WINTELTIPS

Process to Fix RDP issue due to Expired Certificate

noreply@blogger.com (Anonymous) — Wed, 25 Jan 2017 13:19:00 +0000

Process to Fix Remote Desktop issue due to Expired Certificate.

To check the certificate is expired or not follow the below steps.

Go to RUN prompt and Type MMC that will open the Microsoft Management Console.

From MMC we need to add the Certificates Snap in to check the Local System Certificate store.

Below Snap Show the Current Certificate available on the server and its Expiry details under the Remote Desktop Certificate store.

As it’s expired we need to generate a new Self signed certificate.

To create a new Certificate we need IIS Manager

Open the IIS manager and go to the Server root

After opening the root, we will see the features available, we need to select the Server Certificate Feature and have to open it.

Once we open the Server Certificates feature, it will show if any certificates are already available in the store, if not empty store will be shown as shown below.

To Create a new Certificate we need to click on Create Self-Signed Certificate.

As shown below need to Provide a Friendly Identification name for the certificate and select the Personal Option below.

Once we click on OK, it should be able to generate a new self signed certificate, but sometime we get a Access denied error, this we will get because of permission issues on the Machine Key Folder.

To fix the Access denied Error, we need to go to the folder location of “MachineKeys” “C:\ProgramData\Microsoft\Crypto\RSA”

Select the Machine Keys folder and go to Properties> Security Tab & select the Administrators group and provide full permissions to the group

After Providing the rights, apply the rights.

After Providing right go back to server Certicates & create the Selfsigned certificate.

Provide the Details and click on ok as shown below, now it should be able to create a new certificate.

Once the Certificate is generate, it will be available in the Server Certificates store as shown below.

Now we need to Export the same from the store & save that locally.

As shown below provide the location, where the certificate should be saved & also provide any password to access that cert.

Here in this case, we have saved the cert on the desktop.

Double click on RDP cert which will take us to import wizard.

Select the Local Machine and click on next & then next.

Provide Password the same one which was given while exporting the cert.

In the next step we need to select the Remote Desktop Store, where this certificate should be imported.

Click on Finish, which will import the certificate.

Cross check the new certificate, should be available in the Certificate MMC & check the properties. Which should be as shown below.

Go to Details Tab as shown below.

Select the Thumbprint and copy the Thumb print value. & paste the Thumb print value in the command line, because that Thumbprint value will have some ASCII characters hidden in it.

Copy the thumb print value in command prompt and remove all the gaps and question mark as below.

After removing the spaces, please copy the hash value and keep it.

Now we need to use that new cert hash value and replace the same in the WMI Name space using the below command, because as the old certificate value will be there in the name space, that should be replaced with the new value, so that server will start using the new cert hash value and get authenticated. If we don’t perform this step, server will keep on using the old has value, so we will not be able to use the new cert, even if this cert is available in the store. So to replace the old has value we need to use the below command.

wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGener
alSetting Set SSLCertificateSHA1Hash="NEW-CERT-Hash-Value"

By following the above steps, certificate issue will get fixed. If you have any queries or doubts on the same let me know.

Running Dell DSET Report remotely using DSET Colletor on the ESX/ESXI Hosts

noreply@blogger.com (Anonymous) — Wed, 28 Jan 2015 16:17:00 +0000

Running Dell DSET Report remotely using DSET Colletor on the ESX/ESXI Servers

Install DSET collector
Source: http://support.dell.com/support/edocs/SOFTWARE/dset/3.2/EN/ug/pdf/ug.pdf

Permanently Installing DSET and Generating Report on Windows Operating System

Before installing DSET, make sure that the installation prerequisites are met. For more information, see "Installation Prerequisite For Windows Operating System".

Using GUI For Windows Operating System

To permanently install DSET on Windows operating system:

1. Run the Dell_DSET_(Version Number).exe file. The Welcome to the Dell System E-Support Tool (3.2) Installation Wizard window is displayed.
2. Click Next The License Agreement is displayed.
3. Select I accept the license agreement and click Next. The Readme Information is displayed.
4. Click Next. The Installation Type window is displayed.
5. Select Install DSET Components and click Next. The Select Installation Type window is displayed.
6. Select one of the following options and click Next
• DSET Collector and DSET CIM Provider (default)
• DSET Collector
• DSET CIM Provide

The Destination Folder window is displayed.
7. Click Browse and select the folder to install DSET or use the default location and click Next.
The User Information window is displayed.
NOTE: The default location for Windows (x86) systems is C:\Program Files\Dell and
For Windows (x86_64) systems is C:\Program Files (x86)\Dell.
8. Enter the following:
• Full Name — Enter your full name.
• Organization — Enter your organization information.
9. Click Next. The Ready to Install the Application window is displayed.
10. Click Next.The Updating System window is displayed indicating the installation status. After installation, the Dell System E-Support Tool (3.2) has been successfully installed window is displayed.
11. To generate the report and/or upload (optional step):

• Run and Collect DSET Report — Select this option to generate the report.
• At request upload the report to Dell Technical Support — Select this option to upload the report to the Dell Technical Support when requested.
12. Click Finish to close the installer. DSET is now installed in the local system and if you have performed step 11, the report is also generated and/or uploaded.

We Can Run DSET Collector from the remote System

To run the report on a remote system, provide the Fully Qualified Domain Name (FQDN) or IP address of the remote system and administrator credentials.

Run the below command this will run the Deset report on the remote system and will store the report on the local system from where we are running this report.

C:\Program Files\Dell\AdvDiags\DSET\bin>DellSystemInfo.exe -s -u -p -d hw,sw -r C:\temp\dset.zip

Build light weight Active Directory 2008 server core in easy way

noreply@blogger.com (Anonymous) — Tue, 18 Dec 2012 17:12:00 +0000

Build your Active directory server just with 512Mb ~ below 1GB RAM.
Before knowing this please let me give you some details & benefits of using 2008 server core configurations.

There are many benefits of running Server Core instead of a Full installation. Below are the benefits which can be claimed by implementing the server core technology.

Greater stability. Because a Server Core installation has fewer running processes and services than a Full installation, the overall stability of Server Core is greater. Fewer things can go wrong, and fewer settings can be configured incorrectly.
Simplified management. Because there are fewer things to manage on a Server Core installation, it's easier to configure and support a Server Core installation than a Full one—once you get the hang of it.
Reduced maintenance. Because Server Core has fewer binaries than a Full installation, there's less to maintain. For example, fewer hot fixes and security updates need to be applied to a Server Core installation. Microsoft analyzed the binaries included in Server Core and the patches released for Windows Server 2000 and Windows Server 2003 and found that if a Server Core installation option had been available for Windows Server 2000, approximately 60 percent of the patches required would have been eliminated, while for Windows Server 2003, about 40 percent of them would have.
Reduced memory and disk requirements. A Server Core installation on x86 architecture, with no roles or optional components installed and running at idle, has a memory footprint of about 180 megabytes (MB), compared to about 310 MB for a similarly equipped Full installation of the same edition. Disk space needs differ even more—a base Server Core installation needs only about 1.6 gigabytes (GB) of disk space compared to 7.6 GB for an equivalent Full installation. Of course, that doesn't account for the paging files and disk space needed to archive old versions of binaries when software updates are applied. See Chapter 2 for more information concerning the hardware requirements for installing Server Core.
Reduced attack surface. Because Server Core has fewer system services running on it than a Full installation does, there's less attack surface (that is, fewer possible vectors for malicious attacks on the server). This means that a Server Core installation is more secure than a similarly configured Full installation.

Possible Usage Scenarios

Consider again the nine server roles you can install on Server Core:

AD DS
AD LDS
DNS
DHCP
File Services
Print Services
Streaming Media Services
Web Server (IIS)
Hyper-V

This list of roles should immediately suggest some possible usage scenarios for Server Core within your organization. Here are some ways that you could use Server Core to make your network more secure, more reliable, easier to manage, and easier to maintain:

Infrastructure servers. Domain controllers, DHCP servers, and DNS servers are the backbone of your network. Running these roles on Server Core can strengthen this backbone in every way.
Branch office servers. Because Server Core installations are more secure and require fewer software updates than Full installations, they are ideal for use in remote locations, such as branch offices where you have few (or no) information technology (IT) staff and less physical security than at your head office location. For example, you might deploy a Server Core installation as a read-only domain controller with BitLocker for added security at a branch office.
Server consolidation and testing. Because Hyper-V is a supported role on Server Core, you can use Server Core to consolidate multiple servers onto a single system while still keeping them isolated. This can help lower your TCO by reducing your hardware requirements and your power, cooling, and management costs. Server Core running Hyper-V also provides a convenient environment for deployment testing.
Extending hardware life. Because Server Core has lower disk and memory requirements than Full installations, you may be able to get more life out of old systems. For example, when you need to upgrade your e-mail or database servers, those boxes could be moved down the line to become network infrastructure servers running Server Core.

Now our AD installation starts
how to setup domain control using Command prompt.Before planning to implement a domian controller there are some prerequisites which are mandatory.

1)IP address
2)

At command prompt type
netsh interface ipv4 show interfaces

This will show all the network interfaces that available in the server. Please keep note on idx number of the interface that you need to assign the ip in our case its 10
netsh interface ipv4 set address name="10" source=static address=10.0.0.15 mask=255.255.255.0 gateway=10.0.0.1
in here I wanted to apply ip address 10.0.0.15 to the interface. Here you can see after the command the server got the new ip address

Next step was to assign DNS server ip 10.0.0.15
netsh interface ipv4 add dnsserver name="10" address=10.0.0.15 index=1

Now its ready for the DC install. Now we need to create unattend answer file for the domain install

notepad unattend.txt
then you need to type the file with the requirement
[DCINSTALL]
UserName=administrator
NewDomain=forest
NewDomainDNSName=Testlab.edu
Password=Pa$$w0rd
SiteName=Default-First-Site-Name
ReplicaOrNewDomain=domain
DatabasePath="%systemroot%'NTDS"
LogPath="%systemroot%'NTDS"
SYSVOLPath="%systemroot%'SYSVOL"
InstallDNS=yes
ConfirmGC=yes
SafeModeAdminPassword=Pa$$w0rd
RebootOnCompletion=yes
Below is the unattend note snap, this will install domain testlab.edu with DNS

You can execute it from command line
dcpromo /answer:c:\unattend.txt

it will take some time to install and after install it will automatically restart. After restart its done. Now you have DC with Server 2008 core.
If you have nay question feel free to ask me on jakkireddy8@gmail.com

EASY Way to configure your 2008 core

noreply@blogger.com (Anonymous) — Tue, 18 Dec 2012 16:46:00 +0000

There will be some tools which will help you in configuring you 2008 server core, but i will suggest this is the easy tool any one can use.....!!!
Download the tool here

http://coreconfig.codeplex.com/releases/view/36678

Extract files from CoreConfig.zip on other machine type

1.Copy CoreConfig.cab file to folder location of your choice
2.Double Click zip file
3.Select all files and right click and select extract
4.Select Destination and extract.

How to run CoreConfigurator on Server Core

1.If extract was done on a machine other than Server Core >> Copy All script files to a USB pen drive | Map a Network Drive to the file location
2.CD to the directory and run "Start_CoreConfig.wsf"
3.Menu option will appear

!!!Start configuring your Server Core!!!

AD UserAccountControl Attribute Values

noreply@blogger.com (Anonymous) — Wed, 25 Jul 2012 16:51:00 +0000

Normal UserAccountControl Values: These values will help us to check the account status like account is active or disabled or locked. based on these values we can prepare the accounts reports.
===========================

512 - Enable Account

514 - Disable account

544 - Account Enabled - Require user to change password at first logon

4096 - Workstation/server

66048 - Enabled, password never expires

66050 - Disabled, password never expires

262656 - Smart Card Logon Required

532480 - Domain controller

Values with different

1 - script

2 - accountdisable

8 - homedir_required

16 - lockout

32 - passwd_notreqd

64 - passwd_cant_change

128 - encrypted_text_pwd_allowed

256 - temp_duplicate_account

512 - normal_account

2048 - interdomain_trust_account

4096 - workstation_trust_account

8192 - server_trust_account

65536 - dont_expire_password

131072 - mns_logon_account

262144 - smartcard_required

524288 - trusted_for_delegation

1048576 - not_delegated

2097152 - use_des_key_only

4194304 - dont_req_preauth

8388608 - password_expired

16777216 - trusted_to_auth_for_delegation

SUBNET CALICULATOR

noreply@blogger.com (Anonymous) — Tue, 22 May 2012 16:18:00 +0000

Install Roles of 2008 from Command Line

noreply@blogger.com (Anonymous) — Thu, 01 Dec 2011 09:53:00 +0000

DNS

start /w ocsetup DNS-Server-Core-Role

DHCP

start /w ocsetup DHCPServerCore

File Services (Server service is installed by default) but there are other role features

File Replication Service

start /w ocsetup FRS-Infrastructure

Distributed File System

start /w ocsetup DFSN-Server

Distributed File System Replication

start /w ocsetup DFSR-Infrastructure-ServerEdition

Services for Network File System (NFS)

start /w ocsetup ServerForNFS-Base

start /w ocsetup ClientForNFS-Base

Hyper V

start /w ocsetup Microsoft-Hyper-V

Print Server feature

start /w ocsetup Printing-ServerCore-Role

Line Printer Daemon (LPD) service

start /w ocsetup Printing-LPDPrintService

Active Directory Lightweight Directory Services

start /w ocsetup DirectoryServices-ADAM-ServerCore

Active Directory Domain Services

dcpromo /unattend:

Streaming Media Services

Follow directions found in Article ID 934518

IIS

start /w pkgmgr /iu:IIS-WebServerRole;WAS-WindowsActivationService;WAS-ProcessModel

To uninstall IIS use the following command

start /w pkgmgr /uu:IIS-WebServerRole;WAS-WindowsActivationService;WAS-ProcessModel

NOTE: If you need to install a Role that you installed with ocsetup all you need to do is to append the commands above with /uninstall.

Now let's take a look at how we install Features on Server Core:

Microsoft Failover Clustering

start /w ocsetup FailoverCluster-Core

Network Load Balancing

start /w ocsetup NetworkLoadBalancingHeadlessServer

Subsystem for UNIX-based applications

start /w ocsetup SUACore

Multipath IO

start /w ocsetup MultipathIo

Removable Storage

start /w ocsetup Microsoft-Windows-RemovableStorageManagementCore

Bitlocker Drive Encryption

start /w ocsetup BitLocker

Backup

start /w ocsetup WindowsServerBackup

Simple Network Management Protocol (SNMP)

start /w ocsetup SNMP-SC

Windows Internet Name Service (WINS)

start /w ocsetup WINS-SC

Telnet client

start /w ocsetup TelnetClient

Common Networking Commands 2008 Server

noreply@blogger.com (Anonymous) — Thu, 01 Dec 2011 09:52:00 +0000

Server Core Common Networking Commands

To configure the IP address we will have to remember (or learn) Netsh.

Configure a Static IP Address on Server Core:

Netsh int ipv4 set address “Local Area Connection” static 10.1.1.10 255.255.255.0 10.1.1.1

Netsh int ipv4 set dnsserver “Local Area Connection” static 10.1.1.5 primary

Netsh int ipv4 set winsserver “Local Area Connection” static 10.1.1.6 primary

Configure a Dynamic (DHCP) IP Address on Server Core:

Netsh int ipv4 set address “Local Area Connection” source=dhcp

Change the name of the network interface on Server Core:

Netsh int set interface name = “Local Area Connection” newname = “Primary Network”

Server Core Common Windows Firewall Commands:

Disable firewall:

netsh firewall set opmode disable

MMC Snap-in - Event Viewer

Windows Firewall Rule Group - Remote Event Log Management

MMC Snap-in - Services

Windows Firewall Rule Group - Remote Services ManagementMMC Snap-in - Shared Folders

Windows Firewall Rule Group - File and Printer Sharing

MMC Snap-in - Task Scheduler

Windows Firewall Rule Group - Remote Scheduled Tasks Management

MMC Snap-in - Reliability and Performance

Windows Firewall Rule Group - Performance Logs and Alerts

Windows Firewall Rule Group - File and Printer Sharing

MMC Snap-in - Disk Management

Windows Firewall Rule Group - Remote Volume Management

MMC Snap-in - Windows Firewall with Advanced Security

Windows Firewall Rule Group - Windows Firewall Remote Management

To enable all of these rules follow use this command:

Netsh advfirewall firewall set rule group=“remote administration” new enable=yes

To enable specific commands follow this format:

Netsh advfirewall firewall set rule group=“” new enable=yes

Server Core Common Domain Management Commands

Join a domain:

netdom join ComputerName /domain:DomainName /userd:UserName /passwordd:*

Yes, /passwordd:*

needs to have that second d at the end of it.

Remove from domain:

netdom remove

Rename a Domain Member:

netdom renamecomputer %computername% /NewName: /userd: /passwordd:*

Rename Administrator:

wmic UserAccount where Name="Administrator" call Rename Name="new-name"

Add User to a Local Group

net localgroup GroupName /add \

Remove User from a Local Group

net localgroup GroupName /delete \

Confirm Domain and/ New Computer name

Set

Update User Passwords:

Net user [/domain] *

Server Core Common Server Management Commands

Toggle Remote Desktop on and off:

Cscript \windows\system32\scregedit.wsf /ar 0

Enable reduced security for RDP connections:

Cscript \windows\system32\scregedit.wsf /cs 0

Active Server Core:

Local method - Slmgr.vbs –ato

Remote method - Cscript windows\system32\slmgr.vbsServerName UserName password:-ato

Rename a Stand-Alone Member:

netdom renamecomputer /NewName:

List of installed patches:

wmic qfe list

Install Updates:

wusa .msu /quiet

Configure for AutoUpdates:

cscript scregedit.wsf /AU /4

Disable AutoUpdates:

cscript scregedit.wsf /AU /1

View AutoUpdate Setting:

cscript scregedit.wsf /AU /v

Configure the Page File:

wmic pagefileset where name=”” set InitialSize=,MaximumSize=

Configure a Proxy Server:

netsh Winhttp set proxy :

List Running Services:

sc query

Start and/or Stop a Service:

sc start

sc stop

Task Manager: (Ctrl+Shift+Esc)

taskmgr

Manage Disk Volumes:

Diskpart /?

Defrag a Volume:

defrag /?

Change Time and Time Zone:

control timedate.cpl

Change the Desktop Resolution: (requires you to log off and back on)

Regedit - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Video

\0000\DefaultSettings.XResolution

\0000\DefaultSettings.YResolution

Display the Time in the Command Prompt:

prompt [$t]$s$p$g

Log off:

shutdown /l

Restart Now:

shutdown /r /t 0

Terminal services Manager commands for CLI

noreply@blogger.com (Anonymous) — Tue, 19 Apr 2011 16:29:00 +0000

Hi Guys... This article will teach you how we can check the remote login sessions &amp how we can
kill those sessions &amp also how we can view the remote processes &amp
how we can kill those... this article will help you to use CLI when some times GUI is not responding.

To view who and all users are connected to the system here i have given for local system

C:\Users\reddy>quser
USERNAME SESSIONNAME ID STATE IDLE TIME LOGON TIME
reddyjg console 1 Active none 4/19/2011 2:16 PM

If we want to check the remote system users
C:>quser /server:REMOTEServername
USERNAME SESSIONNAME ID STATE IDLE TIME LOGON TIME

if you want the help syntax you can check the help
quser /?

Here i have given one more command which will be usefull for the same work as above command does. QWinsta is different and better. It has more features and options.
C:>qwinsta /?
Display information about Terminal Sessions.
QUERY SESSION [sessionname | username | sessionid] [/SERVER:servername] [/MODE] [/FLOW] [/CONNECT] [/COUNTER] sessionname Identifies the session named sessionname. username Identifies the session with user username. sessionid Identifies the session with ID sessionid. /SERVER:servername The server to be queried (default is current). /MODE Display current line settings. /FLOW Display current flow control settings. /CONNECT Display current connect settings. /COUNTER Display current Terminal Services counters information.

To logoff the remote sessions

C:\Users\reddy>logoff /?
Terminates a session.

LOGOFF [sessionname
sessionid] [/SERVER:servername] [/V] [/VM]

sessionname The name of the session.
sessionid The ID of the session.
/SERVER:servername Specifies the Remote Desktop server containing the user
session to log off (default is current).
/V Displays information about the actions performed.
/VM Logs off a session on server or within virtual machine. Th
e unique ID of the session needs to be specified.

EXAMPLE
C:>logoff /server:Remoteservername 1 /v
Logging off session ID 1

There is one more command which will do the same task to logoff a session remotely as logoff command does... RWinsta has same parameters and does same thing as log off command. It simply means Reset Windows Station. The help goes as,

C:\Users\reddy>rwinsta /?
RESET SESSION {sessionname

sessionid} [/SERVER:servername] [/V]

sessionname Identifies the session with name sessionname.

sessionid Identifies the session with ID sessionid.

/SERVER:servername The server containing the session (default is current).

/V Display additional information.

EXAMPLE
C:>RWinsta /Server:MyWinServer 1
the above command will reset the session with ID 1

How to view the remote running processes
>Tasklist /s Servername

there are many options available for this command Just go through the help...

Kill the tasks remotely

To kill the tasks running on the server remotely is by using the taskkill command
>taskkill /s Servername

here is the help examples

Examples:

TASKKILL /S system /U domain\username /FI "USERNAME ne NT*" /IM *
TASKKILL /S system /U username /P password /FI "IMAGENAME eq note*"

Windows 2003 Server EMS core

noreply@blogger.com (Anonymous) — Wed, 24 Mar 2010 18:02:00 +0000

test2

Windows 2003 Server EMS core Hardware

Introduction

The Microsoft Windows operating system provides many mechanisms for managing a system when Windows is loaded, fully initialized and the system is functioning. This type of system management is called “in-band” and typically occurs over the network. However, a different solution is required for managing a system when the system has failed or when Windows is not loaded, is in the process of loading, or is in distress, because Windows network software is not available. This type of system management is called “out-of-band” management.

The goal for out-of-band management is always to return the system to a fully functioning state where in-band management is available. Making both in-band and out-of-band management available remotely are key components of headless functionality. With the exception of hardware replacement, all administrative functions that can be accomplished locally should be available remotely. For example, it should be able to accomplish the following remotely:

•Power on a system that is currently off

•Change BIOS settings or view POST results

•Choose the operating system, set operating system options

•Interact with specific diagnostic and recovery tools

•View system blue-screens

•Reset a system

To accommodate the many possible system operation states, careful thought must be given to hardware, firmware, and operating system functionality to ensure a comprehensive and complementary implementation of out-of-band management capabilities. Each system component must contribute to the coherent, complementary solution in order to avoid expensive, confusing administration.

This paper summarizes the design issues and requirements for hardware and firmware that will ensure coherent, complementary functionality for out-of-band management of a headless system running Microsoft Windows.

Headless Implementation in the Windows Server 2003 Family

A headless solution requires removal of local console I/O dependencies in the operating system. Windows Server 2003 supports operating without a keyboard, mouse, or monitor attached to the system. On an ACPI-enabled system, Windows Server 2003 supports operating without a legacy 8042 keyboard controller. Windows Server 2003 also includes support for systems without VGA/video hardware.

Based on built-in Windows support, a USB-capable system running Windows Server 2003 can support hot plugging the mouse and keyboard while Windows is running, and a system with a VGA card can support hot plugging a monitor.

In Windows Server 2003, out-of-band console I/O support is provided for all Windows kernel components, the loader, setup, recovery console, Windows kernel, blue-screens and a text mode management console available after Windows Server 2003 has initialized called the Special Administration Console. This functionality is called the Emergency Management Services (EMS). This I/O conforms to the following by default:

•9600 baud

•1 stop bit

•No parity

•8 data bits

•No flow control

•Output conventions are defined in “Standardizing Management Console Output on the Serial Port Interface (VT100+)” later in this paper.

Note that these settings were chosen because they are the current “standard” configuration in UNIX administration world and allow interoperability. However, additional settings are supported if they are passed via the Serial Port Console Redirection Table. It is suggested that higher baud rates be used whenever possible and legacy VT100 support is not a concern. The specification for the Serial Port Console Redirection Table can be found at http://www.microsoft.com/hwdev/platform/server/headless/default.asp

Designing Hardware and Firmware for Windows Server 2003 Headless Systems

There are three key areas that must be addressed to provide a high quality headless platform that is cleanly integrated with Windows Server 2003 EMS. The section of this paper covers these three areas.

The first area is management port hardware: The Windows Server 2003 family will support a standard legacy serial port. Provided hardware support is available for testing, the Windows Server 2003 family will also support systems with more advanced management hardware, that provides a UART interface in system I/O space or Memory Mapped I/O.

The second area is a standardized firmware and management console user interface. It is important the system firmware and out-of-band management service processor user interface be available via the same out-of-band communication channel as the EMS. The firmware must cleanly hand the communication channel off to the EMS during the boot process. The firmware must use the same terminal definition as Windows Server 2003 EMS and use the same keystrokes to represent not standardized keystrokes such as F12 as specified later in this paper.

The third area is the passing of the out-of-band communication channel configuration information from the firmware to Windows Server 2003. This is achieved via the Serial Port Console Redirection Table.

Providing Legacy Out-of-Band Management Port Hardware for Use with EMS

The headless functionality in the Windows Server 2003 family supports a standard (16550) serial port at the legacy address of COM1, COM2, COM3 or COM4 (3F8, 2F8, 3E8 and 2E8 respectively) or a UART at well known non-legacy address as described in “Providing Non-Legacy Out-of-Band Management Port Hardware for Use with EMS” A server must provide at least one UART interface capable of use by Windows Server 2003 EMS. Windows EMS does not make use of legacy PC interrupts even when using a legacy com port.

When using a serial port connection to access Windows EMS support, all serial cables must be null modem cables that support the Carrier Detect (CD) signal. Windows will not provide console I/O if Carrier Detect is not active. Note: Cables with Carrier Detect shorted to RTS (Ready to Send) will work.

Providing Non-Legacy Out-of-Band Management Port Hardware for Use with EMS

This describes requirements for either a serial port or service processor.

The guidelines in this section apply for service processors configured to use an I/O location other than the legacy COM port address.

The legacy COM port on a Super I/O chip is an ideal out-of-band management port. It provides a serial port at a well-known address, and the hardware is reliable and fully defined. Therefore, Windows Server 2003 support for the out-of-band management port communicates with a UART device that uses a serial protocol, typically at a standard COM port address.

Notice, though, that it is a goal for the industry to move to “legacy free” systems that are designed without Super I/O chips or legacy COM ports. To expose the same serial-port functionality in legacy-free system, the mechanism of choice is a UART in PCI I/O space, which can be as simple as a serial port on a PCI card.

However, several OEMs produce add-on management devices for controlling the computer in its pre-boot state. A natural extension of these devices is to use them as the EMS I/O device.

Using Windows software in conjunction with OEM-supplied device provides several benefits. Software-only solutions typically cannot provide all the functionality found on these OEM management boards (hardware reset, power on, and so on). However, combining both hardware and Windows software solutions can achieve an extremely compelling solution for corporate customers.

The non-legacy UART interface in PCI I/O space can be exposed regardless of the underlying device or its external connection. This allows the Windows Server 2003 EMS to use the same simple programming model, regardless of the device or bus that this device uses. The OEM can also abstract the output of the interface such that it is no longer restricted to a serial cable. For example, some of these devices have an RJ45 connector, allowing customers to extend their investment in Ethernet network cabling by implementing a private management network while avoiding the problems and cost of serial cable deployment.

NOTE: Support for non-legacy UARTs in system I/O on 32 and 64 bits and MMIO in the 64-bit versions of the Windows Server 2003 family is dependent on hardware being available for testing. If hardware is not available, only UARTs at the legacy addresses of COM1 and COM2 will be supported.

Out-of-Band Management Port Device Requirements

This section lists the requirements for the out-of-band management port device for the Windows Server 2003 family.

1.UART control register must function as a standard UART Device

The device must act as a 16550 or 16450 UART. Windows Server 2003 will test this device using the following process.

1. Save off the current modem status register.

2. Place the UART into diagnostic mode (The UART is placed into loopback mode by writing

SERIAL_MCR_LOOP to the modem control register).

3.The modem status register is read and the high bits are checked. This means SERIAL_MSR_CTS, SERIAL_MSR_DSR, SERIAL_MSR_RI and SERIAL_MSR_DCD should all be clear.

4.Place the UART in diagnostic mode and turn on OUTPUT (Loopback Mode and OUTPUT are both turned on by writing (SERIAL_MCR_LOOP | SERIAL_MCR_OUT1) to the modem control register).

5.The modem status register is read and the ring indicator is checked. This means SERIAL_MSR_RI should be set.

6.Restore original modem status register.

2.UART control register must be at a well-known address

The current plan is: On x86 systems, this address must exist exclusively in system I/O space (which includes legacy COM port address). On IA-64 systems, this address must exist at a legacy COM port address or in Memory Mapped I/O. Support for addresses other than legacy COM ports will be determined largely based on support by Hardware that OEM’s are able to supply.

3.Device that the UART is on must be available before Windows is loaded

In particular, the device must be available to the Windows loaders. This implies that the device must be configured by the BIOS during POST.

Recommended: The BIOS should expose the out-of-band management port in such a way that the port is available for redirecting BIOS initialization screens or that the surrounding hardware redirects the BIOS screens through some other method (“screen scraping”).

4.UART device must always be available to the system

For the Windows loader to communicate with this device, the address must be “pre-translated” to the processor-relative address, because the loader cannot call into the hardware abstraction layer (HAL) in order to translate a bus-relative address to a processor-relative address.

5.Address of the UART device may not change

The Windows headless software is not Plug and Play-aware, and it only stores the translated address for a device. If the device address were to be relocated, the headless software that wrote to the translated address would write to an invalid system address.

6.System has exclusive access to the out-of-band management port

The system will write directly to the out-of-band management port instead of going through the Windows I/O Manager. No device driver, for example, should also try to write to this device. In particular, there is no Windows support for a “crashport” that is only invoked upon a blue-screen, similar in concept to crashdebug.

7.System can include only one out-of-band management port

The Windows Server 2003 family does not support any scenario where one device is the output out-of-band management port and another device is the input out-of-band management port.

8.Out-of-band management port must remain highly available

For example, the device should not be powered off while the system is running.

Out-of-Band Management Port Implementation

The following describes how Windows Server 2003 and hardware must function together for proper EMS out-of-band management port detection and interaction.

Mechanism must be provided for determining the base address of the out-of-band management port

Windows Server 2003 performs a series of checks to detect the base address of the out-of-band management port. The following is the order of precedence of the settings that are checked (that is, 1 supercedes 2). For a system that will support Windows Server 2003 EMS, one of these mechanisms must be provided.

1.User specifies address in Boot.ini (IA 32 only). The user can indicate that one of the legacy COM ports is to be used for headless operation. By detecting the keywords COM1 or COM2 in Boot.ini for redirection, the system can deduce the I/O address of the device, because these devices are always at a well-known address. This is the least preferred method, because it allows conflicts between Windows and BIOS settings.

2.System detects address in Serial Port Console Redirection (SPCR) ACPI table (ACPI-enabled platforms). An ACPI BIOS can implement the SPCR ACPI table, which indicates the address of the out-of-band management port. This address must be pre-translated to a processor-relative address.

3.System detects address from EFI-based console output handle (IA 64 only). Windows can examine the console device handle (which may include “sub-device paths” to determine whether they are “headless” devices. If the device path for the console device is a UART device, the device path will have a UART device sub-path. Windows can then look at the other parts of the device path to determine the base address of the port. This might include examining the ACPI portion of the device path for the _CRS, and so on. Base addresses of PCI devices are not determined using this method.

Device initialization must be handled by BIOS

The headless-aware BIOS or system firmware must configure the out-of-band management port during POST so that BIOS startup screens and the Windows loader screens can be redirected during system startup.

Out-of-band management port base address must not change

This may be achieved in one of these ways:

•Out-of-Band management port resides on a bus that doesn’t relocate. If the out-of-band management port is a COM port on the ISA bus, then the port address will not move. If the device is on the PCI Root Bus, the device address will not move, because the root PCI bus also receives special treatment in Windows Server 2003; however, in future versions of Windows this may not be the case.

•Non-standard devices can be claimed by BIOS. Here, “non-standard” refers to any device not defined in ISA or PCI space. An ACPI BIOS can implement a Motherboard Resources Device for a non-standard out-of-band management port. This prevents the device resources from being claimed by another resource.

•Windows Server 2003 PCI Bus driver prevents device from being moved. During system initialization, the system bus drivers will initialize the devices on their respective bus. The bus initialization must be able to detect an out-of-band management port on the bus and ensure that the device is not moved. For Windows Server 2003, PCI is the only bus besides ISA that will be supported by Windows EMS. If the BIOS provides the PCI information in the Serial Port Console Redirection ACPI fixed table or the EFI console device path points to an appropriate headless port, then Windows will ensure that the device will not be powered off or moved.

This device will not be enumerated by PNP. This protects the port from having a PNP driver being loaded for it or being moved by PNP. Because the device will not be enumerated by PNP, none of the other functions of the device falling under the same header as the Out-of-Band management port will be enumerated, making it impossible to associate a device driver with the other functions on this device. These other devises must have their own PCI headers and decode logic.

A PCI Out-of-Band management port device can be located using the SPCR ACPI table, which provides sufficient information to describe the out-of-band management port. This data includes PCI bus, slot, and function number for the device. In addition, the device ID and vendor ID for the device will be included in the table. (0xFFFF vendor ID and device ID will indicate an ISA device in the SPCR table.)

Exclusive access to device must be enforced

•The system firmware can use the out-of-band management port for redirecting it’s UI.

It is recommended that the BIOS or service processor redirect all output until serial traffic is detected. The first character of the detected serial traffic must be transmitted. In this scenario, Carrier Detect on UART must be held high even when console redirection in occurring. Once serial traffic is detected, Windows EMS must have full and exclusive access to the out-of-band management port.

If no serial traffic detection code is implemented, once Int 19 on BIOS systems or ExitBootServices on EFI systems has been called, the Windows EMS must have full and exclusive access to the out-of-band management port.

•The out-of-band management port must always be present and available. It may not disappear or become inaccessible for writes or reads.

•Windows Server 2003 detects the out-of-band management port and does not expose this device to any higher-level interfaces.

Implementing Firmware for Headless Systems

The firmware must provide the Serial Port Console Redirection (SPCR) table, which allows Windows to determine the location and setting used by the firmware for console I/O on the serial port. This could be used to automatically match the Windows configuration with the firmware configuration.

The BIOS must support PXE-compatible network adapters, as defined in Preboot Execution Environment (PXE) Specification, Version 2.1, available at http://developer.intel.com/ial/wfm/wfmspecs.htm. For EFI-based systems, the remote boot protocols are defined in the EFI specification. See also “RIS and PXE Requirements” later in this paper.

It is important the firmware configuration, e.g. BIOS Setup, be available via the same out-of-band management port as Windows Server 2003 Emergency Management Services. If the out-of-band management port that the EMS uses is a legacy serial port, the BIOS or system firmware must redirect its console I/O to the same serial port and settings that Windows supports. Furthermore, if the redirection settings can be configured, they should default to the Windows-compatible settings cited earlier: COM1 9600 baud, 8N1 without flow control.

Serial console I/O must be in the format of VT100 plus the conventions defined in “Standardizing Management Console Output on the Serial Port Interface (VT100+)” later in this paper.

Firmware Localization Requirements

If the firmware uses a language other than English, the serial port output must be in UTF8 format as defined by the UNICODE Group (see http://www.unicode.org/).

•On a BIOS-boot system, the language used by the BIOS must be defined in the Serial Port Console Redirection Table (see http://www.microsoft.com/hwdev/platform/server/headless/default.asp).

•On an EFI-based system, this information is stored in the global environment variables as defined in the EFI specification, version 1.0 or later.

RIS and PXE Requirements

The Windows Server 2003 family provides Remote Install Services (RIS) on servers. This allows remote, network-based installation of the Windows EMS on a clean system. To take advantage of this capability, a network adapter that is PXE capable is required, as defined in Preboot Execution Environment (PXE) Specification, Version 2.1.

A PXE capable network adapter is not required. However, if a network adaptor that is PXE capable can be inserted into the system, the system firmware or BIOS implementation must allow the PXE boot to be a selection for the boot order. For example, an administrator might configure the BIOS to attempt to boot in this order: hard drive, CD-ROM, floppy drive, network.

Furthermore, the system firmware or BIOS must provide an option that the administrator can use to initiate a remote boot by way of a keystroke, in effect circumventing the boot order list. This key should be F12.

Being able to specify and circumvent boot order allows implementation of useful emergency recovery scenarios (see “Scenarios” later in this paper).

Designing Service Processor/ASIC or UPS

A service processor/ASIC UPS can provide headless management in conjunction with the support in the Windows Server 2003 family. The Service Processor/ASIC can provide support for dealing with management tasks that Windows Server 2003 can not provide, such as powering on the system, resetting the system when it is hard hung, retrieving Field Replaceable Units information or performing hardware diagnostics. They can also provide secured output on mediums more complicated than serial ports, such as HTTP on TCP-IP on Ethernet.

Service Processor/ASIC General Functionality Requirements

The ASIC or service processor must provide a mechanism to reset the system. The There are many opportunities for value-added capabilities while still adhering to these guidelines. For instance, Field replaceable units (FRUs) and sensor data etc. may be provided.

Service Processor/ASIC Internal Hardware Interface Requirements

To provide complementary functionality Windows Server 2003 EMS and the Service Processors must both be available to the remote Administrator. To this end, the Service Processor/ASIC must provide a pass-through connection between Windows and the management system. This allows the user to interface to both the service processor and Windows Server 2003 EMS via a single connectivity medium and a single cable.

The service processor/ASIC must provide a 16550 (preferred) or 16450 UART in system I/O (which includes legacy COM port addresses) on IA32, and MMIO or at a legacy COM port address on IA64, as an internal hardware interface. This UART hardware Interface must always be available to Windows Server 2003 EMS. I.E. The UART interface must be provided by hardware or firmware not a Windows Device driver so that it is available when the Windows Server 2003 Loader is running, when Windows Server 2003 is fully loaded and when there has been a blue-screen etc. This UART may not disappear or become unavailable to write to at time. For more information on the implementation of Out-of-Band management port hardware, see the above sections entitled “Providing Legacy Out-of-Band Management Port Hardware for Use with EMS” and “Providing Non-Legacy Out-of-Band Management Port Hardware for Use with EMS.”

Non-legacy UART interfaces must be described fully in SPCR table. On IA32 systems, legacy COM ports should be described fully by the SPCR table. On IA64 systems, legacy COM ports must be described fully by the SPCR table (preferred) or via EFI console device path.

Service Processor/ASIC External and User Interface Requirements

These guidelines allow freedom of design in the in external and user interface while maintaining usability and integration of Windows Server 2003 EMS and Service Processor/ASIC. The Service Processor/ASIC may expose varying external hardware interfaces, such as serial port, RJ45 (Ethernet) or a proprietary connector. Furthermore, some external interfaces may support more than one communication protocol, e.g. Ethernet supports telnet, sockets and HTTP traffic among others. However, from the standpoint of these guidelines, these can be divided into two categories, those that can output only a single channel of communication e.g. serial ports with VT100, and those that can output multiple channels simultaneously e.g. Ethernet with HTTP.

Single Channel External Interfaces

When the external interface to the Service Processor/ASIC is a single channel external interface such as the serial port, it is only possible the user to interact with one Out-of-Band management entity at a time. The EMS and the service processor must be able to share this external interface in a reliable and useable way. To this end integration between the Windows Server 2003 EMS and the Service Processor/ASIC is particularly important since during the boot process the user will be using the same user interface, typically some form terminal to interact with both, and expect the same I/O conventions to be followed by both.

During the boot process the typical user experience must be

1)Power on the system (if supported) – Service Processor/ASIC Functionality

2)View and optionally interact with FW POST – Service Processor/ASIC and Firmware Functionality

3)View and optionally interact with the Windows Server 2003 Loader – EMS Functionality

4)View and optionally interact with the Special Admin Console (SAC) – EMS Functionality

The Firmware and Service Process must allow Windows Server 2003 Full control of the service processor after step 2 so that step three and on may occur. These means that complete control of the internal UART interface must be available and the Service Processor/ASIC must provide pass-through port functionally that allows Windows Server 2003 EMS to communication directly with in a manner exactly equivalent to a standard terminal attached via a null modem to a serial port.

During normal operation, service processor/ASIC must allow unconstrained communication between Windows and the management system. In this case Standardizing Out-of-Band Management Console Output and Terminal Emulation (VT-UTF8 and VT100+), available at http://www.microsoft.com/hwdev/platform/server/headless/default.asp, provides a mechanism to invoke and exit the Service Processor or ASIC. When the pass through-port is in use by windows, the service Processor must “snoop” the traffic on the pass through port for the proper escape sequence. The ASIC or service processor may interrupt the Windows use of the pass-through port when the appropriate escape sequence is sent from the management system and the Service Processor/ASIC “snoops” it. Then the Service Processor/ASIC sends an escape sequence as an acknowledgment to the management system that it has been invoked and then present its user interface on the serial connection.. The Service Processor should intercept the escape sequence used to invoke it and any serial traffic that follows the escape sequence until it returns to pass through mode. When the service processor is not in pass through mode, it should lower Carrier Detect (see the section “Exclusive access to device must be enforced” in this paper for the special case of initial BIOS/Service Processor console redirection) unless it buffers all data from EMS. Such a buffer should be configurable to on or off. The Service Processor must return to pass-through mode when the appropriate escape sequence is sent be from the management system. These escape sequences requirements are documented in Standardizing Out-of-Band Management Console Output and Terminal Emulation (VT-UTF8 and VT100+), available at http://www.microsoft.com/hwdev/platform/server/headless/default.asp.

Service Processor/ASIC Serial Port Pass-through Topology

When the service Processor is invoked and the user is interacting with it certain escape sequences must initiate specific behavior. These escape sequences and behaviors are documented in Standardizing Out-of-Band Management Console Output and Terminal Emulation (VT-UTF8 and VT100+), available at http://www.microsoft.com/hwdev/platform/server/headless/default.asp.

If the Service Processor/ASIC did not use the same conventions as the EMS, the user would have an extremely difficult time sending the proper commands escape sequences. A standard terminal must be used to maintain interoperability between Windows NET Server EMS and service processor from multiple systems from multiple vendors. However, no standard terminal covers the additional extended keys on the PC 101 keyboard e.g. neither VT100 nor any other standard terminal has an F12 key or a standard way of encoding it on the wire. To this end, Standardizing Out-of-Band Management Console Output and Terminal Emulation (VT-UTF8 and VT100+), available at http://www.microsoft.com/hwdev/platform/server/headless/default.asp, is provided. The service processor/ASIC and firmware must adhere to the same terminal conventions as described in the Standardizing Out-of-Band Management Console Output and Terminal Emulation (VT-UTF8 and VT100+), available at http://www.microsoft.com/hwdev/headless. The user interface must be accessible via a terminal or terminal emulator supporting either VT100+ or a terminal VT100.

Multiple Channel External Interfaces

When the external interface to the Service Processor is a multiple channel external interface, as LAN connection may be, the requirements for providing access to the EMS change slightly. The channel for EMS communication must always be available regardless of whatever other management tools and communication is ongoing.

The client software provided to manage the out-of-band functionality provided by the Service Processor/ASIC must provide a terminal interface that the administrator may use to directly access the EMS. The terminal portion of the client must behave as a standard 80X25 terminal supporting VT100 or VT100+, i.e. the experience of the user should be that of attaching a terminal via a null modem cable to a serial port.

In the multi channel scenario the service processor is not required to provide any interaction with it’s user interface via this terminal screen. However In this case, the required service processor/ASIC and firmware functionality must be available elsewhere in the client user interface. If the firmware is available through this console, the firmware must adhere to the guidelines in “Implementing Firmware for Headless Systems.” If the Service Processor/ASIC is available through this console, the Service Processor/ASIC must adhere to the guidelines in “Single Channel External Interfaces”.

UPS Requirements

An Uninterruptible Power Supply (UPS) can provide control of the power supplied to the server, which can in turn provide rudimentary management capabilities such as remote control of power off and power cycling. For the purpose of this document the term UPS also represents smart power switches which can offer the same management capabilities of a smart UPS but without the functionality of maintain power to the server when external power is lost.

A UPS can also allow serial communication to pass through it between a management system and the Windows headless server. That is, the management port could have a serial connection to an external serial port on the UPS, which could have a serial connection to the Windows headless server. If a UPS uses a pass-through serial port interface externally, this port must allow unconstrained communication between the system for which the UPS provides backup power, the management system, and Windows. The UPS can interrupt the use by Windows of the pass-through connection by way of an escape sequence sent from the management system. Using this mechanism a smart UPS can provide some of key basic functions of an onboard service processor for systems only have a serial port.

Note: To take advantage these capabilities, a server must be configured to automatically boot when power is applied.

Note: Some UPS provide applications that access the UPS, from the server being powered, via a serial port. The serial connection being used for EMS, between the UPS and the Server, cannot be accessed by an application on the server to access and configure the UPS. This requires 2 serial connections.

The following requirements apply for any UPS to be used to in conjunction with Windows NET Server EMS:

•The UPS must provide a mechanism to reset the system.

•The entire end-to-end pass-through serial path must present the serial signals from the system to be managed to the management console as though from a serial port through a null modem cable as described in “Selecting Hardware for Headless Systems” earlier in this paper.

UPS Pass-through Topology

•The UPS may interrupt the Windows use of the pass-through serial path when the appropriate escape sequence is sent from the management system. The UPS sends an escape sequence as an acknowledgment to the management system that it has been invoked and presents, if one exists, its user interface on the serial connection. The UPS should intercept the escape sequence used to invoke it and any serial traffic that follows the escape sequence until it returns to pass through mode. When the UPS is not in pass through mode, it should lower Carrier Detect unless it buffers all data from EMS. Such a buffer should be configurable to on or off. The UPS must return to pass-through mode when the appropriate escape sequence is sent be from the management system. These escape sequence requirements are documented in Standardizing Out-of-Band Management Console Output and Terminal Emulation (VT-UTF8 and VT100+), available at http://www.microsoft.com/hwdev/platform/server/headless/default.asp.

•The UPS user interface must adhere to the same terminal conventions as described in the Standardizing Out-of-Band Management Console Output and Terminal Emulation (VT-UTF8 and VT100+), available athttp://www.microsoft.com/hwdev/platform/server/headless/default.asp, The user interface must be accessible via a terminal or terminal emulator supporting either VT100+ or a terminal VT100. If the UPS did not use the same conventions as the EMS, the user would have an extremely difficult time sending the proper commands escape sequences.

Management Port Solutions for Partitioned Systems

A partitioned system must provide a management port per partition. The management port may not be added or removed from the partition dynamically.

Security

Security on access to power management tool like a Service Processor and Windows Server 2003 is an important consideration. Because of the nature of the changing states Windows software providing the EMS during the course of boot, Windows operation and possible failure, it would be impossible to provide a seamless and cohesive security story using only the Windows software. Therefore, Windows EMS relies on physical security in the case of simple hardware such as a serial port, and the security provided by any Service Processor, ASIC, UPS, terminal concentrator or other device providing access to the EMS if a less physically secure medium such as the network is provided by said devices.

Note: Any device providing access to the EMS may provide security even if its external interface is a serial port or other physically secure interface. Once the security requirements have been satisfied by the port must behave as specified above.

Server 2008 Roles for Core

noreply@blogger.com (Anonymous) — Wed, 24 Mar 2010 17:50:00 +0000

New

Steps for installing server roles on a 2008 Server Core installation

To see the roles installed on the server, we should use oclist command.

DNS Server role

To install the DNS Server role

1.At a command prompt, type:

start /w ocsetup DNS-Server-Core-Role

After this by using dnscmd from the command prompt we can configure the configuration part like adding DNS zones & records, One more easy way is there by using remote management we can configure all these configurations from the remote server by using DNS management GUI console.

To uninstall the DNS server role

start /w ocsetup DNS-Server-Core-Role /uninstall

IMPORTANT: Server role should be mentioned with case sensitive.

DHCP Server role

To install the DHCP Server role

1.At a command prompt, type:

start /w ocsetup DHCPServerCore

2.Configure a DHCP scope at the command prompt by using netsh, or by remotely using the DHCP snap-in from Windows Server 2008.

3.If the DHCP server is installed in an Active Directory domain, you must authorize it in Active Directory.

The DHCP Server service does not start automatically by default. Use the following procedure to configure it to start automatically and to start the service for the first time.

To configure and start the DHCP Server service

1.At a command prompt, type:

sc config dhcpserver start= auto

2.Start the service by typing:

net start dhcpserver

start /w ocsetup DHCPServerCore /uninstall at the command prompt will uninstall the DHCP Server role

To install File Services role features

•For File Replication Service, type the following at a command prompt:

start /w ocsetup FRS-Infrastructure

•For Distributed File System service, type:

start /w ocsetup DFSN-Server

•For Distributed File System Replication, type:

start /w ocsetup DFSR-Infrastructure-ServerEdition

•For Services for Network File System (NFS), type:

start /w ocsetup ServerForNFS-Base

start /w ocsetup ClientForNFS-Base

Hyper-V role

To install the Hyper-V role, at a command prompt, type:

start /w ocsetup Microsoft-Hyper-V

To manage Hyper-V on a Server Core installation, use the Hyper-V management tools to manage the server remotely. These tools are available for Windows Server 2008 and Windows Vista Service Pack 1.

Print Services role

To install Print Services role features

•For the Print Server feature, type the following at a command prompt:

start /w ocsetup Printing-ServerCore-Role

•For the Line Printer Daemon (LPD) service, type:

start /w ocsetup Printing-LPDPrintService

To add a printer to the print server

1.Determine the IP address or host name of the printer. This may be on the printer's test or printer configuration page or you might need to refer to the manufacturer's documentation for instructions.

2.Verify that the print server can communicate with the printer through the network by pinging the printer from the print server.

3.On another computer running Windows Vista or Windows Server 2008, open the Print Management console and add the server running the Server Core installation.

4.Expand the entry for the print server running a Server Core installation, right-click Drivers, and then click Add Driver. The Add Printer Driver Wizard starts.

5.Complete the wizard to install the printer driver for your printer.

6.In the Print Management console, right-click Printers and then click Add Printer. The Network Printer Installation Wizard starts.

7.Click Add a TCP/IP or Web Services printer by IP address or hostname and then click Next.

8.Enter the printer's host name or IP address (the port name will be the same by default), and then click Next.

9.Make any necessary changes to the printer name, contact information, or sharing status, and then click Next.

Web Server (IIS) role

To install the Web Server role

1.For the default installation, type the following at a command prompt and press ENTER:

start /w pkgmgr /iu:IIS-WebServerRole;WAS-WindowsActivationService;WAS-ProcessModel

2.For an installation that includes all of the options, type the following at a command prompt and press ENTER:

start /w pkgmgr /iu:IIS-WebServerRole;IIS-WebServer;IIS-CommonHttpFeatures;IIS-StaticContent;IIS-DefaultDocument;

IIS-DirectoryBrowsing;IIS-HttpErrors;IIS-HttpRedirect;IIS-ApplicationDevelopment;IIS-ASP;IIS-CGI;IIS-ISAPIExtensions;

IIS-ISAPIFilter;IIS-ServerSideIncludes;IIS-HealthAndDiagnostics;IIS-HttpLogging;IIS-LoggingLibraries;IIS-RequestMonitor;

IIS-HttpTracing;IIS-CustomLogging;IIS-ODBCLogging;IIS-Security;IIS-BasicAuthentication;IIS-WindowsAuthentication;

IIS-DigestAuthentication;IIS-ClientCertificateMappingAuthentication;IIS-IISCertificateMappingAuthentication;IIS-URLAuthorization;

IIS-RequestFiltering;IIS-IPSecurity;IIS-Performance;IIS-HttpCompressionStatic;IIS-HttpCompressionDynamic;

IIS-WebServerManagementTools;IIS-ManagementScriptingTools;IIS-IIS6ManagementCompatibility;IIS-Metabase;

IIS-WMICompatibility;IIS-LegacyScripts;IIS-FTPPublishingService;IIS-FTPServer;WAS-WindowsActivationService;

WAS-ProcessModel

Known issues for installing a server role on a Server Core installation of Windows Server 2008 R2

•You cannot use the Active Directory Domain Controller Installation Wizard (Dcpromo.exe) on a server running Server Core installation. You must use an unattend file with Dcpromo.exe to install or remove the domain controller role.

Alternately, you can run Dcpromo.exe on another computer running Windows Server 2008 R2 and use the wizard to save an unattend file that you can then use on the server running Server Core installation.

•Dcpromo.exe will restart the computer immediately when the installation is complete or when Active Directory is removed unless RebootOnCompletion=No is included in the answer file.

•The Web Server (IIS) role supports a subset of ASP.NET in Server Core installations of Windows Server 2008 R2. The following IIS features are available in Server Core installations of Windows Server 2008 R2, see the section “Web Server (IIS) role.”

Task: View system information

•Msinfo32

•Set

•Systeminfo

Task: View user information

•Whoami

Task: Manage users and groups

•Net accounts

•Net group

•Net localgroup

•Net user

Task: View or change computer name

•Hostname

•Netdom renamecomputer

Task: Join or leave a domain

•Netdom join

Task: Log off or shut down

•Logoff

•Shutdown

Task: Configure networking

•Ipconfig

•Netsh interface

•Netsh routing

•Route

Task: Configure Windows Firewall

•Netsh advfirewall

Task: Configure Internet Protocol security (IPsec)

•Netsh ipsec

•Scregedit.wsf

Task: Activate Windows

•Slmgr.vbs

Task: Manage services

•Net continue

•Net pause

•Net start

•Net stop

•Sc

•Tasklist

Task: Manage processes

•Taskkill

•Tasklist

•Taskmgr

Task: Manage tasks

•At

•Schtasks

Task: Collect and analyze performance data

•Logman

•Relog

•Typeperf

Task: View events and manage event logs

•Wevtutil

Task: Manage disks and storage

•Compact

•Defrag

•Diskpart

•Diskraid

•Mountvol

Task: Manage Volume Shadow Copy Service (VSS)

•Vssadmin

•Cacl

Task: Manage file systems and file permissions

•Convert

•Fsutil

•Icacls

•Takeown

Task: Manage files

•Openfiles

•Sigverif

Task: Manage shares and share permissions

•Net share

Task: Manage the registry

•Reg

•Regedit

Task: Install and manage drivers

•Driverquery

•Pnputil

•Sc

Task: Install and manage updates

•Pkgmgr

•Scregedit.wsf

•Systeminfo

•Wuauclt

•Wusa

Task: Install roles and features

•Oclist

•Ocsetup

Task: Install applications

•Msiexec

Task: Manage Group Policy

•Gpresult

•Gpupdate

•Secedit

Task: Manage certificates

•Certreq

•Certutil

Task: Manage Terminal Services (Remote Desktop for Administration)

•Change

•Logoff

•Msg

•Mstsc

•Qappsrv

•Qprocess

•Query

•Qwinsta

•Reset session

•Rwinsta

•Shadow

•Tscon

•Tsdiscon

•Tskill

Analyze windows server Crash

noreply@blogger.com (Anonymous) — Sun, 31 Jan 2010 08:30:00 +0000

Analyze windows server Crash
A system crash: If you're lucky, it only ruins your day. More than likely, you're in for several bad days followed by a few stressful weeks or months. After all, systems rarely fail only once. Rather, they keep crashing until you find the cause and fix the problem.
This primer will show you how to solve problems quickly. Using a tool that costs nothing, you can solve approximately 50% of Windows server and workstation crashes in a few minutes. The tool is WinDbg , the free Windows debugger.
You've probably never used the debugger, don't have it and don't want it. After all, it's a developer's tool, not an administrator's, right? Yes, but what you need to know is remarkably easy to learn, and even a rudimentary familiarity with the debugger could enhance your skills and your resume.
Think about this: After rebooting a crashed machine, we've brought up the debugger, opened a memory dump file, given the debugger a single command, and learned not only that the cause was a driver, but also the driver's name — all in less than a minute. Granted, the debugger was installed and configured, we knew what commands to use and what to look for.
Why does Windows crash?
To date, Windows has been used most commonly on the x86 processor. The x86 implements a protection mechanism that lets multiple programs run simultaneously without stepping on each other's toes. This protection comes in four levels of privilege or access to system memory and hardware. Two of these levels are commonly referred to as kernel mode and user mode.
Kernel mode is the most privileged state of the x86. Both the Windows OS and drivers are considered trusted, and, therefore, run in kernel mode. This ensures unfettered access to system resources and the ability to maximize performance. Other software is assigned to user mode, the least-privileged state of the x86, restricting direct access to much of the system. Applications, such as Microsoft Word, run in user mode to guard against applications corrupting system-level software and each other.
Although kernel-mode software is protected from applications running in user mode, it is not protected from other kernel-mode software. For example, if a driver erroneously accesses a portion of memory that is being used by other software (or not specifically marked as accessible to drivers), Windows stops the entire system. This is called a bug check or a crash, and Windows displays the popularly known Blue Screen of Death (BSOD). About 95% of Windows system crashes are caused by buggy software (or buggy device drivers), almost all of which come from third-party vendors. The remaining 5% is due to malfunctioning hardware devices, which often prompt crashes by corrupting memory contents.
Another little-known fact is that most crashes are repeat crashes. Few administrators can resolve system crashes immediately. As a result, they typically happen again and again. It's common to see weeks and months pass before the answer is found. By solving a crash immediately after the first occurrence, you can prevent time-consuming and costly repeat crashes.
We'll focus on solving crashes under Windows 2000, XP and Server 2003. The process is identical for Windows servers and desktops. With respect to the debugging and interpretation process, this information applies with remarkably little differences to other operating systems, such as Linux, Unix and NetWare.
Getting started
To resolve system crashes using WinDbg, you need the following:
A PC with 25M bytes of hard-disk space, a live Internet connection and Microsoft Internet Explorer 5.0 or later.
A PC running Windows Server 2003, Windows 2000 or Windows XP.
The latest version of WinDbg .
A memory dump (the page file must be on C: for Windows to save the memory dump file).
The memory dump is a snapshot of what the system had in memory when it crashed. Few things are more cryptic than a dump file at first glance. Yet it is the best place to go for information on a crash. You can try to get this data in other ways - a user or administrator may remember what the system was doing when it crashed, or that they installed a new hardware device recently, in which case you can check related drivers or hardware - but they could also forget, providing incomplete or inaccurate information.
Windows Server 2003, 2000 and XP create three types of memory dump files:
Small or mini dump : A mini dump is a tiny 64K-byte file. One reason it's so small is that it doesn't contain any of the binary or executable files that are in memory at the time of a system crash. The .exes are needed for full and proper crash analysis, therefore, mini dumps are of limited value without them. However, if you are debugging on the machine that created the dump file, the debugger can find them in the System Root folders, unless they were changed by a system update (we'll provide a workaround for this later). XP and Server 2003 produce mini dumps by default, one for each crash event, as well as a full dump file. While it saves all mini dumps, the system only saves the most recent full dump. Windows 2000 can save mini dumps, but by default it is set to save only a full dump.
Kernel dump : This is equal to the amount of RAM occupied by the operating system's kernel. For an XP PC with 512M bytes of RAM, this is usually around 60M bytes, but it can vary. For most purposes, this crash dump is the most useful. It is significantly smaller than the full memory dump, but it only omits those portions of memory that are unlikely to have been involved in the crash.
Complete or full dump : This is equal to the amount of RAM in the box. Therefore, a machine with 512M bytes of RAM creates a 512M-byte dump file (plus a little). While a full dump contains all possible data and executables the memory has to offer, its sheer size can make it awkward to save or transfer to another machine for debugging. Windows 2000 produces a full dump by default.
Because XP and 2003 are set up to save a mini dump for every crash event, there should be a mini dump file for every crash the machine has had since it was turned on. This data can be extremely valuable, giving you a rich history to inspect.
Saving a memory dump
To resolve system crashes through the inspection of memory dumps, set your servers and PCs to automatically save them with these steps:
Right-click on My Computer
Select Properties
Select Advanced
In the Start up and Recovery section, select Settings; this displays the Startup and Recovery dialog box
In the Write debugging information section, select kernel memory dump
While still in the Start up and Recovery dialog box, ensure that the following options are checked in the System failure section:
Write an event to the system log
Send an administrative alert
Automatically restart
In the Write debugging information, you have the option to save only the most recent dump file or to have the system rename the existing dump file before it creates a new one. We prefer saving the dump files because previous dump files may provide additional or different information - however, space can be an issue, so set this option according to your needs.
The Write debugging information section also tells you where the dump file will be created. On XP and 2003 systems, mini dumps are located at %SystemRoot%\Minidump, or c:\Windows\Minidump; kernel and full dumps are located at %SystemRoot%\MEMORY.DMP or c:\Windows\MEMORY.DMP. For Windows 2000, memory dump files are located at c:\winnt\memory.dmp.
If you don't have a dump file on your machine, you can get one from another system or download one here. This kernel dump is about 20M bytes zipped and 60M bytes extracted. It was created using a testing tool that generates a system crash.
Getting the debugger
The debugger is free and available from Microsoft's Web site. At the site, scroll down until you see the heading, "Installing Debugging Tools for Windows." Select the link, "Install 32-bit version…” and then select the most recent non-beta version and install it. The most recent versions are about 12M-byte downloads. You can do the installation on a PC without restarting it (Don’t be surprised if the site has changed somewhat. Microsoft keeps improving the debugger with releases at least once per year.).
This distribution includes KD.EXE, the command-line kernel debugger; NTSD.EXE, the command-line user-mode debugger; CDB.EXE, the command-line user-mode debugger (a variant of ntsd.exe); and WinDbg, the GUI version of the debugger. WinDbg supports kernel-mode and user-mode debugging, so WinDbg is the one we'll use here.
Setting up the debugger
There are two ways to look at crash data: View what's in memory while the system is stopped (by linking it to a running PC with a null-modem cable, or invoking a product that you pre-installed on the system, such as SoftICE, which lets you step through the code in memory line by line)
Null-modem cables are serial cables that have been configured to send data between two serial ports. They are available at most computer stores. Do not confuse null-modem cables with standard serial cables, which do not connect serial ports.
Given that minimizing interruptions is the goal of most administrators, we opt for the second way: Restart the server or PC, launch the debugger, and open the dump file.
From the program group Debugging Tools for Windows, select WinDbg. After the debugger comes up, you'll immediately notice a lot of … nothing. A blank screen. That's because you have to specify a dump file to analyze and download symbol tables to use in the analysis. Let's take care of the symbol files first.
Symbol tables are a byproduct of compilation. When a program is compiled, the source code is translated from a high-level language into machine code. At the same time, the compiler creates a symbol file with a list of identifiers, their locations in the program, and their attributes. Some identifiers are global and local variables, and function calls. A program doesn't require this information to execute. Therefore, it can be taken out and stored in another file, reducing the size of the final executable.
Smaller executables take up less disk space and load into memory faster than large ones. But there's a flip side: When a program causes a problem, the OS knows only the hex address at which a problem occurred. You need something more than that to determine which program was using that memory space and what it was trying to do. Windows symbol tables hold the answer. Accessing these tables is like laying a map over your system's memory.
Windows symbol files are free from Microsoft's Web site, and the debugger can retrieve them automatically. To set up the debugger to do this, verify that you have a live Internet connection and set the symbol file path in WinDbg by selecting File Symbol File Path. Then enter the following string:
SRV*c:\local cache*http://msdl.microsoft.com/download/symbols
Substituting your own directory path for c:\local cache. For example, if you want the symbols to be placed in c:\symbols, then set your symbol path to
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
The location of the symbol table is up to you.
When opening a memory dump, WinDbg will look at the EXE/DLLs and extract version information. It then creates a request to the symbol server at Microsoft, which includes this version information, and locates the precise symbol tables to draw information from. If you have difficulty retrieving symbol files, check that your firewall permits access to http://msdl.microsoft.com.
If you restrict your debugging to memory dumps from the machine you are on, you will need relatively little hard-disk space for the symbol tables. In most cases 5M-bytes will be more than sufficient. But if you plan to look at dumps from other machines that have different Windows versions and patch levels, you'll need more space for the additional symbol files that support those versions.
System update workaround
If you are trying to analyze mini dumps on a machine that had updates installed after the dumps were created (or if you're analyzing a mini dump file from another machine), the drivers found in your system root will be different (newer) than the ones present when the mini dump were created. To solve this, set the executable image file path by selecting File Image File Path. Then enter the following string: c:\windows\System32; c:\windows\system\System32; http://www.alexander.com/SymServe.
Loading the dump file
To open the dump file that you want to analyze, select File Open Crash Dump. You'll be asked if you want to save workspace information. Click Yes if you want it to remember where the dump file is. WinDbg looks for the Windows symbol files. WinDbg references the symbol file path, accesses microsoft.com, and displays the results. Close the Disassembly window so you are working in the Command window.
NOTE: Don’t be surprised if the debugger seems rather busy following opening of the dump file, especially the first time you try it. It needs to retrieve symbols and, in the case of mini dumps, it needs to retrieve the binaries. This may take a few minutes. Also, the newer release of WinDbg seems to take longer retrieving driver data as well. Be patient. It is worth the wait!
At this point, WinDbg may return an error message, such as the following one, indicating it could not find the correct symbol file.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
If it does, one of the following three things is usually wrong:
Your path is incorrect; check to make sure there are no typos or other errors in the symbol file path you entered earlier.
Your connection failed; check your Internet connection to make sure it is working properly.
Your firewall blocked access to the symbol files or damaged the symbol file during retrieval.
If your path and connection are solid, then it's likely that the problem is your firewall. If a firewall initially blocks WinDbg from downloading a symbol table, it can result in a corrupted symbol file. Unblocking the firewall and attempting to download the symbol file again does not work; the symbol file remains damaged. The quickest fix is to close WinDbg, delete the symbols folder (which you most likely set at c:\symbols), and unblock the firewall. Now, reopen WinDbg and a dump file. The debugger will recreate the folder and re-download the symbols.
If you see this message, "***** Kernel symbols are WRONG. Please fix symbols to do analysis.", WinDbg was unable to retrieve the proper symbols and it will resort to using the default symbol table. But as the warning suggests, it cannot produce accurate results. Remember that symbol tables are generated when programs are compiled, so there is a symbol table file for every Windows version, patch, hot fix, and so on. Using the wrong symbols to track down the cause of a crash is like trying to steer a ship into Boston Harbor with a chart for San Diego. You must use the right ones, so go back up to the section above and ensure you have the right path set, the connection is good, and it is not blocked.
Look through WinDbg's output. You may see an error message similar to the following that indicates it could not locate the symbols for a third-party driver.
*** ERROR: Module load completed but symbols could not be loaded for driver.dll Unable to translate address bf9a2700 with prototype PTE Probably caused by: driver.dll (driver+44bd)
This means that the debugger has found a driver is at fault but, being a third-party driver, there are no symbols for it (Microsoft does not store all of the third-party drivers). You can ignore this. Vendors do not typically ship drivers with symbol files, and they aren't necessary to your work; you can pinpoint the problem driver without them.
Debugger commands
With the dump file loaded into WinDbg, it's time to ask for some diagnostic information. While there are loads of commands to use, two are all you need: !analyze –v and , and lmv.

!analyze –v displays information describing the state of a system when it crashed, the fault encountered, and who is the primary suspect.
lmv displays a list of drivers and their path, version and vendor information. It often includes a product description.
If you want to sound like a software engineer, or if at least you don't want to sound clueless, here's how you pronounce the first command: "bang analyze dash vee."
Analysis with !analyze –v
Type !analyze –v on the command line at the bottom of the Command window. The explanation it gives is a combination of English and programmer-speak, but it is nonetheless a great start. In fact, in many cases you may not need to go any further. If you recognize the cause of the crash, you're probably done.
Here's an example. After typing! analyze –v, we receive the following output:
kd> !analyze -v
KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
(This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address.)
Arguments:Arg1: c0000005, The exception code that was not handledArg2: bf9bc4bd, The address that the exception occurred atArg3: f69f02bc, Trap FrameArg4: 00000000
Debugging Details:------------------EXCEPTION_CODE: c0000005
FAULTING_IP:vdriver+44bdbf9bc4bd 8b4014 mov eax,[eax+0x14]
TRAP_FRAME: f69f02bc -- (.trap fffffffff69f02bc)ErrCode = 00000000eax=00000000 ebx=01740000 ecx=010886a0 edx=f69f069c esi=fa07d400 edi=e161f7f8eip=bf9bc4bd esp=f69f0330 ebp=f69f0344 iopl=0 nv up ei pl nz na pe nccs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202vdriver+44bd:bf9bc4bd 8b4014 mov eax,[eax+0x14] ds:0023:00000014=????????
DEFAULT_BUCKET_ID: DRIVER_FAULTBUGCHECK_STR: 0x8ELAST_CONTROL_TRANSFER: from bf9ba5cf to bf9bc4bd
STACK_TEXT:f69f0344 bf9ba5cf e161f7f8 e17f8e30 e21e4530 vdriver+0x44bdf69f06b0 f69f06e0 e2638678 f69f06e4 f69f0890 vdriver+0x25cfe1bd6b90 1f0507b6 00000000 e1622008 00000010 0xf69f06e000000000 00000000 00000000 00000000 00000000 0x1f0507b6f69f0bf0 805766ef f69f0c78 f69f0c7c f69f0c8c nt!KiCallUserMode+0x4f69f0c4c bf8733cd 00000002 f69f0c9c 00000018 nt!KeUserModeCallback+0x87f69f0ccc bf8722a5 bc667998 0000000f 00000000 win32k!SfnDWORD+0xa0f69f0d0c bf873b38 7196bc2d f69f0d64 00affed0 win32k!xxxDispatchMessage+0x1c0f69f0d58 805283c1 00afff2c 804d2d30 ffffffff win32k!NtUserDispatchMessage+0x39f69f0d58 7ffe0304 00afff2c 804d2d30 ffffffff nt!KiSystemService+0xc400afff08 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4
FOLLOWUP_IP:vdriver+44bdbf9bc4bd 8b4014 mov eax,[eax+0x14]
FOLLOWUP_NAME: MachineOwnerSYMBOL_NAME: vdriver+44bdMODULE_NAME: vdriverIMAGE_NAME: vdriver.dllBUCKET_ID: 0x8E_vdriver+44bd
Look for a section labeled "Debugging Details." Then, scan down until you find DEFAULT_BUCKET_ID:. This provides the general category of the failure. It shows DRIVER_FAULT, indicating that a driver is the likely culprit. Scanning further down to IMAGE_NAME, we see vdriver.dll. We have a suspect!
Analysis with lmv

The next step is to confirm the suspect's existence and find any details about him. Typing lm in the command line displays the loaded modules; v instructs the debugger to output in verbose (detail) mode, showing all known details for the modules. This is a lot of information. Locating the driver of interest can take a while, so simplify the process by selecting edit Find.
Here's an example of output generated by the lmv command:
kd> lmv bf9b8000 bfa0dc00 VDriver (no symbolic information) Loaded symbol image file: VDriver.dll Image path: \SystemRoot\System32\VDriver.dll Checksum: 00058BD5 Timestamp: Fri Sep 28 10:12:47 2001 (3BB4855F) File version: 5.20.10.1066 Product version: 5.20.10.1066 File flags: 8 (Mask 3F) Private File OS: 40004 NT Win32 File type: 3.4 Driver File date: 00000000.00000000 CompanyName: Video Technologies Inc. ProductName: VDisplay Driver for Windows XP InternalName: VDriver.dll OriginalFilename: VDriver.dll ProductVersion: 5.20.10.1066 FileVersion: 5.20.10.1066 FileDescription: Video Display Driver LegalCopyright: Copyright© Video Technologies Inc. 2000-2004 Support: (800) 555-1212
Use File Find to locate the suspect driver. If the vendor was thorough, complete driver/vendor detail is revealed
The amount of information you see depends upon the driver vendor. Some vendors put little information in their files; others, such as Veritas, put in everything from the company name to a support telephone number! If a vendor is thorough, the results from the command will be similar to those shown here.
After you find the vendor's name, go to its Web site and check for updates, knowledge base articles, and other supporting information. If such items don't exist or resolve the problem, contact them. They may ask you to send along the debugging information (it is easy to copy the output from the debugger into an e-mail message or Word document), or they may ask you to send them the memory dump (zip it up first, both to compress it and protect data integrity).
Not aways easy
Finding out what went wrong is often a simple process, but it isn't always so. At least 50% of the time (often 70%), the debugger makes the reason for a crash obvious. But sometimes the information it provides is misleading or insufficient. What do you do then?
Inconsistent answers
If you have recurring crashes but no clear or consistent reason, it may be a memory problem. Download the free test tool, Memtest86. This simple diagnostic tool is quick and works great.
Many people discount the possibility of a memory problem, because they account for such a small percentage of system crashes. However, they are often the cause that keeps you guessing the longest.
The operating system is the culprit
Not likely! As surprising as it may seem, the operating system is rarely at fault. If ntoskrnl.exe (Windows core) or win32.sys (the driver that is most responsible for the "GUI" layer on Windows) is named as the culprit, and they often are, don't be too quick to accept it. It is far more likely that some errant third-party device driver called upon a Windows component to perform an operation and passed a bad instruction, such as telling it to write to non-existent memory. So, while the operating system certainly can err, exhaust all other possibilities before you call Microsoft! The same goes for debugging Unix, Linux, and NetWare.
Wrong driver named
Often you will see an antivirus driver named as the cause. For instance, after using !analyze –v, the debugger reports a driver for your antivirus program at the line "IMAGE_NAME". This may well be the case, but bear in mind that such a driver can be named more often than it is guilty. Here's why: For antivirus code to work it must watch all file openings and closings. To accomplish this, the code sits at a low layer in the operating system and is constantly working. In fact, it is so busy it will often be on the stack of function calls that was active when the crash occurred, even if it did not cause it. Because any third-party driver on that stack immediately becomes suspect, it will often get named. From a mathematical standpoint it is easy to see how it will so often be on the stack whether it actually caused a problem or not.
Little or no vendor information
Not all vendors include needed information (not even their name!). If you use the lmv command and turn up nothing, look at the subdirectories on the image path (if there is one). Often one of them will be the vendor name or a contraction of it. Another option is to search Google. Type in the driver name and/or folder name. You'll probably find the vendor as well as others who have posted information regarding the driver.
Summary
When systems crash your first objective is to get them up and running. Your second is to fix the problem to prevent future crashes. Be willing to use any tool that can help you — even the Windows debugger. It won't give you the cause of every crash event, but it can help you solve 50% or more with two simple commands.

Analyze windows server Crash

noreply@blogger.com (Anonymous) — Sun, 31 Jan 2010 08:30:00 +0000

News

noreply@blogger.com (Anonymous) — Sun, 31 Jan 2010 08:14:00 +0000

Nintendo's Iwata dismisses iPad, 3D gaming
In AP report, Nintendo's Satoru Iwata says he doesn't believe Apple's iPad provides the kind of value some hoped it would. He also doesn't see much value in 3D gaming. 1/29/2010 10:18 AM
Read more Open in browser
Boeing puts 787 Dreamliner through stall tests
Company says that it has put its much-anticipated new plane through more than 50 stall tests and expects to do dozens more. So far, so good. 1/29/2010 8:52 AM
Read more Open in browser
Apple icon drops pants, suggests you e-mail your senator
In a PSA in support of the Clean Energy Jobs and American Power Bill, "Get a Mac" icon Justin Long encourages you to e-mail your senator. He also reminds you he's the Mac guy. 1/28/2010 4:46 PM
Read more Open in browser
McGraw-Hill on iPad launch: We didn't get booted; we weren't part of it
Remarks by CEO led some to believe the publisher was privy to iPad details before the launch, but that wasn't the case. It was never part of the event to begin with, says a spokesman. 1/28/2010 2:26 PM
Read more Open in browser
Who will buy the iPad?
The tech-savvy set has expressed mostly disappointment with Apple's latest device. But that doesn't appear to be Apple's intended audience. 1/28/2010 12:05 PM
Read more Open in browser
Expert sees security issues with the iPad
Security expert says things like strong encryption and an access control feature are missing from Apple's new iPad tablet device. 1/28/2010 10:55 AM
Read more Open in browser
Debating the merits of Apple's iPad
CNET writers Ina Fried and Josh Lowensohn hash out some of the pressing issues about the iPad: its merits, its faults, and what to look forward to in future iterations. 1/28/2010 9:12 AM
Read more Open in browser
$1 million for first perfecto in MLB 2K10
Almost any major league pitcher who threw a perfect game would be a millionaire. Now 2K Sports is offering a million dollars to the first gamer to toss one in its hit baseball video game. 1/28/2010 7:43 AM
Read more Open in browser
How 'Avatar' may predict the future of virtual worlds
When James Cameron invented a camera that integrated footage of actors directly into his digital universe, it may have presaged the worlds millions will spend time in one day. 1/28/2010 1:30 AM
Read more Open in browser
iPad unites Apple's media and mobile ambitions
The new tablet epitomizes Apple's direction as a mobile device maker and gatekeeper of media. 1/28/2010 1:30 AM
Read more Open in browser

Server 2008 Commands based on Tasks

noreply@blogger.com (Anonymous) — Sun, 07 Jun 2009 23:02:00 +0000

Task: View system information
Msinfo32
Set
Systeminfo

Task: View user information
Whoami

Task: Manage users and groups
Net accounts
Net group
Net localgroup
Net user

Task: View or change computer name
Hostname
Netdom renamecomputer

Task: Join or leave a domain
Netdom join

Task: Log off or shut down
Logoff
Shutdown

Task: Configure networking
Ipconfig
Netsh interface
Netsh routing
Route

Task: Configure Windows Firewall
Netsh advfirewallTask: Configure Internet Protocol security (IPsec)
Netsh ipsec
Scregedit.wsf

Task: Activate Windows
Slmgr.vbs

Task: Manage services
Net continue
Net pause
Net start
Net stop
Sc
Tasklist

Task: Manage processes
Taskkill
Tasklist
Taskmgr

Task: Manage tasks
At
Schtasks

Task: Collect and analyze performance data
Logman
Relog
Typeperf

Task: View events and manage event logs
Wevtutil

Task: Manage disks and storage
Compact
Defrag
Diskpart
Diskraid
Mountvol

Task: Manage Volume Shadow Copy Service (VSS)
Vssadmin
Cacl

Task: Manage file systems and file permissions
Convert
Fsutil
Icacls
Takeown

Task: Manage files
Openfiles
Sigverif

Task: Manage shares and share permissions
Net share

Task: Manage the registry
Reg
Regedit

Task: Install and manage drivers
Driverquery
Pnputil
Sc

Task: Install and manage updates
Pkgmgr
Scregedit.wsf
Systeminfo
Wuauclt
Wusa

Task: Install roles and features
Oclist
Ocsetup

Task: Install applications
Msiexec

Task: Manage Group Policy
Gpresult
Gpupdate
Secedit

Task: Manage certificates
Certreq
Certutil

Task: Manage Terminal Services (Remote Desktop for Administration)
Change
Logoff
Msg
Mstsc
Qappsrv
Qprocess
Query
Qwinsta
Reset session
Rwinsta
Shadow
Tscon
Tsdiscon
Tskill

WMI Asset Logger System Management Tool for remote controling the Windows systems

noreply@blogger.com (Anonymous) — Thu, 21 May 2009 18:54:00 +0000

Intro

WMI Asset Logger is a multifaceted utility that has the ability to return a great deal of information about windows based computer systems on your network, all from the convenience of your Windows XP workstation. WMI Asset Logger is also much more than that too, it is an administrator’s friend. Once you have scanned your network the true power of WMI Asset Logger comes out. Using the right-click speed menu enables you to quickly perform many tasks. Simply right-click on the desired host and choose Remote Control (initiate RDP Session), Remote Management Console, Install Software, View/Browse/Delete Shares, View/Start/Stop Processes on remote systems, and more. If you have administrative rights to a XP workstation, but the firewall is preventing you from getting results, simply right-click on the system and disable the XP firewall. Wait one minute, and rescan the system.

Tired of having client/server based tools that blue-screen remote hosts? Or tired of dealing with messy Logon scripts to gather important information? WMI Asset Logger does not require any client-side installations and is a stand alone application. WMI Asset Logger uses all the tools that already exist on your XP Workstation to perform its duties. These utilities are native to windows and are much more stable than any add-on could hope to be. WMI Asset Logger also monitors its own progress too, if a client system hangs up WMI Asset Logger and you have to terminate it, it will automatically blacklist the computer system that was being scanning when it was terminated.

Just need a down dirty quick inventory of NetBIOS -> IP -> MAC -> FQDN relationships? Not a problem, simply perform an IP Inventory using WMI Asset Logger. WMI Asset logger will blaze through a list of 2000 computer with impressive speeds, and will even return the IP Address of systems that are currently off-line, allowing you to determine if a system’s account may need to be deleted. (No IP information typically means the PC hasn’t been seen in the duration of a DHCP lease cycle).

You can enumerate a list of hosts to scan using the master browser list, or through the use of ADSI (Active Directory Server Interface). WMI Asset logger can also import text files as well as directly import DSQUERY COMPUTER text dumps too. And as a last resort an IP Ping Sweeper that will ping every IP Address that exists between any two addresses. WMI Asset Logger has the ability to save scans to Tab delimited text files, Straight to Microsoft Excel, or directly to your default printer, and now as of version 5.7f, dump your scans straight to the included MS Access Database.

Features

Microsoft Access Database Support - no limitations on number of clients.
FREELY LICENSED FOR PERSONAL AND CORPORATE USE.
Windows Management Instrumentation (WMI) Network Scanning.
DNS Forward/Reverse look-up tool.
InstallNow! Use WMI to remotely install software packages in real-time.
Dump Advanced WMI report of any computer straight to HTML or XLS.
View, Create, and Stop remote processes on any computer (requires necessary user rights).
View, Explore, Map, and Delete remote shares, including hidden shares!
Perform an IP Inventory. This generates a list of NetBIOS --> IP --> MAC --> FQDN for all your windows hosts. (amazingly fast too)
NEW! Script Runner ! RUN YOUR OWN EXTERNAL VBS, BAT, or CMD FILES USING WMI Asset Logger!
Remote software installation, this copies files to the remote computer and adds a RunOnce registry entry. This causes the installation to run silently in the background the next time the PC is re-booted.
Remotely start/stop Windows XP Firewall Service! Sometimes the Windows XP Firewall will prevent the WMI interface from responding on the remote system. WMI Asset Logger can disable the firewall of the remote host so you can still get results.
Use of Alternate User credentials for WMI scanning.
Import DSQUERY COMPUTER text file dumps directly into WMIAL.
Alternate user passwords are encrypted for security purposes.
In-depth information on systems that return results via WMI.
Right-click speed menu system and Hot-Key enabled menu systems.
Dump straight to your default printer, from WMIAL, with out the need for any third-party software. No need to open results in Excel or Word to print.
Dump directly to Microsoft Excel 97, 2000, XP, and 2003!
Right-click management of scanned systems, and remote control(Remote Control requires Windows XP)
Push software to large numbers of computers with a few simple clicks.
Non-proprietary Information storage for flexibility and portability. (TAB Delimited Text file dumps).
Text File importing, scan a specific list of systems with-out having to muddle through an expansive list of computers in the Network Neighborhood.
Fall back Registry scanning in the event WMI is not present or errors out.
Reboot or shutdown remote hosts.
Result type filtering, great for finding systems that don’t have WMI, or for finding systems where your access is denied (which means you need to go add your global admin groups)
OS Filtering. You can use this to filter out NT, XP, or 2000 systems.
IP Ping utility, use PING to generate a list of scan candidates from just about any range of IP Addresses.
Browse List Enumeration for faster scanning and ADSI Enumeration for pulling domain member list.
You can dump multiple domains into the list for scanning, and then select systems across domains to scan in the even you have people spread out over a few locations or states.
Automated E-Mailing of the results via. SMTP

To Download this tool click on this link

TRUECRYPT Data Security Open Source Tool

noreply@blogger.com (Anonymous) — Thu, 21 May 2009 18:45:00 +0000

TrueCrypt is a software system for establishing and maintaining an on-the-fly-encrypted volume (data storage device). On-the-fly encryption means that data is automatically encrypted or decrypted right before it is loaded or saved, without any user intervention. No data stored on an encrypted volume can be read (decrypted) without using the correct password/keyfile(s) or correct encryption keys. Entire file system is encrypted (e.g., file names, folder names, contents of every file, free space, meta data, etc).

Files can be copied to and from a mounted TrueCrypt volume just like they are copied to/from any normal disk (for example, by simple drag-and-drop operations). Files are automatically being decrypted on the fly (in memory/RAM) while they are being read or copied from an encrypted TrueCrypt volume. Similarly, files that are being written or copied to the TrueCrypt volume are automatically being encrypted on the fly (right before they are written to the disk) in RAM. Note that this does not mean that the whole file that is to be encrypted/decrypted must be stored in RAM before it can be encrypted/decrypted. There are no extra memory (RAM) requirements for TrueCrypt. For an illustration of how this is accomplished, see the following paragraph.Let's suppose that there is an .avi video file stored on a TrueCrypt volume (therefore, the video file is entirely encrypted). The user provides the correct password (and/or keyfile) and mounts (opens) the TrueCrypt volume. When the user double clicks the icon of the video file, the operating system launches the application associated with the file type – typically a media player. The media player then begins loading a small initial portion of the video file from the TrueCrypt-encrypted volume to RAM (memory) in order to play it. While the portion is being loaded, TrueCrypt is automatically decrypting it (in RAM). The decrypted portion of the video (stored in RAM) is then played by the media player. While this portion is being played, the media player begins loading next small portion of the video file from the TrueCrypt-encrypted volume to RAM (memory) and the process repeats. This process is called on-the-fly encryption/decryption and it works for all file types, not only for video files.

Note that TrueCrypt never saves any decrypted data to a disk – it only stores them temporarily in RAM (memory). Even when the volume is mounted, data stored in the volume is still encrypted. When you restart Windows or turn off your computer, the volume will be dismounted and files stored in it will be inaccessible (and encrypted). Even when power supply is suddenly interrupted (without proper system shut down), files stored in the volume are inaccessible (and encrypted). To make them accessible again, you have to mount the volume (and provide the correct password and/or keyfile).

To Download the Truecrypt Link

Expanding Virtual Disk of VMware Server in Windows

noreply@blogger.com (Anonymous) — Thu, 21 May 2009 18:20:00 +0000

To expand an existing partition, the Virtual Machine must be shutdown and powered off. The vmware-vdiskmanager utility resides in the directory that VMWare server was installed. Open a command prompt and navigate to the VMWare server directory.

C:\Program Files>cd VMware

C:\Program Files\VMware>cd "VMware Server"

C:\Program Files\VMware\VMware Server>vmware-vdiskmanager -x 25GB "d:\VM\ForumTest\ForumDB.vmdk"
Using log file C:\DOCUME~1\Jakki\LOCALS~1\Temp\vmware-jakki\vdiskmanager.log

Grow: 100% done.
The old geometry C/H/S of the disk is: 2610/255/63
The new geometry C/H/S of the disk is: 3263/255/63
Disk expansion completed successfully.

WARNING: If the virtual disk is partitioned, you must use a third-party
utility in the virtual machine to expand the size of the
partitions. For more information, see:
http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=1647
You should now see the new size of the virtul disk. Also, notice the Warning message above. You will need to use a third party tool such as Partition Magic or Acronis Disk Director to resize the partition inside the Virtual Machine Operating System.
To list all available options for vmware-vdiskmanager, just enter the following at a command prompt:
vmware-vdiskmanager.exe /?

Steps for installing server roles on a 2008 Server Core installation

noreply@blogger.com (Anonymous) — Sun, 17 May 2009 15:40:00 +0000

To see the roles installed on the server, we should use oclist command.

DNS Server role
To install the DNS Server role
1. At a command prompt, type:
start /w ocsetup DNS-Server-Core-Role

After this by using dnscmd from the command prompt we can configure the configuration part like adding DNS zones & records, One more easy way is there by using remote management we can configure all these configurations from the remote server by using DNS management GUI console.

To uninstall the DNS server role

start /w ocsetup DNS-Server-Core-Role /uninstall

IMPORTANT: Server role should be mentioned with case sensitive.

DHCP Server role
To install the DHCP Server role
1. At a command prompt, type:
start /w ocsetup DHCPServerCore
2. Configure a DHCP scope at the command prompt by using netsh, or by remotely using the DHCP snap-in from Windows Server 2008.
3. If the DHCP server is installed in an Active Directory domain, you must authorize it in Active Directory. The DHCP Server service does not start automatically by default. Use the following procedure to configure it to start automatically and to start the service for the first time.

To configure and start the DHCP Server service
1. At a command prompt, type:
sc config dhcpserver start= auto
2. Start the service by typing:
net start dhcpserver
start /w ocsetup DHCPServerCore /uninstall at the command prompt will uninstall the DHCP Server role

To install File Services role features

For File Replication Service, type the following at a command prompt:
start /w ocsetup FRS-Infrastructure

For Distributed File System service, type:
start /w ocsetup DFSN-Server

For Distributed File System Replication, type:
start /w ocsetup DFSR-Infrastructure-ServerEdition

For Services for Network File System (NFS), type:
start /w ocsetup ServerForNFS-Base
start /w ocsetup ClientForNFS-Base

Hyper-V role
To install the Hyper-V role, at a command prompt, type:
start /w ocsetup Microsoft-Hyper-V
To manage Hyper-V on a Server Core installation, use the Hyper-V management tools to manage the server remotely. These tools are available for Windows Server 2008 and Windows Vista Service Pack 1.

Print Services role
To install Print Services role features
For the Print Server feature, type the following at a command prompt:
start /w ocsetup Printing-ServerCore-Role
For the Line Printer Daemon (LPD) service, type:
start /w ocsetup Printing-LPDPrintService
To add a printer to the print server
1. Determine the IP address or host name of the printer. This may be on the printer's test or printer configuration page or you might need to refer to the manufacturer's documentation for instructions.
2. Verify that the print server can communicate with the printer through the network by pinging the printer from the print server.
3. On another computer running Windows Vista or Windows Server 2008, open the Print Management console and add the server running the Server Core installation.
4. Expand the entry for the print server running a Server Core installation, right-click Drivers, and then click Add Driver. The Add Printer Driver Wizard starts.
5. Complete the wizard to install the printer driver for your printer.
6. In the Print Management console, right-click Printers and then click Add Printer. The Network Printer Installation Wizard starts.
7. Click Add a TCP/IP or Web Services printer by IP address or hostname and then click Next.
8. Enter the printer's host name or IP address (the port name will be the same by default), and then click Next.
9. Make any necessary changes to the printer name, contact information, or sharing status, and then click Next.

Web Server (IIS) role
To install the Web Server role
For the default installation, type the following at a command prompt and press ENTER:
start /w pkgmgr /iu:IIS-WebServerRole;WAS-WindowsActivationService;WAS-ProcessModel

For an installation that includes all of the options, type the following at a command prompt and press ENTER:

start /w pkgmgr /iu:IIS-WebServerRole;IIS-WebServer;IIS-CommonHttpFeatures;IIS-StaticContent;IIS-DefaultDocument;IIS-DirectoryBrowsing;IIS-HttpErrors;IIS-HttpRedirect;IIS-ApplicationDevelopment;IIS-ASP;IIS-CGI;IIS-ISAPIExtensions;IIS-ISAPIFilter;IIS-ServerSideIncludes;IIS-HealthAndDiagnostics;IIS-HttpLogging;IIS-LoggingLibraries;IIS-RequestMonitor;IIS-HttpTracing;IIS-CustomLogging;IIS-ODBCLogging;IIS-Security;IIS-BasicAuthentication;IIS-WindowsAuthentication;IIS-DigestAuthentication;IIS-ClientCertificateMappingAuthentication;IIS-IISCertificateMappingAuthentication;IIS-URLAuthorization;IIS-RequestFiltering;IIS-IPSecurity;IIS-Performance;IIS-HttpCompressionStatic;IIS-HttpCompressionDynamic;IIS-WebServerManagementTools;IIS-ManagementScriptingTools;IIS-IIS6ManagementCompatibility;IIS-Metabase;IIS-WMICompatibility;IIS-LegacyScripts;IIS-FTPPublishingService;IIS-FTPServer;WAS-WindowsActivationService;WAS-ProcessModel

Known issues for installing a server role on a Server Core installation of Windows Server 2008 R2

1)You cannot use the Active Directory Domain Controller Installation Wizard (Dcpromo.exe) on a server running Server Core installation. You must use an unattend file with Dcpromo.exe to install or remove the domain controller role. Alternately, you can run Dcpromo.exe on another computer running Windows Server 2008 R2 and use the wizard to save an unattend file that you can then use on the server running Server Core installation.

2)Dcpromo.exe will restart the computer immediately when the installation is complete or when Active Directory is removed unless RebootOnCompletion=No is included in the answer file.

3)The Web Server (IIS) role supports a subset of ASP.NET in Server Core installations of Windows Server 2008 R2. The following IIS features are available in Server Core installations of Windows Server 2008 R2, see the section “Web Server (IIS) role.”

How to create Automated installation Answer file for XP

noreply@blogger.com (Anonymous) — Wed, 22 Apr 2009 07:12:00 +0000

Windows Setup Manager provides a straightforward wizard interface. To create an answer file for a fully automated installation by using Windows Setup Manager, use these steps:
1. In Windows Explorer, locate the folder where you extracted Windows Setup Manager (setupmgr.exe). Double-click setupmgr.exe. Windows XP Professional starts the Windows Setup Manager Wizard.
2. Click Next. The New Or Existing Answer File page appears.
3. Ensure that the Create A New Answer File is selected, and then click Next. The Windows Setup Manager Wizard displays the Product To Install page, which provides the following three options:
❑ Windows Unattended Installation
❑ Sysprep Install
❑ Remote Installation Services
4. Ensure that Windows Unattended Installation is selected, and then click Next. The Windows Setup Manager Wizard displays the Platform page.
5. Ensure that Windows XP Professional is selected, and then click Next. The Windows Setup Manager Wizard displays the User Interaction Level page, shown in Figure 3-2, which has the following five options:
❑ Provide Defaults. The answers you provide in the answer file are the default answers that the user sees. The user can accept the default answers or change any of the answers supplied by the script.
❑ Fully Automated. The installation is fully automated. The user does not have the chance to review or change the answers supplied by the script.
❑ Hide Pages. The answers provided by the script are supplied during the installation. Any page for which the script supplies all answers is hidden from the user, so the user cannot review or change the answers supplied by the script.
❑ Read Only. The script provides the answers, and the user can view the answers on any page that is not hidden, but the user cannot change the answers.
❑ GUI Attended. The text-mode portion of the installation is automated, but the user must supply the answers for the graphical user interface (GUI) mode portion of the installation.

6. Select Fully Automated, and then click Next. The Windows Setup Manager Wizard displays the Distribution Folder page. The Setup Manager Wizard can create a distribution folder on your computer or network containing the required source files. You can add files to this distribution
folder to further customize your installation.
7. Select No, This Answer File Will Be Used To Install From A CD, and then click Next. The Windows Setup Manager Wizard displays the License Agreement page.
8. Select I Accept The Terms Of The License Agreement, and then click Next.

9. Type your name in the Name box and your organization in the Organization box, and then click Next. The Windows Setup Manager Wizard displays the Display Settings page.
10. Leave the default settings on the Display Settings page, and then click Next. The Windows Setup Manager displays the Time Zone page.
11. Select the appropriate time zone, and then click Next. The Windows Setup Manager Wizard displays the Providing The Product Key page.
12. Type in the appropriate product key.
13. Click Next. The Windows Setup Manager Wizard displays the Computer Names page, shown
in Figure 3-4. Notice that you have three choices:
❑ Enter a series of names to be used during the various iterations of the script.
❑ Click Import and provide the name of a text file that has one computer name per line listed. Setup imports and uses these names as the computer names in the various iterations of the script.
❑ Select Automatically Generate Computer Names Based On Organization Name to allow the system to automatically generate the computer names to be used.

14. In the Computer Name text box, type a name for the computer, and then click Add. Repeat this step to add additional computers to the installation.
15. Click Next. The Windows Setup Manager Wizard displays the Administrator Password page,
which appears with the following two options:

❑ Prompt The User For An Administrative Password
❑ Use The Following Administrative Password (127 Characters Maximum)
Notice that you have the option to encrypt the Administrator’s password in the answer file. You also have the option to have the Administrator log on automatically, and you can set the number of times you want the Administrator to log on automatically when the computer is restarted.
16. Ensure that Use The Following Administrative Password (127 Characters Maximum)
is selected, and then type a password in the Password text box and the Confirm Password box.
17. Select Encrypt Administrator Password In Answer File, and then click Next. The Windows Setup Manager Wizard displays the Networking Components page, shown in Figure 3-5, with the following two options:
❑ Typical Settings. Installs Transmission Control Protocol/Internet Protocol (TCP/IP), enables Dynamic Host Configuration Protocol (DHCP), installs the Client For Microsoft Networks protocol, and installs File And Printer Sharing For Microsoft Networks for each destination computer
❑ Customize Settings. Allows you to select and configure the networking components to be installed

18. Configure network settings as appropriate for your network, and then click Next. The Windows Setup Manager Wizard displays the Workgroup Or Domain page.
19. If the computer will join a workgroup, type the workgroup name. If the computer will join a domain, click Windows Server Domain, and then type the name of the domain. If a computer that will join a domain does not already have a computer account in that domain, you can have Windows Setup create such an account during installation. Click Create A Computer Account In The Domain, and then enter the credentials for an account that has permission to create new computer accounts in the domain. Click Next to continue. The Windows Setup Manager Wizard displays the Telephony page.
20. Select the appropriate setting for What Country/Region Are You In.
21. Type the appropriate setting for What Area (Or City) Code Are You In.
22. If necessary, type the appropriate setting for If You Dial A Number To Access An Outside Line, What Is It.
23. Select the appropriate setting for The Phone System At This Location Uses, and then click Next. The Windows Setup Manager Wizard displays the Regional Settings page. The default selection is Use The Default Regional Settings For The Windows Version You Are Installing, but you can also specify different regional settings.
24. Configure the regional settings, and then click Next. The Windows Setup Manager Wizard displays the Languages page, which allows you to add support for additional languages.
25. Select additional languages if they are required for the computers on which you will install Windows XP Professional, and then click Next. The Windows Setup Manager Wizard displays the Browser And Shell Settings page with the following three options:
❑ Use Default Internet Explorer Settings
❑ Use An Autoconfiguration Script Created By The Internet Explorer Administration
Kit To Configure Your Browser
❑ Individually Specify Proxy And Default Home Page Settings
26. Make your selection, and then click Next. The Windows Setup Manager Wizard displays the Installation Folder page with the following three options:
❑ A Folder Named Windows. This is the default selection.
❑ A Uniquely Named Folder Generated By Setup. Setup generates a unique folder name so that the installation folder will be less obvious. This folder name is recorded in the Registry, so programs and program installations can easily access the Windows XP Professional system files and folders.
❑ This Folder. If you select this option, you must specify a path and folder name.
27. Make your selection, and then click Next. The Windows Setup Manager Wizard displays the Install Printers page, shown in Figure 3-6, which allows you to specify a network printer to be installed the first time a user logs on after Setup.

28. Add any printers that you want to configure during installation, and then click Next. The Windows Setup Manager Wizard displays the Run Once page. This page allows you to configure Windows to run one or more commands the first time a user logs on.
29. To add a command, type the command in the Command To Run text box, and then click Add. Click Next when you are finished adding commands. The Windows Setup Manager Wizard displays the Additional Commands page. This page allows you to specify additional commands to be run at the end of the unattended setup before any user logs on to the computer.
30. To add a command, type the command in the Command To Run text box, and then click Add. Click Finish when you are finished adding commands. The Windows Setup Manager Wizard displays a dialog box indicating that the Windows Setup Manager has successfully created an answer file. It also prompts you for a location and a name for the script. The default is a file named unattend.txt in the folder from which you launched Windows Setup Manager.
31. Accept the default name and location, or type an alternate name and location. Click OK to continue. The Windows Setup Manager Wizard displays the Setup Manager Complete page,
indicating that new files were created:
❑ unattend.txt is the answer file.
❑ unattend.udb is the uniqueness database file created if you supply multiple computer names.
❑ unattend.bat is a batch script that will launch the Windows installation using the answer file and uniqueness database file.
32. On the File menu, click Exit.

SUS Client Setting

noreply@blogger.com (Anonymous) — Wed, 22 Apr 2009 04:03:00 +0000

Client Side installation of SUS service

The SUS component is available for download from (http://www.microsoft.com/
windows2000/windowsupdate/sus/default.asp). After the download is complete, double-
click the setup file to begin the installation process and simply follow the menu
prompts for a Typical installation (a Custom installation lets you choose the folder
where the service is installed and the location where updates are stored).

To Use Group Policy to Configure Clients to Access SUS

After SUS is installed in your environment, you need to configure the client systems to
use it—otherwise, they will just keep using the Windows Update public server instead.
You must use Group Policy to configure clients to use the SUS server.

To set the Group Policy, follow these steps:
1. Log on as a domain administrator or open the Active Directory Users And Computers
tool using the Run As command to enter the appropriate credentials.
2. Right-click the domain or organizational unit and choose Properties from the
shortcut menu.
3. Switch to the Group Policy tab.
4. You could edit the default domain policy, but it is normally recommended that
you create another one for these types of secondary settings. To do this, choose
the New button and name the new policy that appears in the window.
5. After you have named the policy, click the Edit button to open the Group Policy
Object Editor window.
6. Expand the Computer Configuration node, then the Administrative Templates
node, then the Windows Components node, and then the Windows Update node.
7. Double-click the Configure Automatic Updates setting to specify any of the following:
❑ Notify The User Before Download And Before Installation
❑ Automatically Download And Notify The User Before Installation
❑ Automatically Download And Schedule An Automatic Installation
8. Double-click the Specify Intranet Microsoft Update Service Location setting.
Change the setting to Enabled and enter the name of the internal SUS server that
the clients in the domain should use into both fields. This information can be
entered by name or by IP address.
9. Double-click the Reschedule Automatic Updates scheduled installations setting to
change the schedule for automatic installation on clients.
10. Double-click the No Auto-Restart For Scheduled Automatic Updates installations
to prevent clients from restarting after an automatic installation.

Windows XP Editions

noreply@blogger.com (Anonymous) — Wed, 22 Apr 2009 02:52:00 +0000

Available Windows XP Editions

1. Windows XP Professional Edition
2. Windows XP Home Edition
3. Windows XP Media Center Edition
4. Windows XP Tablet PC Edition
5. Windows XP 64-Bit Edition

Windows XP Professional Edition

Windows XP Professional Edition is intended for computers that are part of a corporate
network, for the majority of computers on small networks, and for home users who
need certain advanced capabilities. Windows XP Professional sets the standard for
desktop performance, security, and reliability.

Windows XP Home Edition

Windows XP Home Edition, which is intended for home users, simplifies many aspects
of networking and file management so that home users have a cleaner experience. In
particular, Windows XP Home Edition has the following limitations compared with
Windows XP Professional

■ Windows XP Home Edition does not support the use of NTFS or print permissions.
Instead, Windows XP Home Edition supports only Simple File Sharing.
■ Windows XP Home Edition does not support the use of dynamic disks.
■ Windows XP Home Edition does not support the Encrypting File System (EFS).
■ Windows XP Home Edition supports only one processor, whereas Windows XP
Professional supports two processors.
■ Windows XP Home Edition does not include Internet Information Services.
■ Windows XP Home Edition does not include Remote Desktop.
■ Windows XP Home Edition does not provide Remote Installation Services (RIS).

Windows XP Media Center Edition

The Windows XP Media Center Edition 2004 operating system is available only on new
Media Center PCs—computers with special hardware features that enable users to connect
the computer as an integral part of a home entertainment system. Because of its
special requirements, Media Center PCs running Windows XP Media Center Edition are
available only from Microsoft PC manufacturer partners.

Windows XP Tablet PC Edition

The Windows XP Tablet PC Edition operating system expands on Windows XP Professional,
providing all the features and performance of Windows XP Professional, while also providing additional capabilities designed to take advantage of a touch-screen interface pen input, handwriting recognition, and speech recognition. Windows XP Tablet PC Edition offers users the efficiency and dependability of Windows XP Professional. For developers, it offers a rich platform for creating new applications or extending their current applications to take advantage of Tablet PC handwriting and speech capabilities.

Windows XP 64-Bit Edition

Microsoft Windows XP 64-Bit Edition, which provides support for the 64-bit computing platforms, is designed to meet the demands of advanced technical workstation users who require large amounts of memory and floating point performance in areas such as mechanical design and analysis, 3D animation, video editing and composition, and scientific and high-performance computing applications. One of the key differences between the 64-bit and 32-bit platforms is that the 64-bit platform supports considerably more system memory—up to 16 GB of physical RAM.

Windows 2008 Monitoring Tips

noreply@blogger.com (Anonymous) — Mon, 02 Feb 2009 10:18:00 +0000

There are two ways to find the system uptime in Windows Vista/Server 2008/XP/2003.

1 Using Systeminfo utility
The Systeminfo utility shows you the system boot time. The time originally the system was booted and running from. To run the command,

1. Click Start - search and type “cmd” (Start - Run, cmd in Windows XP
/2003). This should launch the command prompt.
2. From the command prompt, type “systeminfo“. This should check various system stats like installation date, hotfixes etc. Look for the “System boot time”

2 Using “net statistics” command
The “net” command can perform various operations and one of them is the system statistics of a workstation or a server. From the command prompt run, the following command

c:\>net statistics workstation
This will run a check and provide with the system statistics. Look for the line which reads as “statistics since” where it indicates the stats are from the last system startup time.

Windows Server 2008 Command-line Tool Summary

The following table provides a list of each command line tool together with a brief explanation: Command Description

Arp: Display the IP to physical address translation tables used by the

Address Resolution Protocol (ARP).

Assoc : Display and modify file extension associations.

Attrib: Display and change file attributes.

Break : Configure extended Ctrl-C checking.

Bcdedit : Configure properties in name database to control boot loading.

Cacls : Display or modify access control lists of files.
Call : Call a script or script label as a procedure.
CD/Chdir : Display the name of or changes the current directory.
Chcp : Display or set the active code page number.
Chkdsk : Check a disk for errors and display a report.
Chkntfs : Display the status of volumes. Set or exclude volumes from automatic system checking during system boot.
Choice : Create a selection list from which users can select a choice in batch scripts.
Cls : Clear the console window.
Cmd : Start a new instance of the Windows command shell.
Color : Set the colors of the command-shell window.
Comp : Compare the contents of two files or sets of files.
Compact : Display or modify the compression of files or sets of files.
Convert : Convert FAT volumes to NTFS.
Copy : Copy or combine files.
Date : Display or set the system date.
Del : Delete one or more files.
Dir : Display a list of files and subdirectories within a directory.
Diskcomp : Compare the contents of two floppy disks.
Diskcopy : Copy the contents of one floppy disk to another.
Diskpart : Invoke a text-mode command interpreter so that you can manage disks, partitions, and volumes using a separate command prompt and commands that are internal to Diskpart.
Doskey : Edit command lines, recall Windows commands, and create macros.
Driverquery : Display the current device driver properties and status.
Echo : Display messages, or turns command echoing on or off.
Endlocal : End localization of environment changes in a batch file.
Exit : Exit the command interpreter.
Expand : Uncompress files.
FC : Compare two files and display the differences between them.
Find/Findstr : Search for a text string in files.
For : Run a specified command for each file in a set of files.
Format : Format a floppy disk or hard drive.
Fsutil : File system utility - displays and configures file system properties.
Ftp : Transfer files.
Ftype : Display or modify file types used in file extension associations.
Goto : Direct the Windows command interpreter to a labeled line in a script.
Gpresult : Display Group Policy information for a machine or user.
Graftabl : Enable Windows to display extended character sets in graphics mode.
Help : Display Help information for Windows commands.
Hostname : Display the computer name.
ICACLS : Display, modify, backup, and restore ACLs for files and directories.
IF : Perform conditional processing in batch programs.
Ipconfig : Display TCP/IP configuration.
Label : Create, change, or delete the volume label of a disk.
Md/Mkdir : Create a directory or subdirectory.
Mklink : Create symbolic and hard links.
Mode : Configure a system device.
More : Display output one screen at a time.
Mountvol : Manage a volume mount point.
Move : Move files from one directory to another directory on the same drive.
Openfiles : Display files opened by remote users for a file share.
Nbtstat : Display status of NetBIOS.
Net Accounts : Manage user account and password policies.
Net Computer : Add or remove computers from a domain.
Net Config Server : Display or modify configuration of Server service.
Net Config Workstation : Display or modify configuration of Workstation service.
Net Continue : Resume a paused service.
Net File : Display or manage open files on a server.
Net Group : Display or manage global groups.
Net Localgroup : Display or manage local group accounts.
Net Pause : Suspend a service.
Net Print : Display or manage print jobs and shared queues.
Net Session : List or disconnect sessions.
Net Share : Display or manage shared printers and directories.
Net Start : List or start network services.
Net Statistics : Display workstation and server statistics.
Net Stop : Stop services.
Net Time : Display or synchronize network time.
Net Use : Display or manage remote connections.
Net User : Display or manage local user accounts.

Net View : Display network resources or computers.
Netsh : Invoke a separate command prompt that allows you to manage the configuration of various network services on local and remote computers.
Netstat : Display status of network connections.
Path : Display or set a search path for executable files in the current command window.
Pathping : Trace routes and provides packet loss information.
Pause : Suspend processing of a script and wait for keyboard input.
Ping : Determine if a network connection can be established.
Popd : Change to the directory stored by Pushd.
Print : Print a text file.
Prompt : Change the Windows command prompt.
Pushd : Save the current directory then changes to a new directory.
Rd/Rmdir : Remove a directory.
Recover : Recover readable information from a bad or defective disk.

Reg Add : Add a new subkey or entry to the Registry.
Reg Compare : Compare Registry subkeys or entries.
Reg Copy : Copy a Registry entry to a specified key path on a local or remote system.

Reg Delete : Delete a subkey or entries from the Registry.
Reg Query : List the entries under a key and the names of subkeys (if any).
Reg Restore : Write saved subkeys and entries back to the Registry.
Reg Save : Save a copy of specified subkeys, entries, and values to a file.
Regsvr32 : Register and unregister DLLs.
Rem Add : comments to scripts.
Ren : Rename a file.
Replace : Replace a file.
Route : Manage network routing tables.
Rmdir : Remove a directory.
Set : Display or modify Windows environment variables. Also used to evaluate numeric expressions at the command line.
Setlocal : Begin localization of environment changes in a batch file.
Sc : Display and configure background processes (services).
Sch : tasks : Schedule commands and programs to run on a system.
Sfc : Scans and verifies protected operating system files.
Shift : Shifts the position of replaceable parameters in scripts.
Shutdown : Perform system shutdown.
Sort : Sort input.
Start : Start a new command-shell window to run a specified program or command.
Subst : Maps a path to a drive letter.
Systeminfo : Display machine properties and configuration.
Tasklist : Display currently running tasks and services.
Taskkill : Kill or stop a running process or application.
Time : Display or sets the system time.
Title : Sets the title for the command-shell window.
Tracert : Display the path between computers.
Tree : Graphically displays the directory structure of a drive or path.
Type : Display the contents of a text file.
Ver : Display the Windows version.
Verify : Tells Windows whether to verify that your files are written correctly to a disk.
Vol : Display a disk volume label and serial number.
Xcopy : Copy files and directories.
WMI : Display WMI information.

Command Line Console Name

AdRmsAdmin.msc -Active Directory Rights Management Services
Adsiedit.msc - ADSI Edit
Azman.msc - Authorization Manager
Certmgr.msc - Certmgr (Certificates)
Certtmpl.msc - Certificates Template Console
CluAdmin.msc - Failover Cluster Management
Comexp.msc - Component Services
Compmgmt.msc - Computer Management
Devmgmt.msc - Device Manager
Dfsmgmt.msc - DFS Management
Dhcpmgmt.msc - DHCP Manager
Diskmgmt.msc - Disk Management
Dnsmgmt.msc - DNS Manager
Domain.msc - Active Directory Domains And Trusts
Dsa.msc - Active Directory Users And Computers
Dssite.msc - Active Directory Sites And Services
Eventvwr.msc - Event Viewer
Fsmgmt.msc - Shared Folders
Fsrm.msc File - Server Resource Manager
Fxsadmin.msc - Microsoft Fax Service Manager
Gpedit.msc - Local Group Policy Editor
Lusrmgr.msc - Local Users And Groups
Napclcfg.msc - NAP Client Configuration
Nfsmgmt.msc - Services For Network File System
Nps.msc - Network Policy Server
Ocsp.msc - Online Responder
Perfmon.msc - Reliability And Performance Monitor
Pkiview.msc - Enterprise PKI
Printmanagement.msc - Print Management
Remoteprograms.msc - TS RemoteApp Management
Rsop.msc - Resultant Set of Policy
Secpol.msc - Local Security Policy
ServerManager.msc - Server Manager
StorageMgmt.msc - Share And Storage Management
Services.msc - Services
StorExpl.msc - Storage Explorer
Tapimgmt.msc - Telephony
Taskschd.msc - Task Scheduler
Tmp.msc - Trusted Platform Module (TPM) Management
Tsadmin.msc - Terminal Services Management
Tsconfig.msc - Terminal Services Configuration
Tsgateway.msc - TS Gateway Manager
Tsmmc.msc - Remote Desktops
Uddi.msc - UDDI Services Console
Wbadmin.msc - Windows Server Backup
Wdsmgmt.msc - Windows Deployment Services
Winsmgmt.msc - WINS Manager
WmiMgmt.msc - WMI Control

WINDOWS Question & Answers

noreply@blogger.com (Anonymous) — Tue, 19 Aug 2008 00:37:00 +0000

http://docs.google.com/Doc?id=dhs2qttc_18dgjnwz88

Restoring deleted Object from the Active Directory

noreply@blogger.com (Anonymous) — Sun, 17 Aug 2008 17:27:00 +0000

When an object is deleted from Active Directory, it is not immediately erased, but is marked for future deletion. Active Directory uses a replication model "multi-master loose consistency with convergence". Changes can be made on any DC in the forest are incrementally replicated throughout the forest. So in windows AD object deletion will not remove an object.

A tombstone is an object whose ISDeleted property has be set to true, and it indicates that the object has been deleted but not removed from the directory, much like a deleted file is removed from the file allocation table but the data is not actually removed from the drive. The directory service moves tombstoned objects to the Deleted Objects container, where they remain until the garbage collection process removes the objects. The garbage collection process by default runs every 12 hours on a DC. The length of time tombstoned objects remain in the directory service before being deleted is either 60 days for Windows 2000/2003 Active Directory, or 180 days for Windows Server 2003 SP1. AS per the above info, a delete operation is essentially a special modify operation to an object that:
1. Sets the IsDeleted value to True.
2. Sets the internal WhenDeleted column to the IsDeleted metadata's TimeChanged time stamp.
3. Sets the Windows NT security descriptor to a special value.
4. Changes the relative distinguished name (RDN) to a value that is otherwise impossible, (that is, one that cannot be set by an LDAP program).
5. Strips all attributes not needed at this point by Active Directory. Key attributes such as the following are hard-coded to survive deletion:
o Object-GUID
o Object-SID
o Object-Dist-Name
o USN
Methods for restoring deleted items in Active Directory

Restoring the item from a previous backup
Restoring deleted items by usage of the NTBACKUP program and the System State backup involve shutting down the DC and booting it into "DS Restore Mode", the reanimation mechanism is the only way to recover deleted objects without taking a DC offline.

You can use one of the three methods to restore Active Directory from backup media Primary Restore, Normal Restore (i.e. Non Authoritative), and Authoritative Restore.

• Primary Restore: This method rebuilds the first domain controller in a domain when there is no other way to rebuild the domain. Perform a primary restore only when all the domain controllers in the domain are lost, and you want to rebuild the domain from the backup. Members of the Administrators group can perform the primary restore on local computer. On a domain controller, only members of the Domain Admins group can perform this restore.

• Normal Restore: This method makes the Active Directory data to the state before the backup, and then updates the data through normal replication process. Perform a normal restore for a single domain controller to a previously known good state.

• Authoritative Restore: You perform this method in tandem with a normal restore. An authoritative restore marks specific data as current and prevents the replication from overwriting that data. The authoritative data is then replicated through the domain. Perform an authoritative restore for individual object in a domain that has multiple domain controllers. When you perform an authoritative restore, you lose all changes to the restore object that occurred after the backup. You need to use the NTDSUTIL command line utility to perform an authoritative restore. You need to use it in order to mark Active Directory objects as authoritative, so that they receive a higher version recently changed data on other domain controllers does not overwrite System State data during replication.

Performing an authoritative restore

After the data has been restored, use Ntdsutil.exe to perform the authoritative restore. To do this, follow these steps:
1. At a command prompt, type ntdsutil, and then press ENTER.
2. Type authoritative restore, and then press ENTER.
3. Type restore database, press ENTER, click OK, and then click Yes.

Restoring the objects with LDP.EXE
Deleted objects in Active Directory are not really deleted, they are just "tombstoned" for a period of time that can either be 60/180 days, depending on your DCs' operating system, or any other value, if it was ever changed by the system administrator.

Restoring objects with ADRestore.net

This one more way to restore your deleted object from the tombstone
You can go through this link ADRestore.net