Lee Stevens: Technical Blogs

PS without BS: Showing a popup box and killing it

leecstevens — Mon, 30 Apr 2018 11:21:06 GMT

This is a simple solution for those wanting to show a popup box, but not leave it up indefinitely. This may be useful if you are in a process and want to show an error, but don't actually leave it up overnight, maybe kill it at some point so processing can continue. Here is the syntax (my script name is call_popup.ps1): powershell.exe -file call_popup.ps1 and then: -Message (required): The message you want to display to the user. -MessageHeader (optional): The message on the title box. Default is blank. -MessageLevel (optional): The icon you want to display to the user. Default is informational. Other values: Error, Warning -Days (optional): Number of days you want to show the dialog box. Default is 0 days. This can be combined with hours and minutes. -Hours (optional): Number of hours you want to show the dialog box. Default is 0 hours. This can be combined with days and minutes. -Minutes (optional): Number of minutes you want to show the dialog box. Default is 10 minutes. This can be combined with days and hours. Example syntax: -Message "Hello World" -Days 1 Displays an informational message which will terminate in 24 hours. -Message "The world is coming to an end" -MessageLevel Warning Displays a warning message that "The world is coming to an end" for 10 minutes and terminates. [code language="PowerShell"] param( [Parameter(Mandatory = $true, Position = 0)] [string]$Message, [Parameter(Mandatory = $false, Position = 1)] [string]$MessageHeader="", [Parameter(Mandatory = $false, Position = 2)] [string]$MessageLevel="64", [Parameter(Mandatory = $false, Position = 3)] [string]$Days="0", [Parameter(Mandatory = $false, Position = 4)] [string]$Hours="0", [Parameter(Mandatory = $false, Position = 5)] [string]$Minutes="10" ) $MessageTime = New-TimeSpan -Days $Days -Hours $Hours -Minutes $Minutes $DisplayTime = (get-date) + $MessageTime $Message+="`n`nThis message will terminate at $DisplayTime`nor when you click OK." $ConvertedTime=($MessageTime.Minutes*60)+($MessageTime.Hours*60*60)+($MessageTime.Days*60*60*24) switch ($MessageLevel) { "Error" {$MessageLevel="16"} "Warning" {$MessageLevel="48"} "Informational" {$MessageLevel="64"} default {$MessageLevel="64"} } $a = new-object -comobject wscript.shell $b = $a.popup($Message,$ConvertedTime,$MessageHeader,$MessageLevel) [/code] Happy Scripting! — Easy link to my blog: http://aka.ms/leesteve — If you like my blogs, please share it on social media and/or leave a comment.

PS without BS: Replacing Select Case True

leecstevens — Sat, 28 Apr 2018 11:31:12 GMT

This is a short blog to describe how to replace VBScript's brilliant "Select Case True" with PowerShell. Instead of evaluating one variable, what happens when you need to evaluate multiple variables and make sure that one of them returns true? Instead of multiple "if" statements, VBScript used Select Case True. PowerShell can do the same. Here is a quick code snippet: [code language="PowerShell"] $myVar="abc" switch ($true){ ($myOtherVar -eq "123") {write-host "MyOtherVar is 123"} ($MyVar -eq "abc") {write-host "MyVar is abc"} default {write-host "None of the above"} } [/code] In this case, you can see I am looking at 2 variables. Whichever comes back true, the action will be taken. If none are, default will kick and say "None of the above". Happy Scripting! — Easy link to my blog: http://aka.ms/leesteve — If you like my blogs, please share it on social media and/or leave a comment.

When SQL has no certificate...

leecstevens — Tue, 24 Apr 2018 14:19:24 GMT

Yesterday I posted a blog on how to identify the SQL Certificate used. I had some questions come from this, and the biggest one was, but what if the registry key is blank? Fear no more, here are steps to populate this registry key properly. I was able to reproduce this issue on a system with the HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\(Your SQLVersionAndInstance)\MSSQLServer\SuperSocketNetLib\Certifcate key being blank. So, here is how you populate said key:

Act I: Go into IIS Manager

Click on the Server Name and in the features view, open Server Certificates.
Click Create Self-Signed Certificate
For a friendly name of the Certificate, use the FQDN of the server.
Click OK, and you will see the new certificate appear

Act II: Checking the Service Account

Go to Services.msc and look for the SQL Server service account you're using, and of course, write it down.

Act III: Giving the certificate proper permissions

Go into mmc.exe and add the certficate snap-in for the computer account.
Find the certificate you created (should be in the Personal\Certificates container, right click, and Manage Private Keys.
Add the SQL Server service account from Act II. You just need read permissions only.

Act IV: Adding the certificate to SQL Server

Go back to Configuration Manager and under Protocols for (Instance Name), click Properties
Click the Certificates tab, and the certificate your created should show in the drop down.
Select the certifcate, and click OK.
Restart SQL Services to confirm the certificate is working.

Act V: (Almost there) Check that the registry key "Certificate" is now populated.

This should be what you need to create and verify the SQL Server certificate is now in place. — Easy link to my blog: http://aka.ms/leesteve — If you like my blogs, please share it on social media and/or leave a comment.

Server Core: Navigating an old but new world

leecstevens — Mon, 23 Apr 2018 12:06:00 GMT

Lately, I've done a lot of posting on Server Core and one thing I've neglected to write on is how you actually navigate in this new world. Starting with Windows Server 1709 (and at the time of this writing), the "current branch" models of Windows Server will not have a GUI and your one and only option will be to install the Core OS. This doesn't mean that the GUI is going away, think about Citrix installations, RemoteApp, and the vast majority of products (including Microsoft ones) that aren't supported on Server Core. So, take heart, the GUI isn't going anywhere, but will take a backseat into more what was called "Long Term Servicing". The argument I hear all the time is that people don't want to use Core because it's not what they're used to. It's called "Windows" and some even argue if they want a command line interface, they'll switch to Linux. I've discussed the benefits of a Core OS in other blogs, but I'm just going into using it. So, here are some tips and things to help you tolerate this new world a little better. My disclaimer is simple, there are probably more things, more features, and some things I may have missed. I'm writing what comes to mind and what seems important to me.

Tip #1: Not everything is going to be there

Some Windows features like SMTP Server, WDS Server, and what not will not be supported. Also, some apps you may use like Azure AD Connect are not supported on Core. Unless you're testing, insure you have a supportability statement that whatever you run works on Core.

Tip #2: What's old is new

Nothing really changed in Server Core as it is still Windows. If you know the command line or PowerShell, this all works the same (assuming the app or feature is supported in Core). Okay, I'll go here, even VBScript has been known to work a time or two here...

Tip #3: There is Server Manager

Server Manager is a great "wimp out clause" if you want to install a role or feature remotely. Keep in mind Server Manager is smart enough to know that a feature isn't supported on Core. Keep in mind that Server Manager needs to be enabled first with this Windows PowerShell cmdlet: Configure-SMRemoting.exe -Enable.

Tip #4: Don't forget Group Policy and Preferences

Let's not forget with the Windows backbone that you have access to things like Group Policy. You can easily configure many items right from GPO with no scripting involved. Some examples? Windows Update, firewall settings, and Remote Desktop to name a few. I would suggest using different policies for Core as you won't need to worry about user interface items.

Tip #5: Most of your basic tasks: sconfig

There is a tool in Server Core called sconfig. For those not noticing, it is a VBScript. What the *)#&^$&*^ is a VBScript doing in Server Core when Microsoft is pushing PowerShell? Actually, this VBScript predated PowerShell being in Server Core, and just stayed. What can you do with it? It's an older looking DOS command like menu that does the following (and more):

Change the computer name
Join the domain
Change IP v4 Settings
Change date and time
Set up Windows Update (and install updates)
Shutdown/Restart/Logoff the server

So, this tool can take care of a lot of the basics for you, even if there are plenty of tools that can help, like GPO, NTP, and the like.

Tip #6: There's always command line

So, when you can't do something via the GUI or remotely in Server Manager, there is always command line. There are plenty of articles how to run netsh.exe to do firewall rules and set IP addresses. For that basic stuff, I would use sconfig to configure it. If you have admins that just log into systems for the sake of rebooting them, you should look for another way around this. Below is a table with some common tasks and ways to get around with the command line. This table isn't exhaustive, but shows you that there are command line ways to do a lot of things. Of course, you may want to season these commands more to your liking with other parameters...

Substitute Commands
Instead of this...	Use this...
Log off the workstation	shutdown -l
Restart the workstation	shutdown -r -f -t 0 This can also be done remotely by adding -m \\(computername)
Analyze/Dump the System or Application Log	PowerShell: Get-EventLog -LogFile System \| Out-File (filename) Get-EventLog -LogFile Application \| Out-File (filename)
Check for Windows Updates	wuauclt.exe /detectnow
Install Windows Updates	wuauclt /updatenow
Get System Info	systeminfo.exe (although msinfo32.exe still works)
Manual Install of a driver (not needed if your hardware is plug and play)	pnputil.exe -i -a (path to INF)

Tip #7: Some stuff does work

Now, this is an area to tread lightly in, because your results may vary here in what may work and what doesn't. Some things I've noted that work, and this is not an exhaustive list, but some things to keep in mind:

Notepad
The SysInternals tools (the ones I use)
CMTrace
Some installers (get good with your command lines)
Very limited control panel applets
Anything that does not make calls to libraries or DLLs that are not included in Server Core. This may not be saying a lot, but if you see it works on Windows Server and not on Core, you may want to get a supportability statement from the vendor on it.

Tip #8: Remote Tools

We used to call this "single seat administration" back in the day, but the tools for a lot of the things needed on core can be loaded on a workstation. Think of things, but not limited to:

AD Users and Computers
Group Policy Management
WSUS Console
SQL Management Studio
MDT's Deployment Workbench
...and plenty more...

The important thing to note is that the server will be under less pressure without the GUI (or local logon) and everything can be managed from an administrative workstation or jump server.

Tip #9: Some "oldie but goodie" techniques still work

Some tools like RDP is still available in Server Core, but it is nothing more than a command prompt. You still have access to things like Scheduled Tasks and SMB copies. You are not out in the dark. There seems to be a big knowledge gap in managing Server Core, and for those who remember the command line (seems to be a distant memory), this isn't a bad thing. For those who have only known the mouse and keyboard, time to catch up a bit. But at the end of the day, this really isn't as hard as it looks. It just takes some time and patience, you'll get there... — Easy link to my blog: http://aka.ms/leesteve — If you like my blogs, please share it on social media and/or leave a comment.

PS without BS: Finding the SQL Cert and trusting it to a remote system

leecstevens — Mon, 23 Apr 2018 10:23:02 GMT

This was an interesting case, and surprisingly didn't really find anything on how to do this out there. But, the problem statement was simple. When trying to connect to SQL (this was PowerBI, but was the same for SSMS), this error showed up: A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 0 - The certificate chain was issued by an authority that is not trusted.) Now, I remember this situation coming up from SCCM (or something very similar), when you were using Report Builder on a remote system from the SQL Server. The answer was to export the SQL cert, and install it on the remote Report Builder system. So, here is the script, but standard disclaimer applies: Using it does acknowledge all risk is on you, and I'm just sharing what worked for me. Your results may vary, so prior to taking the "cut and run" approach to the script, make sure you read below about the how's and why's. Keep in mind we are not creating a cert here, just leveraging the existing one. [code language="PowerShell"] $SQLVersionAndInstance = "MSSQL14.MSSQLServer" $RegKey = "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$SQLVersionAndInstance\MSSQLServer\SuperSocketNetLib" $Thumbprint = (Get-ItemProperty -Path $RegKey -Name Certificate).Certificate $Certificate=Get-ChildItem -Path Cert:\LocalMachine -Recurse | ? {$_.Thumbprint -eq $Thumbprint} Export-Certificate -Cert $Certificate.PSPath -FilePath c:\temp\sqlcert.cer [/code] Let's dissect this a bit: The $SQLVersionAndInstance denotes the version of SQL you are running (i.e. MSSQL13 = 2016, MSSQL14 = 2017) and the instance (the default is MSSQLServer). So, if you were running SQL 2016 on named instance "MyInstance", the variable will be MSSQL13.MyInstance. The registry key the SQL certificate is listed in will be in registry key in my default example (note the MSSQL14.MSSQLServer for SQL 2017 and default instance) will be HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL14.MSSQLServer\MSSQLServer\SuperSocketNetLib in a string called "Certificate". You will see the cert thumbprint there. Wait: What if this key has nothing in it? I wrote a followup: When SQL has no certificate... We take this value and verify it is in the local computer certificate store (obviously if the thumbprints don't match, this won't work). This cert should be in the Personal store for the Computer certs. Last, but not least, I then take this cert and export it to a file (CER export). I then take this file and import it into Trusted Root Certification Authorities on the system throwing the error. That should be it, simple, easy, and now you're back on your way. — Easy link to my blog: http://aka.ms/leesteve — If you like my blogs, please share it on social media and/or leave a comment.

Upgrading SQL Server on Windows Server Core

leecstevens — Mon, 16 Apr 2018 09:18:22 GMT

This, thankfully is a quick and easy blog discussing the how's of an upgrade to SQL Server 2017 from SQL Server 2016 on Server Core. After looking around, seeing product docs with about 2 million pages of info on it, where was the simple upgrade approach? So, my environment is very simple:

One SQL Server on Server Core
Default Instance

So, not much to see here. How I did it Of course, insure that you have the media copied to the hard drive or the DVD mounted. In my case, this was the command line I used: setup.exe /Q /IACCEPTSQLSERVERLICENSETERMS /Action=Upgrade /InstanceName=MSSQLServer Some things to note:

The IACCEPTSQLSERVERLICENSETERMS is required when using a /Q switch.
As it is a default instance, MSSQLServer is the name of the instance.
Since this upgrade is done entirely in the dark, the SQLSetup.log is located in your user temp directory. You can use this file to monitor progress.

When this is complete, you may see the following: One of more affected filed have operations pending. You should restart your computer to complete this process. So, give it what it wants and restart. When you go back into SQL Server Management Studio (make sure to have the latest, or at least a version that works with the version of SQL you installed), you should see the new SQL version once logging into the server. You can also execute the statement Select @@Version in SSMS to see the version of SQL installed. — Easy link to my blog: http://aka.ms/leesteve — If you like my blogs, please share it on social media and/or leave a comment.

Upgrading MDT on Server Core

leecstevens — Mon, 16 Apr 2018 08:17:29 GMT

So, in my previous blog on PS without BS: Building MDT and WSUS on Server Core, I outlined how to install MDT on Server Core, along with some other components. So, it's upgrade time, and 8443 has turned into 8450. Now how do we update? We do this on both the server itself, and also on the tools box that you use to connect to MDT. Step 1: The server Hopefully you are running this install virtually and you can simply roll back on error, so please create your snapshot now. To update the server, simply download and copy the file to the server. From the command line, run this command: msiexec.exe /i MicrosoftDeploymentToolkit_x64.msi /q ...of course as is standard with MSI, you can add /l for logging and all that if you desire. Now, time to move to the tools box. Step 2: The tools box So, here, you'll need to install the same MicrosoftDeploymentToolkit_x64.msi from before. You can do this via command line or from Windows Explorer. Now, once you open up Deployment Workbench, you will see text similar to the following: Unable to reopen the deployment share at \\server\sharename. The deployment share at \\server\sharename cannot be opened because it needs to be upgraded. The version of the deployment share is 6.3.8443.1000 while the required version is 6.3.8450.1000. Of course, as versions of MDT change, subsititute versions accordingly. I don't expect this message to ever change in the future. Step 3: Upgrade the deployment share To upgrade the deployment share, follow these steps:

Open Deployment Workbench
Right click the deployment share
Click Upgrade Deployment Share
Click Next once you have read through the details
MDT will then do its business of upgrading the share, let it finish
Once completed, click Finish

You should now be able to open up the deployment share and be back to business as usual with a new version of MDT.

Windows 10 and File Recovery

leecstevens — Tue, 27 Mar 2018 09:53:07 GMT

There were a lot of features in Windows 10 that were "different" to previous versions, and some changes were cosmetic, some were more useful. Among one of the most useful features I found was something called "File History" in Windows 10. For the record, File History isn't exactly a new feature, it was in Windows 8.1. Since many enterprises skipped this (like Vista), most people didn't know the feature existed then, like many features brought to us in Windows 7 and later were introduced in Vista. File History actually goes back a lot further than that, if anyone remembers Server 2003 had a feature called "Previous Versions", in which users on network shares could save a subset of the files they modified (thanks to the new creation at the time known as Volume Shadow Copy Service). It also required a client on the workstation. A moment of silence for the history. Done. Going back to my previous blog on Word Troubleshooting, having good backups will keep the need for having to try extracting data out of Word files away. Believe me, it's a painful process. File History is a great way to keep a running backup of your documents in a safe place on your local system. It's great for those "I can't believe I did that" moments where a document was changed and you can't remember what you did or you liked "yesterday's copy" better. This isn't quite the same as "Undo", as the snapshot has to occur for File History to work. Another thing I find file history great for is my scripting and coding work. It almost keeps version control of files for me, and if I write something that I need to revert back to, I can simply restore the old version back in place. The Hardware and Software

Surface Pro
MicroSD card for backups
Bitlocker

Yes, really it is that simple. Now, it is best practice to use an external drive for backups, although as of the time of this writing, Windows 10 1709 still supports backing up to network drives. Note that there are little hacks out there where you can create a share on your local system and back up to that, if you have a single drive. I believe this still works, but not really fond of this idea. I also understand that can be a pain having a bulky USB drive hanging out of your laptop (it could crunch if you accidentally leave it in when you throw your laptop in a bag in a hurry). It also can be problematic if you have something like the Surface Pro that only offers one USB port. So, if you have a MicroSD slot (or something similar), this is a great use for it. For safety, I recommend Bitlocker on both your system and the external disk, and auto-unlock on boot. This will insure that no matter what, your data will be protected if it's stolen. Of course, you won't have a backup, but they won't have your data either. Windows will warn you when you are setting up File History if your drive is not encrypted as well. What does it do? By default, File History will take copies of files (by default) in your well known folders, such as documents, pictures, etc. Now, what about a OneDrive account, or Google Drive or some other folder you want to back up, say C:\Temp? This can be added manually later. The default settings seem extreme, but not so bad. Keep in mind it is only keeping copies of changed files, not a full backup every time. By default, File History will take versions of changed files every hour and keep those backups until the end of time. This, of course is configurable. You can take backups as little as every 10 minutes up to once a day. Usually an hour is good for most people, but you can cut it by a half hour or so if you need to. It will also keep files forever, but you may want to change that to something more reasonable for you, maybe after a year, old copies may not matter. You can keep files as little as 1 month up to 2 years if you configure a time limit. If you prefer to not run out of space, you can just delete old copies of files when you need space. How do you get into it? Open the Settings app in Windows 10. From there, open Update & Security and then click Backup. This is where you may be asked to set up a drive for File History if you wish to enable it. — Easy link to my blog: http://aka.ms/leesteve — If you like my blogs, please share it on social media and/or leave a comment.

Lee's Word Troubleshooting Guide

leecstevens — Tue, 27 Mar 2018 07:57:18 GMT

This is part of a series of my notes and troubleshooting guides referring to Microsoft Office. They are all listed here: Lee's Excel Troubleshooting Guide Lee's Outlook Troubleshooting Guide Lee's Word Troubleshooting Guide For those looking to recover data from corrupted files, I'll spoil it, it's below. :) Also, here's a link to another blog on Windows 10 and File Recovery. But, let me get to some other things first: The standard disclaimer This information is provided “as-is” and is not considered step-by-step troubleshooting. Not all of the steps in this article are going to concatenate into a single solution. Please exercise caution as some things in here can have adverse effects, and by following these steps, you are assuming that risk. Also keep in mind that in a corporate environment, you may not be able to perform some of these steps, either by policy or lack of system permissions. Now, on to some things you can try in your troubleshooting... Step: Empty the User’s temp folder I have often found that the user’s temp folder will cause a lot of crashes to simply not re-occur. You do not need admin rights for this, as this is a user folder. The %windir%\temp folder requires administrator access and is not relevant to this troubleshoot. To do this, close all running apps, open File Explorer, navigate to %temp% and delete everything. You may not be able to delete some files in use (like live logs). Step: Look at security software Now, I know the usual suspect is antivirus, antimalware, and the like. And, it’s easy to blame things that their sole purpose is to keep things from loading. Not so fast – there were some instances where this was the case. In one case, I found Microsoft’s EMET loaded on a Windows 10 system, which actually shouldn’t be there. Portions of EMET were baked into later versions of Windows 10, so there was no need to have it installed. Before tearing out anything that looks like security software, investigate any logs and see if you can find obvious signs of something being denied access or was blocked. This would be great justification to test without it. Some modern antivirus/security software does have pretty comprehensive logging, be it to text or one of their internal mechanisms. If you choose to go this route, keep in mind the words “I disabled antivirus” aren’t definitive words. The only way to truly test without antivirus is to uninstall it. Why? Antivirus typically carries with it not one, but two calls to Windows. The first call is the filter driver that says “should I scan this file”, and even in a disabled state, you can expect this process to trigger. The second is the actual scan driver which checks the file in question for anything suspicious. Step: Change Printers / Update Printer Drivers What is old is new again, and this is huge in Word and has been problematic since the Windows 3.x days (yes, I went there). For those who remember back to the early 90’s and Office 4.x, print drivers could be a problematic thing – why? Simple rendering of a document on screen (print preview) can cause issues with Word because it uses (you guessed it) the print driver to render. The best way to avoid this is choose another printer, and even better is one of the default printers like “Microsoft Print to PDF”. Thankfully, print drivers have become more generic and universal in nature, like when HP released their universal drivers to worldwide cheers years ago. Worst case, you may need a newer print driver or it’s an outside chance at a display driver. It’s always best to keep drivers updated as best you can, especially in an enterprise environment. Step: Attempt to do a quick repair of Microsoft Office A quick repair could solve some minor configuration issues. Below is a link with more information on how to do this. Keep in mind you will need administrator credentials to do this. See Repair an Office application. Step: Run Word in Safe Mode (Disable Add-Ins) Add-ins are also problematic at times. Instead of disabling one add-in at a time, try going into Safe Mode, which will disable them all at once. If this solves your problem, then insure you go into Word and start disabling add-ins one by one. Hopefully in your case, the issue you’re facing is an easy repro (like crashes within 10 seconds of startup). To load Safe Mode, either:

Load Word from the “Run” box with winword /safe
Hold down the Ctrl key while double clicking the Word icon.

Step: Log on as another user There are two ways a user profile can be affected. By policy settings (GPOs) set on Word, but also something that could be in the user profile.
If you are testing GPO settings, insure these things are true:

There are no computer policies applying Word settings. This would invalidate any user setting testing, as policies applied at the computer level cover all users. If you need to for testing, you can deny the computer account “Apply Group Policy” permissions temporarily on the policy with the Word settings.
The two user accounts you are testing do not have the same policies applied, more specifically ones that are specific to Word. Like the above point, you can deny one of the users “Apply Group Policy” permissions temporarily on the user settings that hold the Word settings.

Let’s not always blame GPOs, however. Something can be wrong in the user profile. Just to insure that it’s not the profile, log in as a different user.
Something to note: The beloved "RSOP" (rsop.msc) has been deprecated and shouldn't be used. You can get gpo info via gpresult /r (a personal favorite which just gives the basic info) or gpresult /h. Both of those methods are still supported. Remember to run this in an elevated session or you won't get system policy info.

Step: Delete the Office Keys from the Registry
If you feel that this could be settings related (and likely from a GPO), you can delete the Office portion of the registry. BE CAREFUL HERE as you may lose user settings in the process of fixing the problem (you’ve been warned).

For computer settings, navigate to HKLM\Software\Microsoft\Office.
For user settings, navigate to HKCU\Software\Microsoft\Office.

Note, if the problem applies to everyone on the system, it could be either Computer (or Computer GPO) or User (User GPO) related. Now, for what we've all been waiting for.

Getting into recovering data

Everyone hates and fears not being able to open documents, and I am just going to break your hearts now, this won't be pretty and if you like to format, this could be a difficult extraction. The good news is since Office 2007 that documents are stored in a different format known as OpenXML. As a result, all is not lost when it comes to a file that won't open. Now for my disclaimer: Always work with copies of files, so that if something does go wrong, the original file is unharmed. File You are likely reading this blog because you have a damaged file, accidentally found this on a web search, or just outright cyberstalking me. Regardless, by following these steps, your document recovery will likely not be pretty. The purpose of this blog is to help you recover data out of these files, and the data will be raw. I encourage you to try this, but again, it won't be pretty. Now to the details... Prelude: Common to Word, Excel, and PowerPoint All the files in these apps are actually the same format. What are you talking about? Try this: Rename your file extension (DOCX) to ZIP. Note this also applies to PPTX and XLSX files, but we are focused on Word troubleshooting, similar things may apply here in the archive. Once you open it, you will see that these files open as ZIP archives, simply because all these files save as ZIP archives. This may also be good to know in your backup strategy, as the old Word documents (like 2003 and earlier) weren't ZIP files and could compress like text files. Now, they don't compress much since they already are. Opening the file There won't be a lot of pretty information coming from this, especially if you like formatting. So let's look at the players. Once you open the ZIP file, you will see the following:

_rels
docProps
word
[Content_Types].xml

The most important information will be in the word folder. Most of this is pretty self explanatory: You have header, footer, footnotes, but most importantly, document.xml. Opening document.xml, you will see a lot of formatting in addition to your text, but the good news is the text is there. Here is a sampling of what this text looks like: w:rsidRPr="00835596">Step: Look at security softwareNow, I know the usual suspect is antivirus, antimalware, and the like. And, it’s easy to blame things that their sole purpose is to keep things from loading. Not so fast – there were some instances where this was the case. In one case, I found Microsoft’s EMET loaded on a Windows 10 system, which actually shouldn’t be there. Portions of EMET were baked into later versions of Windows 10, so there was no need to have it installed. So, you can copy and paste this text into a new document. When Word isn't available If you cannot use Word for some reason, there is some hope for you, there is a tool that has existed since Windows 3.x called Write. In Windows 10, Write can save directly to docx format, or you can save to good old fashioned Rich Text (rtf) format. To access Write, run the command directly by invoking write.exe directly. Typing write (without .exe) caused Word to load on my system. You can paste the text in there and manipulate it how you see fit. Moving on, the embedded images In my sample document, I also had 5 pictures in it. If you look into the media folder, the files will also be listed in there, you can extract those files and use them as you like in the rebuilt document. If you want to test with a clean copy of a file There is a way in Word that you can create just a document with bogus sample text. Simply open a new document and type this, followed by the enter key. =RAND(10) This will create 10 paragraphs of text. Of course, you can do as few or many as you like (keep it sane, I think there is a limit to the number of around 6,500). Save this file, rename it to ZIP, and open the document.xml from here. I hope you enjoyed this guide to Word and found some of the troubleshooting info to be useful. Document recovery can be a pain, but it's better than losing everything, making it a more valid reason why backups are such a great idea.

Active Directory and the impact on Schema Updates

leecstevens — Mon, 26 Mar 2018 15:25:45 GMT
There are some considerations in modifying the Active Directory schema. I am hoping this will be helpful to others that may have similar questions. Despite the short intro, let's get into the details: Main player: The Schema Master The Schema Master is one of the 5 FSMO roles in Active Directory. By default, the first domain controller in the domain is the Schema Master. This is a role that only one domain controller is allowed to hold this role and will accept changes to the schema. This is done to prevent conflicts. When you do make changes to the schema, the best practice is to be connected directly to the Schema Master itself, otherwise the domain controller will refer the request to the actual Schema Master role holder. Also, in the interest of security, use the Schema Admins group sparingly. Meaning: Add the admin who needs access to this change, run what you have to run, and revoke group membership. Do not leave anyone in this group unless there is a specific job to run. To find the Schema Master quickly, you can use this quick little PowerShell. Get-ADForest | Select-Object SchemaMaster. This certainly beats the old ntdsutil method. :) Replication of Active Directory When a Schema modification is made, all domain controllers will have this information replicated for consistency. While replication is occurring, you can expect to see an inconsistency in the domain controllers temporarily. This really is a good reason to make sure replication is healthy prior to making any schema change. How the domain controllers stay consistent is that replication occurs and is retried specifically from the originating server. If an object is missed (say it wasn't replicate yet on the originating server), a re-replication takes place which will insure that consistency. Schema changes are considered urgent in Active Directory, and changes to "Attribute-Schema" (located in the Schema partition) will block other replication until the schema changes are performed. Slow down, replication partner One thing that insures consistency in replication is single threading. Single threading may seem old and archaic, but the best practice is never to modify the Active Directory Schema by more than one process at a time. Example: Say you are extending the schema for Exchange while extending the schema for SCCM at the same time. It is very likely one of these installs will fail, because a thread for Exchange was trying to overlap a thread for SCCM to extend the schema. This is important, because a process that modifies the schema may not reinstall cleanly, especially if some of the objects have been created already.
Putting your minds at ease
I've used Active Directory since Windows 2000 Beta, which has been around for just over 20 years now. I got into it about 1998, and since then have yet to see a schema update when done by best practice ever cause Active Directory to collapse. Has it happened? I've just not seen or heard of it. There are plenty of safeguards built into the schema that helps with this. This isn't a directive to "go crazy" on updating the schema, or to be careless in your environment. I've seen schema updates not take for a variety of reasons and saw some who would stop replication while they updated the schema successfully. If it failed, they killed the domain controller, seized the role, and rebuilt the old domain controller. Always exercise good caution when making these changes. I hope this was a good and more simplified take on not just how the Active Directory Schema works, but also how it replicates. — Easy link to my blog: http://aka.ms/leesteve — If you like my blogs, please share it on social media and/or leave a comment.