Tag Info

New answers tagged

1

You need to add &#xD;&#xA;&#x09;&#x09;&#x09;&#x09; after %%1537 &#x09; -- the Tab &#xA; -- newline &#xD; -- carriage return <QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[EventData[Data[@Name='AccessList'] and ...


1

The only reference to SCCM in Active Directory is the "System Management" container, which only exists if you had created it in the first place; if SCCM is no longer in use, you can safely delete it. Unfortunately, there is no centralized way to uninstall the SCCM agent from all computers in your environment; you'll need to either perform a manual ...


0

Search and delete the trace registry setting for windows update: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace\ Those logs will be gone.


1

Resolution was to access the system logs of the machine which currently had that IP. It was an OSX machine and I was able to grep 'IP ADDRESS' /var/log/* /dev/null to find a log file which held historical IP information. I found that it was held in /var/log/daily.out and I was able to confirm the machine which currently held that IP had also had the same IP ...


3

You say the IP has changed, which sounds like you may be using DHCP to assign addresses? Check the DHCP log files C:\Windows\system32\dhcp. Use the time and the IP to find the MAC address, then use your inventory system to track down that asset. https://technet.microsoft.com/en-us/library/dd183591%28v=ws.10%29.aspx


1

Saw the same issue on 4 servers today, all running AVG Business Edition. All had several events related to AVG update logged just before hangup, both in System and Application logs. Could not gain access through console. After reboot, AVG windows says "UPDATE FAILED" but then manual update seemed to work and problem did not occur. Was at version 3495 before ...


0

I would simply leave this as a comment since JohnC has basically covered everything, but I am not allowed to do so yet. The events he described have been used for quite a while, so they will work for any of the OS you mentioned, as well as their desktop brethren. The event ID pages He linked to, such as the one for 6006 on TechNet, mention Windows Server ...


5

The clearest most succinct answer I could find is: How To See PC Startup And Shutdown History In Windows which lists these event ids to monitor (quoted but edited and reformatted from article): Event ID 6005: “The event log service was started.” This is synonymous to system startup. Event ID 6006: “The event log service was stopped.” This is synonymous ...


1

The origin of the problem was I had one scheduled task that was set to kill itself after 24 hours and then restart. It was a PowerShell script that started another program, call it the logger. The logger wasn't killed when the scheduled task died, and over time a large number of loggers built up on the server, though they were no longer writing to their ...


0

If you have a public network on any of the adapters, make sure that the main DNS server to be the "public ip of itself" that resolved the issue for me.


0

Add this key and try running it again: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework] "InstallRoot"="C:\\Windows\\Microsoft.NET\\Framework64\\"


0

Your cpu utilization screenshot shows 2 potential bottlenecks: 4 cores maxing out doing kernel work (i.e. probably interrupt handlers processing packets) 1 core maxing out in - mainly - user mode To address the former: Try changing Interrupt moderation settings, depending on your drivers it is more than just on/off, you may be able to set a moderation ...


-1

I'm responding to an old post in case it helps someone else. I had the same issue. The event log said the program completed normally, but not even the first line of code would write to the log for me. It ended up being the "Start In" option in the Task Scheduler. It occurred to me that the program ran fine from the command line when I was in the current ...


3

Set up a VLAN Put your phones onto that VLAN Put a DHCP Forwarder on the VLAN (your switch should be able to do this). Point the forwarder to the IP address of your existing DHCP server Put a scope on your DHCP server that covers the subnet that the DHCP Helper is assigned to If you are using the piggy-backing function on your phones to plug your PC into ...


0

Deleting c:\windows\security\database\secedit.sdb and rebooting did the trick...


0

As the next step, if you want to investigate further, I would install process explorer (procexp.exe) which you can find it on the Microsoft site. That will give you what services use this process (see screenshot from procexp) you can then stop/start services and see if a particular service is associated with releasing/acquiring a large memory allocation. It ...


0

Try removing the persistent route to 172.25.100.100 for the 0 network. It doesn't seem to fit your configuration. Also your DNS servers for all domain joined servers and workstations should be AD integrated DNS servers that are at least hosting the forward lookup zone for the domain in question.


0

You just have to enter the name (or IP address) of the trap server. The community name is deduced from the order in which the community and the trap servers are defined in the GPO.


0

Use the same SMTP Virtual Server to send email for the new domain. I suggest setting up an SPF record for your new domain that states the existing IP address of your SMTP Virtual Server as a valid outgoing mail server. Follow this link to the Microsoft SPF tool. It is a wizard that helps create the SPF synax to add to your SPF record. More and more email ...


1

Took me couple of hours but I found a way to do it on windows 2008 R2 (a bit complicated but can be automated): run ipconfig /all and get the interface Id you need, it should look like: Tunnel adapter isatap.{46BE0BE9-4808-4CF4-8C3B-DC543261F096} This is the registrey key needs to be changed: ...


0

The easiest way to make changes in Microsoft SChannel protocols and ciphers (including cipher ordering) is to use IIS Crypto which is a completely free tool that can be downloaded without any kind of annoying registration requirements. The tool manipulates the registry keys under the covers however it does so in a controlled, proven and safe way. We use it ...


0

You can actually map the shortcut using Group Policy. Using Server 2012 R2 Essentials, I mapped a WebDAV folder from our companies SharePoint Online site. In Group Policy Management Editor: Go to 'User Configuration/Preferences/Windows Settings/Shortcuts' Right click in the list of shortcuts then click 'Shortcut' Use the following settings Settings: ...


1

I'm testing this on a fresh 2012 R2 server, when applying the Alexander Hass script (AH-Script), I still get the obsolete cryptography: My Chrome 43 supports the following Cipher suites: [C02B] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 [C02F] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [009E] TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 [CC14] ...


6

You have a kernel memory leak. The nonpaged pool is 2.5GB. You can use poolmon to see which driver is causing the high usage. Install the Windows WDK, run poolmon, sort it via P after pool type so that non paged is on top and via B after bytes to see the tag which uses most memory. Now look which pooltag uses most memory as shown here: Now open a cmd ...


0

In general 4GB of memory is slim for a file server. Remember that it will try to cache files when it can, and with just 4GB there is little room for any cache at all. The filesystem itself will also use memory for caching and even active pages (like the NTFS master file table). Adding DFS-R means even more memory usage (it uses a Jet database). Note: By ...


0

The the task manager screen you posted. Try using Resource monitor to track down the culprit. Go to the Memory tab and it gives a breakdown. I also agree, 4GB for Server 2008 is very light.


8

It's not SHA causing the problem, it's TLS 1.0. The SSL Labs report for your domain gives the full story. Your server only supports TLS 1.0, not 1.1 or 1.2. In addition, it still supports obsolete ciphers like RC4, and doesnt support perfect forward secrecy. Tuning IIS to get better security is quite possible, but a pain to do by hand. This wonderful ...


0

Memory allocation is very expensive on the CPU's cycles compared to reusing existing, allocated memory. It is often that once a program starts, until it is finished its function, it will not "let go" of this memory. For example, Firefox holds memory for some time. If you leave your computer on for a week with Firefox open, you'll notice it will constantly ...


0

It would seem the first 40% of the drive is readable so some data may be recoverable. But the Sense Code error indicates the disk check tool ran into unreadable sectors. And the drive "disappearing" is not a good sign. So at a minimum the drive is starting to fail. If you want to try something yourself you could try to access the drive from Linux and ...


0

It sounds like your previous RDP session hasn't completely terminated, and is stuck in an in-between state. I've seen similar situations when you log-out and an application that runs on the tray refuses to close on logout, and causes the session to be hung. Try following Todd Wilcox's suggestion and press to bring up the task-manager and look for ...


0

This is an alignment issue of the columns, not sure what causes this. All responses from Bus Prtocol down should be shifted down one row.


1

For me, the easiest method is using Send-MailMessage in Powershell. From the Powershell console simply run: PS C:\Users\admin> Send-MailMessage -SMTPServer smtp.domain.com -To xxxxx@gmail.com -From youremail@domain.com -Subject "This is a test email" -Body "Hi, this is a test email sent via PowerShell to test the STMP relay server" Loads more options ...


0

Using the Win32_ClassicCOMClassSetting class with Powershell Get-WMIObject Win32_ClassicCOMClassSetting -Filter "AppID='{1CECFD4D-2CFB-4626-95C7-0266C26960FA}'" | select -ExpandProperty InProcServer32 or using WMIC wmic /namespace:\\root\cimv2 path Win32_ClassicCOMClassSetting WHERE AppID^="{1CECFD4D-2CFB-4626-95C7-0266C26960FA}" Get InProcServer32 ...


1

Try to give a look at this article. https://www.technibble.com/how-to-disable-automatic-restart-for-bsod-if-you-are-unable-to-get-into-windows/


2

You will need to install RDP 8.0 on your Windows 7 computers and Windows Server 2008 R2 servers, and then enable RDP 8.0 on the local computer policy or group policy. Here is the Microsoft KB for the RDP 8.0. https://support.microsoft.com/en-us/kb/2592687 Once this is done you should be able to disable TLS 1.0 on the computers and servers by editing the ...


0

Ok, so after a lot of research and trial and error I found a solution. Definitely not best practice, but fits our need. I had to create the shim on a windows 7 machine. The shim was created with the Win7 compatibility mode, and used the following line as the parameters for the CorrectFilePaths shim: -b ...


3

I have been looking into this for a couple of days now as we to have to comply with PCI-DSS 3.1 which requires TLS 1.0 to be disabled. We also do not want to fall back to RDP Security Layer which is a major security concern. I have finally managed to find some documentation that confirms that TLS 1.1 and TLS 1.2 ARE supported by RDP. This documentation is ...


0

Add new domain controllers in your environment (same OS version or new OS version if you are confident about application compatibility). Mask the old domain controllers in the DNS, it means remove everything registered by the NetLogon service (well not everything, the GUID records are used for the replication, so we must keep this one). Wait until the ...


1

What happens when you search the registry for {1CECFD4D-2CFB-4626-95C7-0266C26960FA}? So the powershell component, this should get you started: $cred = Get-Credential domain\user Enter-PSSession <name of computer> -Credential $cred Set-Location HKCR:\Wow6432Node\CLSID\{1CECFD4D-2CFB-4626-95C7-0266C26960FA}\LocalServer32 Get-ChildItem


1

Actually your problem might have been the fact that you weren't connected to your VM Ware RODC Test Server. The objects were still being added because you were still connected to the writable DC. Watch the following video and go straight to the 23 minute mark... https://www.youtube.com/watch?v=2WIonSq88d8 (this solved my issue) Greg P


0

You can't half-enable it - if you enable clipboard on the server-side, then anyone who log in (and, of course, enable it in the client) can use it both to copy from and to the server. You should look for some other remoting solution.


0

Do this to simplify your life: Go the the GPO in question, edit it and go to the following: User COnfiguration/policies/Administrative Templates/system Enable: Don't run specified Windows Applications In that other also click on Show disallowed apps, and add the following: ServerManager.exe cmd.exe powershell.exe Apply and log off and on depending on ...


0

It is not at all obvious that there is any error. What you are trying to achieve is to setup a communication between two hosts behind the same NAT device, not directly but through their mapped endpoints. This has a name, hairpinning because it is a far-from-trivial property to find in current gateways. You must check whether your current NAT router supports ...


1

On Windows 2000+ it is not possible to completely get rid of user's account. However it should be enough to simply delete it, from both security and licensing reasons. As for Windows Server 2008+, to delete user with its home directory: Open System in Control Panel. Click Advanced Settings, and on the Advanced tab, under User Profiles, click Settings. ...


0

Yes, it retains these directories simply because you can have "system held files" that are not necessarily user files anymore. Have you tried Right click c:\Users\her-account-id. >> Delete, if there is a lock, it will highlight


0

The question is, is it a leak? You're saying that the memory usage is "steady". Leak = memory usage increases over time, never decreasing, so you have to reload the server every once in a while. If the taks is staying at ~1 GB for long time (say, two weeks), then the situation is perfectly normal. Modern software is made to use free memory whenever ...


1

Those permissions are being inherited from the parent folder. You'll need to remove/disable inheritance on this folder in order to change those permissions.


0

How about this? <Host name="MyUrl.com"> <PathRegex regex=".*" authType="shibboleth" requireSession="true" /> </Host> Essentially, a regex to protect the entire root. Edit #1 - Just saw how old this was... yikes.


0

first of all I would recommend to check the cabling and try to use another cable. You should also check the packet errors on the link on the switch side. TCP use the window for sending the data. If there is any error on the link and the speed is not as suspected and there are some packet drops, TCP slows down the speed of sending the packets automatically. ...


1

You can also use pkgmgr with an unattend file to install a role with a customised set of sub-ordinate features: pkgmgr /n:\\somesserver\someshare\unattend\IISUnattend.xml The unattend file looks something like: <?xml version="1.0"?> <unattend xmlns="urn:schemas-microsoft-com:unattend" ...



Top 50 recent answers are included