環境 & 問題描述
============
CA : Server 2008 SP1 Standard OS安裝Enterprise Root CA
DC : Server 2008 SP1 DC & Server 2003 SP2 DC
Server 2008 DCs本身的憑證 (Domain Controller範本申請的憑證)過期而沒有自動Renew , 但是Server 2003 DC會自行Renew

問題原因
============
1. 環境有透過GPO啟動Auto-Enrollment機制
2. 環境CA是Enterprise CA搭配Server 2008 Standard OS , 無法支援V2 憑證範本的Auto-Enrollment功能

解決方式
============

方法一

將Enterprise CA移轉至Server 2008 Enterprise OS或是Server 2008 R2 任何版本的OS
藉此讓Auto-Enrollment機制可以生效 (較建議的方式)

方法二

停用GPO的Auto-Enrollment設定 (因為目前環境無法針對V2憑證範本進行Auto-Enrollment , 所以此設定目前也不會生效)

詳細分析說明
============

預設DC 在沒有進行任何設定時 , 只要環境安裝了Enterprise CA (不管安裝在什麼SKU)

DC都會自動透過預設的設定跟Enterprise CA申請[Domain Controller]此範本的憑證 (此為V1的憑證範本 , 何謂V1 V2範本請閱底下參考資料)

此機制是透過Automatic Certificate Request Settings (ACRS)來進行動作 , 而不是我們目前常說的Auto-Enrollment
(ACRS是Windows 2000時代部屬憑證的方式)

Auto-Enrollment的部分是由Server 2003開始才有的技術 , 要使用憑證的Auto-Enrollment時需要達到底下需求

摘錄: https://technet.microsoft.com/en-us/library/cc783873(v=ws.10)
Windows Server 2003 schema and Group Policy updates
Windows 2000 Server domain controllers running Service Pack 3 or later
Windows XP Professional or Windows Server 2003 clients
Windows Server 2003, Enterprise Edition or Datacenter Edition running as an Enterprise CA

上述需求達成後 , 我們則可以透過GPO的方式將Auto-Enrollment啟動 , 讓Client端可以透過此方式針對V2的憑證範本進行自動申請動作

而如果啟動Auto-Enrollment的設定時 , DC在進行本身憑證的取得時依據OS版本會有不同的行為

Server 2003 DC的行為
==============

1. 啟動Auto-Enrollment後 , 系統在開機時或是GPO套用時針對底下V2的憑證範本進行申請 or 更新

    a. Domain Controller Authentication

    b. Directory Mail Replication

    c. Kerberos Authentication (如果Enterprise CA是裝在Server 2008之後的系統時才會有)

2. 如果上述動作可以成功時 , 則整個流程就完成

3. 假設上述因為某些因素無法申請 or 更新時 (如Enterprise CA裝在Server 2008 Standard OS時 or 權限不足)則會進行下一個動作

4. 透過內建預設的方式跟Enterprise CA透過Domain Controller此V1範本來進行憑證申請 or 更新

PS: 原先V1的Domain Controller範本於Server 2003時已經將其分割成上述a & b兩個V2憑證範本
而在Server 2008出來時又多一個Kerberos Authentication的V2憑證範本

Server 2008 DC的行為
==============

1. 啟動Auto-Enrollment後 , 系統在開機時或是GPO套用時針對底下V2的憑證範本進行申請 or 更新

    a. Domain Controller Authentication

    b. Directory Mail Replication

    c. Kerberos Authentication (如果Enterprise CA是裝在Server 2008之後的系統時才會有)

2. 如果上述動作可以成功時 , 則整個流程就完成

3. 假設上述因為某些因素無法申請 or 更新時 (如Enterprise CA裝在Server 2008 Standard OS時 or 權限不足 or 其他因素)
則不會進行後續動作 (不會像Server 2003一樣跟CA透過V1的Domain Controller範本進行申請 or 更新)

所以由此可以得知為何只有外點的Server 2003 DC沒有受到影響 , 而其他Server 2008 DC都有此問題

相關參考資料
==============

何謂V1 , V2 , V3 憑證範本?
我們從Certificate Template的管理畫面內可以看到底下資訊 , Minimum Supported CAs分別會有三種值
Windows 2000 -> V1 憑證範本 (內建 , 無法編輯內容)
Windows Server 2003 Enterprise -> V2 憑證範本 (最常用 , 將V1憑證範本進行複製後即可產生V2 Template , 可以修改裡面內容如年限 & Support Auto-Enrollment等)
Windows Server 2008 Enterprise -> V3 憑證範本 (涵蓋V2憑證範本的所有功能並多ㄧ些新功能)


詳細資訊可以參考底下網址
Designing and Implementing a PKI: Part III Certificate Templates
https://blogs.technet.com/b/askds/archive/2010/05/27/designing-and-implementing-a-pki-part-iii-certificate-templates.aspx

There is an existing document in the sevenforum.com that gives you step by step instruction on how to create a MS-DOS bootable flash drive using HP USB Disk Storage Format tool. See link here:

https://www.sevenforums.com/tutorials/46707-ms-dos-bootable-flash-drive-create.html

However, this method may not work for all the USB flash drvies.

Ex: It does not work for my Kingston 4.0GB USB flash drive

Here is another workaround:

Step1: Download rufus utility, Rufus v 1.1.7 without FreeDOS Support (154KB) from here:

https://github.com/pbatard/rufus/downloads

Step2: Download win98_bootdisk.iso image from allbootdisks.com:

https://www.allbootdisks.com/download/iso.html

Step3: Run rufus_v1.1.7.exe

Step4: click the disk icon to the right of "Create a bootable disk using:", and selected the win98_bootdisk.iso you downloaded in step2.

Step5: click start, once you are finished. You could copy your BIOS upgrade files to this USB flash and run the executables in DOS mode.

客戶反映更新KB2695962後無法使用SSL VPN的機制連線，移除掉KB2695962之後就可以連線。

解決方法：

如果您的網路設備是Cisco ASA 5500 Series，目前確認是相容問題，請聯繫Cisco做升級。

Cisco ASA 5500 Series SSL VPN機制連線安裝KB2695962後無法連線https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-asaclient

過了兩分鐘才出現

問題說明：

您可能會在事件檢視器裡看到下列的訊息：

找不到來自來源 DCOM 之事件識別碼 10010 的描述。本機電腦可能並未安裝引發此事件的元件，或安裝已損毀。您可以在本機電腦上安裝或修復該元件。

如果事件源自其他電腦，則儲存它們時必須一併儲存顯示資訊。

下列資訊已隨附於該事件:

{9B1F122C-2982-4E91-AA8B-E071D54F2A4D}

GUID：9B1F122C-2982-4E91-AA8B-E071D54F2A4D是CAutoUpdate Class 1.0的元件

之所以發生這個問題，是因為CAutoUpdate Class 1.0的元件 在SoftwareDistribution以及子資料匣內無法找到對應的參數。當「元件物件模型」(COM) 物件嘗試登錄時，會將登錄訊息發佈至 CAutoUpdate Class 1.0。由於 CAutoUpdate Class 1.0並未執行，因此登錄訊息會逾時。接著，COM 元件就會在終端機伺服器上記錄事件 ID 錯誤訊息。

通常發生的原因，是因為SoftwareDistribution裡面的資料損毀所導致。

解決方法：

重新命名SoftwareDistribution以及子資料匣

請您將下列指令存成fix.bat，並在發生問題的電腦上執行。

Net stop bits

Net stop wuauserv

cd \documents and settings\all users\application data\microsoft\network\downloader

Del qmgr0.dat

Del qmgr1.dat

cd %systemroot%

Ren SoftwareDistribution SoftwareDistribution.old

Net start bits

Net start wuauserv

再點關機，已可正常點選。

[如何設定]：
 
A.         請透過 [執行] > [regedit] > 找到下面的機碼位置：
            HKLMSystemCurrentControlSetServicesDHCPServerParameters
            新增機碼名稱：LeaseExtension
            Value Type: DWORD
            Value Data: time in minutes
 
[參考資料]：
 
Determining Lease Duration
https://technet.microsoft.com/en-us/library/cc783573(WS.10).aspx
 
Although reducing the lease duration creates more DHCP-related network traffic, it increases the rate at which addresses are returned to the available address pool for reassignment. With an average volume of DHCP request traffic, Windows Server 2003 DHCP has a four-hour default grace period after which an expired lease can be reused. This means that an address is marked for deletion four hours after the lease expires, regardless of lease duration. When the volume of DHCP-related traffic is heavy and no leases are available to service lease requests, DHCP immediately instantiates a cleanup cycle, which reclaims any leases marked for deletion. By default, the cleanup cycle occurs every 60 minutes. You can adjust the duration of the default grace period after which an expired lease is marked for deletion by editing the following key in the registry:

DatabaseCleanupInterval
https://technet.microsoft.com/en-us/library/cc963208.aspx

Description

Determines how often the Dynamic Host Configuration Protocol (DHCP) Service deletes expired ( doomed ) records from the DHCP client information database. By default, records expire after four hours. Deleting expired records releases space for new IP addresses.

Windows XP SP3 外部user 透過 Terminal Server Gateway 進行遠端連線，不定時出現 [連線已終止，因未收到遠端電腦的意外伺服器憑證。請嘗試重新連線]訊息，造成連線中斷。

[解決方法]︰

新增credSSP機碼與安裝kb953760以解決此問題。

[說明]：
 
CredSSP 是Windows XP SP3 中新的 Security Support Provider (SSP)，預設未被啟用。CredSSP enables a program to use client-side SSP to delegate user credentials from the client computer to the target server.
kb953760 則是修正Windows XP Kerberos authentication 的已知問題。
 
[如何設定]：
 
變更credSSP機碼

1) Click Start, click Run, type regedit, and then press ENTER.

2) In the navigation pane, locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

3) In the details pane, right-click Security Packages, and then click Modify. In the Value data box, type tspkg. Leave any data that is specific to other SSPs, and then click OK.


4) In the navigation pane, locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders

5) In the details pane, right-click SecurityProviders, and then click Modify. In the Value data box, type credssp.dll. Leave any data that is specific to other SSPs, and then click OK.


6) Exit Registry Editor and restart the computer.

 
 
2.       安裝Hotfix
 

When you enable SSO for a terminal server from a Windows XP SP3-based client computer,
you are still prompted for user credentials when you log on to the terminal server
https://support.microsoft.com/kb/953760

 
[參考資料]：

951608 Description of the Credential Security Service Provider (CredSSP) in Windows XP Service Pack 3
https://support.microsoft.com/default.aspx?scid=kb;EN-US;951608
說明：
CredSSP 是Windows XP SP3 中新的 Security Support Provider (SSP)
CredSSP enables a program to use client-side SSP to delegate user credentials from the client computer to the target server.

Technet Magazine：https://64.4.10.145/en-au/magazine/hh750380
說明：
Windows Server 2008 R2: Why Use Network Level Authentication?

When you connect to an RD Session Host server with an RDC 6.x or later client, you might have noticed you don’t connect directly to the RD Session Host server logon screen to provide your credentials. Instead, a local dialog box pops up to take your credentials on the client. This dialog box is the front end of CredSSP.
When you type your credentials into this dialog box, even if you don’t choose to save them, they go to CredSSP. This then passes the credentials to the RD Session Host server via a secure channel. The RD Session Host server will only begin building a user session once it accepts those credentials.

When you enable SSO for a terminal server from a Windows XP SP3-based client computer,
you are still prompted for user credentials when you log on to the terminal server
https://support.microsoft.com/kb/953760

解決方式
=================

1. 執行底下指令進行Shadow Copy的大小調整 (此動作會刪除原有的Shadow Copy)

vssadmin resize shadowstorage /for=c: /on=d: /maxsize=2000mb

2. 手動透過UI方式再次進行調整即可

問題原因
===================
有問題VM其C槽的Shadow Copy存放區是沒有存放在C槽本身 , 而是存放於D槽

解決方式
===================
將C:的Shadow Copy存放區改成C:本身即可

參考資料
===================
https://blogs.technet.com/b/virtualization/archive/2008/08/29/backing-up-hyper-v-virtual-machines.aspx

要進行online backup時VM的需求如下

問題原因 & 解決方法
=================

經過確認此問題可能是當下網路卡驅動程式有問題所導致 , 透過底下方式處理即可已經正常

1. 透過裝置管理員將網卡進行移除

2. 重新開機讓網卡自動被偵測並安裝 , 手動設定相關IP設定

3. 嘗試建立NLB即可正常

In addition to notify readers that the disk numbers and SATA channels numbers may not match, this KB took a step further to explain the creation of 100MB system partition.

This is its original content:

Additionally, when you install Windows 7, the installation creates a 100MB system partition alongside the Windows partition by default. The system partition is created to accommodate a Bitlocker requirement. Bitlocker requires that the boot files and Windows files are located on separate partitions. By default, the 100MB system partition is created on the disk that is detected as Disk 0. If you install Windows to a disk other than Disk 0, the 100MB system partition will still be created on Disk 0 during the installation.

Content to clarify:

The 100MB system partition will only be created on Disk 0 during the installation, if the user didn't change any of the pre-selected default settings. This by default definition includes: language selection, what type of installation do you want, which disk to install the Windows operating Sytem to...etc. If the user changes any of the pre-selected default settings, then this 100MB system partition is not guarantedd to be installed on Disk 0 as described in this KB.

Example:

I have a customer that chose "adanved options" and selected Disk 1 to install the Windows Operating System. Then he found out that the 100MB system partition is created on Disk 1 instead of Disk 0. This is because when he chose "advanced options" to make a selection change, this is no longer considered "by default", hence, the 100MB system partition is not guarantedd to be installed on Disk 0 as result.