Ask Aresh

Forefront Protection for Exchange 2010 (FPE) is unable to get updates from the Cloudmark Antispam Engine

2011-09-21T14:12:00.001+05:30

Currently in our Exchange environment we were facing strange issues with the Forefront Protection for Exchange (FPE) on the Edge Servers

Issue Description:

Out of the 7 engines we are unable to get updates on the Cloudmark engine. (See picture)

Two event ids in the application event log as follows: (6019 and 6012)

Log Name:      Application
Source:        GetEngineFiles
Date:          9/9/2011 6:57:20 AM
Event ID:      6019
Task Category: Engine Error
Level:         Error
Keywords:      Classic
Computer:      Description:
Microsoft Forefront Protection encountered an error while performing a scan engine update.
Scan Engine: Cloudmark

Log Name:      Application
Source:        GetEngineFiles
Date:          9/9/2011 6:57:20 AM
Event ID:      6012
Task Category: Engine Error
Level:         Error
Keywords:      Classic
Description:
Microsoft Forefront Protection encountered an error while performing a scan engine update.
   Scan Engine: Cloudmark
   Error Code: 0x80004005
   Error Detail: Description: An error occurred while loading the scan engine.

We have already added the 4 URL’s on port 80 and 443 (cdn-microsupdates.cloudmark, lvc.cloudmark.com, pki.cloudmark.com and tracks.cloudmark.com) into our Cisco firewalls and the httpsinspection option is disable on the firewall. One strange thing we are noticing is the FPE client and Cloudmark server is resetting the connection as per the network trace

Resolution:

When running the two telnet tests, only the one to port 80 is successful. The one to port 443 fails.

telnet cdn-microupdates.cloudmark.com 80
telnet lvc.cloudmark.com 443

The connection errors you are seeing have been seen before and are due to the firewall still having a restriction to the ports. In this case, port 443 is still being block which is preventing the Micro Updates from coming through.

The networking team on our side figured out the URL were not getting resolved properly for https connections and they decided to add the IP address for all the URL’s instead of the names and problem got fixed.

lvc.cloudmark.com: 208.83.138.34

cdn-microsupdates.cloudmark.com: 93.184.215.73

pki.cloudmark.com: 208.83.136.39

crl.microsoft.com: 207.152.124.49, 205.177.95.229, 198.173.20.88

forefrontdl.microsoft.com: 198.63.194.0/24, 198.173.2.0/24, 207.109.221.0/24, 198.63.196.51, 205.234.218.11, 63.216.54.57, 69.31.106.35, 128.242.191.32, 207.152.124.91, 198.63.203.49, 205.234.225.152, 198.173.20.113, 63.236.252.201, 63.236.252.232, 69.31.102.90, 63.216.54.42, 209.18.42.152, 64.145.91.135, 64.145.91.126, 205.234.218.35

I hope this information would be useful for people troubleshooting FPE issues and will save atleast couple of days worth of troubleshooting efforts.
If you like this post please leave your comments and don’t forget to say thanks.

Best Regards,

Aresh Sarkari

SCVMM R2: You cannot contact the Virtual Machine Manager server. ID: 1605

2011-02-03T17:30:00.001+05:30

I am logging onto the same machine where SCVMM is installed. I am part of the Local Administrators group when i open the VMM Admin Console i am receiving the following error. Although my account is not the same account using which the VMM was installed. However, my understanding is if i am local admin i can open the console because by default under VMM console under administration administrator group is added.

You cannot contact the Virtual Machine Manager server. The credentials provided have the insufficient privileges on localhost. Ensure that your account has the access to Virtual Machine Manager server localhost, and then try the operation again

ID: 1605

VMM services is running on "Local System"
VMM version is R2 and not beta.
VMM machine is part of the domain

Solution:

Domain Administrator group would have the by default access to SCVMM Admin Console. Though, I was the local admin on the box I would be required to add explicitly onto the User Roles - Administrator membership (See the below mentioned screenshot). After adding the account here issue was resolved.

Leave your valuable comments here..

Best Regards,

Aresh Sarkari

Hyper V Demo & Excel 2007 ITPro Event 30 May 2009 (Bangalore, India)

2009-05-26T20:47:00.001+05:30

Catch me live presenting the “Demo of Hyper V” … Be there !!!!

Please find the details of the UG meeting for 30th May 09. Kindly circulate the same to the UG members and friends.

Agenda
TimeTopicSpeakers
04.00PM to 04.15PM      Registration
04.15PM to 04.30PM      Welcome
04.30PM to 05.30PM      Demo Hyper –V Mr. Aresh Sarkari
05.30PM to 05.45PM      Tea Break
05.45PM to 06.45PM      Excel 2007 – Introduction and Overview Mr. Jijin KV
06.45PM to 07.15PM      Fun Activity
07.15PM to 07.30PM     Closing Note

Date: 30-May-2009
Time: 04.00PM to 08.00PM

Entry is Free for All

Venue: Chervil Training Room, Signature Building, Microsoft Corp. Bangalore -560017.

Reserve your seat at https://www.clicktoattend.com/invitation.aspx?code=138746
For more details keep visit our group site http://www.bitpro.in

RSVP: Mr.S.Kaliyan, 9740991870 / Mr.Jijin, 9886265058

Regards,
Aresh Sarkari

Hyper V & SQL 2008 ITPro Event May 2009 (Bangalore, India)

2009-05-20T17:01:00.001+05:30

Catch me live presenting the “Technical Overview of Hyper V” … Be there !!!!

Location : MTC Training Room, Signature Building, Microsoft Corp. Bangalore

Start Time : 5/9/2009 4:00 PM

End Time : 5/9/2009 8:00 PM

Time	Topic	Speakers
04.00PM to 04.15PM	Registration
04.15PM to 04.30PM	Welcome
04.30PM to 05.30PM	Technical Overview of Hyper-V	Mr.Aresh Sarkari Technical Solutions Consultant, HP India,
05.30PM to 05.45PM	Tea Break
05.45PM to 06.45PM	Policy Based Management in SQL Server 2008	Mr. Anil Mahadev Senior SQL Server DBA / Infrastructure Lead, M/s. Maitri Information Systems Pvt Ltd.
06.45PM to 07.15PM	Fun Activity
07.15PM to 07.30PM	Closing Note

Registration site: http://www.clicktoattend.com/?id=138274
Event Code: 138274

Regards,
Aresh Sarkari

Performance Counters showing numeric values – Windows Server 2003 x64

2009-04-30T20:03:00.001+05:30

Issue:

Perfmon on Windows 2003 x64 servers, the object counters are showing as numerical values instead of "processor", "memory" etc

Solution:

Make sure you have taken a full System Backup before trying the below mentioned steps.

On a 64-bit machine, there are two versions of "lodctr.exe"

- %windir%\system32
- %windir%\SysWow64

You have to run the 32bit lodctr.exe to reload the 32bit counters and the 64bit

"lodctr.exe /r "

Note: Without quotes “”

Reboot the server

Don’t forget to leave your comments :)

Thanks,
Aresh

How to Manually Uninstall Windows 2003 Cluster

2009-04-16T19:33:00.001+05:30

First try Microsoft KB http://support.microsoft.com/kb/282227/en-us but if that fails, you can perform the following using all or some of the following steps where applicable. The example below is where no eviction or force cleanup has taken place. This is the last remaining node in a cluster.

1.) Unload the cluster hive via the Registry Editor --> Select HKLM\Cluster --> Menu Bar --> File --> Unload Hive
2) Delete HKLM\System\CurrentControlSet\Services\clusnet and clussvc keys
3.) Change the Clusdisk startup type to "disabled" in the Device Manager --> View --> Show Hidden Devices --> Non Plug and Play --> Cluster Disk Properties --> Driver Tab

HKLM\System\CurrentControlSet\Services\clusdisk\
Value 1
Name:            Start
Type:            REG_DWORD
Data:            0x4

Also delete all but the HKLM\System\CurrentControlSet\Services\clusdisk\ and it's security subkey. The registry text export looks like the following example taken from a standalone Windows 2003 EE node where cluster wasn't installed:

Key Name:          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClusDisk
Class Name:        <NO CLASS>
Last Write Time:   6/19/2006 - 3:20 PM
Value 0
Name:            Type
Type:            REG_DWORD
Data:            0x1

Value 1
Name:            Start
Type:            REG_DWORD
Data:            0x4

Value 2
Name:            ErrorControl
Type:            REG_DWORD
Data:            0x1

Value 3
Name:            Tag
Type:            REG_DWORD
Data:            0x7

Value 4
Name:            ImagePath
Type:            REG_EXPAND_SZ
Data:            system32\DRIVERS\ClusDisk.sys

Value 5
Name:            DisplayName
Type:            REG_SZ
Data:            Cluster Disk Driver

Value 6
Name:            Group
Type:            REG_SZ
Data:            Filter

Key Name:          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClusDisk\Security
Class Name:        <NO CLASS>
Last Write Time:   6/19/2006 - 3:20 PM
Value 0
Name:            Security
Type:            REG_BINARY
Data:
00000000   01 00 14 80 b8 00 00 00 - c4 00 00 00 14 00 00 00 ....¸...Ä.......
00000010   30 00 00 00 02 00 1c 00 - 01 00 00 00 02 80 14 00 0...............
00000020   ff 01 0f 00 01 01 00 00 - 00 00 00 01 00 00 00 00 ÿ...............
00000030   02 00 88 00 06 00 00 00 - 00 00 14 00 fd 01 02 00 ............ý...
00000040   01 01 00 00 00 00 00 05 - 12 00 00 00 00 00 18 00 ................
00000050   ff 01 0f 00 01 02 00 00 - 00 00 00 05 20 00 00 00 ÿ........... ...
00000060   20 02 00 00 00 00 14 00 - 8d 01 02 00 01 01 00 00   ...............
00000070   00 00 00 05 04 00 00 00 - 00 00 14 00 8d 01 02 00 ................
00000080   01 01 00 00 00 00 00 05 - 06 00 00 00 00 00 14 00 ................
00000090   00 01 00 00 01 01 00 00 - 00 00 00 05 0b 00 00 00 ................
000000a0   00 00 18 00 fd 01 02 00 - 01 02 00 00 00 00 00 05 ....ý...........
000000b0   20 00 00 00 23 02 00 00 - 01 01 00 00 00 00 00 05   ...#...........
000000c0   12 00 00 00 01 01 00 00 - 00 00 00 05 12 00 00 00 ................

4.) Ensure the following files are the only ones in c:\windows\cluster.

TIP: You can move clusdb or any files or logs to another folder if you want to reference them to view old configuration data.
If you prefer, just delete the other files and leave the remaining.

5.) Make sure the following registry key is present with the following values:

NOTE: The key should be present already with 2 values but just delete the extra ones and change the ClusterInstallationStage value to 1.

Key Name:          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Cluster Server
Class Name:        <NO CLASS>
Last Write Time:   9/8/2006 - 8:53 PM
Value 0
Name:            ClusterInstallationState
Type:            REG_DWORD
Data:            0x1

Value 1
Name:            ClusterInstallationDirectory
Type:            REG_SZ
Data:            C:\WINDOWS\Cluster

6.) Restart the node.
7.) Double-check your modifications to make sure they didn't change from the reboot or you overlooked anything.
8.) You will now be able to access your old quorum, so move or delete the MSCS folder.
9.) You should now be able to install cluster (new cluster or add node to cluster).
10.) If you are installing a new cluster (or adding a node back to a cluster) with the same name as the pre-existing one, you should see passing checks for the analyzing configuration section of the cluster install wizard:

Don’t forget to leave your comments :)

Thanks,
Aresh

How to use Adplus to generate User memory dump’s Windows 2003

2009-04-16T19:12:00.001+05:30

ADPlus is a tool that will allow us to get a memory dump from a process that is giving you problems. To get this tool, please install the "Debugging Tools for Windows" from http://www.microsoft.com/whdc/devtools/debugging/installx64.mspx

Once these tools are installed, do the following:

1. Create a directory called c:\adplus

2. Determine the pid of the process you wish to monitor by looking at the "Process" tab in task manager, you will need this later

3. Open a command prompt and change to the directory where you installed the debugging tools. By default, this is c:\Program Files\Debugging Tools for Windows

4. Type the following: "cscript adplus.vbs -crash -p PID -o c:\adplus" (without the quotes, where PID is the number you determined in step 2).

5. Do not interfere with the windows that is opened, just let it run minimized.

6. You will not be able to log off the system while you are monitoring.

7. When the crash occurs, please zip and send me the contents of the c:\adplus directory.

Reference Microsoft KB article:

286350 HOWTO: Use Autodump+ to Troubleshoot "Hangs" and "Crashes"
http://support.microsoft.com/?id=286350

Don’t forget to leave your comments :)

Thanks,
Aresh

Windows 7 Day - IT Pro Event (Bangalore, India)

2009-04-16T19:04:00.001+05:30

Catch me live presenting the exclusive demo for Windows 7 :) …. Be there

Dear All,

The IT Pro community Bangalore is planning to conduct a session on Windows 7. We would look out for your presence in the event….

Share with your near and dear ones too!!

Regards,

Aresh

BugCheck CB on Windows 2003 Service Pack 2

2009-04-16T01:57:00.001+05:30

Recommendation:
===============
==> In this case TCPIP.SYS driver was the cause for the BugCheck as the IRP was stuck at the TCPIP.SYS.
==> Apply MS KB 962238 to update TCPIP.SYS and AFD.SYS
==> Disable TCP Chimney Feature of Windows Server 2003 SP2. You can follow the article below to disable TCP Chimney either using the package mentioned in the article or you can refer to the workaround section for disabling it manually.

Debug Trace:
============
DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (cb)
Caused by a driver not cleaning up completely after an I/O.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:

Arg1: b7bf92f2, The calling address in the driver that locked the pages or if the
                IO manager locked the pages this points to the dispatch routine of
                the top driver on the stack to which the IRP was sent.
Arg2: b7bfa933, The caller of the calling address in the driver that locked the
                pages. If the IO manager locked the pages this points to the device
                object of the top driver on the stack to which the IRP was sent.
Arg3: 8975d618, A pointer to the MDL containing the locked pages.
Arg4: 00000003, The number of locked pages.

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details

FAULTING_IP:
afd!AfdAllocateMdlChain+bf
b7bf92f2 8b45dc mov eax,dword ptr [ebp-24h]

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xCB

PROCESS_NAME: cognos.cgi

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8084cc7b to 80827c83

STACK_TEXT:
b49b2c38 8084cc7b 000000cb b7bf92f2 b7bfa933 nt!KeBugCheckEx+0x1b
b49b2c68 8094c4eb ffffffe5 898cbcb8 f1256323 nt!MmCleanProcessAddressSpace+0x551
b49b2cf0 8094c569 f1256323 b49b2d4c 8082e0d6 nt!PspExitThread+0x5f1
b49b2cfc 8082e0d6 898cbcb8 b49b2d48 b49b2d3c nt!PsExitSpecialApc+0x1d
b49b2d4c 80889867 00000001 00000000 b49b2d64 nt!KiDeliverApc+0x1ae
b49b2d4c 7c8285ec 00000001 00000000 b49b2d64 nt!KiServiceExit+0x56
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f3bc 00000000 00000000 00000000 00000000 0x7c8285ec

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
afd!AfdAllocateMdlChain+bf
b7bf92f2 8b45dc mov eax,dword ptr [ebp-24h]

SYMBOL_NAME: afd!AfdAllocateMdlChain+bf

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: afd

IMAGE_NAME: afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48f76164

FAILURE_BUCKET_ID: 0xCB_afd!AfdAllocateMdlChain+bf

BUCKET_ID: 0xCB_afd!AfdAllocateMdlChain+bf

Followup: MachineOwner
---------

==>> Now, use the !search extension to find the virtual addresses that are associated with the MDL pointer.

13: kd> !search 8975d618
Debuggee is a kernel summary dump, some physical pages may not be present.
Searches will miss hits from those pages.
Searching PFNs in range 00000001 - 0022FFFE for [FFFFFFFF8975D618 - FFFFFFFF8975D618]

Pfn      Offset   Hit      Va       Pte
- - - - - - - - - - - - - - - - - - - - - - - - - - -
000008A6 0000054C 8975D618 808A654C C0404530
00105EA6 0000016C 8975D618 876A616C C043B530
                876a6160+0xc     : Irp   -- Io, IRP packets
00105EF2 00000828 8975D718 876F2828 C043B790
                876f2000+0x828   : Io   (Free) -- general IO allocations
00106EE8 00000F70 8975D698 886E8F70 C0443740
                886e8f60+0x10    : AfdC (Protected) -- Afd connection structure
00107E22 000008DC 8975D698 896228DC C044B110
                896228a8+0x34    : File (Protected) -- File objects
00107FC3 00000EE4 8975D698 897C3EE4 C044BE18
                897c3e18+0xcc    : TCPA -- TCP/IP network protocol
00107FC3 00000EEC 8975D698 897C3EEC C044BE18
                897c3e18+0xd4    : TCPA -- TCP/IP network protocol
00107FC3 00000EF4 8975D698 897C3EF4 C044BE18
                897c3e18+0xdc    : TCPA -- TCP/IP network protocol
00107FC3 00000F04 8975D698 897C3F04 C044BE18
                897c3e18+0xec    : TCPA -- TCP/IP network protocol
00107FC3 00000F1C 8975D698 897C3F1C C044BE18
                897c3e18+0x104   : TCPA -- TCP/IP network protocol
001085BD 00000B68 8975D698 89DBDB68 C044EDE8
                89dbda78+0xf0    : TCPT -- TCB pool
001085BD 00000BEC 8975D698 89DBDBEC C044EDE8
                89dbda78+0x174   : TCPT -- TCB pool
00108E75 00000034 8975D618 8A675034 C04533A8
                8a675000+0x34    : Dump (LargePool) -- Bugcheck dump allocations
00109211 00000CD8 8975D618 8AA11CD8 C0455088
                8aa11cc8+0x10    : MmLk -- Bugcheck dump allocations
0010A79A 00000318 8975D618 8BF9A318 C045FCD0
                8bf9a2f0+0x28    : TCPr -- TCP request pool
001DDAE0 0000082C 8975D618 B49B282C C05A4D90
001DDAE0 000008BC 8975D618 B49B28BC C05A4D90
001DDAE0 00000C2C 8975D618 B49B2C2C C05A4D90
001DDAE0 00000C4C 8975D618 B49B2C4C C05A4D90
Search done.

==>> For each virtual address (VA) found, look for an IRP signature. Do this by using the dd command with the VA minus one DWORD.

13: kd> dd B49B2C4C-4 l4
b49b2c48 b7bfa933 8975d618 00000003 87ac10e0

13: kd> dd B49B2C2C-4 l4
b49b2c28 b7bfa933 8975d618 00000003 00000000

13: kd> dd B49B28BC-4 l4
b49b28b8 b7bf92f2 8975d618 00000000 01330180

13: kd> dd B49B282C-4 l4
b49b2828 b7bfa933 8975d618 00000003 bad8b242

13: kd> dd 8BF9A318-4 l4
8bf9a314 876a6228 8975d618 00000000 00000000

13: kd> dd 8AA11CD8-4 l4
8aa11cd4 87708550 8975d618 007dd000 00000003

13: kd> dd 8A675034-4 l4
8a675030 b7bfa933 8975d618 00000003 45474100

13: kd> dd 89DBDBEC-4 l4
89dbdbe8 b7bfaf81 8975d698 00000000 00000000

13: kd> dd 89DBDB68-4 l4
89dbdb64 b7bfb4bb 8975d698 00000000 00000000

13: kd> dd 897C3F1C-4 l4
897c3f18 b7bfaf81 8975d698 00000000 00000000

13: kd> dd 897C3F04-4 l4
897c3f00 b7c08f11 8975d698 00000000 00000000

13: kd> dd 897C3EF4-4 l4
897c3ef0 b7bfb4bb 8975d698 00000000 00000000

13: kd> dd 897C3EEC-4 l4
897c3ee8 b7c077bb 8975d698 b7bfb4bb 8975d698

13: kd> dd 897C3EE4-4 l4
897c3ee0 b7bf9ebb 8975d698 b7c077bb 8975d698

13: kd> dd 896228DC-4 l4
896228d8 00000000 8975d698 00000000 00000000

13: kd> dd 886E8F70-4 l4
886e8f6c 00111030 8975d698 891005e0 8aa33030

13: kd> dd 876F2828-4 l4
876f2824 61436d4d 8975d718 00000000 808ab4d4

13: kd> dd 876A616C-4 l4
876a6168 01d80006 8975d618 00000000 00000000 ==>> $ Matches signature

13: kd> dd 808A654C-4 l4
808a6548 b7bfa933 8975d618 00000003 00000000

==>> After a VA with an IRP signature has been found, use the !irp extension to find out what driver is pending on this IRP.

13: kd> !irp 876a6168
Irp is active with 4 stacks 3 is current (= 0x876a6220)
Mdl=8975d618: No System Buffer: Thread 00000000: Irp stack trace.
cmd flg cl Device File Completion-Context
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

                                                Args: 00000000 00000000 00000000 00000000
>[ f, 8]   0 e1 8aa33030 88c532a0 b7bfbb72-8acf31b0 Success Error Cancel pending
                       \Driver\Tcpip             afd!AfdRestartBufferReceiveWithUserIrp
                                                Args: 00002000 00010020 00000000 00000000
[ e, 5]   5 0 8ac68030 894e4c28 00000000-00000000
                       \Driver\AFD
                                                Args: 00002000 00000000 20000020 00000000

==>> From the stack below, TCP Chimney feature is enabled on the server, disabling it will be good step to disable that.

13: kd> dd tcpip!DisableTCPChimney L1
b7c950d0 00000000

13: kd> dd tcpip!DisableRSS L1
b7c950d4 00000000

13: kd> dd tcpip!UseDma L1
b7c95fa0 00000101

13: kd> dd tcpip!DisableTaskOffload L1
b7c95e54 00000000

Reference Microsoft KB articles:

MS09-008: Vulnerabilities in DNS and WINS Server could allow spoofing
http://support.microsoft.com/kb/962238

An update to turn off default SNP features is available for Windows Server 2003-based and Small Business Server 2003-based computers
http://support.microsoft.com/default.aspx?scid=kb;EN-US;948496

Don’t forget to leave your comments :)

Thanks,
Aresh

First Step involved in troubleshooting Event ID 2020 Windows 2003

2009-04-16T01:35:00.001+05:30

1. Start Registry Editor (Regedt32.exe).
2. Locate and then click the following key in the registry:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management
On the Edit menu, click Add Value, and then add the following registry value:
Value name: PoolUsageMaximum
Data type: REG_DWORD
Radix: Decimal
Value data: 60
Setting the value at 60 informs the Memory Manager to start the trimming process at 60 percent of PagedPoolMax rather than the default setting of 80 percent.
If a threshold of 60 percent is not enough to handle spikes in activity, reduce this setting to 50 percent or 40 percent.

Value name: PagedPoolSize
Data type: REG_DWORD
Radix: Hex
Value data: 0xFFFFFFFF
Setting PagedPoolSize to 0xFFFFFFFF allocates the maximum paged pool in lieu of other resources to the computer.

3. Quit Registry Editor.
4. Restart the server for the changes to take effect.

Reference Microsoft KB article:

Server is unable to allocate memory from the system paged pool
http://support.microsoft.com/?id=312362

Don’t forget to leave your comments :)

Thanks,
Aresh

Performance Tuning on Windows 2003 – Event ID 2022 1055 and 2021

2009-04-16T01:27:00.001+05:30

Reduce Event ID 2022 1055 and 2021 errors

Tuning of Server Service:

Click Start, click Run, type Notepad, and then click OK.

Copy the following text, and then paste it into Notepad:

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]
"MaxFreeConnections"=dword:00001000
"MinFreeConnections"=dword:00000064
"MaxRawWorkItems"=dword:00000200
"MaxWorkItems"=dword:00002000
"MaxMpxCt"=dword:00000800

Save the file as .reg file type, and then exit Notepad.

In Windows Explorer, double-click the file to import these registry settings.

Tuning of Workstation Service:

Click Start, click Run, type Notepad, and then click OK.

Copy the following text, and then paste it into Notepad:

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters]
"MaxCmds"=dword:00001000

Save the file as .reg file type, and then exit Notepad.

In Windows Explorer, double-click the file to import these registry settings.

Tuning of Workstation Timeout:

Click Start, click Run, type Notepad, and then click OK.

Copy the following text, and then paste it into Notepad:

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters]
"SessTimeout"=dword:0000012c

Save the file as .reg file type, and then exit Notepad.

In Windows Explorer, double-click the file to import these registry settings.

Above registry fix can be used to increase server performance and throughput.

Reference Microsoft KB Article:

You cannot access the existing File Share resources on a Windows Server 2003 failover cluster
http://support.microsoft.com/kb/961657

How to troubleshoot Event ID 2021 and Event ID 2022
http://support.microsoft.com/kb/317249

Don’t forget to leave your comments :)

Thanks,
Aresh

Mouse not captured in remote desktop session – Hyper V Windows 2008

2009-04-16T00:53:00.001+05:30

Issue:

Mouse not captured in remote desktop

Hyper V Version:

Resolution:

1. Boot the guest Windows 2003 x64 into “Safe Mode”
2. To “add remove programs” we added the following registry
HKLM-SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer
- Value for default key is Services
3. Installed the “Integration Services” under safe mode
4. Rebooted the server in normal mode
5. Mouse started working

Don’t forget to leave your comments :)

Thanks,
Aresh

Required Network Ports for Active Directory

2009-04-02T19:55:00.001+05:30

Here is a listing of the port requirements for Active Directory domain, as well as optional ports:

Required Ports

Port No.

Protocol

Used by

Required for

1024-5000

TCP/UDP

RPC (dynamic response ports)

required for RPC to respond to communications

135

TCP

RPC (endpoint mapper)

required to open the endpoint mapper to the destination for RPC communications

389

TCP/UDP

LDAP

required to bind to a DC

3268

TCP

LDAP GC

required to bind to the GC function of a domain controller (extremely important for Exchange)

TCP/UDP

DNS

required for name resolution and Active Directory functionality as a whole

TCP/UDP

Kerberos

self explanatory

445

TCP

SMB

self explanatory

123

UDP

SNTP

required for time synchronization with a time source

ICMP

required for group policy detection, application, and MTU size detection, as well as other low level activities

Optional Ports

Port No.

Protocol

Used by

Required for

636

TCP

LDAP SSL

required to bind to a DC using LDAP over SSL

3269

TCP

LDAP GC SSL

required to bind to a GC using LDAP over SSL

137

UDP

NetBIOS name

self explanatory

138

UDP

NetBIOS Netlogon and Browsing

self explanatory

139

TCP

NetBIOS session

self explanatory

TCP

WINS replication

self explanatory

1723

TCP

PPTP

required if using PPTP VPN tunnel

PortQryUI is a very good to check the ports.

To download portqry:

http://www.microsoft.com/downloads/details.aspx?familyid=8355e537-1ea6-4569-aabb-f248f4bd91d0&displaylang=en

Description of the Portqry.exe command-line utility
http://support.microsoft.com/default.aspx?scid=kb;en-us;310099

For more information on port requirements, please see:

http://support.microsoft.com/support/kb/articles/q179/4/42.asp

For Exchange considerations:

http://support.microsoft.com/?kbid=259240
http://support.microsoft.com/default.aspx?scid=kb;en-us;280132

For SQL considerations:

http://support.microsoft.com/kb/q287932/

For SMS considerations:

http://support.microsoft.com/default.aspx?scid=kb;en-us;200898
http://support.microsoft.com/kb/q167128/

Don’t forget to leave your comments :)

Thanks,
Aresh

Active Directory Command Line One-Liners

2009-02-04T03:47:00.001+05:30

Domain Controllers
Nltest /dclist:%userdnsdomain%

Domain Controller IP Configuration
for /f %i in (’dsquery server -domain %userdnsdomain% -o rdn’) do psexec \\%i ipconfig /all

Stale computer accounts
dsquery computer domainroot -stalepwd 180 -limit 0

Stale user accounts
dsquery user domainroot -stalepwd 180 -limit 0

Disabled user accounts
dsquery user domainroot -disabled -limit 0

AD Database disk usage
for /f %i in (’dsquery server -domain %userdnsdomain% -o rdn’) do dir \\%i\admin$\ntds

Global Catalog Servers from DNS
dnscmd %logonserver% /enumrecords %userdnsdomain% _tcp | find /i "3268"

Global Catalog Servers from AD
dsquery * "CN=Configuration,DC=forestRootDomain" -filter "(&(objectCategory=nTDSDSA)(options:1.2.840.113556.1.4.803:=1))"

Users with no logon script
dsquery * domainroot -filter"(&(objectCategory=Person)(objectClass=User)(!scriptPath=*))"-limit 0 -attr sAMAccountName sn givenName pwdLastSet distinguishedName

User accounts with no pwd required
dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User)(userAccountControl:1.2.840.113556.1.4.803:=32))"

User accounts with no pwd expiry
dsquery * domainroot -filter"(&(objectCategory=Person)(objectClass=User)(userAccountControl:1.2.840.113556.1.4.803:=65536))"

User accounts that are disabled
dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User)(userAccountControl:1.2.840.113556.1.4.803:=2))"

DNS Information
for /f %i in (’dsquery server -domain %userdnsdomain% -o rdn’) do dnscmd %i /info

DNS Zone Detailed information
dnscmd /zoneinfo %userdnsdomain%

Garbage Collection and tombstone
dsquery * "cn=Directory Service,cn=WindowsNT,cn=Services,cn=Configuration,DC=forestRootDomain" -attrgarbageCollPeriod tombstoneLifetime

Netsh authorised DHCP Servers
netsh dhcp show server

DSQuery authorised DHCP Servers
Dsquery * "cn=NetServices,cn=Services,cn=Configuration, DC=forestRootDomain" -attr dhcpServers

DHCP server information
netsh dhcp server \\DHCP_SERVER show all

DHCP server dump
netsh dhcp server \\DHCP_SERVER dump

WINS serer information
Netsh wins server \\WINS_SERVER dump

Group Policy Verification Tool
gpotool.exe /checkacl /verbose

AD OU membership
dsquery computer -limit 0

AD OU membership
dsquery user -limit 0

List Service Principal Names
for /f %i in (’dsquery server -domain %userdnsdomain% -o rdn’) do setspn -L %i

Compare DC Replica Object Count
dsastat ?s:DC1;DC2;… ?b:Domain ?gcattrs:objectclass ?p:999

Check AD ACLs
acldiag dc=domainTree

NTFRS Replica Sets
for /f %i in (’dsquery server -domain %userdnsdomain% -o rdn’) do ntfrsutl sets %i

NTFRS DS View
for /f %i in (’dsquery server -domain %userdnsdomain% -o rdn’) do ntfrsutl ds %i

Domain Controllers per site
Dsquery * "CN=Sites,CN=Configuration,DC=forestRootDomain" -filter (objectCategory=Server)

DNS Zones in AD
for /f %i in (’dsquery server -o rdn’) do Dsquery * -s %i domainroot -filter (objectCategory=dnsZone)

Enumerate DNS Server Zones
for /f %i in (’dsquery server -o rdn’) do dnscmd %i /enumzones

Subnet information
Dsquery subnet ?limit 0

List Organisational Units
Dsquery OU

ACL on all OUs
For /f "delims=|" %i in (’dsquery OU’) do acldiag %i

Domain Trusts
nltest /domain_trusts /v

Print DNS Zones
dnscmd DNSServer /zoneprint DNSZone

Active DHCP leases
For /f %i in (DHCPServers.txt) do for /f "delims=- " %j in (’"netshdhcp server \\%i show scope | find /i "active""’) do netsh dhcp server\\%i scope %j show clientsv5

DHCP Server Active Scope Info
For /f %i in (DHCPServers.txt) do netsh dhcp server \\%i show scope | find /i "active"

Resolve DHCP clients hostnames
for /f "tokens=1,2,3 delims=," %i in (Output from ‘Find Subnets fromDHCP clients’) do @for /f "tokens=2 delims=: " %m in (’"nslookup %j |find /i "Name:""’) do echo %m,%j,%k,%i

Find two online PCs per subnet
Echo. > TwoClientsPerSubnet.txt & for /f "tokens=1,2,3,4delims=, " %i in (’"find /i "pc" ‘Output from Resolve DHCP clientshostnames’"’) do for /f "tokens=3 skip=1 delims=: " %m in (’"Find /i /c"%l" TwoClientsPerSubnet.txt"’) do If %m LEQ 1 for /f %p in (’"ping -n1 %i | find /i /c "(0% loss""’) do If %p==1 Echo %i,%j,%k,%l

AD Subnet and Site Information
dsquery * "CN=Subnets,CN=Sites,CN=Configuration,DC=forestRootDomain" -attr cn siteObject description location

AD Site Information
dsquery * "CN=Sites,CN=Configuration,DC=forestRootDomain" -attr cn description location -filter (objectClass=site)

Printer Queue Objects in AD
dsquery * domainroot -filter "(objectCategory=printQueue)" -limit 0

Group Membership with user details
dsget group "groupDN" -members | dsget user -samid -fn -mi -ln -display -empid -desc -office -tel -email -title -dept –mgr

Total DHCP Scopes
find /i "subnet" "Output from DHCP server information" | find /i "subnet"

Site Links and Cost
dsquery * "CN=Sites,CN=Configuration,DC=forestRootDomain" -attr cn costdescription replInterval siteList -filter (objectClass=siteLink)

Time gpresult
timethis gpresult /v

Check time against Domain
w32tm /monitor /computers:ForestRootPDC

Domain Controller Diagnostics
dcdiag /s:%logonserver% /v /e /c

Domain Replication Bridgeheads
repadmin /bridgeheads

Replication Failures from KCC
repadmin /failcache

Inter-site Topology servers per site
Repadmin /istg * /verbose

Replication latency
repadmin /latency /verbose

Queued replication requests
repadmin /queue *

Show connections for a DC
repadmin /showconn *

Replication summary
Repadmin /replsummary

Show replication partners
repadmin /showrepl * /all

All DCs in the forest
repadmin /viewlist *

ISTG from AD attributes
dsquery * "CN=NTDS Site Settings,CN=siteName,CN=Sites,CN=Configuration,DC=forestRootDomain" -attr interSiteTopologyGenerator

Return the object if KCC Intra/Inter site is disabled for each site
Dsquery site | dsquery * -attr * -filter "(|(Options:1.2.840.113556.1.4.803:=1)(Options:1.2.840.113556.1.4.803:=16))"

Find all connection objects
dsquery * forestRoot -filter (objectCategory=nTDSConnection) ?attr distinguishedName fromServer whenCreated displayName

Find all connection schedules
adfind -b "cn=Configuration,dc=qraps,dc=com,dc=au" -f "objectcategory=ntdsConnection" cn Schedule –csv

Software Information for each server
for /f %i in (Output from ‘Domain Controllers’) do psinfo \\%i &filever \\%i\admin$\explorer.exe \\%i\admin$\system32\vbscript.dll\\%i\admin$\system32\kernel32.dll \\%i\admin$\system32\wbem\winmgmt.exe\\%i\admin$\system32\oleaut32.dll

Check Terminal Services Delete Temp on Exit flag
For /f %i in (Output from ‘Domain Controllers’) do Reg query"\\%i\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer" /v DeleteTempDirsOnExit

For each XP workstation, query the current site and what Group Policy info
@dsquery * domainroot -filter"(&(objectCategory=Computer)(operatingSystem=Windows XPProfessional))" -limit 0 -attr cn > Workstations.txt & @For /f%i in (Workstations.txt) do @ping %i -n 1 >NUL & @if ErrorLevel0 If NOT ErrorLevel 1 @Echo %i & for /f "tokens=3" %k in (’"regquery "\\%i\hklm\software\microsoft\windows\currentversion\grouppolicy\history" /v DCName | Find /i "DCName""’) do @for /f %m in(’"nltest /server:%i /dsgetsite | find /i /v "completedsuccessfully""’) do @echo %i,%k,%m

Information on existing GPOs
dsquery * "CN=Policies,CN=System,domainRoot" -filter"(objectCategory=groupPolicyContainer)" -attr displayName cnwhenCreated gPCFileSysPath

Copy all Group Policy .pol files
for /f "tokens=1-8 delims=\" %i in (’dir /b /s\\%userdnsdomain%\sysvol\%userdnsdomain%\policies\*.pol’) do @echo copy\\%i\%j\%k\%l\%m\%n\%o %m_%n.pol

Domain Controller Netlogon entries
for /f %i in (’dsquery server /o rdn’) do echo %i & reg query\\%i\hklm\system\currentcontrolset\services\netlogon\parameters

Find policy display name given the GUID
dsquery * "CN=Policies,CN=System,DC=domainRoot" -filter (objectCategory=groupPolicyContainer) -attr Name displayName

Find empty groups
dsquery * -filter "&(objectCategory=group)(!member=*)" -limit 0-attr whenCreated whenChanged groupType sAMAccountNamedistinguishedName memberOf

Find remote NIC bandwidth
wmic /node:%server% path Win32_PerfRawData_Tcpip_NetworkInterface GET Name,CurrentBandwidth

Find remote free physical memory
wmic /node:%Computer% path Win32_OperatingSystem GET FreePhysicalMemory

Find remote system information
SystemInfo /s %Computer%

Disk statistics, including the number of files on the filesystem
chkdsk /i /c

Query IIS web sites
iisweb /s %Server% /query "Default Web Site"

Check port state and connectivity
portqry -n %server% -e %endpoint% –v

Forest/Domain Functional Levels
ldifde -d cn=partitions,cn=configuration,dc=%domain% -r"(|(systemFlags=3)(systemFlags=-2147483648))" -lmsds-behavior-version,dnsroot,ntmixeddomain,NetBIOSName -p subtree –fcon

Forest/Domain Functional Levels
dsquery * cn=partitions,cn=configuration,dc=%domain% -filter"(|(systemFlags=3)(systemFlags=-2147483648))" -attrmsDS-Behavior-Version Name dnsroot ntmixeddomain NetBIOSName

Find the parent of a process
wmic path Win32_Process WHERE Name=’notepad.exe’ GET Name,ParentProcessId

Lookup SRV records from DNS
nslookup -type=srv _ldap._tcp.dc._msdcs.{domainRoot}

Find when the AD was installed
dsquery * cn=configuration,DC=forestRootDomain -attr whencreated -scope base

Enumerate the trusts from the specified domain
dsquery * "CN=System,DC=domainRoot" -filter "(objectClass=trustedDomain)" -attr trustPartner flatName

Find a DC for each trusted domain
for /f "skip=1" %i in (’"dsquery * CN=System,DC=domainRoot -filter(objectClass=trustedDomain) -attr trustPartner"’) do nltest /dsgetdc:%i

Check the notification packages installed on all DCs
for /f %i in (’dsquery server /o rdn’) do @for /f "tokens=4" %m in(’"reg query\\%i\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa /v"Notification Packages" | find /i "Notification""’) do @echo %i,%m

List ACLs in SDDL format
setacl -on %filepath% -ot file -actn list -lst f:sddl

Find out if a user account is currently enabled or disabled
dsquery user DC=%userdnsdomain:.=,DC=% -name %username% | dsget user -disabled –dn

Find servers in the domain
dsquery * domainroot -filter "(&(objectCategory=Computer)(objectClass=Computer)(operatingSystem=*Server*))" -limit 0

Open DS query window
rundll32 dsquery,OpenQueryWindow

Don’t forget to leave your comments :)

Thanks,
Aresh

NT Storage Device Stack

2009-01-13T13:29:00.001+05:30

Today we are going to discuss the NT Storage Device Stack in brief. I am sure most of you would have encountered a server hang issue where the one of the Antivirus or Storage driver was pointed out to be the root cause of the issue. It is important to understand the layers which are in picture when you are trying to write a file to the disk, because every I/O operation in windows is done via IRPs (I/O Request Packets - Data structures representing the I/O) and these IRPs have to pass through all the layers to achieve the completion of the task and any of these layer can potentially block the I/O from completion mostly due to code bug or at times due to the workload.

NT-based operating system class and filter drivers for peripheral storage devices act as an interface between any intermediate or highest level drivers layered above the class or filter driver and a system-supplied port driver.

I/O requests from a user application or kernel component reach storage class drivers through I/O System Services and one or more intermediate or highest level drivers, such as a file system driver. Storage class drivers translate the standard IRPs they get into IRPs with system-defined SCSI request blocks (SRBs) containing SCSI command descriptor blocks (CDBs) before sending each IRP on to the next-lower driver. A storage port driver translates SRBs from class drivers into bus-specific commands which it sends to the storage HBA, through an I/O bus driver and possibly one or more filter drivers.

The following figure shows the layered architecture of NT-based operating system storage drivers.

NT-Based Operating System Storage Driver Architecture

Starting from the bottom of the figure, the following describes each type of storage driver:

1. A storage port driver defines an interface to all Windows NT storage class drivers, including the system-supplied disk, tape, CDROM, DVD, and changer class drivers. This port/class interface insulates class drivers from adapter-specific requirements of the host bus adapter to which their respective devices are connected. A storage port driver also synchronizes access to the bus for all drivers of devices on the corresponding HBA. The system supplies storage port drivers for SCSI, IDE, USB and IEEE 1394 adapters.

A storage port driver receives SRBs from the next higher driver (a storage class driver or intervening filter driver) and processes them as follows:

· The storage port driver for a SCSI bus passes SRBs with CDBs on to an operating system-independent, HBA-specific SCSI miniport driver, which is dynamically linked to the SCSI port driver and provides hardware-specific support for a particular SCSI HBA. For information about implementing a SCSI miniport driver, see SCSI Miniport Drivers.

· The storage port driver for an IDE/ATAPI or IEEE 1394 bus translates the SRBs received from the storage class driver into the format required by the underlying adapter—for example, repackaging CDBs according to a bus-specific transport protocol, or translating them into a different format, thereby insulating upper level drivers from peculiarities of the underlying bus.

2. An upper or lower storage filter driver supports device-specific functionality not provided by a system-supplied storage class driver. A lower filter storage driver monitors SRBs and/or IRPs issued by a storage class driver and modifies them as needed before passing them to the next-lower driver (a storage port driver or another storage filter driver).

For information about implementing a storage filter driver, see Storage Filter Drivers.

3. A storage class driver uses the SCSI port/class interface to control a device of its type on any bus for which the system provides a storage port driver. A class driver is specific to a particular class of device—for example, one class driver can run all CD-ROM devices on any supported bus; another can control all disk devices. The storage class driver handles I/O requests from user applications or drivers higher in the storage stack by building SRBs containing CDBs and issuing those SRBs to the next-lower driver (a storage port driver or intervening filter driver), just as if the device were a SCSI device.

The implementation of a storage class driver is transparent to upper level drivers. A class driver for a tape or medium changer device is implemented as a device-specific miniclass driver that links to a system-supplied class driver. System-supplied class drivers for other storage devices, such as disk and CD-ROM/DVD, are implemented as single monolithic drivers.

4. An upper filter storage driver intercepts IRPs from user applications and drivers higher in the storage stack and then possibly modifies them before passing them to the next-lower driver (a storage class driver or another storage filter driver). Filter drivers typically monitor performance of the underlying device.

The type of bus to which a device is attached and the implementation of its storage port driver are transparent to upper level drivers. A storage port driver might be implemented according to the port/miniport driver architecture, like the SCSI port driver; as a monolithic driver that controls a single, standard piece of hardware, such as the IDE/ATAPI port driver; or as a filter driver that translates SRBs into the format required by a different driver stack, such as the IEEE 1394 port driver.

Storage Drivers and Device Objects

The storage device stack consists of a tree of device objects created by the drivers that are involved in handling I/O to storage devices on the system. The root of this tree is a functional device object (FDO) for a storage adapter or for another driver stack integrated with the storage stack. The leaves of this tree are device objects for use by file systems and user-mode applications.

A PDO (Physical Device Object) or FDO (Functional Device Object) are simply the logical representation of the actual devices via a datastructure in the Windows Kernel. Only the Storage Miniport driver which plugs into the Storage Port Driver is aware of the actual device functionality and layout. The port driver creates a physical device object (PDO) to represent the physical port. Each class driver creates its own functional device object (FDO) to represent the keyboard or mouse device as a target for I/O requests.

Like any PnP driver, a storage class or storage filter driver adds itself to the tree in its AddDevice routine by creating a device object with IoCreateDevice and attaching it to the device stack with IoAttachDeviceToDeviceStack, using the pointer to the device object passed to the driver's AddDevice routine by the PnP manager at initialization. IoAttachDeviceToDeviceStack attaches the new device object to the current top of the device stack.

Storage port drivers create physical device objects (PDOs) of type FILE_DEVICE_MASS_STORAGE. The disk class, CD-ROM class, tape class and changer class drivers create FDOs of types FILE_DEVICE_DISK, FILE_DEVICE_CD_ROM, FILE_DEVICE_TAPE, and FILE_DEVICE_CHANGER respectively.

The example below gives a perspective on how a Storage Device Stack is layered is below.

Device Object Example for a SCSI HBA

The following figure shows the device objects that are created for system with a PCI IEEE 1394 controller and a PCI SCSI adapter with a CD-ROM and partitionable disk device attached.

Additional References:

Device Object Example for an IEEE 1394 Controller

Device Object Example for a PCI IDE Controller

Device Object Example for a USB Mass Storage Device

This brings me to the end of this post, in the next post we will be discussing more about the the IRPs

Note: The content of this blog has been primarily picked up from MSDN and WDK Documentation AS IS

Pushkar Prasad

Clustering and HA Resources -- clustering Blog

2008-12-23T03:06:00.001+05:30

General Resources

· Cluster Team Site: Clustering Technical Resources
· Guide: Failover Clustering Deployment
· Guide: Validating Hardware for a Failover Cluster
· Guide: Migrating Cluster Settings
· Guide: Configuring the Quorum in a Failover Cluster
· Guide: Configuring Accounts in Active Directory
· Guide: Configure a Service or Application for High Availability
· Guide: Modifying Settings for a Failover Cluster
· Guide: Installing a Failover Cluster
· Guide: Creating a Failover Cluster
· Guide: Cluster Requirements
· Guide: Validating a cluster
· Guide: Managing a Failover Cluster
· Guide: The Failover Cluster Management Snap-In
· TechNet: Support Policy
· Webcast: Top 10 Windows Server 2008 Failover Clustering Enhancements over Windows Server 2003 Clustering, Based on Best Practices (Level 300)
· Webcast: Failover Clustering 101
· Webcast: Achieving High Availability with Windows Server “Longhorn” Clustering (Level 200)
Webcast: Microsoft Webcast: Reducing IT Overhead with Windows Server 2008 Storage Features
Webcast: TechNet Webcast: Build High-Availability Infrastructures with Windows Server 2008 Failover Clustering
Webcast: IT Manager Webcast: Delivering High Availability to Your Infrastructure
Webcast: TechNet Webcast: Failover Cluster Validation and Troubleshooting with Windows Server 2008
Webcast: TechNet Webcast: Failover Clustering and Quorum in Windows Server 2008 Enterprise Storage
Webcast: TechNet Virtual Lab: Windows Server 2008 Enterprise Failover Clustering Lab
· Whitepaper: Failover Cluster Architecture Overview
· Whitepaper: Microsoft’s HA Strategy
· Whitepaper: Overview of Failover Clustering

Core

· Utility: Remote Server Administration Tools (simplifies Server Core configurations)
· Guide: Server Core
· TechNet: Installation
· Webcast: How Microsoft does IT: Enhancing High Availability with Server Core in Windows Server 2008

Exchange Server

Windows Server 2008 Step-by-Step Guides

2008-12-20T02:52:00.001+05:30

These step-by-step guides help IT Professionals learn about and evaluate Windows Server 2008.

Creating_and_Deploying_Active_Directory_Rights_Management_Services_Templates_Step-by-Step_Guide.doc

Deploying Active Directory Rights Management Services in an Extranet Step-by-Step Guide.doc

Deploying Active Directory Rights Management Services with Microsoft Office SharePoint Server 2007 Step-By-Step Guide.doc

Deploying SSTP Remote Access Step by Step Guide.doc

Server Core Installation Option of Windows Server 2008 Step-By-Step Guide.doc

Server Manager Scenarios Step-by-Step Guide.doc

Step-by-Step Guide for Configuring a Two-Node File Server Failover Cluster in Windows Server 2008.doc

Step-by-Step Guide for Configuring a Two-Node Print Server Failover Cluster in Windows Server 2008.doc

Step-by-Step Guide for Windows Deployment Services in Windows Server 2008.doc

Step-by-Step Guide to Deploying Policies for Windows Firewall with Advanced Security.doc

Using Identity Federation with Active Directory Rights Management Services Step-by-Step Guide.doc

Windows Server 2008 Active Directory Certificate Services Step-By-Step Guide.doc

Windows Server 2008 Foundation Network Guide.doc

Windows Server 2008 Step-by-Step Guide for DNS in Small Networks.doc

Windows Server 2008 TS Gateway Server Step-By-Step Setup Guide.doc

Windows_ Server_Active_Directory_Rights_Management_Services_Step-by-Step_Guide.doc

Windows_Server_2008_Terminal_Services_RemoteApp_Step-by-Step_Guide.doc

Windows_Server_2008_TS_Licensing_Step-By-Step_Setup_Guide.doc

Windows_Server_2008_TS_Session_Broker_Load_Balancing_Step-By-Step_Guide.doc

Download Link: http://www.microsoft.com/downloads/details.aspx?FamilyID=518d870c-fa3e-4f6a-97f5-acaf31de6dce&DisplayLang=en

Thanks
Aresh

Storage Manager for SANs Step-by-Step Guide

2008-12-20T01:10:00.001+05:30

With Storage Manager for SANs, you can create and manage logical unit numbers (LUNs) on Fibre Channel and iSCSI disk drive subsystems that support Virtual Disk Service (VDS) in your storage area network (SAN). This guide provides server and storage subsystem requirements, an introduction to managing LUNs, and step-by-step walkthroughs for creating and assigning LUNs using Storage Manager for SANs in Windows Server 2008.

Download: http://www.microsoft.com/downloads/details.aspx?FamilyID=06556478-838c-450e-9173-9851378271ad&DisplayLang=en

Thanks
Aresh

Failover Cluster Validation Report failed for Duplicate IP address Windows 2008

2008-12-03T23:08:00.001+05:30

Cluster validation wizard is used to check pre-requisite\best practices before building the cluster. While playing with my lab, I came across a issue under Network Test.

Error:
Found duplicate IP address fe80::100:7f:fffe%14 on node node1.vodka.com adapter Local Area Connection* X and node node2.vodka.com adapter Local Area Connection* X.

Resolution:
It turns out that this is the result of the Teredo, an IPv6 Tunneling Protocol. Teredo allows IPv6 communications to pass through IPv4 NATs and IPv4 servers. However Teredo gives an identical IPv6 address to its network interfaces, which Failover Clustering flags as an error since it require unique IP addresses.

So how do you fix this? There are 2 ways, some details are provided here: http://technet2.microsoft.com/WindowsVista/en/library/91d35c9f-3049-44f4-b711-743dc152c7c31033.mspx?mfr=true

1) Disable Teredo through command line

a. Open ‘Command Prompt’ and ‘Run as Administrator’
b. Type:
           i. > netsh
          ii. > interface
          iii. > teredo
          iv. > set state disabled
c. Teredo will now be disabled

2) Disable Teredo through the registry

a. Open the Registry Editor

i. This can be done through an elevated Command Prompt and typing ‘regedit’

b. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6

c. Right-click on the ‘Parameters’ tab, select ‘New’, choose ‘DWORD’

i. Enter the following name (including capitalization): “DisabledComponents”

d. Double-click on “DisabledComponents”, select ‘Hexadecimal’, under ‘Value data’

i. Enter “8”

e. Click ‘OK’
f. Restart your machine
g. Teredo will now be disabled

But what about disabling Teredo through Device Manager? This will only disable the Teredo adapter so the system does not see it anymore, however this does not disable the underlying logic. This could cause issues later, so it is recommended to disable it through the command line or the registry.

Run Validate and this test will now pass. Enjoy your fully supported cluster!

Don’t forget to leave your valuable comments.

Thanks,
Aresh

Useful Blogs:
Microsoft's Failover and Network Load Balancing Clustering Team Blog: http://blogs.msdn.com/clustering/

Troubleshoot Active Directory Logon issue – By Anang Kumar

2008-12-02T21:00:00.001+05:30

Note the error message (Sometime the error message is very specific )
Login to the machine using local admin account
Check the system Date and time / Time zone – Make sure they are similar to authenticating DC
Check DNS – Make Sure they are pointing to Right DNS (DNS which is alive and doing the name resolution)
Check DNS records with the help of NSLOOKUP
Ping the DC – IP, Netbios Name and FQDn
Ping the DC to DC with 1500 MTU
Run Netdiag and check DNS and Trust and Kerberos test
Make sure NIC card is enabled of “register me in DNS”
Check event viewer for any know errors like Userenv, Kerberos, netlogon
Enable netlogon log and do the further troubleshooting

Don't forget to post your comments :)

Thanks,
Anang Kumar

PowerGUI, a graphical user interface and script editor for Windows PowerShell!

2008-11-28T03:12:00.001+05:30

What is PowerGUI?

PowerGUI is an extensible graphical administrative console for managing systems based on Windows PowerShell. These include Windows OS (XP, 2003, Vista), Exchange 2007, Operations Manager 2007 and other new systems from Microsoft. The tool allows to use the rich capabilities of Windows PowerShell in a familiar and intuitive GUI console.

PowerShell is built-in feature under Windows Server 2008

Download PowerShell for Windows Vista, Windows 2003 and Windows XP
http://www.microsoft.com/windowsserver2003/technologies/management/powershell/download.mspx

Download PowerGUI

Power Packs

Active Directory: http://powergui.org/kbcategory.jspa?categoryID=46

Microsoft Operations Manager (MOM): http://powergui.org/kbcategory.jspa?categoryID=49

Virtualization: http://powergui.org/kbcategory.jspa?categoryID=290

Microsoft Exchange: http://powergui.org/kbcategory.jspa?categoryID=47

Network: http://powergui.org/kbcategory.jspa?categoryID=48

SQL: http://powergui.org/kbcategory.jspa?categoryID=54

Others: http://powergui.org/kbcategory.jspa?categoryID=21

User manuals

For PowerGUI and QAD cmdlets user manuals and FAQ please visit PowerGUI wiki.

Blogs

Latest PowerGUI and QAD cmdlets news can be found at our team members' blogs:

Dmitry's PowerBlog by Dmitry Sotnikov
Poshoholic.com by Kirk Munro

Videos and Flash Demos

Interactive Walkthrough - Take a guided tour of PowerGUI as we perform some basic tasks in both the user interface and the script editor.
Introduction to PowerGUI demo - this is the most basic and introductory demo using Exchange 2007 environment to show how PowerGUI can be used to manage mailboxes, produce reports, how the console can be extended, and finally how these extensions are shared with other community members.
How to Create a PowerPack - this demonstrates how to add nodes, links and actions to PowerGUI and how you can share your nodes, links and actions with the community as a PowerPack.
Extending PowerGUI - this is an advanced demo on how PowerGUI works and how it can be extended with simple and script nodes/links/actions and how you can use .NET, WMI, and ADSI when PowerShell is not enough.
Introduction to the Hyper-V PowerPack - Kirk Munro (the Poshoholic) provides an introduction to the Hyper-V PowerPack that he created.
Managing Operations Manager 2007 with PowerGUI - Rob "Deuce" Doucette is demoing his PowerPack for OpsManager 2007 (also known as MOM).
Advanced Exchange 2007 Management - mailbox provisioning, certificate management, public folder management - all through PowerGUI UI.
Automated Software Testing - test your software projects with PowerShell and PowerGUI.

Don't forget to post your comments :)

Thanks,
Aresh

XP as Domain Controller :)

2008-11-28T02:24:00.001+05:30

This is very funny XP machine as a domain controller

1) Create a share called SYSVOL on an XP machine

2) Try to unshare the directory you shared as SYSVOL.

3) You will get a nice warning stating:

"This share is required for the machine to act properly as a domain controller. Removing it will cause a loss of functionality on all clients that this domain controller serves. Are you sure you wish to stop sharing SYSVOL?"

Screenshot:

But do not worry - unsharing SYSVOL on XP will not break your AD. This is just an example of code reuse that Microsoft does.

Don't forget to post your comments :)

Thanks,
Aresh

Useful Blog:
Guy Teverovsky: http://blogs.microsoft.co.il/blogs/guyt/archive/2007/09/06/XP-as-Domain-Controller-_3F00_.aspx

ADRestore GUI version

2008-11-28T00:13:00.001+05:30

Accidentally deleted user, computer account or OU’s from Active Directory. Don’t worry, now you can get them back using ADRestore tool using GUI interface.

Though there is a command line version of tombstone reanimation tool called adrestore - sysinternals, many people are not CLI savvies and having a GUI version of this functionality could really help them out.

Insight on tombstone: Reanimating Active Directory Tombstone Objects - By Gil Kirkpatrick
Gil Kirkpatrick's article at Technet

Main features:

Browsing the tombstones
Domain Controller targeting
Can be used with alternative credentials (convenient if you do not logon to your desktop as Domain Admin, which you should never do anyway)
User/Computer/OU/Container reanimation
Preview of tombstone attributes

Here are some sceenshots:

Enumerating tombstones

Previewing the tombstone attributes

Restoring a deleted user account

Notice that if you delete an OU with accounts in it, you will have to restore first the OUs the accounts were in, otherwise the reanimation of the child object will fail. It is not enough to create an OU with the same name as this will be a totally new object in AD and child object's lastKnowParent attribute will still reference the deleted OU. Here is a walthrough:

Initial state:

TestOU organizational unit is deleted:

State of tombstones (notice that lastKnownParent attribute of user and computer accounts reference the deleted OU):

OU is restored (lastKnowParent points to the restored OU's distinguished name):

Both computer and user accounts that resided in TestOU are reanimated:

Download ADRestore.NET

Don't forget to post your comments :)

Thanks,
Aresh

Useful Blogs:

ADRestore Rewrite: http://blogs.microsoft.co.il/blogs/guyt/
Reanimating Active Directory Tombstone Objects: http://technet.microsoft.com/en-us/magazine/cc137800.aspx

Hyper-V Videos by John Savill

2008-11-27T22:44:00.001+05:30

One of the most useful videos I have found on the internet, for Hyper-V. Thanks to John Savill for his efforts and time.

Hyper-V Architecture Overview
http://www.savilltech.com/Videos/hypervarch/hypervarch640480sml.wmv
Overview and configuration of Hyper-V Server
http://www.savilltech.com/Videos/HyperVServer/HyperVSrv.avi
Overview and configuration of Hyper-V Quick Migration
http://www.savilltech.com/Videos/QuickMigration/QuickMigration.wmv
Overview of Hyper-V Networking
http://www.savilltech.com/Videos/hypervnetwork/hypervnetwork800600.wmv
Overview of Windows Server 2008 R2 Live Migration
http://www.savilltech.com/Videos/LiveMigration/LiveMigration800600.wmv
SCVMM 2008 Physical To Virtual (P2V)
http://www.savilltech.com/Videos/scvmm2008p2v/scvmm2008p2v800600.wmv
SCVMM 2008 Virtual To Virtual (V2V)
http://www.savilltech.com/Videos/scvmm2008v2v/scvmm2008v2v800600.wmv

Don't forget to post your comments :)

Thanks,
Aresh

32-bit Memory Management Explained

2008-11-21T03:47:00.001+05:30

Windows 32-bit Operating Systems implement a virtual memory system based on a flat 32-bit address space. 32-bits of address space translates into 4GB of virtual memory. A process can access up to 4GB of memory address space (using the /3GB switch changes this behavior - and we'll cover that in a later post).

You can't have a discussion of Memory Management basics, without distinguishing between Kernel-mode and User-mode memory. The system space (aka Kernel space) is the portion of the address space in which the OS and kernel-mode drivers reside. Only kernel-mode code can access this space. User-mode threads can access data only in the context of their own process. User-mode threads cannot access data within another processes space directly, nor can it access the system address space directly. Kernel-mode drivers are trusted by the OS and can access both kernel and user space. When a driver routine is called from a user thread, the thread's data remains in the user-mode space. However, the kernel-mode driver can access the user-mode data for the thread and access the kernel-mode space.

OK - so looking at the diagram above, we can see how the 4GB memory address space is divided. Windows allocates the lower half of the 4GB address space (from 0x00000000 to 0x7FFFFFFF) to processes for their own unique private storage, and reserves the other half (from 0x80000000 to 0xFFFFFFFF) for the Operating System's use. Virtual memory provides a view of memory that does not necessarily correspond to the physical layout of memory.

Kernel memory chart for Windows 2003 Server:

Memory

Default ( /PAE for 6-16GB )

/3GB

1GB

Free System PTE: 51k Paged Pool: 282MB
Non Paged Pool: 212MB

Free System PTE: 32k Paged Pool: 163MB
Non Paged Pool: 131MB

2GB

Free System PTE: 196k Paged Pool: 360MB
Non Paged Pool: 262MB

Free System PTE: 16k Paged Pool: 262MB
Non Paged Pool: 131MB

3GB

Free System PTE: 195k Paged Pool: 360MB
Non Paged Pool: 262MB

Free System PTE: 14k
Paged Pool: 262MB
Non Paged Pool: 131MB

4GB

Free System PTE: 106k Paged Pool: 336MB
Non Paged Pool: 285MB

Free System PTE: 15k Paged Pool: 258MB
Non Paged Pool: 154MB

6GB

Free System PTE: 186k Paged Pool: 366MB
Non Paged Pool: 262MB

Free System PTE: 12k Paged Pool: 239MB
Non Paged Pool: 131MB

8GB

Free System PTE: 182k Paged Pool: 366MB
Non Paged Pool: 262MB

Free System PTE: 12k Paged Pool: 225MB
Non Paged Pool: 131MB

12GB

Free System PTE: 175k Paged Pool: 366MB
Non Paged Pool: 262MB

Free System PTE: 12k Paged Pool: 196MB
Non Paged Pool: 131MB

16GB

Free System PTE: 167k Paged Pool: 366MB
Non Paged Pool: 262MB

Free System PTE: 12k Paged Pool: 169MB
Non Paged Pool: 131MB

What is /3GB?:

/3GB is a switch used within the Boot.ini to Increase the size of a user process address space from 2 GB to 3G B. This in-turn reduces the Kernel space from 2 GB to 1 GB. This is a positive aspect for virtual-memory-intensive applications such as database servers a larger address space can improve their performance. For an application to take advantage of this feature, however, two additional conditions must be met: the system must be running Windows 2000 Advanced Server or Datacenter Server or Windows 2003 (All Editions) and the application .exe must be flagged as a 3-GB-aware application

With the /3GB switch we enable 3 GB area of user-mode memory for programs to use. This feature can expand the virtual address range for user-mode memory from 0x0000000 through 0xBFFFFFF (the user-mode address range is typically from 0x00000000 through 0x7FFFFFFF). The range of memory that is available for kernel-mode components shrinks from 0x80000000-0xFFFFFFFF to 0xC0000000-0xFFFFFFFF.

What is /USERVA?:

Windows 2003 Servers and Windows XP SP1 incorporate a new /USERVA switch to work in conjunction with /3GB switch. You can use the /userva=<xxxx> switch for more precise tuning of user and kernel virtual memory space in the Windows Server 2003 family. Use this new switch with the /3GB switch in the Boot.ini file to tune the User-mode space to a value between 2 and 3 gigabytes (GB), with the difference being given back to Kernel mode.

Thanks,
Aresh

Useful Blogs:

Windows Internals Mark Russinovich's: http://blogs.technet.com/markrussinovich/archive/2008/07/21/3092070.aspx
Memory Management - Demystifying /3GB : http://blogs.technet.com/askperf/archive/2007/03/23/memory-management-demystifying-3gb.aspx
Memory Management: http://blogs.technet.com/askperf/archive/2007/02/23/memory-management-101.aspx

Performance Analysis of Logs (PAL) Tool

2008-11-20T21:56:00.001+05:30

Tired of parsing the Perfmon (*.blg) manually. Let PAL make your job easier, give you html output and highlight high thresholds.

Website: http://www.codeplex.com/PAL

Project Description
Ever have a performance problem, but don't know what performance counters to collect or how to analyze them? The PAL (Performance Analysis of Logs) tool is a new and powerful tool that reads in a performance monitor counter log (any known format) and analyzes it using complex, but known thresholds (provided). The tool generates an HTML based report which graphically charts important performance counters and throws alerts when thresholds are exceeded. The thresholds are originally based on thresholds defined by the Microsoft product teams and members of Microsoft support, but continue to be expanded by this ongoing project. This tool is not a replacement of traditional performance analysis, but it automates the analysis of performance counter logs enough to save you time. This is a VBScript and requires Microsoft LogParser (free download).

Features

Thresholds files for most of the major Microsoft products such as IIS, MOSS, SQL Server, BizTalk, Exchange, and Active Directory.
An easy to use GUI interface which makes creating batch files for the PAL.vbs script.
A GUI editor for creating or editing your own threshold files.
Creates an HTML based report for ease of copy/pasting into other applications.
Analyzes performance counter logs for thresholds using thresholds that change their critieria based on the computer's role or hardware specs.

Download Link: http://www.codeplex.com/PAL/Release/ProjectReleases.aspx?ReleaseId=16807

To use PAL

The PAL tool is primarily a VBScript that requires arguments/parameters passed to it in order to properly analyze performance monitor logs. In v1.1 and later of PAL, a GUI interface has been added to help with this process.

Requirements

Operating Systems
PAL runs successfully on all of the following operating systems: Windows XP SP2, Windows Vista, and Windows 2003 Server. 32-bit only due to OWC11 requirements.
Note: The optional GUI (windows form) portion of PAL requires the Microsoft .NET Framework v2.0.

Log Parser 2.2
Log parser is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files and CSV files, as well as key data sources on the Windows® operating system such as the Event Log, the Registry, the file system, and Active Directory®. PAL uses the Log Parser tool to query perform logs and to create charts and graphs for the PAL report.
http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&DisplayLang=en

Microsoft Office Web Components 2003
Log Parser requires the Office Web Components 2003 in order to create charts.
http://www.microsoft.com/downloads/details.aspx?FamilyID=7287252c-402e-4f72-97a5-e0fd290d4b76

Training
Watch online at: http://www.livemeeting.com/cc/microsoft/view?id=JKGT3N
or
Download it (20071005IntrotoPALwmv.zip) from:
https://www.codeplex.com/Release/ProjectReleases.aspx?ProjectName=PAL&ReleaseId=6759

Related Blogs and Reviews
Clint Huffman's Windows Performance Analysis Blog
http://blogs.technet.com/clint_huffman
Mike Lagase's Exchange Performance Analysis Blog
http://blogs.technet.com/mikelag/archive/2008/08/20/performance-troubleshooting-using-the-pal-tool.aspx
Two Exchange Server Tools You Should Know About
http://windowsitpro.com/article/articleid/100132/two-exchange-server-tools-you-should-know-about.html

Thanks,
Aresh

Failover Clustering Windows 2008 Videos by John Savill

2008-11-20T03:32:00.001+05:30

One of the most useful videos I have found on the internet, for failover clustering. Thanks to John Savill for his efforts and time.

Creating Windows Server 2008 Failover Clusters:
http://www.savilltech.com/Videos/clustercreate/ClusterCreate.wmv
Configuring a Windows Server 2008 Failover Cluster from the command line: http://www.savilltech.com/Videos/clustercmd/clustercmd.wmv
Understanding Failover Cluster Quorum:
http://www.savilltech.com/Videos/ClusterQuorum/ClusterQuorum.wmv
Hyper-V Quick Migration:
http://www.savilltech.com/Videos/QuickMigration/QuickMigration.wmv
Configuring iSCSI connections from the command line:
http://www.savilltech.com/Videos/iscsicli/iscsicli.wmv
Failover Clustering with MELIO File System:
http://www.savilltech.com/Videos/meliofs/meliofs.wmv

Don't forget to post your comments :)

Thanks,
Aresh

Few useful Debugging Commands - WinDbg

2008-11-20T01:17:00.001+05:30

All of these commands are for kernel mode. These are few useful commands, that I use on daily basis for debugging. I hope you find them useful

Vertarget:
Lists Version information for the machine/dump you're debugging. You can also use "version" to tell you about the debugger bits.

1: kd> vertarget
Windows Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: LanManNt, suite: TerminalServer SingleUserTS
Built by: 6001.18000.amd64fre.longhorn_rtm.080118-1840
Kernel base = 0xfffff800`0160c000 PsLoadedModuleList = 0xfffff800`017d1db0
Debug session time: Tue Apr 1 14:29:22.553 2008 (GMT-7)
System Uptime: 0 days 0:03:14.328

!sysinfo
Good utility to check the CPU revs, BIOS revs, etc

1: kd> !sysinfo machineid
Machine ID Information [From Smbios 2.31, DMIVersion 0, Size=1695]
BiosVendor = Phoenix Technologies LTD
BiosVersion = 6.00
BiosReleaseDate = 09/24/2007
SystemManufacturer = VMware, Inc.
SystemProductName = VMware Virtual Platform
SystemVersion = None
BaseBoardManufacturer = Intel Corporation
BaseBoardProduct = 440BX Desktop Reference Platform
BaseBoardVersion = None

1: kd> !sysinfo cpuinfo
[CPU Information]
~MHz = REG_DWORD 2000
Component Information = REG_BINARY 0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0
Configuration Data = REG_FULL_RESOURCE_DESCRIPTOR ff,ff,ff,ff,ff,ff,ff,ff,0,0,0,0,0,0,0,0
Identifier = REG_SZ x86 Family 6 Model 15 Stepping 8
ProcessorNameString = REG_SZ Intel(R) Xeon(R) CPU L5335 @ 2.00GHz
Update Signature = REG_BINARY 0,0,0,0,b4,0,0,0
Update Status = REG_DWORD 2
VendorIdentifier = REG_SZ GenuineIntel
MSR8B = REG_QWORD b400000000

Getting the Server Name from the dump:
It's quite a bit easier to do internally, but this will get it done too. Good to know you're debugging the right server. :)

1: kd> dS srv!srvcomputername
e1b64db0 "Phantom"

!thread
Display current thread on the target system

1: kd> !thread
THREAD fa6046c8 Cid 1ab4.1f34 Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 1
IRP List:
    fa0cc490: (0006,01d8) Flags: 00000404 Mdl: 00000000
Not impersonating
Owning Process            fa15f3e0       Image:         cmd.exe
Wait Start TickCount      16627733       Ticks: 0
Context Switch Count      1102                 LargeStack
UserTime                  00:00:00.312
KernelTime                00:00:00.109
Win32 Start Address 0x00407ccc
Start Address 0x77e617f8
Stack Init f1e9d000 Current f1e9c4b8 Base f1e9d000 Limit f1e99000 Call 0
Priority 6 BasePriority 6 PriorityDecrement 0
ChildEBP RetAddr Args to Child
f1e9c174 e105bba7 0000008e c0000005 e11294a0 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f1e9c538 e10346b4 f1e9c554 00000000 f1e9c5a8 nt!KiDispatchException+0x3a2 (FPO: [Non-Fpo])
f1e9c5a0 e1034668 f1e9c628 e11294a0 badb0d00 nt!CommonDispatchException+0x4a (FPO: [0,20,0])
f1e9c628 e1131ac4 fa6046c8 fa15f3e0 f9de0310 nt!Kei386EoiHelper+0x186
f1e9c628 e1131ac4 fa6046c8 fa15f3e0 f9de0310 nt!SeCreateAccessState+0x27 (FPO: [Non-Fpo])
f1e9c648 e112d742 f9de0310 f9de03c8 00000180 nt!SeCreateAccessState+0x27 (FPO: [Non-Fpo])
f1e9c680 e112c65d 00000000 00000000 b57f0000 nt!ObOpenObjectByName+0x8f (FPO: [Non-Fpo])
f1e9c6fc e1131d22 f1e9c7fc 00000180 f1e9c7b8 nt!IopCreateFile+0x447 (FPO: [Non-Fpo])
f1e9c758 f4df068a f1e9c7fc 00000180 f1e9c7b8 nt!IoCreateFile+0xa3 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f1e9c7a4 f4defe67 80005510 00540052 e9fa0920 savrt+0x4668a
00000000 00000000 00000000 00000000 00000000 savrt+0x45e67

!irp
Display information about an I/O request packet

1: kd> !irp fa0cc490
Irp is active with 10 stacks 12 is current (= 0xfa0cc68c)
No Mdl: No System Buffer: Thread fa6046c8: Irp is completed.
cmd flg cl Device File Completion-Context
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

            Args: 00000000 00000000 00000000 00000000
[ 12, 0]   0 0 fd1a8020 00000000 00000000-00000000
           \FileSystem\Ntfs
            Args: 00000000 00000000 00000000 00000000
[ 12, 0]   0 0 fd101cd8 00000000 00000000-00000000
          *** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
\Driver\SymEvent
            Args: 00000000 00000000 00000000 00000000

!poolused
Investigate what data structures are consuming the various memory pools

!poolused 2 - sorted by Non-paged pool, summary
!poolused 3 - sorted by Non-Paged pool, details*
!poolused 4 - sorted by Paged pool, summary
!poolused 5 - sorted by Paged pool, details*

!running -ti
This will dump the stacks of each thread that is running on each processor

1: kd> !running -ti

System Processors 3 (affinity mask)
Idle Processors 1

Prcb Current Next
0 ffdff120 8089d8c0 ................

ChildEBP RetAddr
f45f0c70 bf8bb568 win32k!CanForceForeground+0x42
f45f0ca4 bf8bab6a win32k!CheckAllowForeground+0x79
f45f0cb4 bf8b7f41 win32k!xxxInitProcessInfo+0x54
f45f0cdc bf8b8032 win32k!xxxUserProcessCallout+0x23
f45f0cf8 809456dd win32k!W32pProcessCallout+0x43
f45f0d54 8088948e nt!PsConvertToGuiThread+0x13d
f45f0d58 00000000 nt!KiBBTUnexpectedRange+0xc
WARNING: Process directory table base EFFC7BE0 doesn't match CR3 EFFC7020
WARNING: Process directory table base EFFC7BE0 doesn't match CR3 EFFC7020

1 f7727120 8c034bd0 ................

*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr
f45f0c70 bf8bb568 win32k!CanForceForeground+0x42
f45f0ca4 bf8bab6a win32k!CheckAllowForeground+0x79
f45f0cb4 bf8b7f41 win32k!xxxInitProcessInfo+0x54
f45f0cdc bf8b8032 win32k!xxxUserProcessCallout+0x23
f45f0cf8 809456dd win32k!W32pProcessCallout+0x43
f45f0d54 8088948e nt!PsConvertToGuiThread+0x13d
f45f0d58 00000000 nt!KiBBTUnexpectedRange+0xc

!stacks
This is a great utility to check what threads are waiting on for each process. Find out more in the debuggers chm.

1: kd> !stacks 2
Proc.Thread .Thread Ticks   ThreadState Blocker
Max cache size is       : 1048576 bytes (0x400 KB)
Total memory in cache   : 0 bytes (0 KB)
Number of regions cached: 0
0 full reads broken into 0 partial reads
    counts: 0 cached/0 uncached, 0.00% cached
    bytes : 0 cached/0 uncached, 0.00% cached
** Prototype PTEs are implicitly decoded
                            [fffffa8000c77950 System]
   4.000008 fffffa8000c774c0 ffffe94b GATEWAIT   nt!KiSwapContext+0x7f
                                        nt!KiSwapThread+0x2fa
                                        nt!KeWaitForGate+0x22a
                                        nt!MmZeroPageThread+0x162
                                        nt!Phase1Initialization+0xe
                                        nt!PspSystemThreadStartup+0x57
                                        nt!KiStartSystemThread+0x16
   4.000010 fffffa8000ca0720 ffffff8c Blocked    nt!KiSwapContext+0x7f
                                        nt!KiSwapThread+0x2fa
                                        nt!KeWaitForSingleObject+0x2da
                                        nt!PopIrpWorkerControl+0x22
                                        nt!PspSystemThreadStartup+0x57
                                        nt!KiStartSystemThread+0x16
   4.000014 fffffa8000c78bb0 fffffcb0 Blocked    nt!KiSwapContext+0x7f
                                        nt!KiSwapThread+0x2fa
                                        nt!KeWaitForSingleObject+0x2da
                                        nt!PopIrpWorker+0x164
                                        nt!PspSystemThreadStartup+0x57
                                        nt!KiStartSystemThread+0x16
<SNIP>

!locks
It will display a list of all kernel mode locks that are being held by threads. Each lock is displayed with the mode the lock was taken out with (shared or exclusive). The owning thread(s) will be listed with an asterisk next to the thread id. If any waiters are queued up for the lock, it will list these too.

1: kd> !locks
**** DUMP OF ALL RESOURCE OBJECTS ****
KD: Scanning for held locks....

Resource @ nt!CmpRegistryLock (0xe10ad4c0)    Shared 2 owning threads
    Contention Count = 87
     Threads: fc783020-01<*> feee9db0-01<*>
KD: Scanning for held locks...

Resource @ 0xfeeed078 Shared 4 owning threads
Threads: fad42330-01<*> fad33020-01<*> fad33db0-01<*> fad42b40-01<*>
KD: Scanning for held locks.......................................

Resource @ 0xfc6df828 Shared 1 owning threads
Threads: fa6046c8-01<*>
KD: Scanning for held locks..

Resource @ 0xfc7e91c8 Shared 1 owning threads
Threads: fa6046c8-01<*>
KD: Scanning for held locks.

Resource @ savrt (0xf4daf040)    Shared 1 owning threads
    Contention Count = 1
     Threads: fa6046c8-01<*>
KD: Scanning for held locks.........................

Resource @ 0xfa6c1380    Shared 1 owning threads
    Contention Count = 71388
     Threads: f9ed1918-01<*>
KD: Scanning for held locks..............................

Resource @ 0xfaab7840 Shared 1 owning threads
Threads: feee9db3-01<*> *** Actual Thread feee9db0
KD: Scanning for held locks....................
11756 total locks, 7 locks currently held

!qlocks
command which displays all the various spinlocks. All processors are displayed across the top and codes appear next to the corresponding spinlock if owned or not, waiting or corrupt.

1: kd> !qlocks
Key: O = Owner, 1-n = Wait order, blank = not owned/waiting, C = Corrupt

Processor Number
Lock Name 0 1 2 3

KE   - Dispatcher
MM   - Expansion
MM   - PFN
MM   - System Space
CC   - Vacb
CC   - Master
EX   - NonPagedPool
IO   - Cancel
EX   - WorkQueue
IO   - Vpb
IO   - Database
IO   - Completion
NTFS - Struct
AFD - WorkQueue
CC   - Bcb
MM   - NonPagedPool

!PCR
Command will show you some useful info from the processor control block. Like the current thread, next, DPQ queues (Can run !dpcs).

1: kd> !pcr
KPCR for Processor 1 at f7727000:
    Major 1 Minor 1
    NtTib.ExceptionList: f4ac3d44
        NtTib.StackBase: 00000000
       NtTib.StackLimit: 00000000
     NtTib.SubSystemTib: f7727fe0
          NtTib.Version: 00336d13
      NtTib.UserPointer: 00000002
          NtTib.SelfTib: 7ffde000

                SelfPcr: f7727000
                   Prcb: f7727120
                   Irql: 0000001f
                    IRR: 00000000
                    IDR: ffffffff
          InterruptMode: 00000000
                    IDT: f772d800
                    GDT: f772d400
                    TSS: f7727fe0

          CurrentThread: 8c034bd0
             NextThread: 00000000
             IdleThread: f772a090

DpcQueue:

lm t n
Displaying the list of installed drivers reveals our obsolete culprit

1: kd> lm t n
start             end                module name
dd800000    dd9d0000     win32k   win32k.sys   Wed Mar 19 17:01:40 2008 (47E0F99C)
dd9d0000    dd9e7000     dxg      dxg.sys      Sat Feb 17 11:44:39 2007 (45D69D4F)
dd9e7000    dda3e100     ati2drad ati2drad.dll Mon Mar 22 21:53:41 2004 (405F130D)
dda3f000    dda5d000     RDPDD    RDPDD.dll    Sat Feb 17 19:31:19 2007 (45D70AAF)
e1000000 e127a000     nt       ntkrnlmp.exe Mon Mar 05 18:32:02 2007 (45EC14CA)
e127a000   e12a6000     hal      halmacpi.dll Sat Feb 17 11:18:26 2007 (45D6972A)
f1ca4000   f1cb81e0      naveng   naveng.sys   Fri Aug 15 09:30:26 2008 (48A4FF5A)
f1cb9000   f1d8ca20      navex15 navex15.sys Fri Aug 15 08:40:42 2008 (48A4F3B2)
f31a0000 f31cb000      RDPWD    RDPWD.SYS    Sat Feb 17 11:14:38 2007 (45D69646)
f38b4000 f38bf000     TDTCP    TDTCP.SYS    Sat Feb 17 11:14:32 2007 (45D69640)
f3904000 f3912000     HIDCLASS HIDCLASS.SYS Tue Mar 25 12:40:17 2003 (3E8000D9)
f3d14000   f3d1d000     hidusb   hidusb.sys   Tue Mar 25 12:40:17 2003 (3E8000D9)
f3d74000   f3d9e000     Fastfat Fastfat.SYS Sat Feb 17 11:57:55 2007 (45D6A06B)
f4046000   f40a3000     srv      srv.sys      Sat Feb 17 11:57:20 2007 (45D6A048)
f466b000   f4683000     clusnet clusnet.sys Sat Feb 17 11:32:57 2007 (45D69A91)
f48b3000   f48c8000     Cdfs     Cdfs.SYS     Sat Feb 17 11:57:08 2007 (45D6A03C)

!LMI <driver>
When I want to find out ifno about a particular driver in the dump, i use "lm n t" to get all of them, but then !lmi to drill into one.

1: kd> !lmi win32k.sys
Loaded Module Info: [win32k.sys]
         Module: win32k
   Base Address: bf800000
     Image Name: win32k.sys
   Machine Type: 332 (I386)
     Time Stamp: 47e0f99c Wed Mar 19 17:01:40 2008
           Size: 1d0000
       CheckSum: 1cd134
Characteristics: 10e perf
Debug Data Dirs: Type Size     VA Pointer
             CODEVIEW    23, 1935ac, 1929ac RSDS - GUID: {09B6D936-14C4-4CA1-90CF-A00888CD89A8}
               Age: 2, Pdb: win32k.pdb
                CLSID     4, 1935a8, 1929a8 [Data not mapped]
     Image Type: MEMORY   - Image read successfully from loaded memory.
    Symbol Type: PDB      - Symbols loaded successfully from symbol server.
                 c:\symcache\win32k.pdb\09B6D93614C44CA190CFA00888CD89A82\win32k.pdb
    Load Report: public symbols , not source indexed
                 c:\symcache\win32k.pdb\09B6D93614C44CA190CFA00888CD89A82\win32k.pdb

Don’t forget to leave your comments :)

Thanks,
Aresh

Ask Aresh

Forefront Protection for Exchange 2010 (FPE) is unable to get updates from the Cloudmark Antispam Engine

SCVMM R2: You cannot contact the Virtual Machine Manager server. ID: 1605

Hyper V Demo & Excel 2007 ITPro Event 30 May 2009 (Bangalore, India)

Hyper V & SQL 2008 ITPro Event May 2009 (Bangalore, India)

Catch me live presenting the “Technical Overview of Hyper V” … Be there !!!!

Location : MTC Training Room, Signature Building, Microsoft Corp. Bangalore

Start Time : 5/9/2009 4:00 PM

End Time : 5/9/2009 8:00 PM

Performance Counters showing numeric values – Windows Server 2003 x64

How to Manually Uninstall Windows 2003 Cluster

How to use Adplus to generate User memory dump’s Windows 2003

Windows 7 Day - IT Pro Event (Bangalore, India)

BugCheck CB on Windows 2003 Service Pack 2

First Step involved in troubleshooting Event ID 2020 Windows 2003

Performance Tuning on Windows 2003 – Event ID 2022 1055 and 2021

Mouse not captured in remote desktop session – Hyper V Windows 2008

Required Network Ports for Active Directory

Active Directory Command Line One-Liners

NT Storage Device Stack

Device Object Example for a SCSI HBA

Clustering and HA Resources -- clustering Blog

General Resources

Core

Exchange Server

File Server

Hyper-V

Multi-Site Clustering

Network Load Balancing

SQL Server

Windows Server 2008 Step-by-Step Guides

Storage Manager for SANs Step-by-Step Guide

Failover Cluster Validation Report failed for Duplicate IP address Windows 2008

Troubleshoot Active Directory Logon issue – By Anang Kumar

PowerGUI, a graphical user interface and script editor for Windows PowerShell!

Power Packs

User manuals

Blogs

Videos and Flash Demos

XP as Domain Controller :)

ADRestore GUI version

Download ADRestore.NET

Hyper-V Videos by John Savill

32-bit Memory Management Explained

Performance Analysis of Logs (PAL) Tool

Features

To use PAL

Requirements

Failover Clustering Windows 2008 Videos by John Savill

Few useful Debugging Commands - WinDbg