Windows server 2012 R2 randomly BSOD's
Dear all,
Since recently we suffering from random BSOD's on a Windows 2012 R2 terminal server. We already checked if there has been any changes, updates, new drivers installed, etc. around the time we receive the first one, but we cannot find anything. The server
is a virtual server on Hyper-V but the Hyper-V host doesn't suffer from BSOD's and is working properly. We updated the servers with newest windows updates. Could someone please help me debugging this minidump:
Loading Dump File [C:\Users\admtem\Desktop\031915-48906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*c:\cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9600 MP (16 procs) Free x64
Product: Server, suite: TerminalServer
Built by: 9600.17668.amd64fre.winblue_r8.150127-1500
Machine Name:
Kernel base = 0xfffff801`f4489000 PsLoadedModuleList = 0xfffff801`f4762250
Debug session time: Thu Mar 19 01:55:51.856 2015 (UTC + 1:00)
System Uptime: 0 days 2:21:59.525
Loading Kernel Symbols
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
Loading User Symbols
Loading unloaded module list
* Bugcheck Analysis *
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffff90140599000, 2, 0, fffff801f45280ab}
Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+3fb )
Followup: MachineOwner
6: kd> !analyze -v
* Bugcheck Analysis *
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff90140599000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff801f45280ab, address which referenced memory
Debugging Details:
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff801f47ec138
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
fffff90140599000
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeSetEvent+3fb
fffff801`f45280ab 488b09 mov rcx,qword ptr [rcx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: AV
PROCESS_NAME: System
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
TRAP_FRAME: ffffd00142686900 -- (.trap 0xffffd00142686900)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd001475bc4e8 rbx=0000000000000000 rcx=fffff90140599000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801f45280ab rsp=ffffd00142686a90 rbp=0000000000000000
r8=0000000000000000 r9=fffff801f492c628 r10=fffff90140599000
r11=ffffd00142686b00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po nc
nt!KeSetEvent+0x3fb:
fffff801`f45280ab 488b09 mov rcx,qword ptr [rcx] ds:fffff901`40599000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff801f45e54e9 to fffff801f45d99a0
STACK_TEXT:
ffffd001`426867b8 fffff801`f45e54e9 : 00000000`0000000a fffff901`40599000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd001`426867c0 fffff801`f45e3d3a : 00000000`00000000 ffffd001`475bc4e0 ffffe001`26538900 ffffcf81`0df3afa0 : nt!KiBugCheckDispatch+0x69
ffffd001`42686900 fffff801`f45280ab : 00000000`00002608 00000000`00000000 00000000`00000030 00000000`00000000 : nt!KiPageFault+0x23a
ffffd001`42686a90 fffff801`f45343ac : fffff901`40599000 ffffe001`00000000 ffffe001`25f34800 fffff801`00000000 : nt!KeSetEvent+0x3fb
ffffd001`42686b50 fffff801`f4561280 : 13131313`13131313 ffffe001`25f34880 00000000`00000080 ffffe001`25f34880 : nt!ExpWorkerThread+0x28c
ffffd001`42686c00 fffff801`f45dffc6 : ffffd001`42040180 ffffe001`25f34880 ffffd001`4204c5c0 13131313`13131313 : nt!PspSystemThreadStartup+0x58
ffffd001`42686c60 00000000`00000000 : ffffd001`42687000 ffffd001`42681000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeSetEvent+3fb
fffff801`f45280ab 488b09 mov rcx,qword ptr [rcx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KeSetEvent+3fb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 54c832b2
IMAGE_VERSION: 6.3.9600.17668
BUCKET_ID_FUNC_OFFSET: 3fb
FAILURE_BUCKET_ID: AV_VRF_nt!KeSetEvent
BUCKET_ID: AV_VRF_nt!KeSetEvent
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_vrf_nt!kesetevent
FAILURE_ID_HASH: {3ff99d47-0a85-0b19-f59a-c152651b9c12}
Followup: MachineOwner
Any help would be much appriciated!
Kind Regards,
Thijs
Hi Thijs,
Just addition, please also check if all necessary windows updates were installed in this problematic server. Please check if drivers need to be updated.
Please also refer to following thread and check if can help you.
Blue Screen Error (Probably caused by : ntkrnlmp.exe)
If this issues is a state of emergency for you. Please contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
To obtain the phone numbers for specific technology request, please refer to the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
Best regards,
Justin Gu
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Similar Messages
-
Storport.sys BSOD on Windows Server 2012 R2
I recently purchased a Server that houses 45 4TB drives to use as my backup to disk solution. I installed Windows Server 2012 R2 Standard so that I could take advantage of Microsoft's Storage Spaces. I have configured the Storage Pool
with Dual Parity with 3 hot spares. I have also updated every thing to the most current firmware, drivers and Windows Updates that I could find but I am still getting the BSOD. I am using Symantec Backup Exec 2010 R3 to backup my file server to this server.
It will run for anywhere between 12 to 31 hours transferring 1.5 to 3TB and then my server will Blue Screen and every time it Blue Screens it says it is caused by the storport.sys Driver. I've found articles talking about the storport.sys driver causing nonpaged
pool leaks but that was for Windows Server 2008 R2, I can't find anything for Windows Server 2012 R2. If you need additional information just let me know and I will provide it. Any help you can give would be greatly appreciated.Hi,
This article provided the limitation of Storage Pool in Windows Server 2012 R2:
https://social.technet.microsoft.com/wiki/contents/articles/11382.storage-spaces-frequently-asked-questions-faq.aspx#What_are_the_recommended_configuration_limits
Yor current situation is still in supported configuration.
Also there is no hotfix for Windows Server 2012 R2 regarding storport.sys yet. Which means your current issue is not a known issue.
For further troubleshooting purpose you may need to collect dump files for analysis. However it will take a long time to do the troubleshooting process on forum. Thus it is recommended to submit a ticket to Microsoft online support for a professional troubleshooting.
To obtain the phone numbers for specific technology request please take a look at the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS
If you have any feedback on our support, please send to [email protected] -
Intermittent loss of UNC path access on Windows Server 2012
Hi All,
I hope someone can help with a major headache we've been having on two Windows Server 2012 boxes since September this year. Basically, these servers will intermittently lose the ability to browse network shares from windows explorer and the only way we have
found to resolve this is to reboot. When the issue happens, we can't even log into the server as it sits at 'applying user settings' - presumably as it is failing to access the netlogon share on our DCs. If we have an active RDP session when the issue occurs,
we can connect. In this instance we see that if you enter a UNC path in Windows explorer and hit enter, nothing happens - no error messages or anything. The only way I can get any response is when trying to access the IPC$ share on another server, which gives
the following response:
\\server\ipc$ is not accessible. You might not have permission to use this resource, Contact the administrator of this server to find out if you have access permissions.
The parameter is incorrect.
Everything looks right from a physical network perspective, as we can ping from the affected servers and DNS queries are working fine. I can even run net view from powershell and see the local servers and shares on these, however any attempt to access shares
just hangs the powershell session.
If I look in the SMBClient event logs, I can see entries like the following:
Event ID 30805
The client lost its session to the server.
Error: The transport connection is now disconnected.
This is made worse by the fact that when this issue happens, we can't even cleanly reboot the server (it just hangs) and have to perform a cold boot.
The firewall has been turned off and we have taken off our antivirus software to eliminate it as a possible cause. We have even rebuilt one of these servers on a clean install of 2012 R2, but the issue re-appeared. We have also tried using different NIC
drivers (Broadcom NICs installed) to no avail. We have also tried disabling IPv6.
We have logged a ticket with Microsoft support, who have come back telling us that this could be related to a known bug with DFS in 2012 for which a fix is being tested prior to release in a few weeks. However, I can't sit around on my hands until then on
the off chance that this fix will resolve our problem. These servers are hosting our production Lync 2013 front end service and when this issue occurs it breaks the address book search and response group services, so this issue is of critical importance for
us to get resolved asap.
Any help on this would be greatly appreciated.Hi,
That's right, if you hit enter absolutely nothing happens, no error messages. It makes no difference if I try name or IP address - even trying \\localhost doesn't work. A few minutes later after trying, an entry appears in the SMBClient event logs as mentioned
in my original post. To me it looks like something deep within the networking operations of the OS is randomly breaking. Also, if I try to browse the network from Windows explorer, it just hangs. When I try to restart the workstation service, it just gets
permanently stuck in a stopping state and the server has to be cold booted. Once it boots up, everything is working fine again....until the next time. There is absolutely nothing appearing in the application or system event logs indicating the root cause.
I've checked and DNS resolution is working OK and I can telnet to other hosts on all the required ports.
I had originally thought it might be related to the Broadcom NICs as we've had issues with them in the past, but we switched over to use the 2012 inbox driver for them and the same issue happens. I should also mention that one server is a blade and the other
a rackmount box. Dell support have run full diagnostics on both and have come up clean, so it doesn't appear to be a hardware issue. The even more baffling thing is that we have a third server with identical spec and config that does not have the problem.
The only difference with this third server is that it is not part of a Lync pool pairing using DFS and sits in a remote location on a different LAN.
I had thought of trying to drop back to use SMB1 by disabling SMB2 and 3, but I'm not sure if this would adversely affect any other services.
This one really has me stumped. -
File systems available on Windows Server 2012 R2?
What are the supported file systems in Windows Server 2012 R2? I mean the complete list. I know you can create, read and write on Fat32, NTFS and ReFS. What about non-Microsoft file systems, like EXT4 or HFS+? If I create a VM with a Linux OS, will
I be able to acces the virtual hard disk natively from WS 2012 R2, or will I need a third party tool, like the one from Paragon? If I have a drive formated in EXT4 or HFS+, will I be able to acces it from Windows, without any third party tool? Acces it,
I mean both read and write on them. I know that on the client OS, Windows 8.1, this is not possible natively, this is why I am asking here, I guess it is very possible for the server OS to have build-in support for accesing thoose file systems. If Hyper-V
has been optimised to run not just Windows VMs, but also Linux VMs, it would make sense to me that file systems like thoose from Linux or OS X to be available using a build-in feature. I have tried to mount the vhd from a Linux VM I have created in HyperV,
Windows Explorer could not read the hard drive.Installed Paragon ExtFS free. With it loaded, tried to mount on Windows Explorer a ext4 formated vhd, created on a Linux Hyper-V vm, it failed, and Paragon ExtFS crashed. Uninstalled Paragon ExtFS. The free version was not supported on WS 2012 R2
by Paragon, if Windows has no build-in support for ext4, this means this free software has not messed around anything in the OS, I guess.
Don't mess with third-party kernel-mode file systems as it's basically begging for troubles: crash inside them will make whole system BSOD and third-party FS are typically buggy... Because a) FS development for Windows is VERY complex and b) there are very
few external adopters so not that many people actually theist them. What you can do however:
1) Spawn an OS with a supported FS inside VM and configure loopback connectivity (even over SMB) with your host. So you'll read and write your volume inside a VM and copy content to / from host.
(I personally use this approach in a reversed direction, my primary OS is MacOS X but I read/write NTFS-formatted disks from inside a Windows 7 VM I run on VMware Fusion)
2) Use user-mode file system explorer (see sample links below, I'm NOT affiliated with that companie). So you'll copy content from the volume as it would be some sort of a shell extension.
Crashes in 1) and 2) would not touch your whole OS stability.
HFS Explorer for Windows
http://www.heise.de/download/hfsexplorer.html
Ext2Read
http://sourceforge.net/projects/ext2read/
(both are user-land applications for HFS(+) and EXT2/3/4 accordingly)
Hope this helped :)
StarWind VSAN [Virtual SAN] clusters Hyper-V without SAS, Fibre Channel, SMB 3.0 or iSCSI, uses Ethernet to mirror internally mounted SATA disks between hosts. -
Windows server 2012 and windows xp remote desktop connection loss
I am having this problem for a month now, and i am stumped with trying to find an answer . I have talked with several network admins in my area and with no luck i have not found a solution. I have a windows server 2012 placed with 5 pcs that are connected
on a local network , those 5 pc's connect to the server via remote desktop. List of pc's:
1x Windows 7
4x Windows XP SP3
All have the latests network drivers, all have the latest version of remote desktop installed. All have been scanned for viruses. All have antivirus software.
Problem is the 4 XP machines lose connection on when connected via remote desktop. If one starts losing connection the other 3 start to lose the connection aswell. The windows 7 machine is not affected by this it works fine.
What have I tried:
Scanning for viruses.
Disabling Firewall and antivirus software.
Updating all drivers.
Did many changes to group policy like keepalives etc.
Turning off SMBv2 SMBv3.
Turning off network adapter Offload settings.
Changed some registry settings like keepalive, smb etc.
Updating every pc and server with all windows updates.
Changed the router and switch.
Port forwarded needed ports like 3389.
Updating remote desktop to 7.0.
I might be forgetting some stuff i will add as i remember anything.
So the thing is this. I use a Windows XP machine from my office I remotely connect to the server via the Internet and I DO NOT experience any connection loss. BUT the XP machines on the local network constantly experience connection loss via remote desktop.
I pinged every Machine from the server via CMD command PING. So when they lose connection the Packets get time outs . Packets get dropped between 1-10 packets when a connection is lost. This packet drop does not occur when using the internet or anything else.
ONLY when connected to the server via remote desktop. The packets get dropped at random intervals.
Problem is I use an XP machine and I am not experiencing any loss of connection , while the XP machines on the local network experience it , but not the windows 7 machine.
Router is ASUS RT-N53 , and switch is Dlink DES-1008D. Server is a Dell PowerEdge T110 II.
Can someone please tell me what can i do to solve this problem?So today got some word from their office. They were using RDP from 8AM until 12PM all was working fine. Then got back after lunch about 1PM and got a few connection lost errors when they tried using RDP again. Its weird since they didn't have disconnects
in the morning, and started having them after lunch.
Also noticed, that two pc were not using RDP and were disconnected as shown in task manager. And they still got request timeouts.
Maybe this is not a remote desktop issue?
TASK MANAGER
The 2 disconnected pc's ping screens: -
We have a problem with one of our deployments of Windows Server 2012 Hyper-V with a 2 node cluster connected to a iSCSI SAN.
Our setup:
Hosts - Both run Windows Server 2012 Standard and are clustered.
HP ProLiant G7, 24 GB RAM. This is the primary host and normaly all VMs run on this host.
HP ProLiant G5, 20 GB RAM. This is the secondary host that and is intended to be used in case of failure of the primary host.
We have no antivirus on the hosts and the scheduled ShadowCopy (previous version of files) is switched off.
iSCSI SAN:
QNAP NAS TS-869 Pro, 8 INTEL SSDSA2CW160G3 160 GB i a RAID 5 with a Host Spare. 2 Teamed NIC.
Switch:
DLINK DGS-1210-16 - Both the network cards of the Hosts that are dedicated to the Storage and the Storage itself are connected to the same switch and nothing else is connected to this switch.
Virtual Machines:
3 Windows Server 2012 Standard - 1 DC, 1 FileServer, 1 Application Server.
1 Windows Server 2008 Standard Exchange Server.
All VMs are using dynamic disks (as recommended by Microsoft).
Updates
We have applied the most resent updates to the Hosts, VMs and iSCSI SAN about 3 weeks ago with no change in our problem and we continually update the setup.
Normal operation:
Normally this setup works just fine and we see no real difference in speed in startup, file copy and processing speed in LoB applications of this setup compared to a single host with two 10000 RPM Disks. Normal network speed is 10-200 Mbit, but occasionally
we see speeds up to 400 Mbit/s of combined read/write for instance during file repair.
Our Problem:
Our problem is that for some reason a random VHDX gets copied to System Volume Information by "System" of the Clusterd Shared Storage (i.e. C:\ClusterStorage\Volume1\System Volume Information).
All VMs stops responding or responds very slowly during this copy process and you can for instance not send CTRL-ALT-DEL to a VM in the Hyper-V console, or for instance start task manager when already logged in.
This happens at random and not every day and different VHDX files from different VMs gets copied each time. Some time it happens during daytime wich causes a lot of problems, especially when a 200 GB file gets copied (which take a lot of time).
What it is not:
We thought that this was connected to the backup, but the backup had finished 3 hours before the last time this happended and the backup never uses any of the files in System Volume Information so it is not the backup.
An observation:
When this happend today I switched on ShadowCopy (previous files) and set it to only to use 320 MB of storage and then the Copy Process stopped and the virtual Machines started responding again. This could be unrelated since there is no way to see
how much of the VHDX that is left to be copied, so it might have been finished at the same time as I enabled ShadowCopy (previos files).
Our question:
Why is a VHDX copied to System Volume Information when scheduled ShadowCopy (previous version of files) is switched off? As far as I know, nothing should be copied to this folder when this functionis switched off?
List of VSS Writers:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2012 Microsoft Corp.
Writer name: 'Task Scheduler Writer'
Writer Id: {d61d61c8-d73a-4eee-8cdd-f6f9786b7124}
Writer Instance Id: {1bddd48e-5052-49db-9b07-b96f96727e6b}
State: [1] Stable
Last error: No error
Writer name: 'VSS Metadata Store Writer'
Writer Id: {75dfb225-e2e4-4d39-9ac9-ffaff65ddf06}
Writer Instance Id: {088e7a7d-09a8-4cc6-a609-ad90e75ddc93}
State: [1] Stable
Last error: No error
Writer name: 'Performance Counters Writer'
Writer Id: {0bada1de-01a9-4625-8278-69e735f39dd2}
Writer Instance Id: {f0086dda-9efc-47c5-8eb6-a944c3d09381}
State: [1] Stable
Last error: No error
Writer name: 'System Writer'
Writer Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Instance Id: {7848396d-00b1-47cd-8ba9-769b7ce402d2}
State: [1] Stable
Last error: No error
Writer name: 'Microsoft Hyper-V VSS Writer'
Writer Id: {66841cd4-6ded-4f4b-8f17-fd23f8ddc3de}
Writer Instance Id: {8b6c534a-18dd-4fff-b14e-1d4aebd1db74}
State: [5] Waiting for completion
Last error: No error
Writer name: 'Cluster Shared Volume VSS Writer'
Writer Id: {1072ae1c-e5a7-4ea1-9e4a-6f7964656570}
Writer Instance Id: {d46c6a69-8b4a-4307-afcf-ca3611c7f680}
State: [1] Stable
Last error: No error
Writer name: 'ASR Writer'
Writer Id: {be000cbe-11fe-4426-9c58-531aa6355fc4}
Writer Instance Id: {fc530484-71db-48c3-af5f-ef398070373e}
State: [1] Stable
Last error: No error
Writer name: 'WMI Writer'
Writer Id: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
Writer Instance Id: {3792e26e-c0d0-4901-b799-2e8d9ffe2085}
State: [1] Stable
Last error: No error
Writer name: 'Registry Writer'
Writer Id: {afbab4a2-367d-4d15-a586-71dbb18f8485}
Writer Instance Id: {6ea65f92-e3fd-4a23-9e5f-b23de43bc756}
State: [1] Stable
Last error: No error
Writer name: 'BITS Writer'
Writer Id: {4969d978-be47-48b0-b100-f328f07ac1e0}
Writer Instance Id: {71dc7876-2089-472c-8fed-4b8862037528}
State: [1] Stable
Last error: No error
Writer name: 'Shadow Copy Optimization Writer'
Writer Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Instance Id: {cb0c7fd8-1f5c-41bb-b2cc-82fabbdc466e}
State: [1] Stable
Last error: No error
Writer name: 'Cluster Database'
Writer Id: {41e12264-35d8-479b-8e5c-9b23d1dad37e}
Writer Instance Id: {23320f7e-f165-409d-8456-5d7d8fbaefed}
State: [1] Stable
Last error: No error
Writer name: 'COM+ REGDB Writer'
Writer Id: {542da469-d3e1-473c-9f4f-7847f01fc64f}
Writer Instance Id: {f23d0208-e569-48b0-ad30-1addb1a044af}
State: [1] Stable
Last error: No error
Please note:
Please only answer our question and do not offer any general optimization tips that do not directly adress the issue! We want the problem to go away, not to finish a bit faster!Hallo Lawrence!
Thankyou for youre reply, some comments to help you and others who read this thread:
First of all, we use Windows Server 2012 and the VHDX as I wrote in the headline and in the text in my post. We have not had this problem in similar setups with Windows Server 2008 R2, so the problem seem to be introduced in Windows Server 2012.
These posts that you refer to seem to be outdated and/or do not apply to our configuration:
The post about Dynamic Disks:
http://technet.microsoft.com/en-us/library/ee941151(v=WS.10).aspx is only a recommendation for Windows Server 2008 R2 and the VHD format. Dynamic VHDX is indeed recommended by Microsoft when using Windows Server 2012 (please look in the optimization guide
for Windows Server 2012).
Infact, if we use fixed VHDX then we would have a bigger problem since fixed VHDX are generaly larger then Dynamic Disks, i.e. more data would be copied and that would take longer time = the VMs would be unresponsive for a longer time.
The post "What's the deal with the System Volume Information folder"
http://blogs.msdn.com/b/oldnewthing/archive/2003/11/20/55764.aspx is for Windows XP / Windows Server 2003 and some things has changed since then. for instance In Windows Server 2012, Shadow Copies cannot be controlled by going to Control panel -> System.
Instead you right-click on a Drive (i.e. a Volume, for instance the C drive/Volume) in Computer and then click "Configure Shadow Copies".
Windows Server 2008 R2 Backup problem
http://social.technet.microsoft.com/Forums/en/windowsbackup/thread/0fc53adb-477d-425b-8c99-ad006e132336 - This post is about the Antivirus software trying to scan files used during backup that exists in the System Volume Information folder and we do not
have any antivirus software installed on our hosts as I stated in my post.
Comment that might help us:
So according to “System Volume Information” definition, the operation you mentioned is Volume Shadow Copy. Check event viewer to find Volume Shadow Copy related event logs and post them.
Why?
Furhter investigation suggests that a volume shadow copy is somehow created even though the Schedule for Shadows Copies is turned off for all drives. This happens at random and we have not found any pattern. Yesterday this operation took almost all available
disk space (over 200 GB), but all the disk space was released when I turned on scheduled Shadow Copies for the CSV.
I therefore draw these conclusions:
The CSV Volume has about 600 GB of disk space and since Volume Shadows Copy used 200 GB, or about 33% of the disk space, and the default limit is 10% then I conclude that for some reason the unscheduled Volume Shadow Copy did not have any limit (or ignored
the limit).
When I turned on the Schedule I also change the limit to the minimum amount which is 320 MB and this is probably what released the disk space. That is, the unscheduled Volume Shadow Copy operation was aborted and it adhered to the limit and deleted the
Volume Shadow Copy it had taken.
I have also set the limit for Volume Shadow Copies for all other volumes to 320 MB by using the "Configure Shadow Copies" Window that you open by right clicking on a drive (volume) in Computer and then selecting "Configure Shadow Copies...".
It is important to note that setting a limit for Shadow Copy Storage, and disabaling the Schedule are two different things! It is possible to have unlimited storage for Shadow Copies when the Schedule is disabled, however I do not know if this was the case
Before I enabled Shadow Copies on the CSV since I did not look for this.
I now have defined a limit for Shadow Copy Storage to 320 MB on all drives and then no VHDX should be copied to System Volume Information since they are all larger than 320 MB.
Does this sound about right or am I drawing the wrong conclusions?
Limits for Shadow Copies:
Below we list the limits for our two hosts:
"Primary Host":
C:\>vssadmin list shadowstorage
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2012 Microsoft Corp.
Shadow Copy Storage association
For volume: (\\?\Volume{e3ad7feb-178b-11e2-93e8-806e6f6e6963}\)\\?\Volume{e3ad7feb-178b-11e2-93e8-806e6f6e6963}\
Shadow Copy Storage volume: (\\?\Volume{e3ad7feb-178b-11e2-93e8-806e6f6e6963}\)\\?\Volume{e3ad7feb-178b-11e2-93e8-806e6f6e6963}\
Used Shadow Copy Storage space: 0 bytes (0%)
Allocated Shadow Copy Storage space: 0 bytes (0%)
Maximum Shadow Copy Storage space: 320 MB (91%)
Shadow Copy Storage association
For volume: (E:)\\?\Volume{dc0a177b-ab03-44c2-8ff6-499b29c3d5cc}\
Shadow Copy Storage volume: (E:)\\?\Volume{dc0a177b-ab03-44c2-8ff6-499b29c3d5cc}\
Used Shadow Copy Storage space: 0 bytes (0%)
Allocated Shadow Copy Storage space: 0 bytes (0%)
Maximum Shadow Copy Storage space: 320 MB (0%)
Shadow Copy Storage association
For volume: (G:)\\?\Volume{f58dc334-17be-11e2-93ee-9c8e991b7c20}\
Shadow Copy Storage volume: (G:)\\?\Volume{f58dc334-17be-11e2-93ee-9c8e991b7c20}\
Used Shadow Copy Storage space: 0 bytes (0%)
Allocated Shadow Copy Storage space: 0 bytes (0%)
Maximum Shadow Copy Storage space: 320 MB (3%)
Shadow Copy Storage association
For volume: (C:)\\?\Volume{e3ad7fec-178b-11e2-93e8-806e6f6e6963}\
Shadow Copy Storage volume: (C:)\\?\Volume{e3ad7fec-178b-11e2-93e8-806e6f6e6963}\
Used Shadow Copy Storage space: 0 bytes (0%)
Allocated Shadow Copy Storage space: 0 bytes (0%)
Maximum Shadow Copy Storage space: 320 MB (0%)
C:\>cd \ClusterStorage\Volume1
Secondary host:
C:\>vssadmin list shadowstorage
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2012 Microsoft Corp.
Shadow Copy Storage association
For volume: (\\?\Volume{b2951138-f01e-11e1-93e8-806e6f6e6963}\)\\?\Volume{b2951138-f01e-11e1-93e8-806e6f6e6963}\
Shadow Copy Storage volume: (\\?\Volume{b2951138-f01e-11e1-93e8-806e6f6e6963}\)\\?\Volume{b2951138-f01e-11e1-93e8-806e6f6e6963}\
Used Shadow Copy Storage space: 0 bytes (0%)
Allocated Shadow Copy Storage space: 0 bytes (0%)
Maximum Shadow Copy Storage space: 35,0 MB (10%)
Shadow Copy Storage association
For volume: (D:)\\?\Volume{5228437e-9a01-4690-bc40-1df85a0e6736}\
Shadow Copy Storage volume: (D:)\\?\Volume{5228437e-9a01-4690-bc40-1df85a0e6736}\
Used Shadow Copy Storage space: 0 bytes (0%)
Allocated Shadow Copy Storage space: 0 bytes (0%)
Maximum Shadow Copy Storage space: 27,3 GB (10%)
Shadow Copy Storage association
For volume: (C:)\\?\Volume{b2951139-f01e-11e1-93e8-806e6f6e6963}\
Shadow Copy Storage volume: (C:)\\?\Volume{b2951139-f01e-11e1-93e8-806e6f6e6963}\
Used Shadow Copy Storage space: 0 bytes (0%)
Allocated Shadow Copy Storage space: 0 bytes (0%)
Maximum Shadow Copy Storage space: 6,80 GB (10%)
C:\>
There is something strange about the limits on the Secondary host!
I have not in any way changed the settings on the Secondary host and as you can see, the Secondary host has a maximum limit of only 35 MB storage on the CSV, but it also shows that this is 10% of the Volume. This is clearly not the case since 10% if 600
GB = 60 GB!
The question is, why does it by default set a too small limit (i.e. < 320 MB) on the CSV and is this the cause of the problem? I.e. is the limit ignored since it is smaller than the smallest amount you can provide using the GUI?
Is the default 35 MB maximum Shadow Copy limit a bug, or is there any logical reason for setting a limit that according to the GUI is too small? -
Windows Server 2012 not applying gpupdate why?
Hello, i am doing group policys on windows server 2012 with windows 7 clients and some of the gp's are not updateing on the clients i am doing gpupdate /force on them but that makes no difference can someone tell me whats wrong. here is some pics
Is the GPO applied for authentificated users? yes they are.
what does gpresult /r say?
image 1:
http://tinypic.com/r/2njy7ap/6
image 2:
http://tinypic.com/r/2qva8mc/6
some more images at random
http://tinypic.com/r/pxi6v/6
http://tinypic.com/r/1zokpk5/6
could you do a
gpresult /H whatever.htm
i did a gpupdate before heres the pic
https://dl.dropbox.com/u/87903671/screen.bmp
and then i did the gpresult heres the website
https://dl.dropbox.com/u/87903671/whatever.htm
now can someone tell me whats wrong?could you please run rsop.msc on client end and post the result
Darshana Jayathilake -
Windows Server 2012 R2 - Windows Network Load Balancing Converging Issue
Hello,
My name is Brandon. We have started upgrading our servers to Windows Server 2012 R2. We have some powerful servers for running ESXI 5.5 as the OS with the Guest Operating Systems as Windows Server 2012 R2. As far of our migrations/upgrades we have configured
ADFS 2012 R2 into a Server Farm with Windows Network Load Balancing to add redundancy in the event a server goes down.
I have been having issues with a Node with the Cluster getting stuck in the Status of Converging. The only way I have been able to get it back up is to restart the virtual server completely and it is temporary. When I first configure the Cluster the two
virtual servers get added to the Node with no problems and fully converge. However, after some time a node will end up in Converging and this takes Authentication for ADFS down as the nodes can not be contacted over Port 443.
Error: Host: server.domain.com Unable to connect to "server name"
System
Provider
Name]
Microsoft-Windows-NLB
Guid]
{F22AF71F-C4C3-425D-9653-B2F47B85DD30}
EventID
21
I have tried using 1 & 2 Virtual NICs on the machines and still receive this error even if only 1 VNIC is assigned to the virtual machine. Could someone assist me with why I am having this issue? Has anyone had experience with a similar configuration
and how were you able to make it work?
Below is my configuration.
Static ARP Entry for Cluster IP Address has been added to our Layer 3 switch.
Physical Server 1:
ESXI 5.5 HOST
1 NIC CONNECTED (shared with virtual guest)
IP ADDRESS: 192.168.0.5
SUBNET: 255.255.255.0
DGW: 192.168.0.1
Virtual Server 1
Physical Server 2:
ESXI 5.5 HOST
1 NIC CONNECTED (shared with virtual guest)
IP ADDRESS: 192.168.0.6
SUBNET: 255.255.255.0
DGW: 192.168.0.1
Virtual Server 2
Virtual Servers
Virtual Server 1
MS SERVER 2012 R2 (VIRTUAL)
NLB NODE
2 – VIRTUAL NETWORK ADAPTERS
VNIC1
IP ADDRESS 192.168.0.10
SUBNET: 255.255.255.0
DGW: 192.168.0.1
VNIC 2 (NLB)
IP ADDRESS: 192.168.0.11
SUBNET: 255.255.255.0
Virtual Server 2
MS SERVER 2012 R2 (VIRTUAL)
NLB NODE
2 – VIRTUAL NETWORK ADAPTERS
VNIC1
IP ADDRESS 192.168.0.20
SUBNET: 255.255.255.0
DGW: 192.168.0.1
VNIC 2 (NLB)
IP ADDRESS: 192.168.0.21
SUBNET: 255.255.255.0
Cluster Configuration/Properties
CLUSTER PROPERTIES
CLUSTER IP: 192.168.0.30
CLUSTER SUBNET: 255.255.255.0
FULL INTERNET NAME: FS.DOMAIN.COM
CLUSTER OPERATION MODE: MULTICAST
PORT RULES:
CLUSTER IP ADDRESS START END PROTOCAL MODE PRIORITY LOAD AFFINITY
ALL 80 80 BOTH MULTIPLE .. EQUAL NONE
ALL 443 443 BOTH MULTIPLE .. EQUAL NONE
CLUSTER NODES:
1.) SERVER1.DOMAIN.COM
a. IP: 192.168.0.11
2.) SERVER2.DOMAIN.COM
a. IP: 192.168.0.21Thank you for your response. It took me a while to figure it out, but the whole issue was related to the type of Virtual Network Adapter I was selecting.
I changed the network adapter from E1000 to VMXNET 3 and have not had a single error in the event logs or Windows NLB.
I read somewhere that VMXNET 3 is preferred for Windows Server 2012 R2.
https://communities.vmware.com/thread/433792
Leyuka May 23, 2013 6:14 AM
"Just a help for everyone with this problem :
After 10 days of research for our virtual datacenter behind a vcloud as iias , i found a solution .
I only run windows 2012 server .
Install vmware tools , remove e1000 network card after a vm stop, add a card same vswitch etc BUT with a vmxnet3 TYPE . DONT USE DEFAULT CARD
Start and enjoy this solution . E1000 and E1000e are just unstable in windows8 / windows 2012 , the network card reset randomly with or without heavy IO. No log in windows , and as a vcloud user i don"t have esxi logs (damn i don't like cloud) and provider
don"t know why ..." -
Hi all;
Suppose I have created a two-node Hyper-V cluster with a fibre channel shared storage in Windows Server 2012. Everything work fine except some issues. One of the is that when I want to configure the cluster to add a VM as its cluster resource, the following
error message appears:
An error occurred while determining the state of this clustered role in the cluster. The remote procedure call failed with error 800706BE.
Any ideas?
Thanks
Please VOTE as HELPFUL if the post helps you and remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.Thanks for your reply…
I have tested many possible solutions without any success. The actions that I have done so far are mentioned in the following and the results of them have been said, too.
When I restart the servers, everything are good but after some times when I reopen Failover Cluster Manager on one of the servers, the snap-in related to my cluster name does not load. Please look at the following figure:
And when I want to connect to my cluster name, the following error message appears:
Note: The above problem appears randomly regarding to servers. In the other hand, after the restart, one of the servers acts as the above statement.
The following error message is the result of the DTCPing utility:
++++++++++++hosts
++++++++++++
06-11, 10:02:15.346-->Error(0x424) at clutil.cpp @256
06-11, 10:02:15.346-->-->OpenCluster
06-11, 10:02:15.356-->-->1060(The specified service does not exist as an installed service.)
++++++++++++++++++++++++++++++++++++++++++++++
DTCping 1.9 Report for ADMINISTRATOR1
++++++++++++++++++++++++++++++++++++++++++++++
RPC server is ready
++++++++++++Validating Remote Computer Name++++++++++++
06-11, 10:02:20.428-->Start DTC connection test
Name Resolution:
SRV04-->172.16.140.11-->SRV04
06-11, 10:02:32.448-->Start RPC test (ADMINISTRATOR1-->SRV04)
Problem:fail to invoke remote RPC method
Error(0x6D9) at dtcping.cpp @303
-->RPC pinging exception
-->1753(There are no more endpoints available from the endpoint mapper.)
RPC test failed
And
06-11, 10:26:10.837-->Error(0x424) at clutil.cpp @256
06-11, 10:26:10.837-->-->OpenCluster
06-11, 10:26:10.837-->-->1060(The specified service does not exist as an installed service.)
++++++++++++++++++++++++++++++++++++++++++++++
DTCping 1.9 Report for ADMINISTRATOR1
++++++++++++++++++++++++++++++++++++++++++++++
RPC server is ready
++++++++++++Validating Remote Computer Name++++++++++++
06-11, 10:26:14.947-->Start DTC connection test
Name Resolution:
SRV04-->172.16.140.11-->SRV04
06-11, 10:26:26.967-->Start RPC test (ADMINISTRATOR1-->SRV04)
Problem:fail to invoke remote RPC method
Error(0x6D9) at dtcping.cpp @303
-->RPC pinging exception
-->1753(There are no more endpoints available from the endpoint mapper.)
RPC test failed
And
++++++++++++hosts
++++++++++++
06-11, 10:47:51.510-->Error(0x424) at clutil.cpp @256
06-11, 10:47:51.510-->-->OpenCluster
06-11, 10:47:51.510-->-->1060(The specified service does not exist as an installed service.)
++++++++++++++++++++++++++++++++++++++++++++++
DTCping 1.9 Report for ADMINISTRATOR1
++++++++++++++++++++++++++++++++++++++++++++++
RPC server is ready
++++++++++++Validating Remote Computer Name++++++++++++
06-11, 10:47:55.020-->Start DTC connection test
Name Resolution:
SRV03-->172.16.140.10-->SRV03
06-11, 10:48:06.830-->Start RPC test (ADMINISTRATOR1-->SRV03)
Problem:fail to invoke remote RPC method
Error(0x6D9) at dtcping.cpp @303
-->RPC pinging exception
-->1753(There are no more endpoints available from the endpoint mapper.)
RPC test failed
The following output is the result of running PortQuery on port 135 on both servers:
=============================================
Starting portqry.exe -n srv03 -e 135 -p TCP ...
Querying target system called:
srv03
Attempting to resolve name to IP address...
Name resolved to 172.16.140.10
querying...
TCP port 135 (epmap service): LISTENING
Using ephemeral source port
Querying Endpoint Mapper Database...
Server's response:
UUID: d95afe70-a6d5-4259-822e-2c84da1ddb0d
ncacn_ip_tcp:srv03[49152]
UUID: 906b0ce0-c70b-1067-b317-00dd010662da
ncacn_ip_tcp:srv03[49285]
UUID: 906b0ce0-c70b-1067-b317-00dd010662da
ncacn_ip_tcp:srv03[49285]
UUID: 906b0ce0-c70b-1067-b317-00dd010662da
ncacn_ip_tcp:srv03[49285]
UUID: 367abb81-9844-35f1-ad32-98f038001003
ncacn_ip_tcp:srv03[49159]
UUID: b97db8b2-4c63-11cf-bff6-08002be23f2f Microsoft Cluster Server API
ncacn_ip_tcp:srv03[49156]
UUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck
ncacn_np:srv03[\\pipe\\lsass]
UUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck
ncacn_ip_tcp:srv03[49155]
UUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck
ncacn_np:srv03[\\pipe\\lsass]
UUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck
ncacn_ip_tcp:srv03[49155]
UUID: 12345778-1234-abcd-ef00-0123456789ac
ncacn_np:srv03[\\pipe\\lsass]
UUID: 12345778-1234-abcd-ef00-0123456789ac
ncacn_ip_tcp:srv03[49155]
UUID: 12345778-1234-abcd-ef00-0123456789ac
ncacn_ip_tcp:srv03[49157]
UUID: 7f1343fe-50a9-4927-a778-0c5859517bac DfsDs service
ncacn_np:srv03[\\PIPE\\wkssvc]
UUID: 3473dd4d-2e88-4006-9cba-22570909dd10 WinHttp Auto-Proxy Service
ncacn_np:srv03[\\PIPE\\W32TIME_ALT]
UUID: 1ff70682-0a51-30e8-076d-740be8cee98b
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: 378e52b0-c0a9-11cf-822d-00aa0051e40f
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: 86d35949-83c9-4044-b424-db363231fd0c
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: 86d35949-83c9-4044-b424-db363231fd0c
ncacn_ip_tcp:srv03[49154]
UUID: 3a9ef155-691d-4449-8d05-09ad57031823
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: 3a9ef155-691d-4449-8d05-09ad57031823
ncacn_ip_tcp:srv03[49154]
UUID: a398e520-d59a-4bdd-aa7a-3c1e0303a511 IKE/Authip API
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: a398e520-d59a-4bdd-aa7a-3c1e0303a511 IKE/Authip API
ncacn_ip_tcp:srv03[49154]
UUID: 552d076a-cb29-4e44-8b6a-d15e59e2c0af IP Transition Configuration endpoint
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: 552d076a-cb29-4e44-8b6a-d15e59e2c0af IP Transition Configuration endpoint
ncacn_ip_tcp:srv03[49154]
UUID: 2e6035b2-e8f1-41a7-a044-656b439c4c34 Proxy Manager provider server endpoint
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: 2e6035b2-e8f1-41a7-a044-656b439c4c34 Proxy Manager provider server endpoint
ncacn_ip_tcp:srv03[49154]
UUID: c36be077-e14b-4fe9-8abc-e856ef4f048b Proxy Manager client server endpoint
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: c36be077-e14b-4fe9-8abc-e856ef4f048b Proxy Manager client server endpoint
ncacn_ip_tcp:srv03[49154]
UUID: c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 Adh APIs
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 Adh APIs
ncacn_ip_tcp:srv03[49154]
UUID: 98716d03-89ac-44c7-bb8c-285824e51c4a XactSrv service
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: 98716d03-89ac-44c7-bb8c-285824e51c4a XactSrv service
ncacn_ip_tcp:srv03[49154]
UUID: 1a0d010f-1c33-432c-b0f5-8cf4e8053099 IdSegSrv service
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: 1a0d010f-1c33-432c-b0f5-8cf4e8053099 IdSegSrv service
ncacn_ip_tcp:srv03[49154]
UUID: c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 Impl friendly name
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 Impl friendly name
ncacn_ip_tcp:srv03[49154]
UUID: c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 Impl friendly name
ncacn_np:srv03[\\PIPE\\srvsvc]
UUID: 30b044a5-a225-43f0-b3a4-e060df91f9c1
ncacn_np:srv03[\\PIPE\\atsvc]
UUID: 30b044a5-a225-43f0-b3a4-e060df91f9c1
ncacn_ip_tcp:srv03[49154]
UUID: 30b044a5-a225-43f0-b3a4-e060df91f9c1
ncacn_np:srv03[\\PIPE\\srvsvc]
UUID: f6beaff7-1e19-4fbb-9f8f-b89e2018337c Event log TCPIP
ncacn_np:srv03[\\pipe\\eventlog]
UUID: f6beaff7-1e19-4fbb-9f8f-b89e2018337c Event log TCPIP
ncacn_ip_tcp:srv03[49153]
UUID: 30adc50c-5cbc-46ce-9a0e-91914789e23c NRP server endpoint
ncacn_np:srv03[\\pipe\\eventlog]
UUID: 30adc50c-5cbc-46ce-9a0e-91914789e23c NRP server endpoint
ncacn_ip_tcp:srv03[49153]
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 DHCP Client LRPC Endpoint
ncacn_np:srv03[\\pipe\\eventlog]
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 DHCP Client LRPC Endpoint
ncacn_ip_tcp:srv03[49153]
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 DHCPv6 Client LRPC Endpoint
ncacn_np:srv03[\\pipe\\eventlog]
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 DHCPv6 Client LRPC Endpoint
ncacn_ip_tcp:srv03[49153]
UUID: 76f226c3-ec14-4325-8a99-6a46348418af
ncacn_np:srv03[\\PIPE\\InitShutdown]
UUID: d95afe70-a6d5-4259-822e-2c84da1ddb0d
ncacn_np:srv03[\\PIPE\\InitShutdown]
Total endpoints found: 51
==== End of RPC Endpoint Mapper query response ====
portqry.exe -n srv03 -e 135 -p TCP exits with return code 0x00000000.
And
=============================================
Starting portqry.exe -n srv04 -e 135 -p TCP ...
Querying target system called:
srv04
Attempting to resolve name to IP address...
Name resolved to 172.16.140.11
querying...
TCP port 135 (epmap service): LISTENING
Using ephemeral source port
Querying Endpoint Mapper Database...
Server's response:
UUID: d95afe70-a6d5-4259-822e-2c84da1ddb0d
ncacn_ip_tcp:srv04[1025]
UUID: 906b0ce0-c70b-1067-b317-00dd010662da
ncacn_ip_tcp:srv04[1143]
UUID: 906b0ce0-c70b-1067-b317-00dd010662da
ncacn_ip_tcp:srv04[1143]
UUID: 906b0ce0-c70b-1067-b317-00dd010662da
ncacn_ip_tcp:srv04[1143]
UUID: 367abb81-9844-35f1-ad32-98f038001003
ncacn_ip_tcp:srv04[1065]
UUID: b97db8b2-4c63-11cf-bff6-08002be23f2f Microsoft Cluster Server API
ncacn_ip_tcp:srv04[1057]
UUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck
ncacn_np:srv04[\\pipe\\lsass]
UUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck
ncacn_ip_tcp:srv04[1028]
UUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck
ncacn_np:srv04[\\pipe\\lsass]
UUID: 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 RemoteAccessCheck
ncacn_ip_tcp:srv04[1028]
UUID: 12345778-1234-abcd-ef00-0123456789ac
ncacn_np:srv04[\\pipe\\lsass]
UUID: 12345778-1234-abcd-ef00-0123456789ac
ncacn_ip_tcp:srv04[1028]
UUID: 12345778-1234-abcd-ef00-0123456789ac
ncacn_ip_tcp:srv04[1084]
UUID: 7f1343fe-50a9-4927-a778-0c5859517bac DfsDs service
ncacn_np:srv04[\\PIPE\\wkssvc]
UUID: 1ff70682-0a51-30e8-076d-740be8cee98b
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: 378e52b0-c0a9-11cf-822d-00aa0051e40f
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: 86d35949-83c9-4044-b424-db363231fd0c
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: 86d35949-83c9-4044-b424-db363231fd0c
ncacn_ip_tcp:srv04[1027]
UUID: 3a9ef155-691d-4449-8d05-09ad57031823
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: 3a9ef155-691d-4449-8d05-09ad57031823
ncacn_ip_tcp:srv04[1027]
UUID: a398e520-d59a-4bdd-aa7a-3c1e0303a511 IKE/Authip API
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: a398e520-d59a-4bdd-aa7a-3c1e0303a511 IKE/Authip API
ncacn_ip_tcp:srv04[1027]
UUID: 552d076a-cb29-4e44-8b6a-d15e59e2c0af IP Transition Configuration endpoint
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: 552d076a-cb29-4e44-8b6a-d15e59e2c0af IP Transition Configuration endpoint
ncacn_ip_tcp:srv04[1027]
UUID: 2e6035b2-e8f1-41a7-a044-656b439c4c34 Proxy Manager provider server endpoint
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: 2e6035b2-e8f1-41a7-a044-656b439c4c34 Proxy Manager provider server endpoint
ncacn_ip_tcp:srv04[1027]
UUID: c36be077-e14b-4fe9-8abc-e856ef4f048b Proxy Manager client server endpoint
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: c36be077-e14b-4fe9-8abc-e856ef4f048b Proxy Manager client server endpoint
ncacn_ip_tcp:srv04[1027]
UUID: c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 Adh APIs
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 Adh APIs
ncacn_ip_tcp:srv04[1027]
UUID: 98716d03-89ac-44c7-bb8c-285824e51c4a XactSrv service
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: 98716d03-89ac-44c7-bb8c-285824e51c4a XactSrv service
ncacn_ip_tcp:srv04[1027]
UUID: 1a0d010f-1c33-432c-b0f5-8cf4e8053099 IdSegSrv service
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: 1a0d010f-1c33-432c-b0f5-8cf4e8053099 IdSegSrv service
ncacn_ip_tcp:srv04[1027]
UUID: c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 Impl friendly name
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 Impl friendly name
ncacn_ip_tcp:srv04[1027]
UUID: c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 Impl friendly name
ncacn_np:srv04[\\PIPE\\srvsvc]
UUID: 30b044a5-a225-43f0-b3a4-e060df91f9c1
ncacn_np:srv04[\\PIPE\\atsvc]
UUID: 30b044a5-a225-43f0-b3a4-e060df91f9c1
ncacn_ip_tcp:srv04[1027]
UUID: 30b044a5-a225-43f0-b3a4-e060df91f9c1
ncacn_np:srv04[\\PIPE\\srvsvc]
UUID: f6beaff7-1e19-4fbb-9f8f-b89e2018337c Event log TCPIP
ncacn_np:srv04[\\pipe\\eventlog]
UUID: f6beaff7-1e19-4fbb-9f8f-b89e2018337c Event log TCPIP
ncacn_ip_tcp:srv04[1026]
UUID: 30adc50c-5cbc-46ce-9a0e-91914789e23c NRP server endpoint
ncacn_np:srv04[\\pipe\\eventlog]
UUID: 30adc50c-5cbc-46ce-9a0e-91914789e23c NRP server endpoint
ncacn_ip_tcp:srv04[1026]
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 DHCP Client LRPC Endpoint
ncacn_np:srv04[\\pipe\\eventlog]
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 DHCP Client LRPC Endpoint
ncacn_ip_tcp:srv04[1026]
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 DHCPv6 Client LRPC Endpoint
ncacn_np:srv04[\\pipe\\eventlog]
UUID: 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 DHCPv6 Client LRPC Endpoint
ncacn_ip_tcp:srv04[1026]
UUID: 76f226c3-ec14-4325-8a99-6a46348418af
ncacn_np:srv04[\\PIPE\\InitShutdown]
UUID: d95afe70-a6d5-4259-822e-2c84da1ddb0d
ncacn_np:srv04[\\PIPE\\InitShutdown]
Total endpoints found: 50
==== End of RPC Endpoint Mapper query response ====
portqry.exe -n srv04 -e 135 -p TCP exits with return code 0x00000000.
I have read the KB197814 and did the steps in it, restarted both servers, but the problem did not resolved.
I have check both servers for RPC Service status and in both servers it has started.
The both servers are alive and can ping each other by their IP address and name.
The firewall of both servers is off and I stopped the Windows Firewall service COMPLETELY.
Any services and applications that are depending on RPC have problems. For example when I want o remotely manages the services on these servers by using Services.msc console, the following error message appears:
Error 1726: The remote procedure call failed.
Please VOTE as HELPFUL if the post helps you and remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread. -
Windows Server 2012 R2 NIC Teaming and DHCP Issue
Came across a weird issue today during a server deployment. I was doing a physical server deployment and got Windows installed and was getting ready to connect it to our network. Before connecting the Ethernet cables to the network adapters, I created a
NIC Team using Windows Server 2012 R2 built-in software with a static IP address (we'll say its 192.168.1.56). Once I plugged in the Ethernet cables, I got network access but was unable to join our domain. At this time, I deleted the NIC team and the two network
adapters got their own IP addresses issued from DHCP (192.168.1.57 and 192.168.1.58) and at this point I was able to join our domain. I recreated the NIC team and set a new static IP (192.168.1.57) and everything was working great as intended.
My issue is when I went into DHCP I noticed a random entry that was using the IP address I used for the first NIC teaming attempt (192.168.1.56), before I joined it to the domain. I call this a random entry because it is using the last 8 characters of the
MAC address as the hostname instead of the servers hostname.
It seems when I deleted the first NIC team I created (192.168.1.56), a random MAC address Server 2012 R2 generated for the team has remained embedded in the system. The IP address is still pingable even though an ipconfig /all shows the current NIC team
with the IP 192.168.1.57. There is no IP address of 192.168.1.56 configured on the current server and I have static IPs set yet it is still pingable and registering with DHCP.
I know this is slightly confusing but I am hoping someone else has encountered this issue and may be able to tell me how to fix this. Simply deleting the DHCP entry does not do the trick, it comes back.Hi,
Please confirm you have choose the right NIC team type, If you’ve previously configured NIC teaming, you’re aware NIC teams usually require the assistance of network-side
protocols. Prior to Windows 2012, using a NIC team on a server also meant enabling protocols like EtherChannel or LACP (also known as 802.1ax or 802.3ad) on network ports.
More information:
NIC teaming configure in Server 2012
http://technet.microsoft.com/en-us/magazine/jj149029.aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place. -
Can I set 10 GB memory to NTFS read cache like CSV cache, or Stroage Space SSD Tier on Windows Server 2012 R2 ?
I want to use 10 GB memory to NTFS file system read cache for random read speed up.
CSV Volume have CSV Cache function,
Windows Server 2012 R2 Storage Space have SSD Tier function.
Regards,
Yoshihiro KawabataHi Yoshihiro,
There is no build-in system function which support to setup memory as disk cache. I know some third party software support this so you could have a search with related keywords (memory, hard disk cache).
If you have any feedback on our support, please send to [email protected] -
Window Server 2012 R2 Job Scheduler Failing.
Hi,
Currently, my company's Window Server 2012 R2 job scheduler having a problem.
Then i found out the solution at http://support.microsoft.com/kb/2617046, so i download the hotfix to fix the problem. However, i get another error as below.
Please, what can i do?
Thanks
Best Regard
Vincent.Amy,
Thanks for the tips, I follow the settings. I checked the condition and troubleshoot according to the lists you provided.
The task was configured to run only when a specified network is available. (Not set this)
The configured expiration time for the task has passed. (no expired time set)
The task is configured to ignore or queue a new task instance if a previous instance is still running. (not set this)
The task is configured not to run when the computer is on battery power. (yes, will not run when computer on battery power. will not happen because is a server all the time running AC power).
The task is configured to run only if a specific user is logged on. (must select this, if not, the scheduler will not run at all)
The task was disabled by a user. (is enabled)
The previous task instance might have been running longer than expected because a component is busy processing data. If the task is normally expected to run for this length of time, consider modifying the task triggers to take this run-time length
into consideration, or configure the task to be terminated after a preset time. (already set "Stop the task if runs longer than 3 days" and "If the running task does not end when requested, force it to stop". and "Do not start
a new instance " had been set)
Frankly, for the moment it run normally, somehow, I don't know when the incident will happen again. It seem randomly happen, and not by default. That is why kinda need the fix to fix this bug. Cannot trigger email when this incident happen.
And the schedule we run is highly critical.
Thanks. -
Learning Windows server 2012 R2 & 2012 core
Hi,
How do i configure a fast and standard solution with 1domain (Windows
Server 2012 R2) and 1subdomain(Windows Server 2012 Core) implemented with a webserver and security for dns?
ThxHi
Maybe this can help,
Nslookup test:
cmd => nslookup => set type=mx => host.net.
Organizational unit:.be
Active directory users and computers openen => rmb op domeinnaam => new => organtizational unit aanmaken => Protection uitvinken
Computer Manueel toevoegen aan domein:
1)DNS veranderen naar 192.168.1.1 van het domein zelf
2)Add-Computer -domainname host -cred administrator@host -passthru -verbose
GPO voor chrome installeren:
1)Group policy management => in OU PC's => new policy aanmaken
2)rmb policy en klik edit
3)onder computer => software => new package => pad ingeven waar je msi bestand hebt gezet van chrome => \\S1\netlogon\msi\chrome.msi
4)client heropstarten en aanmelden met domeingebruiker => powershell => Restart-Computer
5)mapje waar MSI in zit => security => domain controller (user) toevoegen met volledig beheer
GPO voor browser block chrome:
3)block listed urls..
4)op client gpupdate
Failed login events:
1)Group policy instellen op OU Servers: Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\ ==> Failed logins aanzetten
2)gpupdate /force
1)powershell
2)get-windowsfeature => install-windowsfeature SMTP-Server
3)Internet information services => S1 => Domain RMB => properties => Acces tab => Relay => Add => Group computers => IP: 192.168.1.1 subnet 255.255.255.0 => Ok => ok
3b)Eens afmelden en aanmelden met fout wachtwoord zodat er een log geschreven wordt met audit failure in de security log van event viewer
4)Eventviewer security log => op failed audit log RMB => attach => Geef andere naam => next => next start program => program: powershell.exe =>
open the propery dialog aanvinken
5)Run wheter user is logged in or not aanvinken => tabke conditions: start the task only if AC power afvinken! => ok => paswoord administrator ingeven
6)powershell: get-executionpolicy => resultaat moet remotesigned zijn => view tabke => script pane aanzetten =>
Script geven: $smtpServer = ìsmtp2.school.beî
$msg = New-Object Net.Mail.MailMessage
$smtp = New-Object Net.Mail.SmtpClient($smtpServer)
$msg.From = ì[email protected]î
$msg.ReplyTo = [email protected]î
$msg.To.Add([email protected]î)
$msg.subject = ìhacking attempt?î
$msg.body = ìlogin/pwd failure on S1.î
$smtp.Send($msg)
7)Script opslaan in mapje op C schijf => powershell cd naar mapje met script => ls commandoTo configure the time source for the forest
8)Task scheduler openen => naar event viewer tasks => login => rmb properties => actions => powershell.exe edit => add arguments: -command "C:\Script\login.ps1" => ok => password admin ingeven
9)Testen
*Op welke manier kan je je MX records controleren met NSLOOKUP
cmd => nslookup => set type=mx => host.net.
*Commando powershell om Client toe te voegen aan het domein:
Add-Computer -domainname host -cred administrator@host -passthru -verbose
Best practice analyzer:
1)Server manager => klik op dns en op ADDS => Scroll naar onder tot bij BPA => Task start scan => bekijk resultaten:
Vraagje: Welke suggesties zou je kunnen oplossen:
DNS server should have scavenging enabled
De PDC emulator master moet geconfigureerd worden
1)To configure a domain controller in the parent domain as a reliable time source
*W32tm /config /reliable:yes /update
2)To configure the time source for the forest
*w32tm /config /computer:s1.host.net /manualpeerlist:ntp.belnet.be /syncfromflags:manual /update
Tijd moet gelijk zijn van S1 en S2!!
Corefig opstarten in powershell:
1)cd C:\corefig
2)execution policy aanpassen: Set-ExecutionPolicy bypass
3).\corefig.ps1
4)naam veranderen in corefig
Commando om S2 toe te voegen aan het domein in de OU servers:
1)DNS instellen
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 192.168.1.1
2)Toevoegen aan OU servers
Add-Computer -domainname sdhost -cred administrator@host -OUPath "OU=Servers,OU=OU,DC=Host,DC=net"
Herstarten
OPPASSEN HIERMEE ALS S2 ZELF DC MOET WORDEN!
Voorzie je server van de DNS-rol via windows powershell:
1)Import-Module Servermanager
2)Get-WindowsFeature
2)Add-WindowsFeature "DNS" -restart
Remoteaccess:
S1 remote access geven voor administrators bij active directory
view => advanced features enablen
=> Remote management users => HOST\Administrator toevoegen met full rechten
=> Remote Desktop users => HOST\Administrator toevoegen met full rechten
Bekijk welke firewall regel op dit moment Remote Management nog blokkeert en laat
die communicatie toe:
1)Op S2 in powershell: Configure-SMRemoting.exe -enable
2)op S1 => Server manager => manage => add servers => S2 ingeven => ok
3)Active directory installeren op s2 via add roles (via S1)
4)S2 promoveren to domain controller
5)credentials van s1 gebruiken => naam subdomain 'premium'
6)DSRM passwoord: P0wnerken
7)PREMIUM
DNS instellen van s2 zelf
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 192.168.1.2
C2)DNS server instellen op S2 : 192.168.1.2
Toevoegen aan domein premium.host.net => inloggen met admin account van s2 domein
herstarten van C2
Maak†van†deze†tweede†server†nu†een†domeincontroller†voor†het†nieuwe†domein
ìpremiumî.†Daar†zijn†twee†werkwijzen†voor.†Zoek†deze†methodes†op†en†noteer†deze
summier†hieronder:
- Werken met DCPROMO.exe
- Werken met GUI vanop S1
Je†mag†zelf†kiezen†welke†methode†je†toepast.†Noteer†hier†wel†de†commandoís†die†je
toepast:
Werken met GUI: new existing domain to current forest => naam PREMIUM
Netwerkkaarten toevoegen:
VCLOUD => Niet customizen!!!
Firewall disablen S2:
netsh firewall set opmode disable
Op S1 => chrome => ip in url : https://192.168.1.150:446 => proceed => logingegevens:
naam: openfiler
pass: password
Services => CIFS / NFS => Enable => Start
manage volumes => 1GB volume => start cyl = 1, end cyl = 128 => ongeveer 1GB
Add volume group => NFS als naam en 1GB volume toevoegen => Add volume => naar onder scrollen:
Naam: NFS
Bestandssysteem: EXT4 kiezen
*Add new physical volume 10GB: MINSTENS 35 CYLINDERS TUSSENLATEN!!!!
Start cyl = 164, end cyl = 1469, is ongeveer 10GB
Volume groups => Nieuwe aanmaken met SMB als naam => Add volume => volume selecteren en toevoegen => naar uw smb volume group gaan
=> SMB volume kiezen => naam: SMB => MAX Geheugen => EXT4 bestandssysteem
1)Clocksettings zetten via ntp server: ntp.belnet.be (Moet gelijk zijn met domaincontroller waarin je hem toevoegd)
2)DNS zetten van S2
Hostname: of
Primary DNS: 192.168.1.2
Secondary DNS: 192.168.1.1
Gateway: 192.168.1.254
3)Accounts:
Expert view!
*Use windows domain controller and authentication aanvinken
Security Mode: Active directory
Domain / workgroup: PREMIUM
Domain controllers: s2.premium.VAhost.net
ADS realm: PREMIUM.HOST.NET
Join domain: aanvinken
Administrator username: Administrator
Administrator password: Azerty123
*Naar onder scrollen tot kerberos 5: Aanvinken
Realm: premium.host.net
KDC: s2.premium.host.net
Admin server: s2.premium.VAhost.net
Share aanmaken:
1)Shares => klikken op SMB / NFS => Nieuwe subfolder aanmaken: SMBshare / NFSshare
2)subfolder klikken => maak share => bij rechten naar beneden scrollen => Domain admins: PG & RW, Domain users: RO
3)Update
Systeem beveiliging:
1)system => Network access configuration => Nieuw netwerk toevoegen
Name: Sharenetwork
Network/host: 192.168.1.0
Netmask: 255.255.255.0
Type: Share
2)Update
Protocol aanzetten:
Shares => subfolder smbshared => Volledig vanonder scrollen => SMB/CIFS protocol op rw zetten
Connect to share met:
root
Azerty123
Connect Z-schijf met SMB share:
1)RMB op SMB share
2)Map network drive
3)Pad SMB share intypen
4)connecten met share account of finish 1)Private storage en manueel ip adres ingeven
Beveiliging backup:
1)Active directory van S1
2)OP s1 zelf volledig nieuwe OU: "TEMP Accounts" aanmaken => accidentally delete afzetten!!
3)2USers aanmaken die lid zijn van de groep ("member of") Guest
4)Op S1 => C schijf => nieuwe map map aanmaken en delen
5)Op advanced sharing van gedeelde map => Guest 1 Full control => Everyone alleen read rechten
6)Testen op client of je op Guest1 tekstbestand kan aanmaken en via Guest2 op die share map niet.
7)Als het werkt Guest1 verwijderen en bekijk sharing permissions op Guest1 map
*Wat stel je vast bij verwijderen Guest1 via active directory:
De guest account wordt vervangen door een ander account met een lange naam
die full control heeft over de map
8)Guest1 terug opnieuw aanmaken, wat stel je vast?
Guest1 heeft geen rechten meer over de map en de aangemaakte account blijft staan
Recycle BIN:
1)Open Active directory administrative center
2)Klik op uw domein links
3)Rechts => enable Recycle Bin
4)Verwijder Guest1 op AD
5)Guest1 komt te staan bij deleted users/objects op Recycle Bin
6)Mogelijkheid om te restoren
7)Delete OU Temp accounts => Lukt niet onmiddellijk => Omdat er nog objecten in zitten
*Zoek op welke technieken je kan toepassen om een backup te nemen van je Active Directory. Bekijk uiteraard ook welke 2 manieren
er zijn om een backup van je AD terug te plaatsen (Authoritative en non-authoritative):
-13.1.1 Authoritative Restore
Dit proces herstelt de AD na bc een wijziging die ongedaan gemaakt moet worden.
AD wordt hersteld vanaf de backup, de backup overschrijft dan alle andere DC's met eventuele nieuwere informatie.
-13.1.2 Non-Authoritative Restore
Terugzetten van gegevens van de backup. Nadien ontvangt de DC updates van andere DC's die gemaakt zijn sinds de backup.
Backup S1:
Eerst probleem openfiler oplossen:
1)openfiler opstarten vanuit vmcloud
2)cd /etc/samba
3)vim smb.conf (toevoegen: strict allocate = yes) => eerst i voor insert => opt einde escape => :wq voor opslaan
4)/etc/init.d/smb restart
Backup zelf
1)Install windows backup in server manager => add roles => features
2)Open windows backup
3)Action => backup once
4)Different options => Custom kiezen => System State backuppen
5)Remote disk kiezen
6)pad share: \\of\smb.smb.SMBshare
7)Als backup mislukt, de aangemaakte files door de backup manueel verwijderen en backup terug opnieuw proberen
!!!Als openfiler ineens verdwijnd van domein, moet je de tijd nakijken van beiden systemen (moeten gelijk zijn met max 5min verschil)
Restore backup (authoritatief ingesteld)
http://technet.microsoft.com/ru-ru/library/cc816878(v=ws.10).aspx
1)Herstart de domeincontroller in Directory Services Restore Mode Remotely
=> run => Msconfig.msc => stapkes staan in url: http://technet.microsoft.com/ru-ru/library/cc794729(v=ws.10).aspx
2)Restore uw ADDS van je backup a.d.h.v. een non-authoritatieve restore.
Dit zorgt ervoor dat de domeincontroller terug in de staat komt waarop de objecten die verwijderd zijn
er terug bijstaan.
http://technet.microsoft.com/ru-ru/library/cc794755(v=ws.10).aspx
in cmd:
=>wbadmin get versions -backuptarget:\\of\smb.smb.SMBshare
=>wbadmin start systemstaterecovery -version:12/03/2013-12:37 -backuptarget:\\of\smb.smb.SMBshare -quiet
3)Markeer objecten als authoritatief zodat ze niet worden overschreven bij het restoren door synchronisatiefouten
tussen de verschillende domeinen.
http://technet.microsoft.com/ru-ru/library/cc816813(v=ws.10).aspx <== hieraan beginnen
=> open run => ntdsutil
=> activate instance ntds => enter
=> authoritative restore => enter
=> restore subtree "OU=Stagiairs,DC=Host,DC=net" => enter
=> quit => enter
=> Start terug op met de domaincontroller in normale modus dus dsrm opstartmode uitschakelen: Safe boot uitvinken
Nakijken of beide OU's Stagiairs en Guests er nog staan
(In dit geval is OU guests wel verwijderd doordat we maar 1 DC hebben dus de informatie
wordt niet gesynchroniseerd met een 2de DC)
- Debian Machine toevoegen:
Netwerkgegevens: NIC0 / Private management network / static - manual / IP = 192.168.1.3
Als Machine aangemaakt is, nieuwe netwerkkaart toevoegen:
NIC1 / Private storage network / static - manual / IP = 172.16.0.13
op Debian machine:
1)su - => enter => pass: Azerty123 => enter
2)commando: pico /etc/network/interfaces
Voeg volgende lijntjes toe aan het bestand
iface eth0 inet static
address 192.168.1.3
netmask 255.255.255.0
gateway 192.168.1.254
iface eth1 inet static
address 172.16.0.13
netmask 255.255.255.0
CTRL + O (opslaan) => CTRL + X (afsluiten)
3)pico /etc/resolv.conf
veranderd de bestaande lijntjes naar deze:
domain host.net
search host.net
nameserver 192.168.1.1
4)ifdown / ifup van eth0/eth1
IPV6 instellen:
Zelf gekozen ULA subnet:
fdac:1fff:b0b0 (tot dit gedeelte mag random gegenereerd worden vanaf 'fd')
Subnet 1: fdac:1fff:b0b0:4bd0:: /64
Subnet 2: fdac:1fff:b0b0:4bd1:: /64
/sbin/ip
Remote settings toewijzen voor domain users aan clients (en eventueel toevoegen aan domein als dit nog niet gebeurt is)
IPV6 instellen via Netwerkinstellingen (Default gateway openlaten)
NIC0 NIC1
S1: fdac:1fff:b0b0:4bd0::1 /64 fdac:1fff:b0b0:4bd1::11 /64
dns: ::1 dns: fdac:1fff:b0b0:4bd1::11
S2: fdac:1fff:b0b0:4bd0::2 /64 fdac:1fff:b0b0:4bd1::12 /64
(dns: ::1) (dns: fdac:1fff:b0b0:4bd1::12)
Openfiler: fdac:1fff:b0b0:4bd0::150 /64 fdac:1fff:b0b0:4bd1::1 /64
S3: fdac:1fff:b0b0:4bd0::3 /64 fdac:1fff:b0b0:4bd1::13 /64
C1: fdac:1fff:b0b0:4bd0::101 /64
dns: S1
C2: fdac:1fff:b0b0:4bd0::102 /64
dns: S2
Voor windows server core:
*powershell
netsh interface ipv6 add address "Ethernet" fdac:1fff:b0b0:4bd0::2
netsh interface ipv6 add address "Ethernet 2" fdac:1fff:b0b0:4bd1::12
Voor linux: (zowel openfiler als debian)
VOOR DEBIAN 7 (alleen ifup commando gebruiken niet ifdown):
/sbin/ip -6 addr add fdac:1fff:b0b0:4bd0::3/64 dev eth0 (voor debian)
/sbin/ip -6 addr add fdac:1fff:b0b0:4bd1::13/64 dev eth1 (voor debian)
of statisch in /etc/network/interfaces:
iface eth0 inet6 static
address fdac:1fff:b0b0:4bd0::3
netmask 64
iface eth1 inet6 static
address fdac:1fff:b0b0:4bd1::13
netmask 64
pico /etc/resolv.conf => lijntjes toevoegen
=> domain host.net
=> search host.net
=> nameserver 192.168.1.1
=> nameserver fdac:1fff:b0b0:4bd0::1
VOOR OPENFILER eth0: vim /etc/sysconfig/network-scripts/ifcfg-eth0
=> IPV6_AUTOCONF=no
=> IPV6INIT=yes
=> Toevoegen: fdac:1fff:b0b0:4bd0::150/64
VOOR OPENFILER eth1: vim /etc/sysconfig/network-scripts/ifcfg-eth1
=> IPV6_AUTOCONF=no
=> IPV6INIT=yes
=> Toevoegen: fdac:1fff:b0b0:4bd1::1/64
~~ /sbin/ip -6 addr add fdac:1fff:b0b0:4bd0::150/64 dev eth0 (voor openfiler)
~~ /sbin/ip -6 addr add fdac:1fff:b0b0:4bd1::1/64 dev eth1 (voor openfiler)
Risico's gedeelde application pool:
-1 proces per application pool (=>zwaar proces dat veel resources nodig heeft)
(als dit proces vastloopt alle websites geimpacteerd)
-gebruikers kunnen in principe aan elkaars bestanden
1)IIS installeren op S2 via server manager op S1
2)Role services in setup, volledig vanonder => management service aanvinken (dit staat remote management toe)
3)Op S1 Web server zoeken en enkel van IIS de management console installeren zodat IIS van S2 beheerbaar is
4)Powershell op S2:
Invoke-command -ScriptBlock{Set-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\WebManagement\Server -Name EnableRemoteManagement -Value 1}
Invoke-command -ScriptBlock {Set-Service -name WMSVC -StartupType Automatic}
Invoke-command -ScriptBlock {Start-service WMSVC}
In IIS manager op S1 => Add connection => S2.premium.sdhost.net => account: administrator van S2
In IIS Manager => Sites => new Website, 2 website aanmaken
-'klant1.sdhost.net' Physical path => C:\inetpub\wwwroot\Klant1 => hostname = Klant1.host.net
-'klant2.sdhost.net' Physical path => C:\inetpub\wwwroot\Klant2 => hostname = Klant2.host.net
In DNS A-record toevoegen:
-hostname: www
-IP: 192.168.1.2
Voor toegang via IPv6 ook een AAAA-record toevoegen:
-hostname: www
-IP: fdac:1fff:b0b0:4bd0::2
Voor elke site ook een een CNAME-record aanmaken:
-Alias name: klant1, FQDN: www.host.net
-Alias name: klant2, FQDN: www.host.net
In deze standaardopstelling schuilen enkele risicoís. Geef twee risicoís die de huidige
configuratie (gedeelde application pool) met zich mee kan brengen:
- Als je een website hebt die zwaar CPU belastend is (zoals foto's herschalen) heeft dit ook effect op je andere websites
- Omdat je websites binnen dezelfde apppool zitten hebben ze eenzelfde identiteit en kun je geen aparte permissies opzetten.
GROUP MANAGEMENT SERVICE ACCOUNT:
New-ADServiceAccount IISPool1 -DNSHostName s1.amhost.net -PrincipalsAllowedToRetrieveManagedPassword Administrator -KerberosEncryptionType RC4, AES128, AES256
Install-ADServiceAccount IISPool1
Maybe you can do this tutorial to, it is a tuto for learning DFS & DNSSEC..
Wat betekent de optie “dnssecok”
-> Deze optie stelt de dnssecOK bit in voor deze query
-> Dit verteld de server that de client dnssec verstaat en dat deze server hiervan gebruik kan maken met deze client
Krijg je een bevestiging dat dit een secure antwoord is? (RRSIG)
-> Neen want de zone is nog niet gesigneerd
Controleer of de client C1 ingesteld is om secure responses af te dwingen bij zijn DNS
caching server: get-dnsclientnrptpolicy. Resultaat?
-> Het resultaat is niks, vermoedelijk omdat er geen instellingen zijn hiervoor
Probeer opnieuw een request op C1 voor S1 met ResolveDNSName. Is het signeren
van de zone voldoende om secure antwoorden te krijgen op de client?
-> Er komt opnieuw geen RSIG record dus dit is niet voldoende
Om secure DNS responses op de client voor het domein securezone.lab af te dwingen
wordt in het domein Host.net een GPO ingesteld. (nieuwe GPO voor hele domein).
zoek op en stel deze GPO in voor responses van securezone.lab.
-> default domain policy -> Edit => -> Computer Configuration > Policies > Windows Settings > Name Resolution Policy.
"In the details pane, under Create Rules and To which part of the namespace does this rule apply, choose Suffix from the drop-down list and type sec.contoso.com next to Suffix."
"On the DNSSEC tab, select the Enable DNSSEC in this rule checkbox and then under Validation select the Require DNS clients to check that name and address data has been validated by the DNS server checkbox."
"In the bottom right corner, click Create and then verify that a rule for sec.contoso.com was added under Name Resolution Policy Table."
=> GPupdate /force uitvoeren
=> Dan kan de policy bekeken worden
Je zorgt er uiteraard ook voor dat deze policy toegepast werd op de client (C1) en controleer dit opnieuw met get-dnsclientnrptpolicy.
=> GPupdate /force
=> get-dnsclientnrptpolicy => levert hetzelfde resultaat als op de server
Opnieuw: ResolveDnsName s1.securezone.lab server S1 dnssecok Wat krijg je als antwoord te zien? Wat is de oorzaak?
(Distribueer) Kopieer de trust achor data van de secure.lab zone op S2 naar S1 en importeer die op de DNS van S1 als trusted anchor. (keysetsecurezone.lab)
http://technet.microsoft.com/en-us/library/hh831411.aspx
opnieuw: ResolveDnsName s1.securezone.lab server S1 dnssecok Krijg je nu een (beveiligd antwoord)?
->Ik krijg nu een beveiligd antwoord van de DNS server gesigneerd door securezone.lab met geldigheidstermijn
p23 Distributed File System
Installeer op beide server de “file services role”.
-> Add roles and features
-> File services
-> DFS
Maak een namespace aan (DOCUMENTATION) in je domein hOst.net. Stel de sharepermissions zo in dat de groep ‘auteurs’ schrijfrechten heeft. gewone gebruikers
mogen enkel leesrechten hebben.
-> DFS manager
-> Namespaces => Add namespace
maak een folder aan in de namespace DOCUMENTATION met als naam PDF
-> Add folder
maak een tweede target aan voor de PDF folder
-> Add target to folder
stel replicatie in tussen de twee folder targets. De inhoud wordt vanaf nu dus gesynct.
-> Automatisch bij 2de target volg de wizard
Welke andere stappen zijn nodig om een volledig redundant DFS systeem op te zetten?
-> De folder moeten via DFS geschared staan
-> De replicatie moet ingesteld worden
maak een diagnostisch raport aan over hoe replicatie gebeurt, en corrigeer eventue vastgestelde problemen.
-> Rechtermuisknop op de replication object
-> Create diagnostic report
-> kies de reports
stel quota’s in. In de map PDF maak je een subfolder CATALOGS aan, maar zorg dat die niet groter dan 10MB kan worden. Stel hiervoor een harde limiet in.
-> install FSRM bij file services
-> klik quotas => add quota => kies het bestand
-> nieuwe quota => 10mb hard aanvinken
-> save
http://technet.microsoft.com/en-us/library/cc875787(v=ws.10).aspx
omdat we willen vermijden dat de volledige bandbreedte ingenomen wordt door DFS,beperken we de replication speed tot 2MBps.
-> Klik op de replication -> rechterkolom kies vor edit replication group
-> Stel de 2MBps in -
Windows Server 2012 R2 "The password is incorrect. Try again."
Hi,
I tried to login to my Windows Server 2012 R2 and I got this message "The password is incorrect. Try again." Although the username and password are absolutely correct.
Any thoughts. Thanks.Hi,
I have been investigating this behavior for a while, I am wondering that have you migrated your domain from 2003 to 2012 recently?
Because I can reproduce this issue by migrating a Windows Server 2003 domain to Windows Server 2012 domain, after the Domain Controller changes its password.
Here are some similar threads below about this issue, which got me testing this behavior in the first place:
DC - refuses administrator log on
http://social.technet.microsoft.com/Forums/windowsserver/en-US/e16fcdda-8e5a-4b30-bbe0-d847bcb68b4e/dc-refuses-administrator-log-on?forum=winserverDS
KRB_AP_ERR_MODIFIED 4 Random on Member Server in upgraded Domain 2003 to 2012 R2
http://social.technet.microsoft.com/Forums/windowsserver/en-US/4d8a4018-5969-4c6c-99b1-b446711e1dd4/krbaperrmodified-4-random-on-member-server-in-upgraded-domain-2003-to-2012-r2?forum=winserverDS
I am still trying to figure out how and why this issue happens, and consulting with some experts. I will keep you posted once I have progress.
Have a nice day!
Amy -
Windows Server 2012 enable memory Turbo boost
Hello guys.
I have a Sony Vaio VPC-F113FX notebook with Quad Core Intel i7 processor with 8GB of RAM.
It is installed a Windows Server 2012 Standard.
I bought an SD card of 64 GB and intended to use the Turbo Boost feature in memory, only this option is not displayed in the properties of the operating system memory card. Can you help me configure or enable this feature in Windows Server 2012.
Thanks
Obrigado por contactar o fórum Microsoft Technet!Hi Hezequias,
Thanks for posting.The Turbo Boost feature is just provide by Intel can cab be obly used on the Intel i5 and Intel i7.
As you mentioned that you used a 64GB SD card and intended to use the Turbo Boost feature, so I guess you might talked about the Ready Boost.
Ready Boost is a feature provide by Microsoft, Ready Boost is a disk caching software component which allows any compatible mass storage device to be used as a hard-drive memory cache for the purpose of increasing random read access
speed to the hard drive. Potentially compatible ReadyBoost devices include USB flash drives, flash memory,solid-state drivers(SSDs), and SD cards. There is a limitation of 32 GB per ReadyBoost device.
However the Ready Boot feature was just supported by the Microsoft Clients(such as windows 7) but not the server edition.
So the feature can't be used on windows server 2012 standard operation system.
Hope it helps.
If you have any concerns, feel free to post back.
Best Regards,
Elaine
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]
Maybe you are looking for
-
SCM2007 on AIX/Ora install error: class com.sap.engine.offline not found
Hello Readers, I am doing a fresh install of SCM2007 on AIX5.3, Oracle 10.2.0.4. Type of install is central instance (ABAP, Java, DB on one server). After importing ABAP, sapinst proceeds to create secure store. At that point sapinst fails with the m
-
Does Active Directory Support Non English Languages?
Hi, I want to know that does Active Directory Support Non English Languages like japanes, Arabian? I think we can have domain name in non english languages also. How active directory handles it. Sandeep Gupta
-
Defaulting to Internal Orders to Cost Assignment?
The SRM application is currently defaulting to Internal Orders for Cost Assignment. This is despite the fact that in the configuration, we have removed Internal Orders as active. Any help with this will be gratly appreciated Cheers Brent
-
Jar application wont run correctly for win7
hi, i'm new to java and tried to make an application that detects the hard disks connected to my computer. i used native for accessing windows ioctls that i compiled in a .dll. the .jar i made is working in windows 2003 but when i tried it in windows
-
Hi, I someone with little experience with Java EE programming. I have a simple web application consisting of jsp and servlets. A servlet generates an image based on a string which is displayed on a jsp page along with a form containing a text input a