ComputerMan

  To run a Hybrid Worker Service from Azure on a local on-premise machine.   If you want to use an Azure Automation account with a credential from on-premise AD, you have to do quite a few tricks to give the on-premise AD account enough access rights so the HybridWorkerService can actually use and run it.   Do this by granting the on-premise account access to the AzureConnectedMachineAgent Tokens:-   icacls "C:\ProgramData\AzureConnectedMachineAgent\Tokens" `     /grant "<COMPANY\serviceAccountName>:(OI)(CI)(R)" /T   $Account = ‘<COMPANY\serviceAccountName>’ $Keys = @(     @{Path='HKLM:\SYSTEM\CurrentControlSet\Services\EventLog'; Rights='ReadKey'},     @{Path='HKLM:\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters'; Rights='FullControl'},     @{Path='HKLM:\SOFTWARE\Microsoft\Wbem\CIMOM'; Rights='FullControl'},     @{Path='HKLM:\SOFTWARE\Polici...

 Interesting SNMP service problem on Windows. Since installing KB5051979 on Windows Server 2022 Standard, we can no longer use the SNMP service. The server no longer responds to SNMP requests from the management server <Server name>. Message in Event log on the problem server:- "The SNMP Service is ignoring the manager <Server name> because its name could not be resolved." The manager <Server name> CAN be pinged and resolved with DNS, also reverse lookup works. ............. Turns out, the GPO applying the policy for the names in the SNMP service had a fault. Re-created the GPO with the names again, and it worked.

Server Manager will not start on Windows Server 2019 after installing ADConnect. Error ServerManager.exe: This application could not be started. .NET Framework: "This application requires one of the following versions of the .NET Framework:xxxxx Do you want to install .NET framework now?" Of course it's already installed automatically on the server, so if you try and install it again you can't, error "already installed". Try the .NET repair package, can't repair the install. Try dsim.exe to install the package, error "Microsoft .NET Framework is already part of this installation". .NET Runtime version : 4.0.30319.0 - This application could not be started.This application requires one of the following versions of the .NET Framework:  v4.0.30319 The answer is to re-create the registry entries deleted when you installed ADConnect:- [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319] "AspNetEnforceViewStateMac"=dw...

If you have a totally virtualised Active Directory infrastructure in Hyper-V, you can't boot the VM into  Directory Services Restore Mode  using F8. The keypress is not recognised. To get around this, in a elevated command prompt, type: bcdedit /set {globalsettings} advancedoptions true Now when you reboot the DC, it will ask if you want to boot into restore mode, and you can restore A.D. After rebooting, type the command: bcdedit /set {globalsettings} advancedoptions false and it will boot normally again. Now you have to find the restore mode password....

Microsoft updates KB5017379 and KB5017270 seem to have been delayed by a week, for some reason. They didn't appear in the normal patch Tuesday updates on 14 September 2022, but a week later on 21 September. Could be because of the Time Zone change for Chile in August?

When you are registering Microsoft Azure Site Recovery server you might get this message:- The registration key has expired. Download a new registration key from Azure Site Recovery and select it. The downloaded file shouldn't be more than 5 days old. It's really difficult to find this key, it took me more than an hour to find. Here is the location:- Log on to the Azure portal and browse to your Recovery Services Vault. Browse to  Manage/Site Recovery Infrastructure  >  Hyper-V Hosts   Click the  +Server  button at the top. Click the "Download the vault registration key to register the host" button.

 Windows Server: File Server Resource Manager tasks: error occurred details: 0x8007007b I found this error after trying to save a task in the File Server Resource Manager / File Management Tasks: An error occurred while trying to persist changes to the file management task. Details: 0x8007007b, the filename, directory name or volume label syntax is incorrect. What this means to anybody who doesn't speak Microsoft, is that you used invalid characters in your name of the task. Re-create the task with only text and numbers, don't use anything that is not text or a number. none of these:- 0x00000022 (quotation mark) 0x0000002A (asterisk) 0x0000002F (forward slash) 0x0000003A (colon) 0x0000003C (less than) 0x0000003E (greater than) 0x0000003F (question mark) 0x0000005C (backslash) 0x0000007C (pipe or bar)  This happened to me because I had created the task in Server 2008R2 and then upgraded to 2012R2. After the upgrade the File Management Task no longer works.

 Yes, we are still doing the occasional P to V conversion from hardware Windows Server to Hyper-V VM! You can still use Mark Russinovich's PtoV converter to do this, Sysinternals Disk2VHD. After you have done the P-toV the hardware, create a new VM in Hyper-V using Generation 1 machines. When booting, you need to create a BCD / Boot partition. Boot into recovery mode using the same Windows Server ISO, and boot to the CD/DVD. Select Recover and Command Prompt. Then type: bootrec /fixmbr bootrec /fixboot bootrec /rebuildbcd After that, you can boot again to the C drive.

 Windows Server Servicing stack 10.0.17763.2170 rebooted our server automatically, no warnings. The process C:\Windows\system32\svchost.exe (xxxxx) has initiated the restart of computer xxxxx on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Service pack (Planned)  Reason Code: 0x80020010  Shutdown Type: restart  Comment:  Thanks Microsoft. It wans't planned. More downtime caused by your automatic reboots.

If you enable Barracuda Cloud-to-Cloud backup, you might come across this error when trying to set it up: AADSTS7000112: Application '3450a114-871f-4057-b591-f0a8e3c50287'(Cloud-to-Cloud-Backup) is disabled. and if  you log into Azure AD and try the command: (Get-MsolServicePrincipal -AppPrincipalId 3450a114-871f-4057-b591-f0a8e3c50287).accountenabled you get the result $false. Then you can enable Barracuda Cloud-to-cloud Backup by typing: Get-MsolServicePrincipal -AppPrincipalId 3450a114-871f-4057-b591-f0a8e3c50287 | Set-MsolServicePrincipal -AccountEnabled $true

Does the security you have in place match the technology you are using? Is there a gap between your level of security, and the technology the security is there to protect? How do you measure that gap? If you have no security in place, but you are using latest technology in your business, are you putting that technology at risk? Why and how should you close the gap?

 Checklist of roles to move when decommissioning the Active Directory PDC - DNS (inc wpad blocking removal) - DHCP (remember to add helper to L3 switches first)  - A.D. PDC, RID Master, Schema Master, Domain naming master, Infrastructure Master - Any references to LDAP - If this is the root domain controller, remember to add a time source to the internet

I am trying to run the Lignering Object Liquidator (LoL) on my Domain Controllers. But some DC's are Server Core and don't have .Net installed. So I have to run it on a DC with a GUI and connect to the DC with server core. But then I found this error message:  "Failed to create event log subscription to target DC". win rmquickonfig reports WinRM is already set up for remote management on this computer. So I tried turning off the firewall altogether:- Set-NetFirewallProfile -Profile Domain,Public,Private - Enabled True And run the LOL again.  That worked! Of course don't forget to turn the firewall back on again immediately afterwards.

 If you have a server running in Azure you cant log into anymore. You can use the Serial Console to get into the server. But there are not many commands, espeically if you can't log into a command prompt. I wanted to set the network adapter, as it had lost the Gateway. Here is the command to see the network adapters config: SAC>i Net: 4, Ip=172.22.10.9  Subnet=255.255.255.0  Gateway=0.0.0.0 As you can see, the Gateway has been set to 0.0.0.0 To set a new Gateway, issue the command: i 4 172.22.10.9 255.255.255.0 172.22.10.1 Where the number 4 is the identified for the network adapter. Now I can ping my VM again!

Updates may be available for your Azure AD trust.  Update your trust now to ensure you have the latest recommended settings. Don't Panic!

# This Powsershell will set every OneDrive for Business quota to the minimum set below. # Quota's that are above the minimum are not changed. # Richard Artes January 2010 # # Set the location of the Log file here:  $LogFile = "c:\temp\quotaSetMinList.txt" # Set the new minimum GB quota here:  $minQuota = 100  $newQuotaMB= $minQuota * 1024 #Your Sharepoint/OneDrive URL goes here:  Connect-SPOService -Url "https://xxxxxxxxxxxxxxxxxxxxx.sharepoint.com/"  $oneDriveSites = Get-SPOSite -IncludePersonalSite $true -Limit all -Filter "Url -like '-my.sharepoint.com/personal/'"  $oneDriveSites | ForEach-Object {  $site = $_  $strUserDetails = Get-SPOSite –Identity $site  # If you want to see what every site's quota is before changes, uncomment this:  #Out-File -FilePath $LogFile -InputObject $strUserDetails -Encoding UTF8 -append $QuotaGB = ($strUserDetails.StorageQuota / 1024) If($QuotaGB -lt $minQuota) { Out-File ...

If a user has left, their license gets removed and their OneDrive for Business account gets automatically deleted for a period of 93 days. If you try and restore a user, and un-delete their OneDrive, you run into a problem as restoring the account atomically creates a new empty OneDrive. Restoring gets you this error:- Restore-SPODeletedSite : A site collection with the same Site Id or Path already exists. You have to permanently delete the new empty OneDrive account, then restore then old deleted one back:- To delete permanently the newly created (empty) site:- Remove-SPOSite -Identity https://xxxxxx-my.sharepoint.com/personal/xxxxxxxxx To restore the automatically deleted (full) site:- Restore-SPODeletedSite -Identity https://xxxxxx-my.sharepoint.com/personal/xxxxxxxxx

Our server has several network cards. If you ping the server name, you get the wrong IP address (instead of the management IP you get the IP address of the internet facing address, which is not routed internally). First, I removed the "register this connection's address in DNS" option in the network card, and ipconfig /register DNS. This worked for 1 day, but after 1 day the old IP address came back again. Fix: In DHCP, make a reservation for the address lease. In properties, remove the tickbox "Enable DNS Dynamic updates".  Problem solved!

Problem. User left last year, account was disabled and Office 365 mailbox deleted. She comes back 1 year later, her A.D account is enabled and moved to the correct O.U. But….. a new mailbox cannot be created for in O365: error in creating a mailbox. Her old mailbox is still in the “deleted mailboxes” in Exchange Admin Center. Cannot delete the old mailbox. Error: The user mailbox couldn't be permanently deleted. The user mailbox has at least one type of hold or hold policy applied to it. Please remove the holds before trying to delete. LitigationHoldEnabled: true, ComplianceTagHoldApplied: false, Solution. ·          -  Set-Mailbox xxxx@contoso.com -LitigationHoldEnabled $false -InactiveMailbox ·          -  Remove-Mailbox -Identity "xxxx@contoso.com" -PermanentlyDelete -Confirm:$True After that the old mailbox is permanently removed. Re-create the license and let O365 create a new mailbox.

Group policy for deleting old user profiles not working in Windows. We implemented the Active Directory Group Policy: “Delete user profiles older than a specified number days on system restart ” to clear old profiles older than 30 days from the PC. Unfortunately it doesn’t work, nothing gets deleted. I tracked this down to the setting it looks at for each profile: the “LastUseTime”. Something was changing the LastUseTime in NTUSER.DAT to today’s date for every user on the computer. Could be something in Windows or maybe our antivirus. Anyhow, it stopped the policy from working. You can check this with the PowerShell script: Get-WMIObject -class Win32_UserProfile | Where {(!$_.Special) -and ($_.ConvertToDateTime($_.LastUseTime) -lt (Get-Date).AddDays(-30))} (Thanks to Charlie Smith on Spiceworks for this) https://community.spiceworks.com/how_to/124316-delete-user-profiles-with-powershell Instead, use  the “LastDownloadTime” to check the date of profile download: Get...