I’ve had to do this more times than i care to remember, and each time I end up trawling the same sites to recall the same scripts that I run to output the logs that allow me to determine whether everything is OK or not. So this time I decided to compile the individual scripts in to a batch file that will run them all in sequence and output the results to files that I can review for problems. The scripts are thus:

• Dcdiag.exe /v – shows if there are any problems with your Domain Controllers and their associated services
• Dcdiag.exe /test:dns  - validates the health of the Domain DNS service and replication.
• Netsh dhcp show server  - Verifies DHCP servers and names
• Repadmin /showreps  - Shows the status of replication between domain controllers
• repadmin /replsum /errorsonly  - shows you any errors in the replication between domain controllers

I’ve inserted these commands into a batch file, together with the switches to output the results of each script to file, rather than display it on screen. All files are created in C:temp – you will need to created this folder first if it doesn’t already exist. There are 2 batch files – one to be run before your maintenance to check for pre-existing problems, and another to run afterwards, to check for problems created as a result of your maintenance. The scripts are identical except for the name of the output files – the pre files are all prefixed pre_ and the post files are all prefixed post_ – so that you can see the before and after versions for comparison.

The batch files are available for download below. You will need to change the file extension of the downloaded files to .bat in order for them to work:

DC Diagnose Pre

DC Diagnose Post

However there is a better solution. Using Windows Task Scheduler and a few simple powershell scripts it’s possible to get email alerts sent to you as soon as your backup job completes – or fails.

I’ll assume that you have WSB configured and working on the server in question – there are plenty of on-line resources available to help you get this set up and working.

1. Create you alert scripts. You need 3 Powershell scripts – 1 each for a successful backup, a failed backup and another to alert you that the backup disk is full. The content for each is as follows:

   $SmtpClient = new-object system.net.mail.smtpClient
   $SmtpServer = "x.x.x.x"
   $SmtpClient.host = $SmtpServer
   $computer = gc env:computername

   $From = "from@emailaddress.com"
   $To = "to@emailaddress.com"
   $Title = "Backup Complete on " +$Computer
   $Body = "Backup Completed Successfully " + $computer
   $SmtpClient.Send($from,$to,$title,$Body)

   The details in red need to be changed to suit your environment, and are the same in all 3 scripts. The details in green are different in each script, and should be changed to suit the script – i.e. “Backup Failed on ” or “Backup drive full on “. I save the scripts as BackupComplete.ps1, BackupFailed.ps1 and BackupFull.ps1. I put these in c:usersadministrator, but the location is up to you really.

2. You can test the scripts at this point by running them manually in Powershell. You may need to set the script execution policy to remote signed to allow the script to run if this hasn’t already been done on your server. Run

   get-help about_signing

   at the powershell prompt for more info. If the script runs, but you don’t receive the emails, check your mail server config to make sure that it will allow the server to send via it without authentication.

3. Open Windows Server Manager on the server running the backup, or a management server if the backup is running on a Server Core machine. Expand the Configuration node and the Task Scheduler sub-node. Click on Task Scheduler Library sub node.
4. Right click in the Task Scheduler Library middle pane, and select Create New Task. The Create New Task dialog box will appear.
5. On the General tab, give the task a name, a description if you like, and change the Security options as below:
   
6. On the Triggers tab, press the “New” button to add a new Trigger. Select “On an Event” from the Begin the task drop-down. Select Microsoft-Windows-Backup/Operational for the Log, Backup for the Source, and specify the correct EventID depending on which task you are creating. The backup completed EventID is 4, the backup failed EventID is 5, and the backup full EventID is 50.
7. On the Actions tab, press the “New” button to add a new Action. Select Start a program from the Action dropdown list. Enter powershell for the program, and add the argument that points it to the script that you created earlier. e.g. for the backup completed task, I would set the argument to:
   -command “& c:usersadministratorBackupComplete.ps1″
   
8. For the Conditions tab, you can leave the Settings as they are:
   
9. On the Settings tab, adjust the settings as below:
   
10. The History tab will not contain any info at this stage, so you can press OK to save the task. You will be prompted to enter the server administrator password.
11. Repeat items 4 – 10 to add the second and third tasks to the task scheduler.
12. You should now be able to right click on each task and run it manually, and the corresponding email should duly arrive in the appointed inbox. If not, check that the scripts run properly from the Powershell prompt, and that you have entered the script arguments correctly.
13. You should now receive an email after your next scheduled backup cycle, letting you know how that backup went. However, it’s prudent to manually keep an eye on the backups until you’re happy that the emails are reporting the backup status correctly.

Thanks for reading.

• IT Consultancy
• Skills in HA, DR and Fault tolerance – implement these technologies into your systems
• Monitoring – SNMP monitoring of your systems – txt and email alerts
• Desktop and Server Hosting
• Hosted Exchange Services
• AV and AS Scanning for email
• Reliable Website Hosting – 15 sites currently running – zero downtime in 9 months

With Skills in

• Linux Ubuntu
• Windows Server 2008
• Cisco Firewalls and Routers
• Microsoft Exchange 2010
• Datacore SAN Products
• Virtualisation – Citrix, VMWare and Hyper-v

Please call 01332 890 460 if you wish to discuss using our services

• hosted MS Exchange 2010 services
• IMAP/POP
• Outlook Anywhere
• iPhone / activeSync conenctivity
• or plain simple webmail

To add to this offering, we have now integrated Anti Virus and Anti Spamming Scanning Services into our inbound and outbound flow of mail

See http://cronlab.com/ for details

This service therefore protects our clients and our servers from unwanted nasties. SPAM and VIRUS’

Please call 01332 890 460 if you wish to discuss using our email services

To Install Windows Backup use the following command:

CODE

ocsetup WindowsServerBackup

This command IS case sensitive.

Once run, you will be able to connect remotely via Windows Server Backup to setup your backup schedule.

I had an issue this week where I had installed Exchange 2010, standard setup, onto a server and I was having issues with iphone connectivity.

The thing that really saved me was the use of

https://www.testexchangeconnectivity.com/

I don’t own an iPhone myself and using the above online tool helped me to test the ActiveSync connectivity to the new mailserver, without needing a phone.

Please make sure you have ports 80 and 443 open on your firewall – both Windows Firewall and Hardware Firewall, otherwise traffic will not flow in and out correctly.

First of all, when running through the “ActiveSync (non-autodiscover)” utility, it flagged up the need for an external certificate. This I purchased and installed. See my other post for using a single domain external SSL certificate both internally and externally here

Single Domain SSL Certificate – Exchange 2010

Secondly the tool then started to flag issues with running “CONNECT” statements and gave some error 500′s

Exchange ActiveSync Returned an HTTP 500 Error

An Unsupported Authentication Method was Found

at this point I could start to Google possible resolutions. Interestingly I managed to see that some users connected without any issues, and others caused errors, within the utility. This lead me to look into permissions issues.

The resolution turned out to be extremely simple.

1. Open Active Directory Users and Computers
2. Turn on Advanced Features in the tools menu
3. Locate the user in question
4. open their properties (right click – properties)
5. Goto the security tab
6. Click the Advanced button
7. In here TICK the box “inherit permissions from  parent”

This was ticked for users which were working and un-ticked for those who were not. very simple indeed.

Then the online connectivity tool started producing “green” “connected” messages

Hope this helps

JK

Windows Server 2008 R2

and

Outlook 2010

During use of Outlook a “Windows Search” is not installed message was showing in the bottom pane, within the client.

This is how to install the Windows Search Service under Windows Server 2008

1. Open Server Manager
2. Click on Roles
3. Click on Add a Role
4. Choose the File Server Role
5. Click Next
6. on the following screen remove the file server service
7. click on the Windows Search option
8. click next
9. You are given the option to turn on INDEXING for your drives – I didn’t select ANY as I only want search for use by Outlook
10. Click next
11. This will install the Search service

Restart Outlook and as it loads it will re-install some components. This may take a few minutes, then Outlook opens, and away you go.

The search facility working in conjuction with Outlook is excellent. I search through my emails all the time using this kind of built in feature and it’s very quick really.

Enjoy

Hi All

As you’re all probably aware, Exchange 2010 likes to have a certificate installed, under the “Server Configuration” node, to apply to

SMTP, IIS, POP, UM, IMAP etc

Out of the box, you can create a self signed certificate, which you can use. However, if your server is called “BR-EXCHANGE” for example, you get given a certificate valid for the server BR-EXCHANGE and nothing else.

This is generally fine for internal use. Outlook connects to BR-EXCHANGE, the certificate is read, it matches the server name and all is well.

Buying a Certificate for your External URL – e.g mail.binaryroyale.com

So then you want to start allowing external users to use Outlook Web Access, for example. They login to https://mail.binayroyale.com/OWA and are presented with a certificate error!

Certificate BR-EXCHANGE does not match the FQDN – mail.binaryroyale.com

So you go out and purchase a certificate to use externally on your mailserver.

THIS IS WHERE YOU HAVE A CHOICE -

1. do you buy a standard SSL certificate for mail.binaryroyale.com
2. do you purchase one of these fancy SAN certificates, designed to work with Exchange 2010

The standard cert will cost you around £80, the exchange cert will cost you around £350. For small businesses, this is a no brainer. You need to save money, so you buy a standard one.

You install the certificate onto your Exchange server, and designate SMTP, IIS, POP and IMAP to it.

NOW – THIS IS WHERE YOU START GETTING ERRORS and is why you are reading this post. Your external cert is being read internally and Outlook is moaning that mail.binaryroyale.com, read on the certificate, does not match BR-EXCHANGE, the name of the server it’s communicating with. We’re going round full circle now!

If you had spent the £350, you would have been allowed to add mail.binaryroyale.com as well as BR-EXCHANGE to the certificate as well as a couple of extra domain names used for autodiscovery services.

SO – WHAT NOW?

You need to issue some commands in Exchange Powershell, which tells Outlook to use alternative names, i.e the external one, when connecting to Exchange.

Firstly you need to check the name of your CASServer

CODE

Get-ClientAccessServer

This for me, returns BR-EXCHANGE – so where you see this below, substitute for the name of your CASServer. My external URL is mail.binaryroyale.com, and again, substitute accordingly.

The next thing you need to absolutely make sure of is that you have a DNS entry, internally, for mail.binaryroyale.com, which actually points at the IP address of your CASServer.

I did this in Windows DNS by adding an ALIAS, in a forward lookup zone, for binaryroyale.com. My Alias was called MAIL and it pointed at existing A record for my CASServer, BR-EXCHANGE. I guess you don’t necessarily need to use an alias.

CODE

Set-ClientAccessServer -Identity BR-EXCHANGE -AutoDiscoverServiceInternalUri https://mail.binaryroyale.com/Autodiscover/Autodiscover.xml

CODE

Set-WebServicesVirtualDirectory -Identity “BR-EXCHANGE\EWS (Default Web Site)” -InternalURL https://mail.binaryroyale.com/EWS/Exchange.asmx -BasicAuthentication:$true

Set-OABVirtualDirectory -Identity “BR-EXCHANGE\OAB (Default Web Site)” -InternalURL https://mail.binaryroyale.com/OAB

CODE

Enable-OutlookAnywhere -Server BR-EXCHANGE -ExternalHostname “mail.binaryroyale.com” -ClientAuthenticationMethod “Basic”-SSLOffloading:$False

All of the command’s here were taken from Elans’s BLOG here

http://www.shudnow.net/2007/08/10/outlook-2007-certificate-error/ – so thank you Elan for this.

and now, you should hopefully have set the Client Access Server, the Web Services Directory, The OAB Virtual Directory and Outlook Anywhere to know that the CASServer is defined as the name of your internal CASServer and yet to use it’s external FQDN name.

Log out and back into Outlook, and your error should have disappeared.

Hope this helps

JK

I have a Windows Server which is tied down, so that the control panel is not visible. I therefore needed to work out how to open it up, via a command. It was dead simple, after doing some digging around.

CODE

Goto start and then run – alternatively hit “Windows Key” + R

type “control panel” in the run box

Very simple indeed.

There are lots of .cpl calls you can make, to the various options within the control panel, such as

CODE

sysdm.cpl – for the system properties

ncpa.cpl – for the network control centre

desk.cpl – for display stuff

But to get directly to the whole control panel, is done from RUN using “control panel”

all the best

JK

Today I also had to setup mysql on Ubuntu and allow for remote connections to it.

There are a few things that need to be done, to get this working, after you have installed mysql-server

1. Edit my.cnf to bind to the servers REAL IP address

sudo vi /etc/mysql/my.cnf

edit the line which reads “bind-address = 127.0.0.1″

and change this to “bind-address = 192.168.80.85″ or whatever the mysql server’s IP address is

2. Restart mysql

sudo /etc/init.d/mysql restart

or

service mysql restart

3. Create an account with to use from a remote machine. On the mysql server

mysql -u root -p

type in the password you entered during mysql-server setup

GRANT ALL PRIVILEGES ON *.* TO newrootuser@’%’ IDENTIFIED BY ‘newpassord’ WITH GRANT OPTION;

mysql>Flush Privileges;

mysql> exit

4. On a remote machine now try and connect using the newrootuser (name can obviously be anything) and the newpassword

and that’s it

IF you want to be a tad more particular about the remote account use

GRANT ALL PRIVILEGES ON *.* TO newrootuser@’machinename’ IDENTIFIED BY ‘newpassword’ WITH GRANT OPTION;

Hope this helps.

JK