Pre-provision BitLocker and Server 2008 R2

Hi,
I am trying to pre-provision BitLocker during WinPE and then install Windows Server 2008 R2. This results in a BSOD after the operating system image has been applied. Does anyone know if pre-provisioning bitlocker is supported or works on Server 2008 R2
(like it works on Windows 7 SP1)?
On technet I found the following regarding Server 2012: http://technet.microsoft.com/en-us/library/jj612864.aspx
There it states:
For all Windows Server editions, BitLocker must be installed using Server Manager. However, you can still provision BitLocker before
the server operating system is installed as part of your deployment.
Has anyone pre-provisioned BitLocker on Server 2008 R2?
Regards,
Carl

I am creating the BDE partition as mentioned and have used pre-provisioning of bitlocker without issues on win7, but the same thing does not seem to work on server 2008 r2 and results in BSOD. I suspect it could be related to the fact that BitLocker is not
installed on server 2008 r2 by default, so I'll try to add bitlocker using DISM and see if it makes any difference.
Another issue is that I have to create 2 partitions on the drive besides the BDEDrive (so 3 partitions in total), this messes up SCCM and it looks for the media from the wrong location, more info in this thread:
http://social.technet.microsoft.com/Forums/en-US/0b24b745-b890-494e-993c-1f1f307af960/configmgr-client-does-not-install-during-osd-trying-to-use-wrong-setup-path?forum=configmanagerosd#a4914c0d-1f56-4ba2-a745-b43fb0005e55
Carl

Similar Messages

MBAM Agent Key Escrow Issue After Pre-Provisioning Bitlocker in SCCM TS

Hello, I'm having an issue with MBAM key escrow now that we have moved to using pre-provisioned Bitlocker. After imaging completes the initial key escrow works properly (the MBAM Agent transmits the Numerical Password key protector to the MBAM server) however
the MBAM Agent no longer automatically changes the Numerical Password when the recovery code is revealed in the
MBAM Drive Recovery console. As far as I can tell MBAM is supposed to change this on the user's computer within 90 minutes by default and this behavior cannot be changed.
I have tested this using a previously-imaged computer that didn't use pre-provisioned Bitlocker. After revealing the recovery code in the MBAM console, the computer's Numerical Password protector was automatically changed as is expected. However
on the computers imaged with the pre-provisioned Bitlocker this does not happen.
Here are the versions of the software we're using:
SCCM 2012 R2
Windows 7 Enterprise SP1 x64
MBAM Agent v2.0.5301.1
The task sequence steps we are using consist of:
Ensure TPM is activated
Format and partition drive
Pre-provision Bitlocker, Encrypt Used Space Only mode
Apply Windows 7 image, install drivers and software, etc
Use manage-bde to set key protectors (-TPM and -RecoveryPassword)
Run the MBAM activation script
Use manage-bde to turn on Bitlocker on the drive
There are no error messages displayed and I can't see anything in the Event Viewer which would point to the root cause. The MBAM logs in Event Viewer are all Operational logs which simply state that the
'MBAM policies were applied successfully'.
Is this a known issue with pre-provisioned Bitlocker and MBAM? I haven't been able to find any information regarding this issue so any help would be greatly appreciated.
Thanks,
Justin.

According to the
MBAM TechNet documentation the client should log in the Microsoft-Windows-MBAM/Operational
section of Event Viewer. However:
The test computers do not show any error messages in the MBAM Operational log section. The only entries present are Information events
that state "The MBAM policies were applied successfully"
The test computers also don't seem to show any general Security or System Error logs related to Bitlocker or MBAM
According to the TechNet documentation listed above, when a machine has its Numerical Password reset there should be a
'RecoveryKeyReset' event logged. However on the laptop where MBAM is changing the Numerical Password I do NOT see this event (though I have confirmed with manage-bde that the recovery password was changed successfully). The only events I see
are, again, Operational logs for Information events that state "The
MBAM policies were applied successfully".
I'm not sure why there aren't any errors logged, or why that laptop isn't generating that RecoveryKeyReset event like it should. As far as I can tell there isn't any way to change what the MBAM client logs, right? I didn't see any logs in AppData or Program
Data so I have to assume everything is supposed to be logged in Event Viewer.

Pre-provision bitlocker during OSD with a Windows 7 Enterprise image fails at Enable Bitlocker - SCCM 2012 SP1 beta

I'm trying the SP1 feature to pre-provision bitlocker during OSD, using an MDT integrated task sequence. It seems like the pre-provision part is working, but when the task sequence tries to enable bitlocker after installing the
OS, it fails. ZTIBDE.log contains the following:
Property UDI is now = ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Microsoft Deployment Toolkit version: 6.1.2373.0 ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
The task sequencer log is located at C:\WINDOWS\CCM\Logs\SMSTSLog\SMSTS.LOG. For task sequence failures, please consult this log. ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
System drive is: C: ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
The deployment method is using ConfigMgr. ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Property BdeInstallSuppress is now = NO ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
This script is not currently running in Windows PE ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
We are running a OS that supports BitLocker ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
OSDBitLockerTargetDrive= , OSDBdeTargetDriveLetter= , sOSDBitLockerTargetDrive= C: ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
This is a Refresh Build where BDE protectors were disabled. ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
OS Version is Windows 7 or higher. ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Encryptable Volume Count:1 ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Attempting to bind to: C: ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Success setting oBdeVol ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
BDE Instance Bind Complete ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Attempting to enable BDE Protectors ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
FAILURE ( 6767 ): -2144272377 0x80310007: Enable BDE Protectors ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
This laptop is in an OU with bitlocker related settings applied via GPO, including allowing enhanced PINs, requiring backup of the recovery passwords and key packages to AD, and to require TPM+PIN for the startup authentication.
Bitlocker provisioning is working on my production server using only MDT (No SCCM), with a task sequence deploying Windows 7. I copied some of the variables from the customsettings.ini over to a collection variable in SCCM for
the collection I'm testing deployment to. Putting those same variables in collection variables should work the same as if they were in the custom settings, but only for members of that collection, right?
The variables set in the collection variables area are
BDEInstall - TPMPIN
BDEInstallSuppress - NO
BDEPin - SET
BDERecoveryKey - AD
BDERecoveryPassword - TRUE
TPMOwnerPassword - SET
OSDBitlockerMode - TPMPin (This one wasn't copied from the other MDT share, but added just for sccm.
I didn't copy the BDEWaitforEncryption variable, it didn't seem like that one would be necessary with the pre-provisioning. What am I doing wrong here?

If not you could add a set variable action to your task sequence after the UDI wizard to set OSDBitLockerPIN to %BDEPin%. You could add a condition to the action to only run if BDEPin exists.
I don´t quite fallow, how I can switch these variables between. I admit I some time have difficulties to understand the variables. Could you mark discribe me the settings of set variable step I have to enter. Thanks!
With Confmgr step Enable Bitlocker I have another issue - it does not allow to to enter pin code with letters.
No problem :-). There is a task sequence action called "set task sequence variable". Just add one of these actions to the task sequence after the UDI wizard. There are only two things you have to configure in the action, the variable you want to set
and the value you want to set that variable to. The UDI wizard will create the variable BDEPin with a value equal to the PIN you enter in the UDI wizard page. So in your "set task sequence variable" action enter the variable name as OSDBitlockerPIN
and the value as %BDEPin%. This action will then create the OSDBitlockerPIN variable with the value that was stored in BDEPin by the UDI wizard. The built in SCCM action will then use this as the PIN rather than whatever value is configured in the task sequence
editor.
However the best solution would probably be to get the UDI wizard to set OSDBitlockerPIN rather than BDEPin in the first place. I think you can do this in the UDI wizard editor or directly in the XML. I don't use the editor these days so can't recall offhand.
I will take a look at this next week.
Most of the task sequence actions support variables and it enables you to configure the action dynamically at runtime. For example the same sequence can be used to deploy systems into different domains, languages, applications etc. all by setting variables.
It's the basis of how the UDI wizard works, it just sets variables which are then consumed by either MDT scripts or task sequence actions. The variables can be configured by UDI, collections, MDT customsettings.ini, MDT database or scripts. Dynamic deployment
is definitely the way to go :-).
I think you are correct about the built-in action not supporting enhanced PIN. I think it only supports standard numeric PIN. Whether setting the PIN via the variable works around a restriction in the task sequence editor I am not sure, I suspect not.
Mark.

Pre-provisioned Bitlocker

SCCM 2012 SP1 with MDT 2013 doing Windows 7 SP1 images. Can somebody who successfully sets up Bitlocker give me some guidance here. I'm looking at Niall's Noob article
http://www.niallbrady.com/2012/09/23/how-can-i-pre-provision-bitlocker-in-winpe-for-windows-8-deployments-using-configuration-manager-2012-sp1/ about using pre-provisioning. I realise about setting up AD, and turning on the TPM chip etc. , but my
confusion is with the BDE variables needed if using the MDT client task sequence which I use
I see articles about adding variable into the customsettings.ini such as
bdedriverletter=S
bdedrivesize = 30000
etc. but isn't this handled by the MDT TS which creates hidden partition for Bitlocker anyway ??
I have also seem some articles saying NOT to use the MDT version of enable bitlocker step which I believe runs ztibde rather to use the SCCM step enable bitlocker
Also if using pre-provisioning which seems to make sense is it sensible to put the client files such as the Dell CCTK into the boot image
Thanks
Ian Burnell, London (UK)

Hi,
I normally let the builtin format step create the BDEdrive partition, and I normally put the Dell CCTK files in a package instead and reference that package from the task sequence step instead of putting it in the WinPe image, it makes it much easier to
update if a new model requires a new version of the CCTK.
Regards,
Jörgen
-- My System Center blog ccmexec.com -- Twitter
@ccmexec

Enterprise Hotfix Rollup for Win7 and Server 2008 R2 via WSUS

I stumbled across the fact that Microsoft released a hotfix rollup for Win7 and Server 2008 R2 that contains 90 hotfixes
http://support.microsoft.com/kb/2775511/en-us
The articled I linked above talks about after installing 2775511 (the big hotfix rollup containing 90 hotfixes) it is also necessary to install three more hotfixes:
After this update is installed, you must install update 2732673 to fix a regression issue in the Rdbss.sys file
After this update is installed, you must install update 2728738 to fix a regression issue in the Profsvc.dll file
After this update is installed, you must install update 2878378 re-released on November 11, 2013 to fix a regression issue in the Advapi32.dll file
I have imported all four of these hotfixes into my WSUS server. Do I need to install 277551 first and then install the other three or can all four be approved and go out at once? I guess I am hung up on the language of "After this update is installed
.... ". I want to put all 4 of these on our Win7 machines as well as my 40+ WinServer 2008 R2 machines

I read somewhere that over half of the updates included in Win7 SP1 and WinServer 2008 R2 SP1 were originally released as hotfixes. This means Microsoft made the decision that a large number of hotfixes would benefit every user of these two OSs
I think your conclusion is flawed. The only thing that you can draw from the presented statistic, is that Microsoft determined that a significant percentage of updates originally released as hotfixes warranted the additional investment in regression testing
to subsequently release those hotfixes as updates.
The fact that they bundled these 90 hotfixes together leads me to the same conclusion.
In fact, exactly the opposite conclusion applies: What you have in this package is all the rest of the stuff that didn't make that cut. What you have in this package are still NOT-regression tested hotfixes, they've just been bundled up for easy deployment
(and note that three of them got further broken in the process of bundling), causing yet three more hotfixes to have to be released.
In fact I read the MS Team Blog about this big hotfix release and they say the same thing, all users of these OSs would benefit from the installation of this hotfix rollup, not just a subset of users.
I suspect there are a notable number of patch administrators and systems administrators who would disagree with that self-serving promotion. If, in fact, it's true that "all users" would benefit, then the product team should have invested the effort in properly
regression testing those hotfixes, and releasing them as REAL updates. They did not; ergo the *actual* value is less than claimed.
Of course the bugaboo here is the fact that three other individual hotfixes need to be installed after the big hotfix rollup is installed.
Exactly! (And those are just the attempted fixes that broke something. Who knows how many other "fixes" may still result in newly discovered "broken stuff" that was never broken in the first place.)
The second part of this question should revolve around an itemized review of the hotfixes contained in this rollup with one simple question asked for each:
Have we actually *experienced* the issue addressed by this hotfix.
Where hotfixes are concerned one very simple but important rule applies:
If it ain't broken, don't try to fix it!
Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
SolarWinds Head Geek
Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
http://www.solarwinds.com/gotmicrosoft
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

Unable to execute embedded application windows azure in Windows Vista and Server 2008

I'm having problems to install the backup application Azure.
In Windows Vista and Server 2008 .
I segudo instructions :
http://support.microsoft.com/es-es/kb/2934202
But I still can not install the agent.
When I run it , it is decompressed and then a window with an error.
Anyone else happens ?

The message that Windows creates me exactly is:
Unable to execute the embedded application to complete the installation.
After being , checking this:
Microsoft .NET Framework 4
Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package MFC Security Update
Windows PowerShell 3.0 (my machine is 2.0)
Microsoft.NET Framework 4 Client Profile (installed)
Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package (installed)
The announcement of support Server 2008 64bit versions .
https://msdn.microsoft.com/es-es/library/azure/jj573031.aspx#BKMK_testsrv
I realize that my machine is 32bit Server 2008 Standard
http://azure.microsoft.com/blog/2014/10/06/announcing-support-for-backup-of-windows-server-2008-with-azure-backup/
It occurred to me descompri the MARSAgentInstaller package.
Run the application, but being 32bit my system , I think the Agent application is 64bit Copies Azure .
For this throws an error commenting same .

Server 2012 Kms Host and Server 2008 r2 client.

I have deployed a Server 2012 Kms host.
Windows 7, and 8 are activating just fine, and Office 2010 is working.
The issue I'm having is activating Server 2008 and Server 2008 r2.
It seems I have missed a step that would allow me to activate those clients.
Can someone please guide me as to what possibly needs to be done to allow these clients to activate?

Hi,
The following steps are needed to set up Volume Activation Services in a Windows Server 2012 test lab:
1. Step 1: Set up the base test lab configuration
2. Step 2: Install the Volume Activation Services server role
3. Step 3: Configure Active Directory-based Activation
4. Step 4: Verify that Active Directory-based Activation works
5. Step 5: Configure Key Management Services (KMS)
6. Step 6: Verify that KMS volume activation works
At same time KMS volume activation requires
a minimum threshold of 25 computers before activation quests will be processed. The verification process described here will increment the activation count each time a client computer contacts the KMS host. However, unless the activation threshold
is reached, the verification will take the form of an error message rather than a confirmation message.
The related KB:
Test Lab Guide: Demonstrate Volume Activation Services
http://technet.microsoft.com/en-us/library/hh831794.aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Adding sites to compatibility mode and trusted sites, IE10 and Server 2008

We're having a challenge with configuring a GPO to add several sites to Compatibility View Settings as well as adding several others (the same sites, plus some others) to Trusted Sites. We are currently running VMware's Persona Management/floating
pools (thin provisioned linked clones), with the appdata folder redirected to the Persona server. Clients are running IE10, DCs are running Server 2008 R2 with IE8.
gpresult/r shows the GPO listed under Applied GPOs on the User Settings side (and all the settings are user settings); however, compatibility and trusted sites settings do not apply.
From prior research on the topic, I seem to recall that I needed to install the IE10 IEAK; however, I cannot install that without having IE10 installed first, and I cannot install IE10 without installing the pre-requisite elements, which I cannot install
(either through Windows Update or the IE10 standalone installer). When the IE10 install fails, it refers me to a Microsoft KB article that won't open. If I open the article on a workstation PC, I find links to five separate prerequisite files.
If I download all five files and attempt to install them, they say they're not applicable to my computer. I can't post links in this article yet (account hasn't been verified), but a Google search for "MS KB 2818833" leads to the page with
the links.
64-bit Server 2008 R2.
Any thoughts?

Hi,
Before going further, how did we configure the settings? Since Windows 8, the IEM settings have been deprecated. As a result, IEM settings won't apply to IE10 or above. However, in this situation, we should be able to use administrative templates
to configure the settings we want.
Regarding how to add web site to Compatibility View List via GPO, the following article can be referred to as reference.
How to add web site to Compatibility View List via GPO
http://blogs.msdn.com/b/asiatech/archive/2013/10/23/how-to-add-web-site-to-compatibility-view-list-via-gpo.aspx
Regarding how to Internet Explorer security zone sites via native policies, the following article can be referred to for more information.
How to configure Internet Explorer security zone sites using group polices
http://blogs.msdn.com/b/askie/archive/2012/06/05/how-to-configure-internet-explorer-security-zone-sites-using-group-polices.aspx
Best regards,
Frank Shen

PKI SCCM Client Certificate Template not viewable by Windows 7 and Server 2008 workgroup machines.

Hello everyone,
I’m having issues with workgroup computers, not domain systems when I request a certificate.
It’s extremely weird. It has something to do with Windows 7 and Windows 2008 machines. In 2003 server I can request a certificate manually with certutil and it see the certificate template. I copy over the exact command
on windows 7 and it can’t see the certificate template.
I have the following configuration:
CA Enterprise
I have created the SCCM Client Certificate
I have created the SCCM Web Server Certificate
I have created the SCCM Distribution Point Certificate
GPO is configured
SCCM 2012 R2 CU2 configured to do HTTP and HTTPS
Installed SCCM Client Certificate
Installed SCCM Web Server Certificate
Installed Distribution Point Certificate
Deployed to a domain computer good on PKI
Workgroup Computers:
I’m having issues with deploying certificates
Windows 7 –
(ERROR) not successful
Windows Server 2008 R2 –
(ERROR) not successful
Windows Server 2003 - successful
Windows XP – successful
How I’m getting the certs for the clients is by utilizing the following scripts from this URL.
http://www.ithierarchy.com/ITH/node/48
I did find a couple of errors in the code, but if it’s working on my Server 2003, then it should work on the others. Windows 7 and Windows 2008 R2 seem to have the same issue. The error I’m getting is the following:
Command line requesting the cert ---- CertReq –new –f testcomputer.home.pvt.inf c:\client\testcomputer.home.pvt.req
Error --- Template not found.
SCCMClientCertificate (this is my template)

Just to give an update on what’s happening with this. I found out this format is unsupported by MS with Windows Vista and newer OS’s.
Instead you must utilize two other additional roles on the CA to have this work. The caviate is, I’m down to the testing and it’s not working as in the document. I have MS Support
working with me to resolve this issue since it was written by MSFT.
http://blogs.technet.com/b/askds/archive/2010/05/25/enabling-cep-and-ces-for-enrolling-non-domain-joined-computers-for-certificates.aspx
and use this doc for similar workgroup computers for rolling out certs. This was written for RT devices, however, it should work once I get to that point.
http://blogs.technet.com/b/pki/archive/2012/12/11/certificate-for-winrt-devices-and-non-domain-member-devices.aspx

PKI Client Certificate Template not viewable by Windows 7 and Server 2008 workgroup machines.

Hello everyone,
I’m having issues with workgroup computers, not domain systems when I request a certificate.
It’s extremely weird. It has something to do with Windows 7 and Windows 2008 machines. In 2003 server I can request a certificate manually with certutil and it see the certificate template. I copy over the exact command
on windows 7 and it can’t see the certificate template.
I have the following configuration:
CA Enterprise
I have created the SCCM Client Certificate
I have created the SCCM Web Server Certificate
I have created the SCCM Distribution Point Certificate
GPO is configured
SCCM 2012 R2 CU2 configured to do HTTP and HTTPS
Installed SCCM Client Certificate
Installed SCCM Web Server Certificate
Installed Distribution Point Certificate
Deployed to a domain computer good on PKI
Workgroup Computers:
I’m having issues with deploying certificates
Windows 7 –
(ERROR) not successful
Windows Server 2008 R2 –
(ERROR) not successful
Windows Server 2003 - successful
Windows XP – successful
How I’m getting the certs for the clients is by utilizing the following scripts from this URL.
http://www.ithierarchy.com/ITH/node/48
I did find a couple of errors in the code, but if it’s working on my Server 2003, then it should work on the others. Windows 7 and Windows 2008 R2 seem to have the same issue. The error I’m getting is the following:
Command line requesting the cert ---- CertReq –new –f testcomputer.home.pvt.inf c:\client\testcomputer.home.pvt.req
Error --- Template not found.
SCCMClientCertificate (this is my template)

Just to give an update on what’s happening with this. I found out this format is unsupported by MS with Windows Vista and newer OS’s.
Instead you must utilize two other additional roles on the CA to have this work. The caviate is, I’m down to the testing and it’s not working as in the document. I have MS
Support working with me to resolve this issue since it was written by MSFT.
http://blogs.technet.com/b/askds/archive/2010/05/25/enabling-cep-and-ces-for-enrolling-non-domain-joined-computers-for-certificates.aspx
and use this doc for similar workgroup computers for rolling out certs. This was written for RT devices, however, it should work once I get to that point.
http://blogs.technet.com/b/pki/archive/2012/12/11/certificate-for-winrt-devices-and-non-domain-member-devices.aspx

Problem with m1319f mfp on WIndows 7 and Server 2008

Hi there,
I just bought a m1319f mfp.
Plugged it in an old D-Link dp-300u print server.
The printer work fine on Windows XP.
Not working on Windows 7 and Windows server 2008.
I configured the port as in XP (adress, lp, queue name) and when i print from 7 or server 2008, there is a message on the printer saying "printing document". It stays there for a couple of minutes but no printing. No stuck document on the computer printing queue.
Every time i install the printer from 7 or server 2008, the print server have to be restarted (lights flashing).
The print server seems to fail when i'm on the Windows printer searching part (windows trying to find the printer when adding a new printer).
Maybe the dp-300u is too old?
I have another printer on it (LPT this time) and its working fine. Brother MFC7220 it is.
ANy idea?
Thank
Hope i have been clear, English is not my first language...

BUmp

880GM-E41 and Server 2008 / Windows Home Server 2011

I am building a WHS 2011 machine (which is based on Server 2008) and am considering the 880GM-E41 mainboard. However when I go to the product website:
http://www.msi.com/product/mb/880GM-E41.html
I don't see drivers listed for Server 2008. Specifically, there are chipset, audio, raid (etc) drivers listed for Windows 7 64-bit, but nothing for Windows Server 2008. However in the past I have experienced mainboards which 'just work' regardless of the drivers that are downloadable. My question is... before I purchase this mainboard, does anybody know if the motherboard works on Windows Server 2008? Or which devices/features will not work?
I actually don't require the RAID drivers to work since I won't be using hardware raid, but I will need the system, chipset, and audio drivers working (whether they get pulled from Windows Update or downloaded from MSI).
Thanks!

WHS 2011 is built on the Windows Server 2008 R2 code base, which is built on Windows NT 6.1, the same core operating system used with the end-user oriented Windows 7. So basically, you need to use Windows 7 64bit drivers and everything will be fine.

OID and Server 2008 R2 AD

Hi,
We have recently decided to upgrade our Active Directory Domain to Server 2008 R2. We use Oracle OID 10g but are experiencing problems pointing OID at a 2008 R2 domain controller because only 250 results are returned. Below is a message we have recieved from Oracle support blaming Microsoft AD for the problem but we think there may be something else going on.
Can anyone help us out please?
Many thanks,
Tim
Hello.
Please have a look at Note 944298.1
Although DIP synchronization of OID 10g with MS Windows 2008 / AD 2008 may work, it is not officially compatible / certified due to known issues.
You can try to fix the synchronization but it's possible that may not work, or other components may not work (for example WNA).
Current error at bootstrap is
[LDAP: error code 12 - 00002040: SvcErr: DSID-031401E0, problem 5010 (UNAVAIL_EXTENSION)
This error is thrown by Microsoft AD when searching for more than 250 entries.
This is an AD issue, and if you would like to fix the uncertified setup, you will need to first raise a case with Microsoft Support for this error.
For opening a case, more details would need to be provided to Microsoft.
I have seen the exact same error recently with AD2008 and I know that the problem is with Microsoft's pagination control "1.2.840.113556.1.4.319 (pagedResultsControl)" when reading the second page.
In order to confirm this before opening a case with Microsoft, please use following note to capture network trace during bootstrap and check the controlType of the frame which returns UNAVAIL_EXTENSION.

Thought I'd follow up with you guys. Been working with Ritesh Mishra at Microsoft. He had us install the patch referenced in KB977180 on our 2008 R2 domain controller followed by a reboot, which did not work by itself. But after adding the following registry key to the 2008 R2 domain controller followed by another reboot, everything started working.
HKLM\System\CurrentControlSet\Services\NTDS\Parameters
Add String value “DSA Heuristics”
Set the value to 000000000001
I hope this helps.
Edited by: user13336785 on Aug 4, 2010 12:38 PM

Server 2012 ADFS and Server 2008 R2 ADFS Proxy compatilibility

Hi,
Does anyone know if a 2008 R2 ADFS Proxy will talk to ADFS running on Server 2012?
TIA.

I have not found a reference to say if this is supported or not. I know that there is no longer a separate ADFS proxy role in Windows 2012 R2. The Remote Access feature provides VPN, Direct Access and Web Application Proxy (WAP) functionality.
So, better to use the new functionality.
More if you ask them here: https://social.msdn.microsoft.com/Forums/vstudio/en-US/home?forum=Geneva
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Need to refine searches in Windows 7 (and server 2008)

I need to perform a Windows XP-like search and cannot find a method of doing so. Windosw XP allowed a "search-within-a-search", for example:
File Name:
*abc*.txt
Word or phrase within the file:
..\interface\100\
Search in:
D:\DATA\TextFiles
This effectively proposes three levels of filtering simultaneously: Location, file name, content.
I cannot find this in Windows 7 (or W2008 server) and for historical reasons cannot work without it. I am about to lose all WXP access to the drives concerned. I would be willing to accept a DOS command script, or PowerShell script.
Thanks in advance for any help you can give on this subject.
Paul ROBERTSON

Hi -
& thanks to J Davidson. Yes I agree that this can do it, and although a bit more laborious than the GUI of Windows XP, it has a lot more flexibility. Consider my life saved.
The example I gave in the original question would resolve to:
C:\Windows\System32>D:
D:\>cd DATA\TextFiles
D:\DATA\TextFiles>findstr /S /C:..\interface\100\ *abc*.txt
It does the business, but is much slower if you type it out without creating a batch file. Microsoft cannot argue that this is a step forward for the average user, but thanks Guys, case closed.
Paul ROBERTSON

Pre-provision BitLocker and Server 2008 R2

Similar Messages

Maybe you are looking for