https://docs.microsoft.com/archive/blogs/sbs/feed.xml The official blog for Windows Server Essentials and Small Business Server support and product group communications. Wed, 14 Mar 2018 12:39:24 GMT en-US hourly 1 https://docs.microsoft.com/archive/blogs/sbs/office-365-integration-fails-with-cannot-connect-to-microsoft-online-services-in-windows-server-2012-r2-essentials Wed, 14 Mar 2018 12:39:24 GMT https://blogs.technet.microsoft.com/sbs/?p=7125 In the C:\ProgramData\Microsoft\Windows Server\Logs\SharedServiceHost-EmailProviderServiceConfig.log, we may find the following exception: BecWebServiceAdapter: Connect to BECWS failed due to known exception : System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at https://bws902-relay.microsoftonline.com/ProvisioningWebservice.svc?Redir=1098557810&Time=636356539931802459 that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 157.56.55.77:443 We can see the provisioning endpoint that the wizard is trying to reach, by running the command: ipconfig /displaydns However, when we attempt to browse that URL (provisioning web service) in a browser, it may fail with the following exception: Additionally, when we attempt to do a telnet test to this remote server through the port 443, it fails: The issue occurs due to a web exception when the Bec Web Service API tries to reach out to the remote endpoint for provisioning purpose. The address is written to the following registry key on the server: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Server\Productivity\O365Integration\Settings\ Name: BecEndpointAddress Type: String value Resolution: To resolve the issue, follow these steps:

1. Launch the registry editor console and take a backup of the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Server\Productivity\O365Integration

2. Click HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Server\Productivity\O365Integration\Settings, on the right pane delete the BecEndPointAddress key and click Yes

3. Exit the registry editor console and proceed to run the Integrate with Microsoft Office 365 wizard

 ]]> https://docs.microsoft.com/archive/blogs/sbs/how-to-configure-asr-in-windows-server-essentials-2016 Wed, 13 Sep 2017 18:54:11 GMT https://blogs.technet.microsoft.com/sbs/?p=7006

Azure Virtual Network:  https://azure.microsoft.com/en-us/services/virtual-network/

Azure Site Recovery: https://azure.microsoft.com/en-us/services/site-recovery/

Using Windows Server Essentials wizards and setting up the hardware in a working configuration can be challenging and there are a few steps and prerequisites to consider before deploying the server. Two of our bright stars in the Windows Server Essentials community are Daniel Santos and Alex Fields. Alex is from Minneapolis and he wrote a new series of blogs (leveraging Daniels's great analysis work) to help folks navigate through the configuration of the hardware and the Windows Server Essentials operating system to enable this disaster recovery solution. Check out Alex's blog series on itpromentor.com for a detailed rundown of the configuration steps: Part 1: Pre-requisites      https://www.itpromentor.com/asr-wse-part-1/ Part 2: Configuring          https://www.itpromentor.com/asr-wse-part-2/ Part 3: Failover and failback    https://www.itpromentor.com/asr-wse-part-3/    Here is what the topology looks like:   Cheers and good luck! Scott M. Johnson Senior Program Manager Windows Server Essentials @SuperSquatchy          ]]> https://docs.microsoft.com/archive/blogs/sbs/windows-home-server-2011-end-of-mainstream-support Mon, 03 Jul 2017 20:11:43 GMT https://blogs.technet.microsoft.com/sbs/?p=6985 here. What does this mean for you? This means that Microsoft will no longer issue security updates for the Home Server-specific components that make up Windows Home Server 2011. If you are still running Windows Home Server 2008 or Windows Home Server 2011, Microsoft recommends bringing in a new device running Windows Server Standard or Windows Server Essentials and migrating your roles, features and data to the new appliance. Today’s new hardware is significantly faster and cheaper and can better handle the latest Windows security infrastructure, roles and features. Customers moving to a modern operating system will benefit from dramatically enhanced security, broad device support, higher user productivity, and a lower total cost of ownership through improved management capabilities. Why migrate from Windows Home Server to Windows Server Essentials? The latest versions of Windows Server Essentials support improvements in security, scalability, and manageability, and it contains device driver support for new hardware and silicon. • Simplified setup. There is no easier way to set up a server than using the Windows Server Essentials Out-of-Box experience. Windows Server Essentials configures AD, certificate services, and DNS. It helps get a public domain name set up, and it generates and installs SSL certificates and everything you need to get started with your own hybrid cloud setup. • Data redundancy and single pool of storage. Windows Server Essentials includes a feature called Storage Spaces that provides data redundancy and storage pooling functionality like that provided by Drive Extender in WHS. Windows Server Essentials has a much more reliable and resilient storage subsystem. • Centralized PC backup and restore. Windows Server Essentials includes the next generation version of the centralized PC backup and restore functionality from Windows Home Server 2011 as well as centralized File History storage for all your PCs. Windows Server Essentials supports up to 75 PC backups vs. Windows Home Server’s 25 PC backup limitation. Windows Server Essentials 2016 also supports backing up volumes to Azure and backing up VMs to Azure Site Recovery (ASR). • Centralized PC and server health monitoring. Windows Server Essentials includes health monitoring, both for the server itself as well as for all the connected PCs. • Document and media sharing. Windows Server Essentials can share content using SMB, iSCSI or NFS. Windows Server Essentials 2016 no longer includes the media streaming codecs, however, we found that people were not actually using that feature and they prefer to decode in the respective media applications. • Remote access. Windows Server Essentials has the remote access gateway feature that automatically generates SSL certificates for your server from GoDaddy. Essentials includes a web-based client for accessing home documents and media, and you can also remote desktop into the server if needed for administration purposes. The Home Server line of products had a very enthusiastic fan following -- it introduced the concept of a server in the house to the world and books appeared to make sense of it all. Microsoft learned quite a bit helping and supporting hundreds of thousands of home users and small businesses to deploy Windows Server. If you are looking to upgrade your old Windows Home Server, now is a great opportunity to look at the new devices available and move to a modern platform. For more information about Windows Server Essentials see the documentation site and it can be purchased at the Microsoft store. Cheers, Scott M. Johnson Senior Program Manager Windows Server Essentials ]]> https://docs.microsoft.com/archive/blogs/sbs/windows-server-essentials-2016-update-two-on-remote-web-access Mon, 26 Jun 2017 17:11:08 GMT https://blogs.technet.microsoft.com/sbs/?p=6955 update for the remote web access feature went live in May and so the workaround suggested in this previous blog can be undone. Users will now be able to get to http://servername/remote or https://servername.remotewebaccess.com/remote without errors, regardless of how long the server has been online. Thanks, Scott Johnson    ]]> https://docs.microsoft.com/archive/blogs/sbs/information-about-sbs-2008-product-support-lifecycle Wed, 03 May 2017 05:05:14 GMT https://blogs.technet.microsoft.com/sbs/?p=6935 For more details please browse to http://support.microsoft.com/lifecycle/search/ and search for individual products. End of support refers to the date when Microsoft no longer provides automatic fixes, updates, or online technical assistance. This is the time to make sure you have the latest available update or service pack installed. Without Microsoft support, you will no longer receive security updates that can help protect your PC from harmful viruses, spyware, and other malicious software that can steal your personal information. Microsoft is committed to provide support to customers facing issues when migrating to supported versions. ]]> https://docs.microsoft.com/archive/blogs/sbs/windows-server-essentials-2016-update-on-remote-web-access Mon, 17 Apr 2017 19:21:25 GMT https://blogs.technet.microsoft.com/sbs/?p=6905 https://servername/remote web site will indicate that it is not accessible and will redirect users to their Administrator with the following message: "Cannot connect to Remote Web Access. Please contact the person who manages the server. " There is a temporary workaround discussed on the windows server forum here, and it is a safe workaround to use until the fix is available. The issue is caused by WCF connections not being cleaned up by the Essentials provider framework and they are no longer removed by the CLR in Windows Server 2016. To verify this, you can check the amount of WCF connections by running the following PowerShell command in an elevated console: netstat -a | select-string ':65532' | measure-object -line There should be 100-300 connections typically. The fix has been tested and checked in and it will be available in the May update package for Windows Server 2016. When the kb article is published and the fix is available, I will post about it here. Thanks, Scott Johnson Windows Server Essentials]]> https://docs.microsoft.com/archive/blogs/sbs/windows-server-2016-essentials-is-now-ga Tue, 25 Oct 2016 00:45:12 GMT https://blogs.technet.microsoft.com/sbs/?p=6886 Windows Server 2016 Essentials has reached the GA (General Availability) milestone as a part of Windows Server 2016 launch. The product is now available in all channels.  For more details, visit the following links:  https://blogs.technet.microsoft.com/hybridcloud/2016/09/26/announcing-the-launch-of-windows-server-2016/ https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2016-essentials  ]]> https://docs.microsoft.com/archive/blogs/sbs/fix-for-office-365-integration-issue-with-windows-server-2012-r2-essentials-has-been-released Tue, 25 Oct 2016 00:39:48 GMT https://blogs.technet.microsoft.com/sbs/?p=6865 There was a known issue about Microsoft Office 365 Integration failure on Windows Server 2012 R2 Essentials due to exceeding the maximum message size quota for incoming messages while retrieving the subscription information. We are pleased to inform that the fix for this issue has been included with latest monthly quality rollup for Windows Server 2012 R2: https://support.microsoft.com/en-us/kb/3192404 Detailed information about the issue is mentioned below: Microsoft Office 365 may fail to integrate with Windows Server 2012 R2 Essentials with the following exception: The file SharedServiceHost-EmailProviderServiceConfig.log located at the C:\ProgramData\Microsoft\Windows Server\Logs folder may show the following exception:  The issue occurs due to a scalability issue conflicting with default output buffer size used for subscriptions. This causes a failure during the retrieval of any O365 subscription and breaks the O365 integration feature. Resolution: The fix for this issue has been included with the monthly quality rollup for Windows Server 2012 R2. Install the following rollup on the server: https://support.microsoft.com/en-us/kb/3192404 Note: This is an optional update and will be promoted to a mandatory one in the next update cycle.]]> https://docs.microsoft.com/archive/blogs/sbs/updated-inbox-component-in-windows-server-2012-r2-essentials-for-client-connector Sun, 24 Jul 2016 21:37:17 GMT https://blogs.technet.microsoft.com/sbs/?p=6855 [This post comes to us courtesy of Schumann GE from Product Group and Sandeep Biswas from Global Business Support] We are happy to announce that the fix for client side issues due to Windows 10 feature upgrade that was discussed in the following SBS Blog has been released: https://blogs.technet.microsoft.com/sbs/2016/01/22/windows-10-feature-upgrade-breaks-client-connector-for-window-server-2012-r2-essentials-windows-server-2012-essentials-and-windows-small-business-server-2011-essentials/ The inbox fix for Windows Server 2012 R2 has been included with the following update rollup: https://support.microsoft.com/en-in/kb/3172614 Note: This is an optional update and will be promoted to a mandatory one in the next update cycle.]]> https://docs.microsoft.com/archive/blogs/sbs/windows-sbs-2011-windows-sbs-2008-and-impact-of-ms16-072 Wed, 20 Jul 2016 20:33:25 GMT https://blogs.technet.microsoft.com/sbs/?p=6765 [This post comes to us courtesy of Susan Bradley, Wayne Small and Schumann GE (from Product Group)] On June 14, 2016 Microsoft released MS16-072  KB3159398 to fix a vulnerability in Group Policy whereby an attacker can allow elevation of privilege if an attacker launches a man-in-the-middle (MiTM) attack against the traffic passing between a domain controller and the target machine on domain-joined Windows computers.  After MS16-072 is installed, user group policies are retrieved by using the computer’s security context. This by-design behavior change protects domain joined computers from a security vulnerability.  Any Group policy that performs Security filtering on a per user basis will need to be adjusted now work after MS16-072. For SBS 2008 and SBS 2011 in particular there are several group policies set up in the product for purposes of controlling the users’ desktop environment and Windows Software Update Services (WSUS) that are directly impacted by this change and will need adjustment in order to continue to work after the application of this patch. There will be no automated patch to fix this issue on the SBS 2011 platform, thus we recommend that you take the following action to ensure that the default group polices on the SBS 2008 and SBS 2011 server are adjusted as well as checking if any group policies you have placed on the systems are impacted. I would like to thank various blogs and resources that provided additional information that I am relying on in order to provide the information for the SBS community. If you’d like to review these additional resources, I’d recommend reviewing Jeremy Moskowitz’s blog, and Darren Mar-Elia’s blog .  Additional resources include the AskDS blog, and the  JH consulting blog.  I would recommend reviewing these additional resources if you manage different Server platforms as the commands and PowerShell scripts are slightly different for different versions of Windows Server. Prior to MS16-072, Group policy could be set up with security filtering uniquely for computer users.  Both the SBS 2008 and SBS 2011 systems as part of the SBSMonitoring service run a routine that every 20 minutes there is a service that synchronizes the SBS created (“stamped”) users with the Security Filtering on the “Windows SBS User Policy” so that the SBS can deploy specific settings to the users desktop environment.  If you merely add the Domain computers READ right to the security filtering section in group policy (or any other manual change to security filtering), 20 minutes later you will find this right removed.  So we must add this domain computer READ right in a specific way. I’d first recommend that you review your server(s) and workstations to confirm that the patch has been deployed. Secondly, you will need to review your group policies to asses if they are impacted.  An excellent PowerShell script you can use to check your systems is from the PoSHChap blog. To begin, log into your SBS  2011 server.  Find Windows PowerShell under Accessories/Windows PowerShell.  Right mouse click and click on Run as Administrator. Now copy and paste the following script to review what group polices are impacted: Copy below this line =============================================================================== #Load GPO module Import-Module GroupPolicy #Get all GPOs in current domain $GPOs = Get-GPO -All #Check we have GPOs if ($GPOs) { #Loop through GPOs foreach ($GPO in $GPOs) { #Nullify $AuthUser & $DomComp $AuthUser = $null $DomComp = $null #See if we have an Auth Users perm $AuthUser = Get-GPPermissions -Guid $GPO.Id -TargetName “Authenticated Users” -TargetType Group -ErrorAction SilentlyContinue #See if we have the ‘Domain Computers perm $DomComp = Get-GPPermissions -Guid $GPO.Id -TargetName “Domain Computers” -TargetType Group -ErrorAction SilentlyContinue #Alert if we don’t have an ‘Authenticated Users’ permission if (-not $AuthUser) { #Now check for ‘Domain Computers’ permission if (-not $DomComp) { Write-Host “WARNING: $($GPO.DisplayName) ($($GPO.Id)) does not have an ‘Authenticated Users’ permission or ‘Domain Computers’ permission – please investigate” -ForegroundColor Red }   #end of if (-not $DomComp) else { #COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT! Write-Host “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) does not have an ‘Authenticated Users’ permission but does have a ‘Domain Computers’ permission” -ForegroundColor Yellow }   #end of else (-not $DomComp) }   #end of if (-not $AuthUser) elseif (($AuthUser.Permission -ne “GpoApply”) -and ($AuthUser.Permission -ne “GpoRead”)) { #COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT! Write-Host “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) has an ‘Authenticated Users’ permission that isn’t ‘GpoApply’ or ‘GpoRead'” -ForegroundColor Yellow }   #end of elseif (($AuthUser.Permission -ne “GpoApply”) -or ($AuthUser.Permission -ne “GpoRead”)) else { #COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT! Write-Output “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) has an ‘Authenticated Users’ permission” }   #end of else (-not $AuthUser) }   #end of foreach ($GPO in $GPOs) }   #end of if ($GPOs) =============================================================================== Copy above this line Script courtesy of https://blogs.technet.microsoft.com/poshchap/2016/06/16/ms16-072-known-issue-use-powershell-to-check-gpos/ Either paste the script into your PowerShell window on the server or save it as a .ps1 script and run it.  You should see several red warnings that several of your group policies do not have the right permissions. In reading various scripts online – It turns out there are different PowerShell commands for GP Permissions in 2008/2008R2 vs later versions of Windows.  So be aware the solution provided in this blog post specifically works on 2008 and 2008 R2 and does not work on 2012 and 2012 R2.  Specially the difference is simple – for 2008 and 2008 R2, replace the Get-GPPermission and Set-GPPermission commands with Get-GPPermissions and Set-GPPermissions in the script and it will work fine. Secondly – given we have a large number of SBS sites still, I did some specific testing with it.  The results of the script means that the following policies are affected by this issue and MAY NOT APPLY if you don’t add the Authenticated Users OR Domain Computers as READ on the Delegation tab for that GPO.

• Windows SBS User Policy
• SharePoint PSConfig Notification Policy
• Update Services Server Computers Policy
• Update Services Client Computers Policy

Microsoft have indicated specific conditions for using either Authenticated Users OR Domain Computers with the READ permission.  I’ve done quite a bit of investigation and in conversation with Group Policy MVPs, have decided that I will implement this consistently using the Domain Computers group as this works for all scenarios. Now we need to adjust the permissions so that the group policies work after the installation of MS16-072, the patch of KB3159398. For SBS 2011 in the PowerShell window cut and paste the following script: Copy below this line =============================================================================== Import-Module GroupPolicy Get-GPO -All | Set-GPPermissions -TargetType Group -TargetName "Domain computers" -PermissionLevel GpoRead =============================================================================== Copy above this line The first line calls the Group policy module for PowerShell, the second line adds the Domain Computers READ right to the delegation tab so that the Security filtering set up by the server can continue to process. The script should scroll through the settings and adjust the group policies. The script has done what it needs to do.   If you’d like to visually see the impact, if you go to any Group policy object you will now see Domain Computers on the delegation tab with READ rights. On the Group policy object of Windows SBS User policy you should now see Domain Computers with a Read right to the Group policy object. Now run the testing script again to confirm that your group policy permissions have been adjusted. Once again copy and paste the following script in the PowerShell window or save it as a .ps1 script: Copy below this line =============================================================================== #Load GPO module Import-Module GroupPolicy #Get all GPOs in current domain $GPOs = Get-GPO -All #Check we have GPOs if ($GPOs) { #Loop through GPOs foreach ($GPO in $GPOs) { #Nullify $AuthUser & $DomComp $AuthUser = $null $DomComp = $null #See if we have an Auth Users perm $AuthUser = Get-GPPermissions -Guid $GPO.Id -TargetName “Authenticated Users” -TargetType Group -ErrorAction SilentlyContinue #See if we have the ‘Domain Computers perm $DomComp = Get-GPPermissions -Guid $GPO.Id -TargetName “Domain Computers” -TargetType Group -ErrorAction SilentlyContinue #Alert if we don’t have an ‘Authenticated Users’ permission if (-not $AuthUser) { #Now check for ‘Domain Computers’ permission if (-not $DomComp) { Write-Host “WARNING: $($GPO.DisplayName) ($($GPO.Id)) does not have an ‘Authenticated Users’ permission or ‘Domain Computers’ permission – please investigate” -ForegroundColor Red }   #end of if (-not $DomComp) else { #COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT! Write-Host “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) does not have an ‘Authenticated Users’ permission but does have a ‘Domain Computers’ permission” -ForegroundColor Yellow }   #end of else (-not $DomComp) }   #end of if (-not $AuthUser) elseif (($AuthUser.Permission -ne “GpoApply”) -and ($AuthUser.Permission -ne “GpoRead”)) { #COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT! Write-Host “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) has an ‘Authenticated Users’ permission that isn’t ‘GpoApply’ or ‘GpoRead'” -ForegroundColor Yellow }   #end of elseif (($AuthUser.Permission -ne “GpoApply”) -or ($AuthUser.Permission -ne “GpoRead”)) else { #COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT! Write-Output “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) has an ‘Authenticated Users’ permission” }   #end of else (-not $AuthUser) }   #end of foreach ($GPO in $GPOs) }   #end of if ($GPOs) =============================================================================== Copy above this line Script courtesy of https://blogs.technet.microsoft.com/poshchap/2016/06/16/ms16-072-known-issue-use-powershell-to-check-gpos/ Your resulting testing screen should not show any red warnings and instead be filled with white and yellow comments: Your SBS 2011 default group polices will now function as usual. If you’d like to make all future group polices you set up work by default with the new behavior, you can follow the advice in  the section entitled “Making the change permanent in Active Directory for future / newly born GPOs” in the Jeremy Moskowitz’s  blog. For SBS 2008, you’ll need to manually add the READ permission right to the delegation tab as shown: On the Group policy object of Windows SBS User policy you should now see ]]>