is in a share on the domain controller that is visible from my computer, and permissions are set where "Everyone" has read access. I have tested the package on my computer and it installs
correctly if I do it manually, so it's a good package.
I'm at a loss. I am admitedly very new to GP management, but I'm pretty sure I have covered all my bases here. I humbly ask for any and all help that you all can provide.
Thank you all very much, have a great weekend!

> Magnolia_Schools.exe
What's that???
> \\hs-dc2\software\avg\installavg.msi
> <file://\\hs-dc2\software\avg\installavg.msi> /qb addeploy=1
/qb ADDEPLOY=1
Uppercase matters (:
A bissle "Experience", a bissle GMV... Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
I should have explained, my apologies. The InstallAVG.msi is the package I have GP deploying. it is a package that AVG wrote for us that goes in, uninstalls the two previous antivirus softwares we have on our network if it is present, and
then wraps it to run magnolia_schools.exe which installs the AV software. I am uninstalling AVG now and will try reinstalling with
\\hs-dc2\software\avg\installavg.msi /qb ADDEPLOY=1 and report back.
also, the only logs I found that were around the time of the install attempt were such as these:
1: 2905 2: C:\windows\system32\appmgmt\MACHINE\{06ee0d46-cd5f-4216-a09f-2aeb573aa5ba}.aas
1: 2905 2: C:\windows\system32\appmgmt\MACHINE\{06ee0d46-cd5f-4216-a09f-2aeb573aa5ba}.aas
Does that tell you anything?
I will say this, if this means anything...now that AVG is installed, the event logs are changing from an error %%1603 to this:
Failed to apply changes to software installation settings. The installation of software deployed through Group Policy for this user has been delayed until the next logon because the changes must be applied before the user logon. The error was : %%1274
The removal of the assignment of application exe2msiSetupPackage from policy Install AVG failed. The error was : %%2
So it acts like it's at least seeing that the package is installed...and reacting differently, correct?
Thanks so much

Web service proxy creation issue

am facing an issue with the creation of web service proxy for an esb project that i have created based on oracle esb tutorial. In the web service proxy creation wizard, it is accepting the concrete URL for the wsdl in the first step however in the second step it is not showing any endpoint URL. Also the wizard does not allow to go beyond step 2 of the web service proxy creation. following is my wsdl to which the concrete wsdl url points to. What am i missing here. Please help
following is my wsdl
<?xml version= '1.0' encoding= 'UTF-8' ?>
<definitions
name="custinsoap_RS"
targetNamespace="http://oracle.com/esb/namespaces/custdata"
xmlns="http://schemas.xmlsoap.org/wsdl/"
xmlns:tns="http://oracle.com/esb/namespaces/custdata"
xmlns:inp1="http://xmlns.oracle.com/Esb/CustomerData"
xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/">
<types>
<schema xmlns="http://www.w3.org/2001/XMLSchema" >
<import namespace="http://xmlns.oracle.com/Esb/CustomerData" schemaLocation="public_html/LegacyCustomer.xsd" />
</schema>
</types>
<message name="CustomerData_request">
<part name="CustomerData" element="inp1:CustomerData"/>
</message>
<portType name="Readcustsoapdata_ppt">
<operation name="Readcustsoapdata">
<input message="tns:CustomerData_request"/>
</operation>
</portType>
<binding name="readsoapbinding" type="tns:Readcustsoapdata_ppt">
<soap:binding style="document"
transport="http://schemas.xmlsoap.org/soap/http"/>
<operation name="Readcustsoapdata">
<soap:operation soapAction="http://oracle.com/esb/namespaces/custdata/Readcustsoapdata"/>
<input>
<soap:body use="literal" parts="CustomerData"/>
</input>
<output>
<soap:body use="literal" parts=""/>
</output>
</operation>
</binding>
<service name="readcustdatasoapservice">
<port name="soapport" binding="tns:readsoapbinding">
<soap:address location="http://myhost.mycompany.com/esb/wsil/custdata/custinsoap_RS"/>
</port>
</service>
</definitions>

Hi,
Are you accessing teh WSDl from a deployed service ? If yes, when providing the Web Service URL, did you extend the URL with ?WSDL ?
Frank

Urgent Group Policy Issue - not applying despite saying it does

Thank you for this urgent help. Auditors checking this out tomorrow morning.
We have a GPO that sets the eventlog audit settings for success or failure security events. The scope is set to Authenticated Users.
When I run the group policy wizard in GPMC it shows the settings applying to one of our servers in that OU.
When I run gpresult/z from that server it shows the policy applying to that server.
But when I go into gpedit.msc the security audit settings are all set to "not defined" and they are grayed out so I can't edit them manually.
As a test I set the GPO to deny applying to that server. I ran gpudpate/force on the system and then gpresult and it shows the GPO now not applying. But the settings are still set to not defined and still not editable. they are not being set by any other GPO.
In the event logs I only see three GPO errors but they are unrelated. A separate GPO is having issues creating user accounts. No other GPOs apply.
Quick help would be fantastic.
Server runs on Windows Server 2008 R2 (I can edit GPO but not the domain ones and I don't have access to the domain controllers).

OK, After several hours I figured it out. Turns out there's bugs and odd functionality.
If someone ever tested the 'advanced audit settings' (which I did in the same GPO at some point) then it sets a registry key to disable the use of the older basic audit settings. But when you stop using those advanced settings in your GPO it doesn't remove
that registry bit. So I used the GPO to undo that setting. This was the first step. This is found Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > "Audit: Force audit policy subcategory
settings (Windows Vista or later) to override audit policy category settings" to DISABLED.
Even though this is done, sometimes the GPO files on the domain controllers don't remove the old audit settings. So in the comments of another thread I found out you may have to go to
\\domain-fqdn\SYSVOL\domain-fqdn\Policies\{your-policy-id-where-this-setting-was-originally-set}\Machine\Microsoft\Windows NT\ and delete the Audit folder which is left behind due to some odd bug. If you don't do this even after doing the next step the
next gpupdate will bring that security setting above back down.
Next you have to reset your audit settings on your PC to the defaults. Unfortunately there is no way to do this. Auditpol /clear does not accomplish this. The only way to do this is to take the audit settings from another working system, export them and
then 'restore' those same settings to the affected server. To do this:
1. On 'working system' run cmd.exe as administrator and export the audit settings to a folder like this:
auditpol /backup /file:c:\working-auditpol-settings.txt
2. Copy that file to the broken system such as the C:\ drive and run this on the broken system:
auditpol /restore /file:c:\working-auditpol-settings.txt
Open GPEDIT.MSC and verify the audit settings are back to normal. Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
Then run gpupdate/force on the formerly broken system. Close gpedit.msc and reopen and verify the settings were not overwritten. If you skipped the sysvol audit folder deletion step they may come back.
Hope this helps someone.

SOAP- Proxy scenario, issue with WS adapter

Hi guys,
i've set up a soap->abap proxy scenario (on 7.1) and want to use the new WS adapter. unfortunately I'm facing some issues. The proxy has been generated properly and I also set it up in soamanager. I tested it from XML Spy and it works fine. So there shouldn't be any problem with it.
But when I try to run the scenario, I get following error:
WS_ADAPTER_SYS_ERROR
<sap:ExceptionChain xmlns:sap="http://www.sap.com/webas/710/soap/runtime/abap/fault/system/SystemFault"><sap:ChainedException><Exception_Name>CX_SOAP_FAILURE</Exception_Name><Exception_Text>SRT: Processing error in Internet Communication Framework: ("ICF Error when receiving the response: ICM_HTTP_CONNECTION_FAILED")</Exception_Text></sap:ChainedException><sap:ChainedException><Exception_Name>CX_SOAP_CORE</Exception_Name><Exception_Text>SRT: Processing error in Internet Communication Framework: ("ICF Error when receiving the response: ICM_HTTP_CONNECTION_FAILED")</Exception_Text></sap:ChainedException></sap:ExceptionChain>
System error while calling Web service adapter: <sap:ExceptionChain xmlns:sap="http://www.sap.com/webas/710/soap/runtime/abap/fault/system/SystemFault"><sap:ChainedException><Exception_Name>CX_SOAP_FAILURE</Exception_Name><Exception_Text>SRT: Processing error in Internet Communication Framework: ("ICF Error when processing Web service
I checked the /sap/xi/engine service on both - PI & ECC and it is activated.
Any hint, what could be wrong?
Thanks a lot,
Olian

Hi,
"ICM_HTTP_CONNECTION_FAILED" this error is relaed to ICM. Does your Type H connection "INTEGRATION_SERVER_HMI" works fine.And check integration engine configuration in SXMB_ADM.
And here is a similar thread.
Re: HTTP to Enterprise Services.
Regards,
Reyaz

Proxy policy issue

Similar Messages

Maybe you are looking for