Share iT…

When trying to create a new Remote Desktop Session Collection you receive an error: Unable to configure the RD Sessionhost server servername.domain.local. Invalid operation.

The collection it self is created but not completly, some parts are missing, like there is no Desktop icon on the Webaccess page. And probably some other settings aren’t set correctly. So it would be wise to solve the problem, delete the old and create a new collection.

Solution:
Described in this kb kb3014614 article it is a know issue, some policies are already applied to the RD Session Host server. To solve the issue make sure there are no policies set to the new RD Session Host server especially these two gpo strings:

• Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Security
• Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing

In most cases this would be the case when there is already an existing Remote Desktop server and policies are applied via a group policy to a specific OU and the new server is already moved to this OU.

Move the new Remote Desktop server to another OU where no policies are applied. Run gpupdate /force or reboot the new RDSH server. Then delete the existing collection and create a new collection.

If you already set local policies on the RD Sesions Host policy these also need to be removed.

• Delicious

Just configured a Azure AD Connect (AADConnect / AADSync) synchronisation between an on premise domain and Office 365. All users are synchronized without any problems except one user. Nothing special for this user, same OU, member of the same groups, no special rigths or anything visible different. Also no errors in AADConnect logs, event logs or whatever.

Also followed this helpful Microsoft document One or more objects don’t sync when the Azure Active Directory Sync tool is used, but none of the options described solved the problem. sAMAccountName, proxyAddresses, etc are all correctly filled.
Other strange thing is when you run IdFix as described in the same document, the result also does not show this specific “problem” user.

Solution:
Accidently I did an export of all mailboxes and properties and for this perticular user I saw that LinkedMasterAccount was filled with an SID and the IsLinked value was set to true.
To see if these values are set for this account run the following powershell command: get-mailbox username | select-object *link*

If the IsLinked is set to true the mailbox is a linked Mailbox and linked mailboxes are not synced to Azure AD, as described in this article: Understanding Users and Contacts in Azure Active Directory Sync

A disabled account will contribute userPrincipalName and sourceAnchor, unless it is a linked mailbox.

Disabled accounts are synchronized as well to Azure AD. Disabled accounts are common to represent resources in Exchange, for example conference rooms. The exception is users with a linked mailbox; as previously mentioned, these will never provision an account to Azure AD.

In this case the linked mailbox was probably a leftover from the past so we could convert the mailbox back to a normal user with this powershell command: Set-User -Identity kweku@fabrikam.com -LinkedMasterAccount $null and after that the account was directly synced to Azure AD at the next syncronization schedule.

• Delicious

When you go through the Exchange 2010 manage hybrid configuration wizard, at the Mail Flow Security option the certificate list is empty. When you click on view certificate you get the error “No valid certificate exist for the Hub Transport server(s)”.

When you take a look in the Exchange Management Console at server configuration your certificate is visible and also valid. When you run the following command in the Exchange Management Shell: Get-ExchangeCertificate | FL you will see the result RootCAType : Registry as result.

The problem in this case was that the Root CA certificate (in this case the GoDaddy Root CA certificate) was only available in the Thrusted Root Certificate Authorities store and NOT in the Third-Party Root Certificate Authorities store.

Solution:

Open a mmc windows and add the Local Computer Certificates snap-in, browse to the Thrusted Root Certificate Authorities / Certificates store and export the Root CA certficate (when not avaiable at all, get the certificate from your provider).

Then browse to the Third-Party Root Certificate Authorities / Certificates store and right choose all tasks and choose Import. Follow the wizard and import the exported certificate in the selected store.

You should now see the Root CA Certificate in the Third-Party Root Certificate Authorities / Certificates store.

When you run the following command in the Exchange Management Shell: Get-ExchangeCertificate | FL you will now see the result RootCAType : ThirdParty as result.

When you now go through the Exchange manage hybrid configuration wizard you should be able to select the certificate and complete the wizard.

• Delicious

When trying to connect to a RemoteApp or Desktop Connection via the Remote Desktop Web Access or RemoteApp and Desktop Connections on a Windows desktop you can start the remote application but receive the following error:

This computer can’t connect to the remote computer.

Try connecting again. If the problem continues, contact the owner of the remote computer or your network administrator.

—

There are two Windows 2012 R2 servers in the Remote Desktop deployment, one with the RD Licensing, RD Gateway, RD Web Access and RD Connection Broker roles and one with the RD Session Host role. Investigating the deployment and collection settings there are no misconfigured settings found.

When you create a manual RDP file and create a desktop connection via the RD Gateway to the Session Host there is no problem.

—

Examining the eventlogs on the RD Connection broker will result in the following errors:

Event log: Microsoft-Windows-TerminalServices-SessionBroker-Client/Operational
Event 1301 Verbose:
Remote Desktop Connection Broker Client received request for redirection.
User : Domain\username
RDP Client Version : 5

Event 1296 Error:
Remote Desktop Connection Broker Client failed while getting redirection packet from Connection Broker.
User : Domain\username
Error: Element not found.

Event 1306 Error:
Remote Desktop Connection Broker Client failed to redirect the user Domain\username.
Error: NULL

Event log: Microsoft-Windows-TerminalServices-SessionBroker/Admin
Event 802 Error:
RD Connection Broker failed to process the connection request for user Domain\username.
Error: Element not found.

—

Solution:

The solution to the problem was as easy as just deleting the Collection and creating a new Collection.

—

• Delicious

If you have created an export of a virtual machine on a windows 2008 R2 server and try to import the export on a windows server 2012 R2 Hyper-V host, you get the following error:

“Hyper-V did not find virtual machines to import from location”

The Problem: After some searches I found this article “Windows Hyper-V 2012 & 8.1 Hyper-V Did Not Find Virtual Machine to Import” which describes the problem I ran into.

The problem is “WMI root\virtualization namespace v1 (used in Hyper-V)” has been removed in Windows Server 2012 R2, it was deprecated in Windows Server 2012 but still exist so you could import the export in Server 2012, but it is removed in Server 2012 R2. Since Server 2012 they introduced WMI namespace (version 2 or root\virtualization\v2.

Solution: There are a couple of workarounds possible,

• First you can just copy the VHD files and just built a new Virtual machine with the existing VHD files.
• Second if you have a windows Server 2012 server you can import the machine on this server and make an export and then copy that export to the 2012 R2 server.
• Last option if the existing Virtual Machine is still on the windows 2008 R2 server, stop the Virtual Machine, copy the complete directory with VHD and configuration to the 2012 R2 server and on then choose import on the 2012 R2 and point to the copied folder.

• Delicious

Because virtualization becomes more and more common use and with Microsoft Hyper-V included in Windows Server at no additional costs and most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 2011 installation and never get the full benefits of the hardware. It is worth considering to virtualize the SBS 2008 or 2011 server and run one or maybe two or more virtual servers beside it on the same hardware.

In this blog post I will put together some facts, tips and considerations you should look after before you start virtualizing a SBS 2008 or 2011 server. Of course a lot of this information can also be used for virtualizing non SBS servers.

Enable Hyper-V role on a SBS 2008 or 2011 server
So if you just want to add just one other server, why not install SBS 2008 or 2011 on the physical hardware and just enable the Hyper-V role?

The answer is really simple, because it is not supported!! Enabling the Hyper-V role on a SBS 2008 or 2011 server will break stuff, for some additional information read here: http://blogs.technet.com/b/sbs/archive/2009/08/07/you-cannot-install-the-hyper-v-role-on-the-sbs-2008-primary-server.aspx

Hyper-V Host
So as we cannot enable the Hyper-V role on a SBS 2008 or 2011 server we need to install a Windows Server version on the physical hardware to function as a Host for the Virtual Machines. It is recommended that the Hyper-V Host will only hold the Hyper-V role and not to include any other roles or tasks. Only exception maybe for some management or backup tasks.

The Windows Server version we will choose is a real important decision, so let’s see what choices we have:
Hyper-V is included within Windows Server since version 2008 this was a version 1.0 and has a lot of limitations. I would not recommend using Windows Server 2008 to host the virtual machines. So I will limit to choice between the different server versions based on Windows Server 2008 R2 and Windows Server 2012.

SBS 2011 Premium Add-on
When you already bought SBS 2011, you might have bought the SBS 2011 Premium Add-on (PAO) in addition. The SBS 2011 PAO includes a Windows Server 2008 R2 standard and SQL 2008 R2 license. With Windows Server 2008 R2 Standard you have the right to install the software on a physical machine and install one Virtual Machine with the same license. This is called virtualization rights (1+1), you may do this only when you do not install any other role on the Host installation other than the Hyper-V role. When you install another role you will lose this right and need to buy a separate license for the virtual installation.

This said the SBS 2011 PAO will be a perfect consideration to use for your Host installation and run SBS 2011 and a second Virtual Machine for SQL server and / or a LOB application or even a Remote Desktop Session Host (Terminal) Server.

Memory
So the SBS 2011 PAO looks like an ideal solution, but one limitation is worth naming. Windows Server 2008 R2 standard has a 32GB memory limitation, this might be a problem when running SBS 2011 standard and also have a memory consuming SQL / LOB application. SBS 2011 standard itself with especially Exchange 2010 is a very memory consuming product, if you also need to run a loaded SQL / LOB application server beside this 32 GB might not be enough.
The Windows Server 2008 R2 Host installation needs about 2 – 4 GB, a SBS 2011 Standard for 25 – 50 users will need at least 20 – 24 GB, so this only leaves 6 – 10 GB for your SQL / LOB application server, this might be a problem. So keep this in mind if you are a growing organization and see the limit coming it is not possible to just insert more memory in your server, Windows Server 2008 R2 standard has a hard limit of 32 GB memory.

Windows Server 2008 R2 Enterprise or Datacenter
If memory could be an issue you might consider Windows Server 2008 R2 Enterprise or Datacenter, they both have a memory limit of 2 TB, this is a significant improvement. Also if you need to run more than one additional Virtual Machine you might consider both, Windows Server 2008 R2 Enterprise has an 1 to 4 virtualization right and Windows Server 2008 R2 Datacenter even 1 to unlimited. So with both version you will be far more flexible, but will cost considerably more than a standard or PAO version. Because also Windows Server 2012 is available at this moment I would not recommend these option only if you already own a license for these products it might be worth considering.

Hyper-V Server
If you do not have the SBS 2011 PAO or already have a Windows Server 2008 R2 license the free Hyper-V server might be worth considering. The free Hyper-V Server is a stripped Windows Server version with only the Hyper-V role included, there aren’t any other roles included.
The Hyper-V Server 2008 R2 has a memory limit of 1 TB and the Hyper-V Server 2012 has even a memory limit of 4 TB. There are no limitations between the Hyper-V server and the full blown versions of Windows Server, only thing is there is no graphical user interface (gui) on the Hyper-V Server. There is a small configuration menu to do some basic tasks but furthermore you need to configure and administer the server via a command window or via a remote management console.

For additional information about the Hyper-V Server look here: http://technet.microsoft.com/en-us/library/hh923062.aspx

Windows Server 2012
If you are not comfortable with a non gui server or have no ability to remotely manage the server and also not have any license available the best option would be to go for a Windows Server 2012 edition. There are only 2 version applicable, the Standard and the Datacenter version, only difference between both versions are the Virtualization rights. Windows Server 2012 Standard has an 1 to 2 virtualization right and Datacenter even 1 to unlimited. Both version have a memory limit of 4 TB so no limitation anymore on the standard version.

Client Access Licenses
If you need one or two Virtual Machines beside the SBS 2008 or 2011 the Windows Server 2012 Standard is an ideal solution.
One thing to keep in mind is that when the Virtual Machines also are installed with Windows Server 2012, the SBS 2011 client access license (CALs) are not covered. SBS CALs cover for all servers in your SBS domain but up to the same version as is the base operating system (OS) of your SBS version. So with SBS 2008 this is Windows Server 2008 and for SBS 2011 this is Windows Server 2008 R2, if you install a newer version of Windows Server you need to buy separate CALs.

Overview
Enough considerations on which OS you could install on the physical hardware as Hyper-V Host. You have to keep in mind there is not one best choice available it all depends on your situation, do you already have licenses that can be used, are you comfortable using a server installation without a gui, how many Virtual Machines do you need to run, etc, etc. To make some choices easier here a little table with the different versions:

 
Because licensing is complex material I would recommend you contact your distributor or reseller if you have any doubt about the solution you would like to choose and verify if it fits your company.
If you want to read more about virtualization and licensing I would suggest reading this excellent post: http://www.aidanfinn.com/?p=13090

 
Let’s continue with some other considerations if you could or could not virtualize the SBS 2008 or 2011 server.

SBS Backup
With SBS 2008 Microsoft introduced a wizard for configuring a backup, SBS Backup it is based on the Windows Backup but has its own configuration and monitoring options via the SBS console. It is easy to use and has no additional costs, you can configure backup to multiple disks, only thing is it only uses USB disks.

Problem is Hyper-V does not support USB redirection so you cannot attach the USB disks to a Virtual Machine and use them for SBS Backup. Of course there are some workarounds possible to attach an USB disk to a Virtual Machine, see this blog post http://blog.ronnypot.nl/?p=721 for some information, but this is probably not a supported workaround.
You can also create VHD files and attach them to the Virtual Machine and use them for SBS backup, but these VHD files are not attached and detached automatic and are not stored offline by default. You have to consider if this is a good alternative for you. Another option would be not using the wizards and interface but create command scripts using the command version (wbadmin.exe) of Windows Backup.

So if you want to use SBS Backup the way it is intended with USB disks, virtualization is not a good option.

USB redirection
As said there is no USB redirection with Hyper-V, this is for USB hard disks, but also for all other USB hardware, so no USB printers, scanners, drivers, dongles or what so ever.

Hardware
As there is no USB redirection it also is not possible to redirect some other hardware like, Fax boards, other pci cards, hardware dongles, etc.

So if you have any specific hardware that needs to be connected to a Virtual Machine you have to make sure this is possible, but in most cases this might be a configuration where virtualization is not an option.

Conclusion
The question to virtualize or not to virtualize cannot be simply answered with just a true or false, it all depends on many factors, decisions and considerations. Hope the information given in this blog will help you making the decision if you would virtualize your SBS 2008 or 2011 server or not.

 

• Delicious

After finishing a successful server migration from SBS 2003 to multiple Windows Server 2008 R2 servers there were some DNS issues. After a restart of the domain controller it looked like DNS is not working as it should the servers are also signaling they don’t have an internet connection. Restarting the DNS service fixes all problems for that time, but after a new restart same problem comes back every time.

Looking at the system event log there are a lot warnings and error events from the Source: NETLOGON

Event ID: 5774

ADDITIONAL DATA
Error Value: DNS name does not exist.

And:

Event ID: 5781

‘DomainDnsZones.domain.local.’
‘ForestDnsZones.domain.local.’

As we run DCDIAG /C before this didn’t give any error, but when we now run DCDIAG /test:dns we see the following result:

Running enterprise tests on : domain.local
Starting test: DNS
Test results for domain controllers:

TEST: Delegations (Del)
Error: DNS server: OLDSERVERNAME. domain.local.
IP: [Missing glue A record]

As you can see the test is trying to resolve the old servername at the Delegations test.

Solution:

At the end the problem was when looking in DNS manager and going to the domain.local – _msdcs subzone, the NS record had still the old servername entered.

Just change the record and change the data to the new server information. This resolved the first error, but the second stayed.

This error occures because there are one or more DNS zones are not correctly saved within Active Directory. You can easy see this by using the Registry editor regedit.exe and browse to HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ DNS Server \ Zones. All you dns zones should be located over here.

When you select a zone it would look like this:

As you can see there isn’t a REG_SZ value DirectoryPartition DomainDnsZones.domain.local or ForestDnsZones.domain.local these are the problem zones. I had to delete these zones (both were manual made zones in the past on the old DC) and recreate them. After recreation the REG_SZ value DirectoryPartition value was set and the event warnings didn’t come back as after restarts no problems have raised anymore.

• Delicious

After installation of System Center Virtual Machine Manager 2012 SP1, setup finishes without any errors, but when you try to start the program it tells the Virtual Machine Manager (vmmservice)service is not started. When you take a look at services indeed the service is not started, when you try to start the service it starts but almost immediate it crashes.

Taking a look at the System Event Log there are a couple of Event ID 7031 source: Service Control Manager events:
“The System Center Virtual Machine Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.”

In the Application Event Log you will see a Event ID: 19999 Source Virtual Machine Manager:
“Virtual Machine Manager (vmmservice:3620) has encountered an error and needed to exit the process. Windows generated an error report with the following parameters:
Event:VMM20
P1(appName):vmmservice
P2(appVersion):3.1.6011.0
P3(assemblyName):Engine.Common
P4(assemblyVer):3.1.6011.0
P5(methodName):M.V.E.SqmRefresher.IsRefreshRequired
P6(exceptionType):System.FormatException
P7(callstackHash):5104
.”

Also in the Application Event Log you will see a Event ID: 1 Source Virtual Machine Manager:
“System.FormatException: String was not recognized as a valid DateTime.
at System.DateTime.Parse(String s, IFormatProvider provider)
at System.Convert.ToDateTime(String value)
at Microsoft.VirtualManager.Engine.SqmRefresher.IsRefreshRequired(String refreshTime)
at Microsoft.VirtualManager.Engine.SqmRefresher.RefreshData(SQMSessionManager manager)
at Microsoft.VirtualManager.Engine.RefreshDriver`1.RefreshThreadFunction(Object obj)-2146233033

Problem signature:
P1: vmmservice
P2: 3.1.6011.0
P3: Engine.Common
P4: 3.1.6011.0
P5: M.V.E.SqmRefresher.IsRefreshRequired
P6: System.FormatException
P7: 5104
P8:
P9:
P10:”

Solution:
After a couple of different approaches and reinstallation the problem solution was that I installed the Windows Server 2012 server with the Dutch region setting. So the date and time were set to the Netherlands, when I changed the Region format to English (United States) and did a new installation setup finished a lot quicker and the services stays started.

So conclusion do not change the Date and Time setting when trying to install System Center Virtual Machine Manager 2012 SP1.

• Delicious

Last week microsoft released Windows Management Framework (WMF) 3.0 which includes Powershell 3.0 (KB2506146 for Windows 2008 SP2 and KB2506143 for Windows Server 2008 R2) as an optional Windows update. So everyone can approve and install the update via Windows update, WSUS or any other updating mechanism you are using.

But installing this update on a Small Business Server (SBS) 2008 and 2011 or on an Exchange Server 2007 and 2010 will give all kind of trouble.

Symptoms for an Exchange Server:
Installation of Exchange update rollups will fail one of the errors is: error code of 80070643.

The Exchange Team wrote this blog about this issue. It states: “Windows Management Framework 3.0 (specifically PowerShell 3.0) is not yet supported on any version of Exchange except Exchange Server 2013. If you install Windows Management Framework 3.0 on a server running Exchange 2007 or Exchange 2010, you will encounter problems, such as Rollups that will not install, or the Exchange Management Shell may not run properly.”

Symptoms for a Small Business Server:
When running some SBS wizards like the Fix My Network wizard it will end up with errors about access denied for the Exchange Management Shell.
Also other kind of problems may occur with the Exchange and / or SharePoint 2010 Management Shell and as written for Exchange Servers installation of Exchange update rollups may fail.

On the Small Business Server Blog there is a post on these issues.

Recommendation for both Exchange and Small Business Servers is to NOT install the Windows Management Framework 3.0 update at this time. If you already installed the update and encoutered the previously described problems, uninstall the update. Your server should be fine when it comes back online after a restart.

Update:
There is another problem reported in the Small Business Technet forum uninstallation of the also removes a registry key that gives problems to the event log. This is the key that is deleted: “HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ WINEVT \ Channels \ ForwardedEvents”

Anytime later in the same post there is a mention that the updates are removed from Microsoft Update:

As a result of these regressions and feedback from customers and experts like you, we have expired the WMF 3.0 Update for all platforms (Windows 7, Server 2008, and Server 2008 R2) as of 5:07 pm PDT.

doug neal
Microsoft Update (MU)

• Delicious

When you start the add printer wizard on windows 7 or windows server 2008 R2 (and probably windows 8 and windows server 2012) not all your printers are displayed in the list. But all printers are configured to be listed in Active Directory.

Solution:
It seems there is a default limit set to only show 20 directory printers in this list. You can change this amount with a Group Policy:

• Open Group Policy Management
• Add a new policy or edit an existing policy
• Browse Computer Configuration – Administrative Templates – Printers Add Printer wizard and edit Network scan page (Managed network)
• Enable the policy and change the value for Directory printers to a higher number. This is the amount of printers you will see in the list.

• Delicious