DirectAccess2012 + SCCM2012 + ISATAP Manage Out DA Clients

Good Day, have some trouble.
1. We have deployed DA Server behind the TMG.
2. DA Clients succesfully establish connection to work resources and could connect to internal resources
3. The question is - how i can manage out DA clients, i could ping them only from DA server.
First of all i need to manage DA Clients from SCCM server what i have already done (http://blogs.technet.com/b/jasonjones/archive/2013/04/19/limiting-isatap-services-to-directaccess-manage-out-clients.aspx):
1. Created DNS A record daisatap.domain.com which points to ipv4 internal DA address
2. Created GPO which enables isatap adapter and gives the router name daisatap.domain.com
3. Applied this GPO to SCCM server successfuly.
Now my SCCM server shows ISATAP - Enabled, it tooks ipv6 address: fe80::5efe:10.62.4.110%12 but still couldnot ping DA clients and DA server by IPv6 address... If i trying to ping ant ipv6 address i receive "transmit failed" failure
Need some help with it...
Some upgrade to post:
My SCCM server have istatap ipv6 ISATAP address: fe80::5efe:10.62.4.110%12
My DA have ipv6 LAN address: fd72:3d36:76b8:333::1/128
My DA client have ipv6 fd72:3d36:76b8:1000:3077:665f:cdeb:2b00
And i wonder SCCM receives Local Link ipv6, is it correct? From DA i could not ping ipv6 address of SCCM too...

Hello, thank you for your answer. My SCCM server could successfuly ping daisatap.domain.com by ICMPv4. Not sure about protocol 41, on my SCCM server firewall is disabled, on DA server - enabled and i could not find how to allow this protocol... there is
no such protocol in predefined core networks...
So i`ve disabled Windows Firewall on my SCCM and DA servers for all profiles and still my SCCM server receives fe80:: address... so there is some trouble not in firewal...
And one more thing on DA server ISTSP adapter have only fe80:: address too...
Ethernet adapter LAN:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) 82574L Gigabit Network Connection
Physical Address. . . . . . . . . : 00-50-56-87-6F-B9
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : fd72:3d36:76b8:3333::1(Preferred)
Link-local IPv6 Address . . . . . : fe80::884c:fb2:838c:474e%12(Preferred)
IPv4 Address. . . . . . . . . . . : 10.62.4.55(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.252.0
Default Gateway . . . . . . . . . : 10.62.7.254
DHCPv6 IAID . . . . . . . . . . . : 302010454
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-19-0D-16-00-50-56-87-6F-B9
DNS Servers . . . . . . . . . . . : 10.62.4.4
10.62.4.44
NetBIOS over Tcpip. . . . . . . . : Disabled
Tunnel adapter 6TO4 Adapter:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft 6to4 Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter IPHTTPSInterface:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : IPHTTPSInterface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : fd72:3d36:76b8:1000::1(Preferred)
IPv6 Address. . . . . . . . . . . : fd72:3d36:76b8:1000::2(Preferred)
IPv6 Address. . . . . . . . . . . : fd72:3d36:76b8:1000:8dac:2df:c4bf:e891(Preferred)
Link-local IPv6 Address . . . . . : fe80::8dac:2df:c4bf:e891%15(Preferred)
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 419430400
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-19-0D-16-00-50-56-87-6F-B9
NetBIOS over Tcpip. . . . . . . . : Disabled
Tunnel adapter isatap.{4E20B5D6-171C-4F5C-A90F-DED6C04D5D87}:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::5efe:10.62.4.55%16(Preferred)
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 436207616
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-19-0D-16-00-50-56-87-6F-B9
DNS Servers . . . . . . . . . . . : 10.62.4.4
10.62.4.44
NetBIOS over Tcpip. . . . . . . . : Disabled

Similar Messages

Manage out clients are not accessible from intranet

Hi!
DA 2012 R2 works in NLB cluster in DMZ zone. I can access internet clients from DA servers (ping, RDP), but not from intranet management workstations (W7). Those workstations have ISATAP IPv6 addresses (from DA server(s)).
What can be wrong here, how to troubleshoot?
Thanks,
UV

Hi!
Again, briefly:
DA clients are out and configured for remote (manage out) management;
DA clients out there are registering their IPv6 addresses in DNS;
HTTPSTunnel is the only way to connect, DA server is in DMZ zone, no straight connection to internet from DA server.
Intranet management workstations have ISATAP address from DA server;
Intranet management workstations can resolove DA clients IPv6 updated addresses;
In clients outside users are logged on and need help over remote assistance;
Remote assistance is enabled on DA clients (and it can be offered from DA server);
Intranet management workstations no not belong to management servers group.
Intranet management workstations cannot connect to DA clients out there to offer remote assistance!
Why can it happen?
UV

Configuring "Manage Out" Server 2012 DirectAccess IP-HTTPS

Hoping someone with hands on experience configuring Manage Out functionality can answer a few questions for me?
We have built a Server 2012 VM and deployed DirectAccess successfully. Have tested with both Win7 and Win8 clients successfully. After some initial issues with DNS were addressed with a Microsoft hotfix, it seems to be running stable.
I want to configure Manage Out capabilities, so that I can remotely help the DA clients with software installs and similar. I've read up on as many blog entries as I can find, but still finding it a bit mystifying.
We are using IP-HTTPS connectivity. As best I can tell, we are not using Teredo or ISATAP. The DA server is dual-NIC and is configured behind an Edge device (NIC #1 is DMZ and receives NAT'd traffic from external IPv4 address on firewall, NIC
#2 is internal LAN). Our internal networks are IPv4 only (no IPv6 at all); therefore DNSv4 and DHCPv4 internally).
Am hoping that somewhere there might be a step-by-step configuration guide to match our scenario. Alternatively, if someone can recommend a Local (i.e. Melbourne, Australia) consultant who knows this stuff backwards, I'd consider paying for that.

OKay, so finally I am in a position to share some information ... it has taken me about 6 months of off-and-on (mostly "off") activity to get things working.
We engaged a third-party company to do the initial installation of Direct Access. This got us 90% of the way to where we needed to go.
The configuration of Manage Out was eventually achieved, but we did take some further expert advice, because I didn't want to change anything without first understanding What was being changed and Why it needed to be changed. So I had to be educated
quite a bit about IPv6, IP-HTTPS and ISATAP.
We ended up disabling all IPv6 on the clients EXCEPT for the IP-HTTPS protocol. This was done via a GPO.
I ran into some problems with IPv6 and ISATAP initially when configuring our IT PCs to be able to "manage out" to the DA clients. We went with a non-standard name for the ISATAP Router (we called ours ISATAP-DirectAccess) and pointed this in DNS to
the internal IPv4 address of the DA server. This was enforced via a GPO. However our PCs did not get IPv6 addresses on their ISATAP adapters. This was eventually resolved by changing some settings on the ISATAP adapter for the Internal NIC
on the DA server. The settings were: Forwarding=Enabled and also Advertising=Enabled
After that the IT PCs were getting ISATAP addresses fine, but some of the DA Clients were not registering themselves with an IPv6 address in our Internal DNS. This was eventually resolved when we discovered that some of the DA Clients' DNS records
had 'bad' security permissions on them. Once we fixed those permissions we found the DA Clients would register an IPv6 address when operating in Direct Access mode (and would remove their old IPv4 address) and would register an IPv6 address when connected
internally (and would remove their unwanted IPv6 address).
There was also a hitch with getting Windows Remote Assistance working with the DA clients. This required a Hotfix from Microsoft to get it working properly.
Setting the Firewall rules for the DA clients with Edge Traversal enabled was the easiest part of the process frankly. The most difficult part was troubleshooting the problems with DNS registration and the problems with getting selected internal PCs
to get a valid ISATAP adapter address from the DA server.

Directions on how to setup printers and push them out to clients using WGM

Hello, I am looking for directions on how to manage printers in WGM. How do you set them up and how do you push them out to clients.

You'll probably get a more succinct answer posting to the server forums.

Manage SCCM 2012 clients in DMZ (OS Deploy, Windows updates) via DP/MP

Hi,
We ’d like to manage (=OS Deploy, Packages,Windows updates) Windows clients (Windows 2008/2012 R2 servers for now, about 20 of them) in a DMZ (= different domain).
There is this article
https://nikifoster.wordpress.com/2011/01/31/installing-configmgr-clients-on-servers-in-a-dmz/ which explains what to do … in 2011. Since then lots of things are changed I guess
Before I dive in, I’d need to have an overview + do some administrative tasks (like asking for firewall accesses).
Current setup DMZ:
Our SCCM 2012 R2 server is on a Windows 2008 R2 OS
Client communication is done via HTTP (not HTTPS)
An extra physical Distribution point is setup (only DP, nothing more) in our current domain
A new Windows 2012 server is setup in the DMZ which should host the DP and probably management point (since it should manage the clients over there)
There are clients in DMZ that are currenlty managed by SCCM 2007 but
this server will be phased out, these client have:
Correct sccm functionality
Correct DNS resolution
My steps/questions, please comment:
Add the DMZ ip range to SCCM 2012 boundary as “DMZ”
Add the network access account to be able to deploy as well clients as distribution point in DMZ
In the DMZ accesses on firewall for server VLAN have to be asked
When we have a distribution point and communication is “HTTP only” then http (port 80) from DMZ to sccm server should suffice, correct? Or are
extra firewall openings needed for management point access/packages and windows updates sync?
Now the sccm clients will be deployed to the servers in DMZ: deploy SCCM clients to hosts in DMZ, how this should be done: we connect a console to the SCCM-server in the DMZ then deploy the discovered clients?
OS Deploy should be made available, but no dhcp is available in DMZ and it is not an option either, therefore we would boot from an ISO then enter an ip (or pre-enter it so there is already filled in an ip?). So tasksequences/deployments
for servers in DMZ, where are they configured/deployed then? Via console access on DMZ management point or can we deploy on our domain SCCM management point (not in DMZ) and it will be synced to the DMZ management point? Not clear
Selective sync of software to this distribution point (howto? not sure), we don’t need any Windows 8 software/drivers to be synced.
Thanks for your input!
J.
Jan Hoedt

No comment;
I think you mean the client push installation account and the site system installation account;
More ports are required, see site server > distribution point and distribution point > management point from the provided link;
The console will always be connected to your primary site server. The client will be pushed from the primary site server and it will provide the initial files. The other files will be downloaded from the local distribution point;
The task sequence deployment will be just like a normal taks sequence deployment. The only difference is the location of the server;
Only the content that's distributed to the distribution point in the DMZ will be available on that distribution point.
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Managing 10.4 clients with 10.5 Server

Before I jump in....any feedback on managing 10.4 clients with 10.5 server (will post the vice-versa in the 10.4 server forum) from those who are doing it currently?
Thanks,
k

I checked out the link you mentioned. It's really dealing w/ managing the client. I'm have weird issues w/ clients logging in. Today I had a grade level try to log in. Ten of the computers would let that grade level in, two would not. Of the Ten computers approx 5 wouldn't let them log in the first time, but once they were restarted they were able to log in. All of the computers are on a wired network as well as a wireless backup. Of the two that would not let them login I had just restored one and set the settings up the same as the others.
I'll be damned, this is the weirdest I have had with Apple client management.

Imp:How to find out whether client authentication Enabled on the Web Server

Hi,
I am trying to find out whether the Client Authentication Enabled on the Web Server or not.
Reason for doing this, if we have two certificates in the key store which will authenticate the Web Server, JSSE Authentication will always take the first cert from the keystore. If the first Certificate is Expired, it will fail while doing the HandShake.
So if I can find out whether Client Authentication is Enabled or not, then I can prompt a dialog for the user to select the Certificate for the Hand Shake.
Thanks in advance for any Response,
Krish.

AUTH_TYPE will tell you only if it SSL or not. It won't say whether the Client Certificates Required for SSL Connection.
Also, AUTH_TYPE is not part of the Http Headers.
If there is any other solution, greatly appreciated.
Thanks
Krish.

How to change the mouse cursor icon type when mouse moves out of client area ( propertysheet) WTL?

I got stuck with an issue in property sheet .I want to load different cursor when the mouse position is within the client area and load another when moves out of the client area.
In the porpetysheet I added four page. In the first page when I click next I am loading cursor of IDC_WAIT type and loading IDC_ARROW when the mouse moves out of the client area.
In the page class I triggered the event for WM_MOUSEMOVE as follow:
MESSAGE_HANDLER(WM_MOUSEMOVE, OnMouseMove)
LRESULT OnMouseMove(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/)
if(TRUE == m_bIsNextBtnClicked)
::SetCursor(LoadCursor(NULL, IDC_WAIT));
else
::SetCursor(LoadCursor(NULL, IDC_ARROW));
return TRUE;
This event is getting triggered and absolutely had no issue with this. Similarly I tried adding `MESSAGE_HANDLER(WM_MOUSELEAVE, OnMouseLeave)` this event making an assumption that this will get triggered if the mouse moves out of the client area, but
this event did not get triggered at all.If this is not the mouse event to be triggered for mouseleave which event should I trigger?
LRESULT OnMouseLeave(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/)
::SetCursor(LoadCursor(NULL, IDC_ARROW));
return TRUE;
Now when I click Next button , **I was actually calling a function which is taking sometime to return** . Before to this function I am loading IDC_WAIT cursor i.e.,
`::SetCursor(LoadCursor(NULL, IDC_WAIT));` .
Now when move the mouse cursor on to the non-client area I want to load IDC_ARROW cursor i.e.,
::SetCursor(LoadCursor(NULL, IDC_ARROW));
When the moves on to the non-client area I am handling the mouse event in sheet derived class as follows,
MESSAGE_HANDLER(WM_NCMOUSEMOVE, OnNCMouseMove)
LRESULT OnNCMouseMove(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/)
::SetCursor(LoadCursor(NULL, IDC_ARROW));
return 0;
This event is not getting triggered until unless the function in the Next button event is executed.
I want both of them to be done in parallel i.e, click Next button now hover mouse on the client area, Busy icon should come and when mouse moves out of the client area then IDC_ARROW icon should come.
LRESULT OnWizardNext()
::SetCursor(LoadCursor(NULL, IDC_WAIT));
m_bIsNextBtnIsClicked = TRUE;
BOOL bRet = MyFun();
m_bIsNextBtnIsClicked = FALSE;
//Until this function(MyFun()) is executed **WM_NCMOUSEMOVE**
//event is not getting triggered.But this event should get triggered and I
//should be able to see the change of cursor within and out of client area.
Can anyone kindly help me to solve this issue.
SivaV

Hello
sivavuyyuru,
For this issue, I am trying to involve someone to help look into, it might take some time and as soon as we get any result, we will tell you.
Regards.
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

How to determine installed management studio is client or server

How to determine installed management studio is client or server
when I see in help it says
version 10.50.1600.1
Neil

Blog/thread:
7 things to check to resolve “A network-related or instance-specific error occurred while establishing a connection to SQL Server…”
http://social.msdn.microsoft.com/Forums/sqlserver/en-US/0628296e-939a-4700-b498-1c3c9ce90597/a-networkrelated-or-instancespecific-error-occurred-while-establishing-a-connection-to-sql-server?forum=sqlsecurity
http://blogs.msdn.com/b/sql_protocols/archive/2007/05/13/sql-network-interfaces-error-26-error-locating-server-instance-specified.aspx
http://stackoverflow.com/questions/18060667/connect-to-server-a-network-related-or-instance-specific-error
Kalman Toth Database & OLAP Architect
SQL Server 2014 Database Design
New Book / Kindle: Beginner Database Design & SQL Programming Using Microsoft SQL Server 2014

How Can We Change Batch Management Level From Client level to Plant Level?

Hi all,
I want to know whether it is possible to change the batch management level from client to plant level.Pls Help..

Hi,
Refer SAP Note 891902 - FAQ: Batch level

Management Out of Band with ISe Appliance

Hello,
I want to know if it is possible to use port GigabitEthernet 1 as a managmenet port ( Management out of Band) .
I try to configure it.
When I do that I can ping it , but I cannot do an SSH to this Ip adresse.
The errror message is : "The remote system refused the connection."
Why doesn't it work ?
( Note that it works on an Prime appliance which is pretty the same.)
Here is my config
+++++++++++++++++
ZZSDC2ISE3/admin# sh run
Generating configuration...
hostname ZZSDC2ISE3
ip domain-name resource.local
interface GigabitEthernet 0
ip address 172.26.58.138 255.255.255.240
ipv6 address autoconfig
interface GigabitEthernet 1
ip address 172.26.200.62 255.255.255.0
ipv6 address autoconfig
+++++++++++++++++++++
Miche Misonne

Hello Michel
You cannot for the moment
Management is restricted to Gig0
You can refer to this document for better understanding
http://www.cisco.com/en/US/docs/security/ise/1.1.1/installation_guide/ise_app_e-ports.html
Tony

Manage billing of clients depending on usage.

Hi,
My requirement is like below:
I have one Windows Azure Account and I want to host my client's websites within that azure account, there will be one or two websites per client. I want to allow each client to login and manage only his websites/databases and charge each client as per his
site usage and I want to achieve this using Windows Azure web sites (requirement is like reseller plan on other hosting providers). Is it possible on Azure? How?
I know about the create subscription for each client and add client them as service administrator/co-administrator and manage their sites/services, but I want to manage all the clients under single subscription and chanrge them as per their site usage, so how
can I achieve this with windows Azure websites? If its not possible in websites then is it possible in other like cloud service/VM? how?
Thanks, Dilip

hi Dilip,
>>I have one Windows Azure Account and I want to host my client's websites within that azure account, there will be one or two websites per client.
What's the meaning of client? According to your description, I understand your meaning is that you want to host your customer's website on one azure websites server. And each customer could access themselves host server. And they could manage their usage
and billing. Am I right?
If yes, I think you use Azure websites Service don't achieve to. The reason is like following:
1.Azure billing service didn't support to show the every sites costs. The billing service could show the entire website pricing tire costs. You could see this detail form new portal billing usage panel.
2. Like the websites charged, the Database is charged by the service tire not shown the every database.
3.Azure websites service didn't support each customer logon on for manage their websites . If the customer could be able to login on the Azure, he could see all the services on that subscription.
For your requirement, as you said, multiple subscriptions could resolve this issue.
If you want to use Azure VM service, you could create the different VMs for each customer, and give them the permission (User name and password) to manage the VM using RDP.Each customer could login their VM and management their resource. But for Azure
Database, if they used it, you can not control the billing of Azure database.
Regards,
Will
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

KDE Printer Manager fails with "client-error-bad-request"

I'm having some trouble with printing on my system. The KDE printer manager shows "client-error-bad-request" and no other information. When I run the KCM from the command line, I also get "kcmshell(17286) KCupsRequest::serverError: status unrecognised: 1024" on the console. I wasn't able to find any useful information on this issue on google or these forums; not even what the 1024 status code means. It seems to me that this may be a bug in the kcm_printer_manager module, but I'd like to rule out other possibilities first. Unfortunately, I don't know what to try from here. I'll provide as much potentially relevant information as I can think of below.
Changes since last successful print job:
Multiple updates to KDE packages
Update to cups that changed systemd unit file names.
Stopped and disbled old units
daemon-reload
Enable and start new units
Other updates to cups since then, if I recall correctly.
Packages and versions:
kdeutils-print-manager 4.14.3-1 (owns kcm_printer_manager module for kcmshell4)
kdebase-runtime 4.14.3-1 (owns kcmshell4 binary)
cups 2.0.1-1
libcups 2.0.1-1
systemd 218-1
linux 3.17.6-1
Let me know if any other information might be helpful.

Anyone please help.
Thanks,
Orton

Managing Time Machine clients

All out clients are 10.6.5. Our backup server is 10.6.4.
Is anybody using Time Machine to backup clients to server and managing preferences to exclude folders or files?
For example, all our mail is IMAP so we could exclude ~/Library/Mail. We'd also like to exclude /System and /Applications, etc.
The default Snow Leopard Server MCX settings backup everything that is on the boot drive.
Thanks,
b.

Looking to find out the same info, others have not had success but the code may get you started down the right path. See:
http://lists.apple.com/archives/client-management/2008/Dec/msg00043.html
Having gotten this to work through managed preferences on a client bound to my OS X Server, I am now curious how/if this would work through pushing out local MCX preferences as well. Have not yet gotten it to work. I copy the prefs down to the client, but it just does not seem to list the server TimeMachine share in the System Preferences at all. Strange.

SAP Work Manager 6 - WPF Client & ATE Error

Hi,
I have installed SMP 2.3 SP03 L01 and have deployed the Work Manager 6 application on the server. My Agentry.ini and JavaBE.ini files seem okay. Self-Signed certificates were used properly as mentioned in the guides. connectTest.bat executes correctly, thus showing SAP backend information. The Work Manager agentry application starts correctly from SMP.
However, now that i want to test the application, I'm unable to connect to the server. The WPF and ATE errors are as below:
Can somebody help me out with these errors?
Tags edited by: Michael Appleby

Hi Abhishek,
I have figured out the problem. You are correct, the common name should be indessapd011. Other than that I had to change a couple of settings in the Agentry.ini too.
I'm now able to connect to the test environment:
However, I'm still unable to connect to the WPF client. The error is still:
Logging user into server
Communications error (14)
Connection failed
Ending transmission
Any ideas on this?

DirectAccess2012 + SCCM2012 + ISATAP Manage Out DA Clients

Similar Messages

Maybe you are looking for