Share iT…

Just configured a Azure AD Connect (AADConnect / AADSync) synchronisation between an on premise domain and Office 365. All users are synchronized without any problems except one user. Nothing special for this user, same OU, member of the same groups, no special rigths or anything visible different. Also no errors in AADConnect logs, event logs or whatever.

Also followed this helpful Microsoft document One or more objects don’t sync when the Azure Active Directory Sync tool is used, but none of the options described solved the problem. sAMAccountName, proxyAddresses, etc are all correctly filled.
Other strange thing is when you run IdFix as described in the same document, the result also does not show this specific “problem” user.

Solution:
Accidently I did an export of all mailboxes and properties and for this perticular user I saw that LinkedMasterAccount was filled with an SID and the IsLinked value was set to true.
To see if these values are set for this account run the following powershell command: get-mailbox username | select-object *link*

If the IsLinked is set to true the mailbox is a linked Mailbox and linked mailboxes are not synced to Azure AD, as described in this article: Understanding Users and Contacts in Azure Active Directory Sync

A disabled account will contribute userPrincipalName and sourceAnchor, unless it is a linked mailbox.

Disabled accounts are synchronized as well to Azure AD. Disabled accounts are common to represent resources in Exchange, for example conference rooms. The exception is users with a linked mailbox; as previously mentioned, these will never provision an account to Azure AD.

In this case the linked mailbox was probably a leftover from the past so we could convert the mailbox back to a normal user with this powershell command: Set-User -Identity kweku@fabrikam.com -LinkedMasterAccount $null and after that the account was directly synced to Azure AD at the next syncronization schedule.

When trying to connect to a RemoteApp or Desktop Connection via the Remote Desktop Web Access or RemoteApp and Desktop Connections on a Windows desktop you can start the remote application but receive the following error:

This computer can’t connect to the remote computer.

Try connecting again. If the problem continues, contact the owner of the remote computer or your network administrator.

—

There are two Windows 2012 R2 servers in the Remote Desktop deployment, one with the RD Licensing, RD Gateway, RD Web Access and RD Connection Broker roles and one with the RD Session Host role. Investigating the deployment and collection settings there are no misconfigured settings found.

When you create a manual RDP file and create a desktop connection via the RD Gateway to the Session Host there is no problem.

—

Examining the eventlogs on the RD Connection broker will result in the following errors:

Event log: Microsoft-Windows-TerminalServices-SessionBroker-Client/Operational
Event 1301 Verbose:
Remote Desktop Connection Broker Client received request for redirection.
User : Domain\username
RDP Client Version : 5

Event 1296 Error:
Remote Desktop Connection Broker Client failed while getting redirection packet from Connection Broker.
User : Domain\username
Error: Element not found.

Event 1306 Error:
Remote Desktop Connection Broker Client failed to redirect the user Domain\username.
Error: NULL

Event log: Microsoft-Windows-TerminalServices-SessionBroker/Admin
Event 802 Error:
RD Connection Broker failed to process the connection request for user Domain\username.
Error: Element not found.

—

Solution:

The solution to the problem was as easy as just deleting the Collection and creating a new Collection.

—

Because virtualization becomes more and more common use and with Microsoft Hyper-V included in Windows Server at no additional costs and most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 2011 installation and never get the full benefits of the hardware. It is worth considering to virtualize the SBS 2008 or 2011 server and run one or maybe two or more virtual servers beside it on the same hardware.

In this blog post I will put together some facts, tips and considerations you should look after before you start virtualizing a SBS 2008 or 2011 server. Of course a lot of this information can also be used for virtualizing non SBS servers.

Enable Hyper-V role on a SBS 2008 or 2011 server
So if you just want to add just one other server, why not install SBS 2008 or 2011 on the physical hardware and just enable the Hyper-V role?

The answer is really simple, because it is not supported!! Enabling the Hyper-V role on a SBS 2008 or 2011 server will break stuff, for some additional information read here: http://blogs.technet.com/b/sbs/archive/2009/08/07/you-cannot-install-the-hyper-v-role-on-the-sbs-2008-primary-server.aspx

Hyper-V Host
So as we cannot enable the Hyper-V role on a SBS 2008 or 2011 server we need to install a Windows Server version on the physical hardware to function as a Host for the Virtual Machines. It is recommended that the Hyper-V Host will only hold the Hyper-V role and not to include any other roles or tasks. Only exception maybe for some management or backup tasks.

The Windows Server version we will choose is a real important decision, so let’s see what choices we have:
Hyper-V is included within Windows Server since version 2008 this was a version 1.0 and has a lot of limitations. I would not recommend using Windows Server 2008 to host the virtual machines. So I will limit to choice between the different server versions based on Windows Server 2008 R2 and Windows Server 2012.

SBS 2011 Premium Add-on
When you already bought SBS 2011, you might have bought the SBS 2011 Premium Add-on (PAO) in addition. The SBS 2011 PAO includes a Windows Server 2008 R2 standard and SQL 2008 R2 license. With Windows Server 2008 R2 Standard you have the right to install the software on a physical machine and install one Virtual Machine with the same license. This is called virtualization rights (1+1), you may do this only when you do not install any other role on the Host installation other than the Hyper-V role. When you install another role you will lose this right and need to buy a separate license for the virtual installation.

This said the SBS 2011 PAO will be a perfect consideration to use for your Host installation and run SBS 2011 and a second Virtual Machine for SQL server and / or a LOB application or even a Remote Desktop Session Host (Terminal) Server.

Memory
So the SBS 2011 PAO looks like an ideal solution, but one limitation is worth naming. Windows Server 2008 R2 standard has a 32GB memory limitation, this might be a problem when running SBS 2011 standard and also have a memory consuming SQL / LOB application. SBS 2011 standard itself with especially Exchange 2010 is a very memory consuming product, if you also need to run a loaded SQL / LOB application server beside this 32 GB might not be enough.
The Windows Server 2008 R2 Host installation needs about 2 – 4 GB, a SBS 2011 Standard for 25 – 50 users will need at least 20 – 24 GB, so this only leaves 6 – 10 GB for your SQL / LOB application server, this might be a problem. So keep this in mind if you are a growing organization and see the limit coming it is not possible to just insert more memory in your server, Windows Server 2008 R2 standard has a hard limit of 32 GB memory.

Windows Server 2008 R2 Enterprise or Datacenter
If memory could be an issue you might consider Windows Server 2008 R2 Enterprise or Datacenter, they both have a memory limit of 2 TB, this is a significant improvement. Also if you need to run more than one additional Virtual Machine you might consider both, Windows Server 2008 R2 Enterprise has an 1 to 4 virtualization right and Windows Server 2008 R2 Datacenter even 1 to unlimited. So with both version you will be far more flexible, but will cost considerably more than a standard or PAO version. Because also Windows Server 2012 is available at this moment I would not recommend these option only if you already own a license for these products it might be worth considering.

Hyper-V Server
If you do not have the SBS 2011 PAO or already have a Windows Server 2008 R2 license the free Hyper-V server might be worth considering. The free Hyper-V Server is a stripped Windows Server version with only the Hyper-V role included, there aren’t any other roles included.
The Hyper-V Server 2008 R2 has a memory limit of 1 TB and the Hyper-V Server 2012 has even a memory limit of 4 TB. There are no limitations between the Hyper-V server and the full blown versions of Windows Server, only thing is there is no graphical user interface (gui) on the Hyper-V Server. There is a small configuration menu to do some basic tasks but furthermore you need to configure and administer the server via a command window or via a remote management console.

For additional information about the Hyper-V Server look here: http://technet.microsoft.com/en-us/library/hh923062.aspx

Windows Server 2012
If you are not comfortable with a non gui server or have no ability to remotely manage the server and also not have any license available the best option would be to go for a Windows Server 2012 edition. There are only 2 version applicable, the Standard and the Datacenter version, only difference between both versions are the Virtualization rights. Windows Server 2012 Standard has an 1 to 2 virtualization right and Datacenter even 1 to unlimited. Both version have a memory limit of 4 TB so no limitation anymore on the standard version.

Client Access Licenses
If you need one or two Virtual Machines beside the SBS 2008 or 2011 the Windows Server 2012 Standard is an ideal solution.
One thing to keep in mind is that when the Virtual Machines also are installed with Windows Server 2012, the SBS 2011 client access license (CALs) are not covered. SBS CALs cover for all servers in your SBS domain but up to the same version as is the base operating system (OS) of your SBS version. So with SBS 2008 this is Windows Server 2008 and for SBS 2011 this is Windows Server 2008 R2, if you install a newer version of Windows Server you need to buy separate CALs.

Overview
Enough considerations on which OS you could install on the physical hardware as Hyper-V Host. You have to keep in mind there is not one best choice available it all depends on your situation, do you already have licenses that can be used, are you comfortable using a server installation without a gui, how many Virtual Machines do you need to run, etc, etc. To make some choices easier here a little table with the different versions:

 
Because licensing is complex material I would recommend you contact your distributor or reseller if you have any doubt about the solution you would like to choose and verify if it fits your company.
If you want to read more about virtualization and licensing I would suggest reading this excellent post: http://www.aidanfinn.com/?p=13090

 
Let’s continue with some other considerations if you could or could not virtualize the SBS 2008 or 2011 server.

SBS Backup
With SBS 2008 Microsoft introduced a wizard for configuring a backup, SBS Backup it is based on the Windows Backup but has its own configuration and monitoring options via the SBS console. It is easy to use and has no additional costs, you can configure backup to multiple disks, only thing is it only uses USB disks.

Problem is Hyper-V does not support USB redirection so you cannot attach the USB disks to a Virtual Machine and use them for SBS Backup. Of course there are some workarounds possible to attach an USB disk to a Virtual Machine, see this blog post http://blog.ronnypot.nl/?p=721 for some information, but this is probably not a supported workaround.
You can also create VHD files and attach them to the Virtual Machine and use them for SBS backup, but these VHD files are not attached and detached automatic and are not stored offline by default. You have to consider if this is a good alternative for you. Another option would be not using the wizards and interface but create command scripts using the command version (wbadmin.exe) of Windows Backup.

So if you want to use SBS Backup the way it is intended with USB disks, virtualization is not a good option.

USB redirection
As said there is no USB redirection with Hyper-V, this is for USB hard disks, but also for all other USB hardware, so no USB printers, scanners, drivers, dongles or what so ever.

Hardware
As there is no USB redirection it also is not possible to redirect some other hardware like, Fax boards, other pci cards, hardware dongles, etc.

So if you have any specific hardware that needs to be connected to a Virtual Machine you have to make sure this is possible, but in most cases this might be a configuration where virtualization is not an option.

Conclusion
The question to virtualize or not to virtualize cannot be simply answered with just a true or false, it all depends on many factors, decisions and considerations. Hope the information given in this blog will help you making the decision if you would virtualize your SBS 2008 or 2011 server or not.

 

After finishing a successful server migration from SBS 2003 to multiple Windows Server 2008 R2 servers there were some DNS issues. After a restart of the domain controller it looked like DNS is not working as it should the servers are also signaling they don’t have an internet connection. Restarting the DNS service fixes all problems for that time, but after a new restart same problem comes back every time.

Looking at the system event log there are a lot warnings and error events from the Source: NETLOGON

Event ID: 5774

ADDITIONAL DATA
Error Value: DNS name does not exist.

And:

Event ID: 5781

‘DomainDnsZones.domain.local.’
‘ForestDnsZones.domain.local.’

As we run DCDIAG /C before this didn’t give any error, but when we now run DCDIAG /test:dns we see the following result:

Running enterprise tests on : domain.local
Starting test: DNS
Test results for domain controllers:

TEST: Delegations (Del)
Error: DNS server: OLDSERVERNAME. domain.local.
IP: [Missing glue A record]

As you can see the test is trying to resolve the old servername at the Delegations test.

Solution:

At the end the problem was when looking in DNS manager and going to the domain.local – _msdcs subzone, the NS record had still the old servername entered.

Just change the record and change the data to the new server information. This resolved the first error, but the second stayed.

This error occures because there are one or more DNS zones are not correctly saved within Active Directory. You can easy see this by using the Registry editor regedit.exe and browse to HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ DNS Server \ Zones. All you dns zones should be located over here.

When you select a zone it would look like this:

As you can see there isn’t a REG_SZ value DirectoryPartition DomainDnsZones.domain.local or ForestDnsZones.domain.local these are the problem zones. I had to delete these zones (both were manual made zones in the past on the old DC) and recreate them. After recreation the REG_SZ value DirectoryPartition value was set and the event warnings didn’t come back as after restarts no problems have raised anymore.

After installation of System Center Virtual Machine Manager 2012 SP1, setup finishes without any errors, but when you try to start the program it tells the Virtual Machine Manager (vmmservice)service is not started. When you take a look at services indeed the service is not started, when you try to start the service it starts but almost immediate it crashes.

Taking a look at the System Event Log there are a couple of Event ID 7031 source: Service Control Manager events:
“The System Center Virtual Machine Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.”

In the Application Event Log you will see a Event ID: 19999 Source Virtual Machine Manager:
“Virtual Machine Manager (vmmservice:3620) has encountered an error and needed to exit the process. Windows generated an error report with the following parameters:
Event:VMM20
P1(appName):vmmservice
P2(appVersion):3.1.6011.0
P3(assemblyName):Engine.Common
P4(assemblyVer):3.1.6011.0
P5(methodName):M.V.E.SqmRefresher.IsRefreshRequired
P6(exceptionType):System.FormatException
P7(callstackHash):5104
.”

Also in the Application Event Log you will see a Event ID: 1 Source Virtual Machine Manager:
“System.FormatException: String was not recognized as a valid DateTime.
at System.DateTime.Parse(String s, IFormatProvider provider)
at System.Convert.ToDateTime(String value)
at Microsoft.VirtualManager.Engine.SqmRefresher.IsRefreshRequired(String refreshTime)
at Microsoft.VirtualManager.Engine.SqmRefresher.RefreshData(SQMSessionManager manager)
at Microsoft.VirtualManager.Engine.RefreshDriver`1.RefreshThreadFunction(Object obj)-2146233033

Problem signature:
P1: vmmservice
P2: 3.1.6011.0
P3: Engine.Common
P4: 3.1.6011.0
P5: M.V.E.SqmRefresher.IsRefreshRequired
P6: System.FormatException
P7: 5104
P8:
P9:
P10:”

Solution:
After a couple of different approaches and reinstallation the problem solution was that I installed the Windows Server 2012 server with the Dutch region setting. So the date and time were set to the Netherlands, when I changed the Region format to English (United States) and did a new installation setup finished a lot quicker and the services stays started.

So conclusion do not change the Date and Time setting when trying to install System Center Virtual Machine Manager 2012 SP1.

Last week microsoft released Windows Management Framework (WMF) 3.0 which includes Powershell 3.0 (KB2506146 for Windows 2008 SP2 and KB2506143 for Windows Server 2008 R2) as an optional Windows update. So everyone can approve and install the update via Windows update, WSUS or any other updating mechanism you are using.

But installing this update on a Small Business Server (SBS) 2008 and 2011 or on an Exchange Server 2007 and 2010 will give all kind of trouble.

Symptoms for an Exchange Server:
Installation of Exchange update rollups will fail one of the errors is: error code of 80070643.

The Exchange Team wrote this blog about this issue. It states: “Windows Management Framework 3.0 (specifically PowerShell 3.0) is not yet supported on any version of Exchange except Exchange Server 2013. If you install Windows Management Framework 3.0 on a server running Exchange 2007 or Exchange 2010, you will encounter problems, such as Rollups that will not install, or the Exchange Management Shell may not run properly.”

Symptoms for a Small Business Server:
When running some SBS wizards like the Fix My Network wizard it will end up with errors about access denied for the Exchange Management Shell.
Also other kind of problems may occur with the Exchange and / or SharePoint 2010 Management Shell and as written for Exchange Servers installation of Exchange update rollups may fail.

On the Small Business Server Blog there is a post on these issues.

Recommendation for both Exchange and Small Business Servers is to NOT install the Windows Management Framework 3.0 update at this time. If you already installed the update and encoutered the previously described problems, uninstall the update. Your server should be fine when it comes back online after a restart.

Update:
There is another problem reported in the Small Business Technet forum uninstallation of the also removes a registry key that gives problems to the event log. This is the key that is deleted: “HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ WINEVT \ Channels \ ForwardedEvents”

Anytime later in the same post there is a mention that the updates are removed from Microsoft Update:

As a result of these regressions and feedback from customers and experts like you, we have expired the WMF 3.0 Update for all platforms (Windows 7, Server 2008, and Server 2008 R2) as of 5:07 pm PDT.

doug neal
Microsoft Update (MU)

When you start the add printer wizard on windows 7 or windows server 2008 R2 (and probably windows 8 and windows server 2012) not all your printers are displayed in the list. But all printers are configured to be listed in Active Directory.

Solution:
It seems there is a default limit set to only show 20 directory printers in this list. You can change this amount with a Group Policy:

• Open Group Policy Management
• Add a new policy or edit an existing policy
• Browse Computer Configuration – Administrative Templates – Printers Add Printer wizard and edit Network scan page (Managed network)
• Enable the policy and change the value for Directory printers to a higher number. This is the amount of printers you will see in the list.

I ran into this problem on a Terminal Server configuration where the Adobe Reader X (AcroRd32.exe) process keeps using high if not all cpu capacity even after you close the program. After some searches I found this could be because the welcome screen that is opened when you start Acrobat Reader isn’t closed at all, the session stays active and keeps using a lot of cpu capacity.

Solution:
I could not found a fix for the problem at this time , but there is a workaround that solves the problem. You can disable the welcome screen from starting with a registry key.

1. Open the regedit and navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\10.0\FeatureLockDown

2. Add a new key with the name: cWelcomeScreen

3. Add a DWORD value to the key: bShowWelcomeScreen with value 0

Now when starting Adobe Reader it will not start the welcome screen but also does not uses the high cpu.

Today Microsoft announced the Windows Server 2012 editions, they have simplified the licensing. There are coming dramatic changes and there will only be four editions, Datacenter, Standard, Essentials and Foundation. For more details see this post on the official site and the licensing datasheet.

There is also a FAQ with most common questions answered. Specific I would point to Q33 because this will sign the end of an era Windows Small Business Server.

Q33: Will there be a next version of Windows Small Business Server 2011 Standard?

No. Windows Small Business Server 2011 Standard, which includes Exchange Server and Windows server component products, will be the final such Windows Server offering. This change is in response to small business market trends and behavior. The small business computing trends are moving in the direction of cloud computing for applications and services such as email, online back-up and line-of-business tools.

The Small Business Server Essentials product introduced with version 2011 with a connection to Office 365 will be kept but renamed to Windows Server 2012 Essentials, so it also will lose the product name SBS. Here is the official announcement on the SBS Blog.

So as expected Microsoft is changing their complete focus with Windows Server 2012 to cloud optimized solutions and the Windows Small Server doesn’t fit in this picture anymore.

Last week I attended my very first TechEd, TechEd Europe to be precise and what an experience it was. This is my personal experience and a global overview of my interests that I have seen this week. TechEd Europe was a great mix of getting input for projects I am working on and to get a grip on what to expect the next couple of months.

Day one started with a keynote presented by Brad Anderson and Jason Zander, with a lot of information about Windows Server 2012 and Microsoft’s perception on private, public and hybrid clouds. And what cool new features are waiting for us. Probably the most impressive demo was where they showed 1.000.000 iops on one single virtual machine. Also the copy of a 10gb file that was finished in about 10 seconds on an odx (Offloaded Data Transfer) storage solution was really cool.

Watch the day one keynote over here: http://channel9.msdn.com/Events/TechEd/Europe/2012/KEY01

Day two there was another keynote, this time presented by Antoine Leblond it was more about Windows 8, applications and some developer stuff. Beside the new Windows 8 metro interface and the demo’s it is not only optimized for touch experience but you can do fine with keyboard and mouse, I really liked the demo of Windows to Go. A complete Windows 8 installation on an usb device, boot from the usb but use the hardware of the desktop it is put in.

Watch the day two keynote over here: http://channel9.msdn.com/Events/TechEd/Europe/2012/KEY02

Beside both keynotes there were over 300 breakout sessions, exam crams, workshops, hands-on labs and a TechExpo with a lot of partners showing their products and services. There were also a lot of Microsoft product manager talk with you about their products and answer your questions.

The enormous amount of session made it really hard to decide which session to attend, because on every timeframe there was more than one interesting session. Luckily al session are recorded so we can watch them on a later moment. All sessions can be found here: http://channel9.msdn.com/events/TechEd/Europe/2012/

Because of my job, projects and interests most sessions I attended were about Windows Server, Hyper-V, Virtual Machine Manager and Exchange Server. Of course not all sessions reached the expectations, but there are some sessions I really enjoyed.

Although you think you know a lot about Exchange 2010 the “Microsoft Exchange Server 2010 SP2 Tips & Tricks” session by Scott Schnoll showed there is always place for some new information. There was also an announcement for the new version 1.5 of the Remote Activity Analyzer tool, which can be tested over here: Remote Connectivity Analyzer.

The “What’s New in Active Directory in Windows Server 2012” by Samuel Devasahayam and Ulf B. Simon-Weidner was probably one of my favorites. Because of all the new features in virtualization world the other new features in Windows server 2012 don’t get that much attention, but also here there are a lot of new features waiting for us. Another thing I liked about this session is the deep dive they did on some material I didn’t expect this at all.

Two other great sessions I would like to mention, because these are two new features I really like and I think they have great potential. First the “Enabling Disaster Recovery for Hyper-V Workloads Using Hyper-V Replica” session by Vijay Tandra Sistla and Mike van de Merwe, the solution by creating a replica of your Virtual Machine on another server local or in another location (datacenter) gives great opportunities for disaster recovery solutions.
Second “Building Flexible Hyper-V Environments Windows Server 2012 Hyper-V Live Migration and Live Storage Migration” by Ben Armstrong because of the possibility of migrating a Virtual Machine from one physical server with direct attached storage to another physical server with direct attached storage only connected by an Ethernet cable without any downtime is brilliant. Or even better as Ben Armstrong said, I did it over wireless ethernet so there is no physical connection at all. Of course this will also work for cluster to cluster, standalone to cluster and vice versa. Think of the flexibility you have with this feature.

If you think these are the new features, you are wrong there were dozens of other cool new ones like, Windows Server 2012 Dynamic Access Control, SMB 3.0, Hyper-V Network Virtualization, Bare metal deployment of Hyper-V hosts via Virtual Machine Manager 2012, and so on and so on.

Beside all the great sessions and loads of technical information I also really liked the talks with other it professionals and to meet the people you normally only know via twitter or blog posts.

Another personal highlight for me was the achievement of the new MCSE Private Cloud certification, via the possibility to do some free and discounted exams on the TechEd site.

To end with a quote by Brad Anderson on the keynote on day one; there are a lot of opportunities. “Don’t follow, LEAD!”