Category Archives: Windows Server

Quick Migration of Windows Server 2008 R2 Hyper-V to Windows Server 2012 or 2016

Here are the proven and tested steps for migrating from Windows Server 2008 R2 to Windows Server 2012 or 2016.  Note:  You cannot IMPORT a VM from 2008 R2 into 2012 or 2016, so you have to do the whole process manually.  That’s the reason for this post.

  1. log into the existing 2008 R2 virtual machine and note the following
    1. memory and CPU config
    2. IP addressing information (you need all the IP information, static IP’s etc.)
  2. Shut down the 2008 R2 virtual machine
  3. copy the VHD from the 2008 R2 virtual machine to the new host.
  4. On the new host open Hyper-V manager
    1. Edit disk
    2. select the VHD
    3. CONVERT to VHDX
    4. this will take a while
  5. When that completes, create a new VM
    1. DO NOT attach the hard drive.  Select “add a HD later”.  (I have seen issues with attaching the hard drive as part of the setup here, so I skip it and do it separate)
    2. Generation 1 VM
    3. set the memory and CPU configs
    4. complete the VM creation
    5. edit the VM and attach the VHDX file as IDE 0 master
  6. Using the Hyper-V remote control interface (by double clicking on a VM)
  7. Start the new VM
  8. boot into windows
  9. while on the desktop, after ~15-60 seconds you might see a “REBOOT” notification after changes are made to the OS.  If you get this notification, go ahead and reboot.  Otherwise, continue on.
  10. at this point in the Hyper-V manager, you need to double click on the VM and remotely control it through the Hyper-V manager
  11. while you are logged into the VM as administrator and at the desktop, insert the Hyper-V integration tools disc and upgrade the Hyper-V tools
  12. reboot when that completes
  13. log in again to the machine through the Hyper-V remote control interface
  14. edit the network adapter properties and set it exactly as it was before.
    1. Note:  During this whole process your OLD NIC will be hidden (because it’s gone now) and you will be given a new NIC and it will be in DHCP mode from the start.
    2. you will need to edit that new NIC and put in the correct static TCP/IP information if applicable to your setup.
    3. ALL OTHER settings (machine name, IIS, DNS, etc.) will retain fine.  Just edit the NIC and config the NIC the same way it was on the old VM

 

All done!

Migrate Symantec Backup Exec 2015 14.2 to new server with a DIFFERENT name

I have used this procedure to successfully migrate an installation of BUE 2015 ver. 14.2 to a new server, with a different machine name.  If you are moving things from the old machine to the new machine and they both have the same names, see my post here and use that instead.

I used this procedure for a client who was ONLY using local disk based backups, but this will also work for tape/other device backups as well.

First, download this document.  It contains most of the steps, with the additions/changes below.

Using the PDF document from above:

  1. Setup the new server.  Patch it up to date through Windows updates.  Join it to the domain.  Make sure the machine name is correct (what you want it to be going forward)
  2. Install BUE onto the new server.
    1. This is SECTION 3 of the PDF, “Install Backup Exec on the Destination Computer”
  3. Make sure both the old BUE server and the new BUE server have the exact same
    1. Software version, BUE 2015 / 14.2 (etc.)
    2. Patches.
      1. Run live update on both machines and make 100% sure both have the same version and hotfixes
  4. Perform step #1 in the PDF, “Obtain information about the current Backup Exec installation”
  5. Perform step #2 in the PDF, “Move Backup Exec data to a temporary location”
    1. Note:  it’s up to you if you want to copy directly from the old server to the new server.  I directly copied things over the lan from the old machine to the new machine and left the old machine intact.
  6. Skip step #3 (already done above)
  7. Start step #4 “Move Backup Exec data from temporary location to the destination…”  NOTE:  Stop after 4.3.  Do not proceed yet.
    1. Complete steps 4.1, 4.2 and 4.3
  8. In our case, this client was using a disk based backup strategy.  At this point, we shut down the old server, shut down the new server, and installed the 3tb hard drive from the old server into the new server.
    1. we also made sure the DRIVE LETTER was the same on the new server for this drive as it was on the old server (after startup)
  9. On the new server, go to the BUE path:
    1. C:\Program Files\Symantec\Backup Exec\Catalogs
    2. You will see the copied over files from your old server.
    3. You need to make a COPY of the folder name from your old server and copy that folder (and contents) into the same “Catalogs” directory, but renamed for the new BUE server name.
      1. For example, if your catalogs folder contains a folder BACKUPSERVER1 (and within that folder are many files), create a new folder named for the NEW server name (whatever that is) and copy all the FILES and FOLDERS from within the BACKUPSERVER1 folder, to the new folder.
      2. You will now have to folders now, one named for the old machine and one for the new machine, each with identical contents
  10. On the new server, do this procedure:
    open a command prompt as administrator and enter the following pressing the ENTER key after each line:
    
    osql -E -S .\BKUPEXEC
    
    1>use bedb
    
    2>go
    
    1>SELECT partitionname FROM datapartition
    
    2>go
    
    *At this point, the old server-name should be listed
    
    1>UPDATE DataPartition SET PartitionName="new-server-name" WHERE PartitionID =0
    
    2>Go
    
    * # of rows affected should be listed To verify the change took place; run the original commands:
    
    1>SELECT partitionname FROM datapartition
    
    2>Go
    
    *At this point the new server-name should be listed
  11. At this point, RESTART the new server
  12. When it boots back up, login and launch BUE
  13. if all went well you should be ready to go.

Migrate Symantec Backup Exec 2015 14.2 to new server with same name

The process of moving BUE 2015/14.2 to a new server with the exact same name as the old server is pretty straightforward (but very long).

The entire procedure is in this PDF which I have tried and it works fine.

If you are moving to a new server with a different name, please use this post instead.

Notes:

  1. Setup the new server.  Install the same version of BUE, and run all LIVEUPDATES –on both the old and new servers.  Verify that both servers are on the exact same version and updates.
  2. follow the PDF as is
  3. Note:  Before step 4 in the PDF, if you are moving hardware, like a tape storage unit, disk based backups (to a local drive on the old server, etc.), you need to install that hardware prior to step 4.
    1. in our case we were moving a 3tb hard drive of disk based backups.  Prior to step 4, we shutdown both servers.  Removed the hard drive from the old server, moved it to the new server.  Started up the new server and made sure the drive letter for the drive was the SAME as on the old server.
    2. If you are using other hardware, you need to go ahead an install that onto the new server prior to completing step 4.
  4. If all goes well you should be fine.

 

Solution for Windows cross-subnet browsing issue in mid-2016

**NOTE: as of 12/2017 and the Fall Creator’s Update builds 1709 and later, Microsoft has again broken the functionality of the “Network” (Network Neighborhood) item inside Windows Explorer.  You will probably need to do both add the registry key below, as well as follow the directions in my new post, here.

=========

Hello all-

this is a follow-up to my original post in which I discussed how to setup cross-subnet browsing so that all computers come up in “Network” or “Network Neighborhood”.

For the last few months, my “Network” browse list has disappeared and would ONLY show computers from my LAN subnet.  My remote (VPN-to-VPN) network subnet disappeared from my “Network” computer list.

After >>MUCH<< research I have found the problem and will present the solution.

The problem is due to the Microsoft Windows Update (for both desktop and server OS’s) KB3161949  (read about it here).

Part of the effect of this update was to “harden” the NETBIOS service and prevent NETBIOS data from being sent between subnets.

 

THE SOLUTION:

Two ways of handling this.

  1. You can remove this specific hotfix
  2. You can add a registry setting to override it.

(YOUR CHOICE)

To REMOVE the hotfix:

On SERVERS:  Go to Control Panel, Uninstall a program, View Installed Updates… Remove 3161949.  You’ll need to reboot.  After rebooting, go check for windows updates again (MANUALLY)  3161949 will pop up.  Right click and HIDE UPDATE.

On Desktops:  Same process as above – HOWEVER – Depending on which version of windows, which OS Rollup you are on, 3161949 might not show up.  If you cannot remove 3161949, simply add the registry key below.

–OPTIONAL METHOD–

Involves a registry key addition, then you need to reboot the machine.

SUBKEY: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
Value Name: AllowNBToInternet
Type: Dword
Value: 1

 

** REMEMBER TO REBOOT after you do either the uninstall or registry key.

** It will take 5-60 minutes for the Network browse lists to refresh

*** MOST IMPORTANT ***

You MUST do this on your domain servers (Master Browsers) on each side of the subnet.  For example, I have for domain servers, two on each side.  I did this procedure on both, then rebooted all four domain servers.

Then I did this on my Windows 10 Pro workstation (via registry key) and rebooted.

When I checked my computer 30 minutes later, all machines were showing up in the browse list under “Network” in Windows 10.

** ADDITIONAL NOTE:  Just for the heck of it, you might as while put that registry key onto all your domain servers.  Even though I had uninstalled 3161949 from all 4 of my domain servers (and hidden that update), one of my DC’s re-applied that patch and rebooted, thereby messing up my Network list again.  So I just went and put that reg key onto all 4 DC’s just in case they get that update somehow in the future.

** NOTE: Do this at your own risk.  I’m not responsible for your network security.  You have to make the decision on what’s more important to you here.  Being able to see the entire cross-subnet network, or security.  I can’t speak as to how this increases or decreases your security risk.

Let me know if any questions…

Kerio Mailserver CSR generation and import of SSL Cert

This is the entire process from CSR generation to installing the CRT with all trusted intermediate certs so that your connection is a good as possible.

The primary reason for this article is due to issues that Google Gmail has with remote POP mail checking if the SSL and all Intermediate Certs aren’t installed.

Note: This applicable for Kerio Mailserver 6.X and earlier.  I cannot verify if it 100% works with 7.0 or newer.

Generating the new CSR Certificate Signing Request from Kerio

  1. download the Kerio SSL tool here
  2. extract that file to a new directory off your C:\ root, something easy like “C:\SSL”
  3. inside the Kerio interface, go to the SSL Certs config page and
  4. New->New Certificate Request
  5. complete it and make sure your hostname is your full domain name to be protected by the SSL, eg “mail.yourdomainname.com”
  6. save this file into the new directory above.
  7. Run the following command from a command line.  Feel free to change the bits if needed.  We only use 4096
    1. openssl genrsa -out server.key 4096
    2. This will output a file called “server.key”
  8. Run the following command:
    1. openssl req -new -days 365 -key server.key -out server.csr -config openssl.cfg
  9. That will generate a file called “server.csr”. You will need this for Godaddy, Comodo or wherever you get the SSL cert

 

Buy a new SSL and use the “server.csr” file to process it.

 

Handling the installation of your new CRT and installing intermediate keys as well.

  1. extract the zip file with your new CRT file into the directory above
  2. you will need to locate and download the “intermediate certificates” for your SSL if they do not already come inside the zip file.  In my case, we had an “Comodo Instant SSL” and inside it there was our domain CRT file and a second file “mail_mydomainname_com.ca-bundle”.  I used the contents of this “ca-bundle” file for my needs.
  3. using a text editor like “Ultraedit” or “Notepad++”  (NOTE: DON’T USE NOTEPAD., open the .CRT file.
  4. Copy it
  5. paste it into a new blank document
  6. open the additional file(s)
  7. Paste them directly below your .CRT file text, into the text file.  If there is more than one past them back to back to back in the file.  Note: your domain CRT must be the first one, followed by the Int. certs.
  8.  Save the file.  Call it something mydomainname with extras.CRT
  9. open Kerio
  10. SSL Certs
  11. Import New Cert
  12. first it will ask for the KEY file you generated in the first section above.  locate that file and open it
  13. second it will be looking for our new combined CRT file that we just did in this section above.
  14. once it imports, select the new cert as the active cert
  15. restart kerio mailserver
  16. go to this site and run a test on your domainname.
  17. if you’ve done everything properly, you should have all “Green Checkmarks” and a clean bill of health on your domain name.

 

PFSENSE 2.3 PPTP VPN passthru workaround

PFSense 2.3.x and up have removed the PPTP tab, and PPTP passthru options.  This is because PPTP has been depreciated and it not considered 100% safe anymore.

For those of you still in need of using PPTP passthru to allow Windows VPN remote users into your LAN, here is the easy workaround.

  1. Firewall, NAT, Port forward.
    1. add port forward from WAN (presumably your outside interface name)
      1. TCP
      2. WAN ADDRESS
      3. DEST PORT RANGE=PPTP 1723
      4. REDIRECT TARGET IP=the internal IP of your Windows RRAS server.
      5. REDIRECT TARGET PORT=1723
      6. Allow it to ADD ASSOCIATED FILTER RULE for this entry
      7. SAVE
    2. add another rule, exactly the same as above EXCEPT for GRE.  All the same settings, but use GRE
  2. Once that is complete, go look at your WAN firewall rules.  You should have two new auto-created rules.  One for PPTP and one for GRE.
  3.  Remote users should now be able to connect just fine through PFSENSE 2.3.x into your Windows RRAS server.

Remember, using PPTP in 2016 is considered a risk, so do it at your own risk.  Please consider moving towards a newer VPN standard with better security.

How to uninstall MSE from Windows Server 2012 R2

We recently ran into a situation where we had a Windows 2012 R2 server with Microsoft Security Essentials installed on it (from a few years ago), and now with a recent Windows Update – the Windows update will not install because MSE is no longer compatible with this OS.

The issue is that you can not uninstall MSE via the standard “add/remove” programs.  When that is attempted I get the following error:

Error Code: 0x8004FF04

At that point you’re dead in the water and can’t remove MSE.

Here’s the EASY fix:

go to

C:\Program Files\Microsoft Security Client

and RIGHT CLICK on Setup.exe

Go to Compatibility, check it and change to WIN 7.

Bring up a command prompt

Type in:

“C:\Program Files\Microsoft Security Client\Setup.exe” /disableoslimit /u

This will bring up MSE and at this point you will see an “uninstall” button.

Click Uninstall and remove it!

 

Seagate Backup Exec 14.x reuse improperly allocated tape

Let’s say you have a DLT drive and you are running a backup job like this:

Full

Incremental

Incremental

{eject}

Next tape

etc.

Every so often, due to power outages, mistakes etc. a tape may eject out of the drive. So you pop it back in but the job won’t run, it ejects the tape and asks for a tape that is over writeable and the current tape is already (previously) allocated and you can’t use it.

There is an easy solution for this, but you’ll need to re-run your full backup job.

How to address it:

  1. With the current tape out, cancel the current job, so that the jobs re-queue as queued in the future
  2. pop the tape in
  3. go to the Storage tab, click on the DLT drive
  4. pick INVENTORY -> Inventory Now
  5. Let that complete
  6. pick Erase -> Erase now
  7. restart the FULL job and let it complete.
  8. the next incremental job will then run as scheduled and you are back on track with the backup cycle.

 

WordPress 4.x auto updates under windows

If you want your WordPress install to do auto-updates (in a Windows Server based hosting setup), you need to do one simple step.

 

Edit the hosts file.

Put a local IP in there for the domain name of the site.

Save the changes.

 

Example:

10.5.5.5  www.whatever-the-site-is.com

Re-log into WordPress and go to dashboard-updates and in there it should tell you “future updates will be automatically applied”

Why is all of this needed?  WordPress uses PHP CRON and that is reliant on the server being able to find the local website.  Therefore it is necessary to put a hard-coded IP in the hosts file so the CRON job can “see” the wordpress site.  Without the hosts entry the website will resolve to the external IP of the site, and you will have an unreachable IP issue and auto-update won’t work.

Proper FTP setup via IIS using Passive FTP

Since PASSIVE FTP seems to be a relative standard (that I experience), and since most clients don’t understand or want to use “ACTIVE” FTP, here is the easy way to configure your firewall and FTP software on an IIS machine to permit PASSIVE FTP.

Firewall Setup

You’ll need two rules and one “one to one” NAT mapping (this may vary a bit due to your firewall software).

The one to one NAT mapping needs to map the external IP address to the internal IP of the server.  Such as “66.33.123.21” mapped to “10.1.1.21”

One rule to allow the world into TCP port 21, mapped to the specific server in question.  (Allow * from ANY to 10.1.1.21 TCP port 21).

Second rule, specifically for PASSIVE FTP.  Allow * from ANY to 10.1.1.21 on ports range 50000 to 50100.

FTP Server Setup

We normally use Filezilla Server (latest version, of course).

Add a user and setup the standard settings.

Passive settings are as follows (below).

Most importantly, the “X.X.X.X” area below is your PUBLIC IP that is mapped through your firewall.

Click OK and save the settings.

FTP1

 

FTP Client Settings

Nothing fancy here, just check to make sure the settings look like this:

FTP2

1 2 3 4