Light

emet useful remote-controlled browsers systems (recobs) , virtual desktop infrastructure (vdi). applications protected emet eaf feature run 10 times slower (or @ 10% speed) in hyper-v guests presumably because processor debug registers used. performance counter "hypervisor root virtual processor(*)\debug register accesses/sec" increases few 10 thousands on system when emet eaf protected applications run. any ideas improve performance without loosing eaf benefits? the emet documentation doesn't explicitly reference hyper-v, but: “some virtual machines not support debug registers (and consequently eaf). however, eaf option still available configuration if emet being run on machine doesn’t support debug registers. setting option on machines have no effect. be aware of limitation when configuring eaf.“ drm , copy protection (securom and/or safedisc afair) software affected. references: aslr bypass mitigated eaf: https://badishi.com/tweaking-metasploit-mod

what best method of keeping fsmo roles in 3 dcs? fsmo availability , placement active directory installation wizard performs initial placement of roles on domain   controllers. placement correct directories have few domain   controllers. in directory has many domain controllers, default placement   may not best match network. consider following in selection criteria:    it's easier keep track of fsmo roles if host them on fewer computers. place roles on domain controllers can accessed computers need access given role, on networks not routed. example, obtain current or standby rid pool, or perform pass-through authentication, dcs need network access rid , pdc role holders in respective domains. if role has moved different domain controller, , current role holder online , available, should transfer (not seize) role new domain controller. fsmo roles should seized if current role holder not available. more information, go following microsoft website: http://techn

i put question put me. "trying see if remote desktop web access requires registered domain name my dad moved server windows 2008 office house he on residential (dynamic ip) connection" like said, pressed time on this, need pointer.  i don't know it, first place thought come. thanks help. hi john, my dad moved server windows 2008 office house >>>i assume server personal computer, , rds related roles remain in office. if network solutions such vpn deployed, can access internal rds resources usual. if not, public dns host record needs registered. best regards, jay please remember mark replies answers if , un-mark them if provide no help. if have feedback technet subscriber support, contact tnmff@microsoft.com. Windows Server  >  Remote Desktop

windows 10 (hyper-v manager 10.0.10586.0) for reason, had make clean install of os. hyper-v settings pointed out disk volume virtual hard disks , virtual machines, these ok , intact. (i cannot see way keep virtual switches etc. though) i assume "must" possible "hook into" these 2 locations again after clean install of os, failed see how. (neither can see backup help). a zillion people "must" have experienced (and solved ?), please tell me how solve if possible :) hi, aah, okay. got point. check out these 2 blogposts: https://www.petri.com/export-hyper-v-configuration-powershell https://blogs.msdn.microsoft.com/virtual_pc_guy/2010/03/24/performing-a-configuration-only-export-import-on-hyper-v/ -tomi tomi pietilä, blog , twitter Windows Server  > 

hello, i have issue in title, rds hosts updated windows 2012 r2. pcs windows 7 sp1, of them 32 bits , of them 64. i tried download hotfix: support.microsoft.com/en-ca/kb/2862019 link broken. because it's included in update? if so, one? thanks, jonathan hi jonathan, you download hotfix on link below. a remoteapp application main window takes focus after applications windows maximized in windows https://support.microsoft.com/en-us/kb/2862019 best regards, jay please remember mark replies answers if , un-mark them if provide no help. if have feedback technet subscriber support, contact tnmff@microsoft.com. Windows Server  >  Remote Desktop Services (Terminal Services)

hola, tengo un inconveniente al tratar de instalar una solución antivirus en windows server 2008, este me indica que existe otra solucion antivirus ya instalada pero ya fue desinstalda correctamente, probado con herramientas del propio fabricante para borrar rastros de la solucion y nada, cuando tenia este problema con windows xp realizaba lo siguiente: desde inicio – ejecutar 'wbemtest' y aceptar. - pulsar en conectar y sustituir root\default por root\securitycenter2 si se trata de un sistema operativo posterior windows vista sp1 o bien por root\securitycenter, si es un sistema operativo anterior windows vista sp1. - conectar. - pulse en el botón clases enumeradoras. - en la ventana información de superclase que se abrirá, deje el campo en blanco y pulse en aceptar. - haga doble clic sobre antivirusproduct. - pulse sobre el botón instancias. imagino que no es posible realizar lo mismo en el server 2008 ya que no deben ser los mismos nombres para el secu

hi team, i'm running problems licensing. error upon login: remote desktop licensing mode not configured remote desktop services stop working in 8 days. on rd connection broker server, use server manager specify remote desktop licensing mode , license server. what need: i want 5-10 users able remote desktop 2012 r2 server via remote desktop tool. i think must have added wrong roles or licenses. please let me know can running. thank you! hi, 1. did install rd licensing role services , activate server , install rds cals using rd licensing manager (licmgr.exe)? 2. if created rds deployment using server manager can set licensing mode , licensing server name in deployment properties.  server manager -- rds -- overview -- tasks -- edit deployment properties -- rd licensing tab. if did not create deployment can configure licensing mode , licensing server name via group policy.  example, use gpedit.msc , configure 2 settings under following path: comp

i'm having consistent problem attempts upgrade dcs of root domain server 2008. dcpromo setting incorrect acls way down windows folder on server 2008 try promote, and any existing 2003 dc upgraded 2008 ends same way. for example on system32 get: authenticated users    read & execute    this folder, subfolders , files server operators        modify                    this folder, subfolders , files administrators             full control            this folder, subfolders , files system                        full control            this folder, subfolders , files trustedinstaller           special                   this folder only creator owner        special                    subfolders , files only whereas should be: trustedinstaller            special                    this folder , subfolders system                        special                    this folder only system                        special                    subfolders , files only administrators             

i'm running remoteapp on windows xp sp3 workstation. connecting w2k8 ts on different domain. in order streamline authentication process i've enabled credssp on work station. want achieve when run remoteapp, authenticate once on client side no further server side authentication prompts. @ present still getting server side logon prompt. have configured following settings on xp sp3 test machine: enable credssp: hklm\system\currentcontrolset\control\securityproviders\securityproviders append, don't replace: credssp.dll hklm\system\currentcontrolset\control\lsa\security packages append, don't replace: tspkg   configure delegation registry settings: hkey_local_machine\software\policies\microsoft\windows\credentialsdelegation reg_dword: allowfreshcredentials value data: 1 (enable) reg_dword: concatenatedefaults_allowfresh value data: 1 (enable) hkey_local_machine\software\policies\microsoft\windows\credentialsdelegation\allowfreshcredentials\allow

hi all, can here please assist me how correct below script can work comparing date & time stamp ? $daysinactive = 180 $time = (get-date).adddays(-($daysinactive)) get-aduser -properties * -searchbase "ou=head office,dc=domain,dc=com" | where-object {($_.lastlogontimestamp -le $time -or $_.lastlogontimestamp -notlike "*") -and ($_.passwordlastset -le $time) -and ($_.enabled -eq $true)} | select-object name,@{n='last logon timestamp';e={[datetime]::fromfiletime($_.lastlogontimestamp)}}, passwordlastset, canonicalname because error: could not compare "130698308169494429" "07/24/2015 13:00:01". error: "cannot convert value "24/07/2015 1:00:01 pm" type "system.int64". error: "invalid cast 'datetime' 'int64'."" @ c:\users\admin\appdata\local\temp\fc8e5dd3-5962-496c-9e59-eaf95b323be2.ps1:6 char:15 + ... ere-object {($_.lastlogontimestamp -le $time -or $_.lastlogontim

   when switch on audit policy on windows 2008 server registering maximum events, can see among others event id 4656. event correspond event 560 in windows 2003 (and older). then when start 'evntwin' , try make custom settings, don'e see event such id in events lists old ids , if add these (old) events nothing events transfered destination. necessary windows 2008 snmp service settings made successfully. using 'evntcmd' command new event ids don't bring success.    simultaneously similar configuration made windows 2003 system , work successfully.    , when use 'evntwin' utility in windows 2008 in list of events have items 'success' severity , old ids (below 4096) though have correct setup audit policy.    in widows 2003 haven't such problem , can select events different severity. hi alex, yes, noticed, evntwin.exe tool on windows server 2008 not contain updated security events vista , windows server 2008; in addition, severiy level contains

hello, currently have test environment 3 hyperhost wich have 2 nic teams.  lan team , team live/mngt. in hyper-v created virtual switch (wich nic team live/mngt) we want seperate mngt , live vlans. created 2 virtual adapters. mngt , live, assigned ip adresses , 2 vlans(mngt 10, live 20) now here our problem: in failover cluster cannot select virtual adapter(live). virtual switch wich both on. meaning live migration simple uses vswitch instead of virtual adapter. either not possible seperate live migration vlan way or maybe there powershell commands add live migration virtual adapter? greetings selmer it doesn't show adapters @ all. shows discovered networks, in context means unique subnets. all non-storage adapters virtual. eric siron altaro hyper-v blog independent blog contributor, not altaro employee. solely responsible content of posts. Windows Server

i installed rd gateway role administration purposes, can't seem work. installation , configuration went fine, time try login error: "your computer can't connect remote computer because remote desktop gateway running low on server resources , temporarily unavailable". there plenty of resources on server in question , absolutely nothing logged on server. https://server/rpc give me blank page, not ask me credentials. i'm assuming part of problem. please advise. hi, could using password contains ascii character not supported gateway iis service? there seems similer issue described in thread: http://social.technet.microsoft.com/forums/en-us/winserverts/thread/af0efcc6-b5fb-491c-bda4-ce5413fa4abe/ (last post). kind regards, freek berson the microsoft platform twitter linked-in wortell company website Windows Server  

hi experts, i trying setup dns in workgroup environment , wondering if on how this. have 3 computers; 1 windows 2008 server , other 2 running windows seven. connected netgear router, in-turn connected isp router.  intend configure server dns server. can please provide me walk-through on how dont run issues? thank in advance if dns service set correctly, client's need configured point dns server.  on clients, if dhcp enabled, modify dhcp scope clients configured correctly. if want make sure clients pointing dns server, open command prompt, type ipconfig /all , view results. now on dns server itself, need create zone.  once create zone, need add host records.  for example, if dns server called server1, in zone, create host record (a) called 'server1' , map ip address of server. guides , tutorials, visit itgeared.com . Windows Server

hi, running web application generates xls file, there 2 apps running, excel , app l2.exe - on website user clicks generate file. there way on server specify run 3 of these @ time , queue other user generated one. lets 6 users want generate xls file , click web application, if 6 l2.exe , excels run, peak our cpu @ 100%, 3 seems perfect number , balance of cpu. any assistance appreciated! -pablo i'd ask site developer this. if developer i'd ask in microsoft official iis or asp.net forums here. https://forums.iis.net/ https://forums.asp.net/       regards, dave patrick .... microsoft certified professional microsoft mvp [windows server] datacenter management disclaimer: posting provided "as is" no warranties or guarantees, , confers no rights. Windows Server  > 

i checking out script scripting guy gather information active directory gather list attributes have run issue.    here script: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   $strcategory = "computer" $objdomain = new-object system.directoryservices.directoryentry $objsearcher = new-object system.directoryservices.directorysearcher $objsearcher.searchroot = $objdomain $objsearcher.filter = ("(objectcategory=$strcategory)") $colproplist = "name" foreach ($i in $colproplist){$objsearcher.propertiestoload.add($i)} $colresults = $objsearcher.findall() foreach ($objresult in $colresults) {$objcomputer = $objresult.properties; $objcomputer.name the way explained understand add attributes array $colproplist = "name" such $colproplist = "name", "lastlogintimestamp"  and that would return value needed; however, still returns name. can provide insight on how modify script to  gather additional ad attributes?   "gi

say have active directory user account named joe.  there domain policy passwords must changed every 6 months.  when @ joe's account in active directory users , computers has password expiration set on 1 year away. (someone has manually set account expire radio button in aduc) is joe's password 6 months or 1 year? password expiration different account expiration. unless have fine grained password policy configured joe, password expire in 6 months, , joe need change then. account expire after year, , unusable, unless admin changes or removes account expiration. edit: not see max password age in user account properties in aduc. must view properties of domain object domain settings, such maxpwdage. richard mueller - mvp enterprise mobility (identity , access) Windows Server  > 

my hosts have 48gb ram , 2 pcpus giving me 2 numa nodes, , have 5 vms need run on each, 4 9100mb ram , 1 7000mb. should fit, , does. prior migrating hyper-v these hosts running xenserver 5.5, not numa aware (and possibly had lower memory overhead windows anyway), , vms powered on, no problems. spanning on nuam nodes, performance ok didn't care. then moved couple of hosts 2012 (not r2) , ran vms in hyper-v. because hyper-v numa aware thought it'd nice take advantage of split 7000mb vm 2 smaller ones, , assigned 1 of plus 2 of larger vms onto each numa node. assigned vms numa nodes using wmi http://rcmtech.wordpress.com/2013/08/12/set-hyper-v-2012-vm-numa-node/ 2012 r2 seems have changed/removed ability configure vm sit on particular numa node though, above doesn't work anymore. so i'm experimenting various "allow span numa" tickboxes host , vms, mixed success. i've gone 5 vms, can 4 power on, fifth saying "not enough memory", yet on

hello, i have dedicated server installed windows 2008 server standard. i have lots of event logs about; is  - trying log in system  - trying connect mssql sa user.   i made research , ip policy soluition me. i blocked ips attack me.   then realized, can not connect web sites or cant ping them.   i got following error when ping site in command promt (for example hotmail.com) general failure i stoped ipsec policiy agent , can ping it. how can use ipsec policiy , can connect sites @ same time?   check profile configuration of firewall , make sure enabled profile, please check article  http://technet.microsoft.com/en-us/library/ff602926(ws.10).aspx  and  http://technet.microsoft.com/en-us/library/bb877967.aspx  and  http://technet.microsoft.com/en-us/library/dd421709(ws.10).aspx  for more details default settings , how rules ordered. i suggest configure firewall block inbound connections default action , create rules allow inbound connections ports/proto

dear all, in our data center, have around 100, 2008 r2 windows servers. have mak key licensing. our client not want connect servers internet because of security reason. my question is possible activate servers using mak or have install kms server? please me!!!!!!!! hello kumar,  i suggest check guide once: http://technet.microsoft.com/en-us/library/cc303280.aspx#_convert_kms_clients kms vs mak: http://social.technet.microsoft.com/forums/en-us/itprovistaactivation/thread/fd0a37a9-a260-4789-b400-b4f2e134916a regards, ravikumar p Windows Server  >  Windows Server General Forum

are there other options fix dirty volume on windows 2008 r2 besides taking volume offline , doing chkdsk ?   our problem cannot judge how long take run chkdsk on volume. any suggestions or ideas appreciated  thanks in advance hi sabo, >> are there other options fix dirty volume on windows 2008 r2 besides taking volume offline , doing chkdsk ? you turn on maintenance mode on disk , perform disk maintenance: https://technet.microsoft.com/en-us/library/cc772587(v=ws.11).aspx best regards, leo please remember mark replies answers if help. if have feedback technet subscriber support, contact tnmff@microsoft.com . Windows Server  >  High Availability (Clustering)

i created new group policy disable autorun on of our machines. setting located under administrative templates. confirmed through group policy results policy being applied client machines expected. however, when go local group policy editor (gpedit.msc) on of client machines, "turn off autoplay" setting showing "not configured". expected behavior? administrative template settings made in ad group policy not displayed in local group policy on configured machines? thanks. that's correct. local gpo distinct entity domain gpos apply machine. therefore, local gpo not show settings coming domain-based gpos. can use group policy results gpmc or gpresult.exe determine ad-based gpos have been delivered system.   darren darren mar-elia ms-mvp, group policy www.gpoguy.com www.sdmsoftware.com - "the group policy experts" Windows Server

is there way capture log/output of copy-item? -verbose shows outcome in command prompt.. when i'm using cmdlet part of large script, couldn't capture output... thanks ! --ss | microsoft certified technology specialist (tfs 2010) using -passthru parameter, can capture results varible.  note, variable populated if operation successful: $x = copy-item -path 'test.txt' -destination 'c:\new folder' -passthru -erroraction silentlycontinue if ($x) { $x } else { "copy failure"} grant ward, a.k.a. bigteddy what's new in powershell 3.0 (technet wiki) Windows Server  >  Windows PowerShell

hello everyone, i running issue, have wsus server setup on w2008 server , times client computers going out on internet , consuming lot of internet bandwidth. works fine , after every month face problem once/twice. guys please me out solve issue? troubleshooting done far: 1. crossed checked through rsop.msc policy has been applied on computers. 2. crossed checked option on computer settings showing per configured on wsus gpo. hi vinig, 1. configure automatic update, if yes, clients automatically download , install updates follow policy wsus server. clients won't update internet unless click check update online manually user. when issue occurs, please check if wuserver's value in registry key hklm\software\policies\microsoft\windows\windowsupdate 2. if want block clients update internet, may enable policy " turn off access windows update feature " in group policy computer configuration > policies > administrative templates > system > in

hi, i have microsoft vdi lab setup windows 2012 core servers. started facing issues in vdi setup. i getting authentication error (error 1) when launch virtual machines. , not able create new virtual machine pool using gold image  (error 2 - getting network error). error 1: an authentication error has occured. local security authority cannot contacted remote computer: due expired password. please update password if has expired. error 2: could not identify state of virtual desktop. ensure rd virtualization host serveris avaliable on network , virtual desktop gold image test1 shut down. so far have taken below steps troubleshoot, 1. created new test gold image. 2. rebooted virtulization hosts. 3. rebooted vmm, rd gateway , connection broker servers. 4. ad diagnostic has been done , did not find errors. please let know if 1 gone through same error , work around. hi shivaprabhu, sorry delay , please post details error ? best reagards elton ji

i used domain user assign person virtual desktop domain user during vdi environment testing and got failed, can please let me know what's permission needed action? can please describe in greater detail "it got failed" means? were unable assign? unable launch?  need more detail able assist. thanks! brian ehlert (hopefully have found useful) http://itproctology.blogspot.com learn. apply. repeat. Windows Server  >  Remote Desktop Services (Terminal Services)

hello all, build server, , host remote app on it, 30 users. put sql server on same box. have never built before, , i'm overwhelmed information out there. have couple of questions: faster 3.5ghz 6core or slower 2.6ghz 8 core cpu better task? if put 256 gig of memory in box, have problem running rdp , sql on same box? i'm thinking of purchasing supermicro mbd-x10srh-cln4f-o motherboard, has built in aspeed ast2400 bmc graphics. would enough remote desktop? or need purchase better? thank you i put sql server on same box. for 30 users, it's ok try compartmentalize ressources. either virtualize both roles have 2 vms on same physical box, or pin yur sql instance cpu cores , limit ram usage. would faster 3.5ghz 6core or slower 2.6ghz 8 core cpu better task? i'd go more cores, if choose virtualization route. if put 256 gig of memory in box, have problem running rdp , sql on same box? probably not, if every user start jav

i have primary domain controller, dns, and, additional domain controller. when try install these sever, got error. ip address, nslookup ok. how configure dns install these server. you haven't provided many details assist. could provide: o/s of dc attempting promote ipconfig /all  <-- both current dc , new dc event log error dc in error your new dc should pointing @ dns of dns server hosting dns ad domain , not isp -- paul bergson mvp - directory services mcitp: enterprise administrator mcts, mct, mcse, mcsa, security+, bs csci 2008, vista, 2003, 2000 (early achiever), nt4 twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson please no e-mails, questions should posted in newsgroup. posting provided "as is" no warranties, , confers no rights. Windows Server  > 

i set anywhere access , seems working fine.  however, hoping clients using service able print stuff out on own printers.  so, i'm working on word doc , want print out while i'm working home, click print, can see printers installed on work network (i.e. in office).  my questions are:  possible (and if so, how!), or not available feature? many in advance. you can launch dialog devices -> remote desktop options on remote web access website. Windows Server  >  Windows Server 2012 Essentials

my server unable install software need write .inf file during install.  1 culprit failing trying install sql server 2012 management studio.  fails access denied when trying write autorun.inf temp directory tree in expanding out actual installer. for 1 such installer, machine files extracted -- trying unzip them on this failing server fails, but able create file share , copy file machine.  corresponding autorun.inf has its file security privileges in mess.  on win2k8 r2 server, unable see file owner (it not inheriting parent folder), , can't successful set owner. i have seen reference mcafee enterprise security having rules preventing writing autorun.inf -- no such anti-virus software involved in case. can remove av sure ? unzip blocked, seem me av @ first. the zip not corrupt, block .inf creation... i try a chkdsk in worst case sure the file table ok.   regards, philippe

hi all, i'm new wds , seem having problem. have added drivers os , need to. got working fine last week , have come week , when try boot says connection deployment share \\server\testdeploymentsharef$ not made. had created share mouth ago , deleted because little testing. created new share call deploymentshare , running of fine last week. thing have done week add application share , error keeps coming up. images of xp, 7 , s08r2 gratly appriciated thanks  can see  wds mdt 2010 .   have ask here. http://social.technet.microsoft.com/forums/en-us/winserversetup/threads   thanks Windows Server  >  Windows Server General Forum

good day, our server1 (for reference renamed) had unexplained policy changes (listed below) , caused server reboot.  have wsus server performing update pushes, one, thought ie is/has , patched current levels unexplained, our other servers have not been modified.  we identified it ie core os file changes.  perhaps validate concerted microsoft update.  malware/virus/root kit scans negative , veted know it, inside , out. thanks much, william ________________________________________________________________________ log name:      security source:        microsoft-windows-security-auditing date:          9/7/2012 5:00:48 pm event id:      4907 task category: audit policy change level:         information keywords:      audit success user:          n/a computer:      server1.domain description: auditing settings on object changed. subject:  security id:  system  account name:  server1$  account domain:  domain  logon id:  0x3e7 object:  obje

hello gurus, i have power shell script collects metrics windows servers , inserts them mysql database , send emails based on conditions. now, strange part when execute manually database part , email part works desire. when put script in task scheduler task scheduler executes script , sends the  email ignores execute database part. reason ? thanks, rama check account you're running task under. make sure has proper permissions write database. don't retire technet! Windows Server  >  Windows PowerShell

how prevent server manager showing specific users in server 2008 r2?   sorry ask many questions today.   learning lot myself, especially transitioning mcse learning newer server technology , obtainnig mcitp.   i have client has 2008 r2 server , keeps popping of individual users.   if need further information please let me know need.   thanks.   -tim. hi tim, server manager not  run automatically for standard users.  if coming users means the users members of administrators group.  security , stability reasons critical regular users  not member of administrators group. -tp Windows Server  >  Remote Desktop Services (Terminal Services)

hello i'm network administrator @ small/medium business , thinking of virtualize our 4 servers on 2 ml350 servers. have 3 2012r2 licenses (think it's standard lisences). before decide have find out how cost us. have small problems understanding total cost of having 2 physical servers running hyper-v 1 of them main host running 4 virtual servers , other 1 failover. this how think works: i need have 4 2012r2 standard lisences in order run 4 virtual servers on both of physical hyper-v hosts, need 4 server licenses 4 virtual servers running. total of 8 server licences. correct? if not, need?  it depends :-) 1. licensing hosts only . (there no licenses vm! have virtualization rights.) 2. 1 license valid server up 2 cpu . 3. can have two vms or 1 vm . if host supports vm (hyper-v role, backup,...), two vms are valid. if host domain controller, 1 vm allowed. 4. if have 2 physical servers 2 cpu , 2 standard licenses, can have 4 vms. 5. if use hosts purposes

hey! so, 1 of users on network has laptop. i want make signs onto domain when @ work... , profile stored in users$/%username% folder on server... want when takes laptop home, can still login same credentials , have appear same if @ work... without vpn (because has no internet connection). so, guess have locally cache profile onto laptop then? , synchronize difference server when gets work each day? also, have folder redirection gpo's setup on domain redirect desktops / documents / appdata / etc.. users computers profile folders on server. thanks in advance!!  :-) hey! so, 1 of users on network has laptop. i want make signs onto domain when @ work... , profile stored in users$/%username% folder on server... want when takes laptop home, can still login same credentials , have appear same if @ work... without vpn (because has no internet connection). so, guess have locally cache profile onto laptop then? , synchronize difference server when gets work each day?