Background:

I have a customer that has been using smart card authentication in conjunction with Desktop Validator for years with no issues until they upgraded their domain controllers to Server 2008. The problem was if they rebooted a domain controller they could never predict if smart card authentication was going to work. The results were sporadic at best. Their setup was as follows:

• Server 2008 64Bit
• Desktop Validator (DV) - version 4.10.0.344
• DV is validating against external OCSP Responders
• External CA

In the above configuration we were seeing where the KDC service was starting before DV thus causing the failures. The easiest way to determine this was by looking at the System log on the domain controller and looking for event id 29.

The Key Distribution Center (KDC) cannot find a suitable certificate to use for smart card logons, or the KDC certificate could not be verified. Smart card logon may not function correctly if this problem is not resolved. To correct this problem, either verify the existing KDC certificate using certutil.exe or enroll for a new KDC certificate.

We could also verify that it didn't work by looking in the DV logs and locating the most recent event id of 1.

System Message: Tumbleweed Desktop Validator Service was started.

Once this was located we could look at the following events and see that lsass never made a call to DV to validate any certificates. In order for smart card authentication to work lsass (KDC) must know that it has a valid certificate that can be used for smart card logons.

Resolution:

To make a long story short we were able to get this fixed by forcing DV to start before the KDC. We did this by adding the following registry key to the DV service.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tumbleweed Desktop Validator

Create a new REG_SZ:  Group

Data Value:  NetBiosGroup

Suggested Reading:

If you are interested in learning more about smart card authentication, KDC and how to control device driver load order please see the following links.

Smart Card Authentication

KDC

How to control device driver load order

Until next time....

Hi all. Today I would like to bring to your attention an issue we have been seeing lately that very well may effect those of you in a corporate environment. McAfee has recently released information about this issue on their web site.

The issue is that one or multiple servers may become unresponsive or start failing in any of their installed roles. Some of the possible symptoms are:

• · Slow file access
• · Slow read/writes from an application
• · Server unresponsive/hangs
• · Slow SQL Server performance
• · IIS Hangs
• · Inability to connect remotely via RDP

There are 2 new features that may interest you.

1. Dynamic Memory - will allow customers to adjust memory of a guest virtual machine on demand to maximize server hardware use.

2. RemoteFX - will enable users of virtual desktops and applications to receive a rich 3-D, multimedia experience while accessing information remotely.

To read more about Dynamic Memory and RemoteFX you can visit the Virtualization blog here. 

On a side note Windows XP Mode no longer requires hardware virtualization technology. This change simplifies the experience by making virtualization more accessible to many more PCs for small and midsize businesses wanting to migrate to Windows 7 Professional or higher editions, while still running Windows XP-based productivity applications.

You can read the full press release here.  

Introducing Windows Server 2008 R2 and Deploying Windows 7 Essential Guidance from the Windows 7 Resource Kit and TechNet Magazine

Windows Server 2008 R2 e-book here

Windows 7 e-book here

I was recently working an issue where system state backups were failing when using wbadmin. I was getting error code 2155348129.

After doing some troubleshooting I discovered that the HP Smart Update Manager service had the incorrect image path. The incorrect path was c:/windows\hpsum_1256670671\hpsumserverw32.exe. Notice the "/" after C:.

In order to correct this you need to either contact the vendor or navigate to the following registry key and correct the "/" with a "\".
HKLM\System\CurrentControlSet\Services\hpsumserverw32\ImagePath

Value  Data: c:\windows\hpsum_1256670671\hpsumserverw32.exe

That is all for today.

These spreadsheets list the configuration settings for users and computers that can be set within Group Policy.

Click here to be taken to the download site.

Enjoy!

Enjoy!

First, did you know that Storage Server 2008 has a default password when you install it? Well, I wasn't aware of this until I recently installed this to do some testing. I would imagine there are a lot of people who are not aware of this since in every other version of Windows Server that I have installed you either get to set the password or it makes you change it the first time you login.

The default password is: wSS2008!

I highly recommend you changing this password once your install has finished.

The second thing I wanted to touch on was that you can now download Microsoft iSCSI Software Target 3.2 for Storage Server 2008 via MSDN or Technet. As the name implies this gives you the ability to make your server an iSCSI target without having to purchase 3rd party software. This is very useful when you need a shared storage solution for clustering in Windows Server.

Th iSCSI Software Target is available in x86 and x64.  

Well that is it for today. Until next time...

LDIFDE is a command line utility that is used to import or export information from Active Directory.

Warning: Before attempting this please make sure you have a valid backup.

When exporting users from Active Directory it is recommended to know what attributes are needed. By having this information ahead of time you will ensure you only have the data that is needed.

Non-importable Attributes

When you are exporting users there are certain attributes that should be omitted if the ldif file will be used as an import file into another Active Directory environment. Those attributes are as follows: badPasswordTime, badPwdCount, lastLogoff, lastLogon, logonCount, memberOf, objectGUID,objectSid, primaryGroupID, pwdLastSet, and sAMAccountType

Switches

The following switches will be used to perform the export: -f, -s, -d, -p, -r, and –o

Explanations of the switches are explained below.

-f  -  this is the file that you are exporting to

-s  -   This specifies what server you want to run the command against. This is not a required switch since ldifde can select a DC at random. It is recommended that it be used.

-d  -  Specifies the RootDN – defaults to Naming Context

-p – This is the search scope that ldifde will perform (options are base/one level and subtree)

-r  -  Specifies the filter that will be used. In our command we are filtering on the User class

-o  -  This switch tells ldifde what attributes to omit

Commands

The following command will export the user accounts and all attributes that have a value with the exception of the attributes mentioned above.

Example:

ldifde -f Exportuser.ldf -s <Domain Controller Name Here> -d "dc=YourDomain,dc=Com" -p subtree -r "(&(objectCategory=person)(objectClass=User)(givenname=*))" -o "badPasswordTime,badPwdCount,lastLogoff,lastLogon,logonCount, memberOf,objectGUID,objectSid,primaryGroupID,pwdLastSet,sAMAccountType"

In the next example I will show you how to export only a few of the available attributes.  

Example 2:

ldifde -f Exportuser.ldf -s <Domain Controller Name Here> -d "dc=YourDomain,dc=Com" -p subtree -r "(&(objectCategory=person)(objectClass=User)(givenname=*))" -l "cn,givenName,userPrincipalName,objectclass,samAccountName"

Once you have determined what you need exported and executed your command your output should look similar to the following (depending on what you are exporting). The following only displays the output of 1 user. 

Output:

dn: CN=John Doe,CN=Users,DC=YourDomain,DC=Com

changetype: add

objectClass: top

objectClass: person

objectClass: organizationalPerson

objectClass: user

cn: John Doe

sn: Doe

givenName: John

distinguishedName: CN=John Doe,CN=Users,DC= YourDomain,DC=Com

instanceType: 4

whenCreated: 20090122031550.0Z

whenChanged: 20090122031551.0Z

displayName: John Doe

uSNCreated: 73758

uSNChanged: 73763

name: Your Name

userAccountControl: 512

codePage: 0

countryCode: 0

accountExpires: 9223372036854775807

sAMAccountName: jdoe

userPrincipalName: jdoe@YourDomain.com

objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=YourDomain,DC=Com

mail: John Doe@YourDomain.com

Note: If you plan to import your users into Active Directory you are required to have the following attribues: objectclass and samAccountName

References:

https://support.microsoft.com/kb/555636

https://technet.microsoft.com/en-us/library/cc731033.aspx

https://support.microsoft.com/default.aspx/kb/555638

When digitally signing software for Vista you should meet the following requirements:

1. A valid code signing certificate from a CA that is trusted within your environment - Please click here to read how to setup an Enterprise CA
2. The certificate must be installed on the workstation/server that you are performing the following steps
3. Windows SDK - The SDK can be downloaded HERE

Once you have met the above requirements you can proceed to the following steps.

1. Click on Start, All Programs, Microsoft Windows SDK and click CMD Shell
2. At the cmd prompt type "cd bin"
3. Type "signtool.exe signwizard" - Click next on the following Welcome screen

4. Select the file that you want to digitally sign and click Next

5. To keep this simple we will select Typical and click Next

6. The following 2 screens are asking for the certificate you would like to use to sign the software. Click on Select from Store and highlight your certificate and click Ok.

7. The following screen is requesting optional information on the data you are signing. You can opt to fill it in or not fill it in and click Next.

8. When signing a software/driver package, you should always use the option to timestamp the signature. This timestamp specifies when the signature was created. If a certificate expires or is revoked for security reasons, then only signatures created before the expiration or revocation are valid. If a timestamp is not included in the signature, then Windows cannot determine if the package was signed before or after the expiration or revocation, and will reject the signature. You can use the following timestamp service Url: https://timestamp.verisign.com/scripts/timestamp.dll

To add the timestamp url, check the box "Add a Timestamp to the data" and put in a valid url and click Next.

9. At this point you have almost finished digitally signing your software. Click Finish.

10. After clicking Finish a dialog box will appear requesting access to a protected item. Click Ok.

11. Now you have completed digitally signing software for Vista. Click Ok.

Note: If you would like to verify your signature you can right click on the file that was just signed and go to properties. Within the properties tab you will now have a Digital Signatures tab. You can click that tab and see your digital signature.

That concludes how to digitally sign software for Vista.