When you open Server Manager both Roles and Features display Error and you are unable to add any role or features. When you select the details link it displays error: HRESULT: 0x800F0818.

You also get the following error in the event log:  

 Log Name:      Microsoft-Windows-ServerManager/Operational
Source:        Microsoft-Windows-ServerManager
Date:          10/23/2011 11:35:43 AM
Event ID:      1601
Task Category: None
Level:         Error
Keywords:     
User:        

Computer:    

Description:
Could not discover the state of the system. An unexpected exception was found:
System.Runtime.InteropServices.COMException (0x800F0818):
Exception from HRESULT: 0x800F0818
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)

 Action:

1. Browse to c:\Windows\Logs\CBS\
2. Copy the CBS.log to c:\Temp
3. Search the file for errors: corruption or failed

Example:

2012-01-10 19:47:55, Info  CBS  Mark store corruption flag because there is a
mismatch between package identity package:
Package_for_KB2511455_RTM~31bf3856ad364e35~amd64~~6.1.1.0.
[HRESULT= 0x00000000 - S_OK] 2012-01-10 19:47:55, Info CBS Identity mismatch:
Specified Identity:Package_for_KB2511455_RTM~31bf3856ad364e35~amd64~~6.1.1.0,
actual package Identity:
Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385
[HRESULT = 0x800f0818 - CBS_E_IDENTITY_MISMATCH] 2012-01-10 19:47:55, Info
CBS  Failed to resolve package [HRESULT = 0x800f0818 - CBS_E_IDENTITY_MISMATCH]

4. The above highlighted text above indicates that there is an issue with KB2511455. Once you find the corrupt Package you want to look for the KB number. The key information from the log is the below error string.

package_for_KB2511455_rtm~31bf3856ad364e35~amd64~~6.1.1.0.

5. You may have more than 1 corrupt corrupt package. After you identify all the corrupt packages download each of the KB's.

6. Unpack the KB’s using the following command:

Expand -F:* UpdateKBXXXX.msu c:\Temp\KBXXXX_Unpackage

7. After you expand the file you will see UpdateKBXXXX.cab File. Expand it as well using the following command: “Right-click cmd click Run as administrator”

Expand -F:* UpdateKBXXXX.CAB c:\Temp\KBXXXX_Unpackage\CAB

8. You now need access to the c:\Windows\Servicing\Packages folder. In order to do this use the following commands:

takeown /F c:\Windows\Servicing\Packages /D y /R

9. Give your account full control of the folder: You can use windows explorer to give your account full control to the folder or use

cacls c:\Windows\Servicing\Packages /E /T /C /G "UserName":F

10. Rename the corrupt files both the .cat and .mum Example:

Current file name:

package_for_kb2511455_rtm~31bf3856ad364e35~amd64~~6.1.1.0.cat

package_for_kb2511455_rtm~31bf3856ad364e35~amd64~~6.1.1.0.mum

Rename file name:

_package_for_kb2511455_rtm~31bf3856ad364e35~amd64~~6.1.1.0.cat

_package_for_kb2511455_rtm~31bf3856ad364e35~amd64~~6.1.1.0.mum

11. Copy the unpackaged files from step 8 to c:\Windows\Servicing\Packages

Example:

You need both the .mum and .cat files

package_for_kb2511455_rtm~31bf3856ad364e35~amd64~~6.1.1.0.cat

package_for_kb2511455_rtm~31bf3856ad364e35~amd64~~6.1.1.0.mum

12. Server Manager should open as expected now.

I ran into an interesting replication issue that I was troubleshooting a few days ago and I thought it would be a good idea to post the issue with the fix action. I was running repadmin /showreps and I found that a domain controller was failing to replicate with a few replication partners.  

Issue:

During the beginning phase of troubleshooting I found that DC01 was failing to pull all but 2 partitions from DC02. Even more interesting DC01 was pulling 15 out of the 17 partitions successfully from DC02. When I ran repamin /showreps dc01 “I got the following error”

DsReplicaSync() failed with status 1127 (0x467):

While accessing the hard disk, a disk operation failed even after retries.

Here is the breakdown from the repamin /showreps output:

DC01 pulling from DC02 “intra-site partners” failing to replicate all but 2 partitions.

DC02 pulling from DC01 “intra-site partners” replicating all partitions.

DC01 pulling from DC03 “inter-site partners” failing to replicate all but 1 partitions.

DC03 pulling from DC01 “inter-site partners” replicating all partitions.

Because I was getting the hard disk error I did check the hard drives and the array for issues of a possible hard drive failure on DC01. Unfortunately there was no indication of a hard drive failure in the Dell OpenManage console.

I checked the event log on DC01 and I found the following error:

Log Name: Directory Service

Source: Microsoft-Windows-ActiveDirectory_DomainService

Event ID 1084

Task Category: Replication

Computer: DC01

Description:

Internal event: Active Directory could not update the following object with changes received from the following source domain controller. This is because an error occurred during the application of the changes to Active Directory on the domain controller.

Object: distinguished_name_path_of_object_that_failed_to_write_to_local_database

Object GUID: 32_character_alpha-numeric_object_GUID

Source domain controller:object_GUID_for_source_domain_controller's_NTDSDSA_object._msdcs

I did a Bing search and found the following article: http://support.microsoft.com/kb/837932. I chose option 2 which was to uncheck the Global Catalog on the DC01.

Action:

• I unchecked the Global Catalog option in “AD Sites and Services” on DC01. Depending on the environment size this process can take a while because it has to remove all the GC partitions.
• After an hour I checked replication and I was still getting the original error:

DsReplicaSync() failed with status 1127 (0x467):

While accessing the hard disk, a disk operation failed even after retries.

• Sometimes you get different error messages in the GUI so I opened “AD Sites and Services” and right clicked on the connection object for  DC01 and DC02 then select replicate now. I got the following error:

The following error occurred during the attempt to synchronize naming context fqdn "This is the same partition from previous event ID 1084" from Domain Controller DC01 to DC02 the naming context is in the process of being removed or is not replicated from the specified server.

I checked the event log on DC01 and it was unable to remove the objects in the GC partition. I was getting error:

Log Name: Directory Service

Source: Microsoft-Windows-ActiveDirectory_DomainService

Event ID 1661

Task Category: Replication

Computer: DC01

Description:

Active Directory Domain Services did not remove objects of the following partition from the local Active Directory Domain Services database.

Directory partition:

DC=local ,DC=domain ,DC=com "The error was referencing all the GC partitions"

At this point my only option was to run an offline defrag on the ntds.dit using the following article http://technet.microsoft.com/en-us/library/cc794920(WS.10).aspx.

After I restarted the ntds service there was no errors when the database mounted.

• To save time I manually replicated all partitions.
• Command repadmin /replicate <dest-dc01> <source-dc02> DC=full DN path of partition
• The DC started replicating all partitions with all its partners.
• I verified the ActiveDirectory_DomainServices event ID 1660: The removal of the following partition from the local Active Directory Domain Services database completed. Verified this was recorded for all the GC partitions.
• I selected the Global Catalog option in “AD Sites and Services” on the NTDS Settings.
• Then after an hour or so the DC was a Global Catalog again and it was successfully replicating with its partners again.

Additional information:

I later found that there was a hard drive failure on DC01 about a month prior and the drive was replaced. The last successful replication occurred just before the hard drive crashed. It appears this issue was caused by a disk failure that corrupted a section in the ntds.dit.

Links:

Event ID 2108 and Event ID 1084 occur during inbound replication of Active Directory in Windows 2000 Server and in Windows Server 2003

http://support.microsoft.com/kb/837932

Compact the Directory Database File (Offline Defragmentation)

http://technet.microsoft.com/en-us/library/cc794920(WS.10).aspx

Repadmin Syntax

http://technet.microsoft.com/en-us/library/cc770963(WS.10).aspx

Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows

http://support.microsoft.com/kb/822158

When you check “Scavenging stale resource records” and "Apply these settings to the existing Active Directory-integrated zones"at the server level the Scavenging settings, No-refresh, and Refresh intervals are not always propagating to existing DNS zones. This is also true for newly created zones. In order to propagate the settings to existing and new zones you have to actually modify the current values in order for this to happen. This behavior is by design. I will walk you through the steps to get a better understanding of the behavior I am talking about.

 1. In DNS MMC Right-click the server node and select properties

 2. Select Set Aging/Scavenging for All Zones

3.       Select Scavenge stale resource records and keep the default of 7 and 7. Click ok

4.       In the “Server Aging settings for New Active Directory-Intergraded zone:” window, click “Apply these settings to the existing Active Directory-integrated zone” Notice there is No-refresh and Refresh intervals listed in the dialog box.

 5.       Click ok

So a few weeks go by and start to notice that you are missing records in DNS. You start to investigate the issue and you happen to find that the zone was misconfigured to something crazy like 3 and 1.

OK, so I know you might be saying to yourself but I checked the box Apply these setting to existing Active Directory-integrated zone right? Just remember whatever is in the dialog box is what is actually being applied. So depending what you are trying to configure your No-refresh and Refresh intervals to, and you also want those setting to apply to all ADI zones you may have to modify the existing values first in order to get your expected settings to propagate down.

For example if you wanted have your No-refresh and Refresh intervals configured to 7 and 7 you will have to modify them to some other value like 8 and 8.

Let’s take a look at what is configured at the server level and the zone.

Server:

Zone:

Ok let’s fix this mess.

1. In DNS MMC Right-click the server node and select properties

2. Select Set Aging/Scavenging for All Zones

3. Select Scavenge stale resource records and change it to 8 and 8. "Remember we have to change these values to something other than the current values". Click ok

The reason you don’t see the Scavenge stale resource records: Enabled is because that value was not changed. OK time for a quick sidebar: You could run into the same situation where aging\scavenging is checked at the server level and you have additional zones that reside on the server that are unchecked. If you want to enable aging\scavenging on all zones on the server you will have to deselect the checkbox at the server level then go back in and re-enable it. Make sure you also select "Apply these settings to the existing Active Directory-integrated zones”

If we take a look at the server and zone intervals they will both be 8 and 8 in the GUI or 192 via DNSCMD.

Server:

Zone:

Now let’s change them to 7 and 7.

If you take a look at the server and zone intervals they will both be 7 and 7 in the GUI or 168 via DNSCMD. This is how you get your expected intervals to propagate to existing zones and new zones. You can use DNSCMD to modify whether scavenging is enabled, or modify the No-Refresh and Refresh intervals. But the only way to Apply the settings to the existing ADI zones or new zones from  the server level is from within the GUI unfortunately.

Here is a great article on scavenging: http://blogs.technet.com/b/networking/archive/2008/03/19/don-t-be-afraid-of-dns-scavenging-just-be-patient.aspx

Overview of MaxTokenSize

The MaxTokenSize by default is 12,000 bytes. This has been the default value since Windows 2000 SP2 and still remains in Windows 7 and Windows 2008 R2. As company’s grow so do the groups within your organization.  If your Kerberos token becomes too big your users will receive error messages during login and applications that use Kerberos authentication will potentially fail as well.

  Updated Guidance and Recommendations: 

In the past we had guidance that stated you could increase the MaxTokenSize registry entry to 65535. But because of HTTP’s base64 encoding of authentication context tokens limits starting with Windows Server 2012, the default value of the MaxTokenSize registry entry is 48000 bytes. This is why we are recommending that you set the MaxTokenSize no larger than 48000 bytes on any OS version.

How to reduce Kerberos token bloat

To reduce the Kerberos Ticket Size you can:

•  Reduce/consolidate group membership
• Clean up SID History
• Limit the number of users that are configured to use "trusted for delegation". The account that are configured  to use "trusted    for delegation" the buffer requirements for each SID may double.

How to prevent Kerberos login errors due to token bloat

  To allow a user to be a member of more than 900 groups you can increase the size of the MaxTokenSize by modify the following registry key on all workstations.

 To use this parameter:

1. Start Registry Editor (Regedt32.exe).

2. Locate and click the following key in the registry:
   System\CurrentControlSet\Control\Lsa\Kerberos\Parameters

3. If this key is not present, create the key. To do so:
   1. Click the following key in the registry:
      System\CurrentControlSet\Control\Lsa\Kerberos
   2. On the Edit menu, click Add Key.
   3. Create a Parameters key.
   4. Click the new Parameters key.

4. On the Edit menu, click Add Value, and then add the following registry value:
   Value name: MaxTokenSize
   Data type: REG_DWORD
   Radix: Decimal
   Value data: 48000
5. Quit Registry Editor.

However keep in mind there is a hard limit of 1,015 groups a user can be a member of. If a user tries to log into a computer by using a local or domain account and they are a member of more than 1,015 groups they will get this Logon Message: The system cannot log you on due to the following error: During a logon attempt, the user’s security context accumulated too many security IDs. Please try again or consult your system administrator.

How to use Group Policy to add the MaxTokenSize registry entry to multiple computers

http://support.microsoft.com/kb/938118/EN-US

New resolution for problems with Kerberos authentication when users belong to many groups
http://support.microsoft.com/kb/327825

"HTTP 400 - Bad Request (Request Header too long)" error in Internet Information Services (IIS)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;2020943

Users who are members of more than 1,015 groups may fail logon authentication
http://support.microsoft.com/kb/328889/

Group Policy may not be applied to users belonging to many groups
http://support.microsoft.com/kb/263693/

Do not allow clipboard redirection

Description:

Specifies whether to prevent the sharing of clipboard contents (clipboard redirection) between a remote computer and a client computer during a Remote Desktop Services session.

You can use this setting to prevent users from redirecting clipboard data to and from the remote computer and the local computer. By default, Remote Desktop Services allows clipboard redirection.

If the status is set to Enabled, users cannot redirect clipboard data.

If the status is set to Disabled, Remote Desktop Services always allows clipboard redirection.

If the status is set to Not Configured, clipboard redirection is not specified at the Group Policy level. However, an administrator can still disable clipboard redirection using the Remote Desktop Session Host Configuration tool.

Location:

Computer Configuration \ Administrative Templates \ Windows Components \ Remote Desktop Services \ Remote Desktop Session Hosts \ Device and Resource Redirection \ Do not allow clipboard redirection

Windows Server 2008 R2 Feature Components Poster

http://www.microsoft.com/downloads/details.aspx?FamilyID=64a5cc28-f8a1-4b30-a4a2-455c65bda8d7&displaylang=en

Job Aids for Server Core Installations of Windows Server 2008 and Windows Server 2008 R2

http://www.microsoft.com/downloads/details.aspx?familyid=8DD99AC0-4A59-41E9-8037-F33760D560F0&displaylang=en

Windows Server 2008 R2 Documentation Survival Guide

http://www.microsoft.com/downloads/details.aspx?familyid=0576CE09-2DDE-48E7-9BD7-77E4A4717100&displaylang=en  

Infrastructure Planning and Design Windows Server 2008 and Windows Server 2008 R2 (This is the whole kit and caboodle)

http://www.microsoft.com/downloads/details.aspx?familyid=AD3921FB-8224-4681-9064-075FDF042B0C&displaylang=en

As you know Microsoft acquired Winternals back in 2007. ERD Commander is included in Microsoft’s Desktop Optimization Pack. To get the latest’s version of ERD Commander you first need to get your hands on Microsoft Desktop Optimization Pack 2009 R2 (MDOP).

How to get MDOP:

MDOP subscribers can download the software at Microsoft Volume Licensing Site (MVLS).

MDOP is also available for test and evaluation for MSDN* and TechNet** subscribers in accordance with MSDN and TechNet agreements.

Prerequisites:

1.    Download the Microsoft Desktop Optimization Pack 2009 R2

2.    Install the appropriate DaRT (Diagnostic and Recovery Toolset)

Options:

A.    Windows 7 and 2008 R2: x64, x86

B.    Windows Vista and Windows Server 2008: x64, x86

C.   Windows 2000, Windows XP, and Windows Server 2003: x86

Important:

Depending what Windows version of DaRT you install will determine what version of Windows ERD Commander Recovery Disk can be used on. Example: If you create a Windows 2008 R2 x64 ERD Commander Recovery Disk it will boot on a Windows 2003 x86 OS but you will not find an active partition and not all the MSDart Tools will work. It is important to create ERD Commander Recovery Disk specific for the Operating System you are wanting to triage.

3.    Optional: Download and Install Debugging Tools for Windows x64 and x86

4.    Optional: Download and extract to a folder Debug Symbols

Listed below are the Step-by-Step instructions without the screenshots. At the bottom of this post you can download my original doc with screenshots.

1.    Click on Start, Programs and launch the ERD Commander Boot Media Wizard

2.    Browse to where your Windows CD is located.

3.    This step is going to extract the files and create a temp location to build your image.

4.    Select your tools. I kept the default which is everything.

5.    On my ERD Commander Recovery Disk I wanted to add the Debugging Tools and Symbols. You must have the tools already installed on your computer before you start the ERD Commander Boot Media Wizard.

6.    System Sweeper Definition gives you the ability to triage an infected system.

7.    You need internet connectivity to download the updates.

8.    I didn’t need to add any additional drivers to my boot disk.

9.    I added the Debug Symbols to my ERD Commander Boot disk just in case I needed them in the future. This will help me if I am ever in a squeeze and I need to launch

Crash Analyzer to view a dump without being connected to the internet. All I have to do is point the Crash Analyzer Wizard to the

following path: X:\Windows\DebugSymbols and it should be able to read my symbols.

Important:

Remember the ERD Commander Boot disk has to load in memory. So whatever you dump on your ERD Commander Boot disk make sure the computer you are wanting to triage has adequate memory to support the size of your boot disk.

10.  I chose the default path to put the .ISO.

11.  This step is creating your ERD Commander Recovery Disk. Make sure you have adequate space on this drive otherwise this process will fail.

Trust me I know..

12.  Select your burning device.

13.  Burn Baby Burn…

14.  Your ERD Commander Recovery Disk is done!!

 Now go and save the world…

Step-by-Step How To Create a ERD Commander Boot Disk.docx