Showing posts with label Small Business Server 2011. Show all posts
Showing posts with label Small Business Server 2011. Show all posts
Saturday, May 4, 2013
Disable SSTP Certificate Revocation Check
Windows 7 supports a number of different types of VPN protocols. PPTP and IKE can be problematic when attempting to connect through a router that is conducting NAT. SSTP gets around that problem by tunneling over an SSL session.
In order to enable SSTP, the server must have a certificate with a hostname that matches the certificate and the CRL URL must be reachable by the client. These are not always easy to accomplish when using a self signed certificate.
In my case I had everything working except for the CRL URL. The client was unable to check the CRL so it rejected the connection. An interesting form of Denial of Service could be implemented by denying access to CRLs, but that is a bit of a digression.
On the client computer, create a DWORD value NoCertRevocationCheck under HKLM\System\CurrentControlSet\Services\Sstpsvc\Parameters Set the value = 1. This will disable the certificate revocation check and enable the connection to proceed.
Friday, January 11, 2013
Windows Update Error 800B0109
This Windows update error 800B0109 means that the WSUS signing certificate is not trusted. Windows 7 64 bit will not install the update if the certificate is not trusted. If this happens to a regular home user who gets updates via Microsoft you should check really hard to make sure you do not have some malware that has hijacked you WSUS process.
However is my case I used System Center Updates Publisher to push out Adobe updates and I created my own self signed certificate which is not trusted by the clients. I either need to add that certificate to the trusted store on each computer or create a new cert using my CA that is already trusted by the clients.
Because the root goal of this exercise was to eliminate visiting each client for Adobe updates, I will try the CA route and see how it goes.
However is my case I used System Center Updates Publisher to push out Adobe updates and I created my own self signed certificate which is not trusted by the clients. I either need to add that certificate to the trusted store on each computer or create a new cert using my CA that is already trusted by the clients.
Because the root goal of this exercise was to eliminate visiting each client for Adobe updates, I will try the CA route and see how it goes.
Wednesday, December 26, 2012
Yet Another Exchange Activesync Issue
A user received a new Android tablet and they wanted to sync their email with the Exchange 2010 server. After configuring everything phone side the phone never displayed the security setting warning and displayed a loading sign that never ended.
On the server side, the exchange server was spewing event id 1008 into the event log.
Other users had no problem, but this was the first time this user had attempted to sync with exchange.
To make a long story short and after some googling I found, Cannot sync iPhone with Exchange ActiveSync.
This article talks about a permissions problem on the server. The solution was to verify that the user has the "Include inheritable permissions from this object's parent" checked on the Active Directory user's permissions.
1. Open "Active Directory Users and Computers" (dsa.msc).
2. Go to "View" and make sure "Advanced Features" is checked, if it isn't - check it.
3. Find the problematic user and open its "Properties" (right click --> Properties).
4. Go to the "Security" tab and click on the "Advanced" button.
5. Verify that the "Include inheritable permissions from this object's parent" checkbox is checked. If it is, you may try to reset the user's permissions by clicking on the "Restore defaults" button.
After fixing the permissions and then newly adding the email account on the tablet, everything worked but the initial sync did seem to take a little while. It is interesting that this is the same root cause of a similar problem I had before.The interesting thing is that I checked this on all of the users last time and I also checked all of the users again this time. Probably I missed this one user the last time around though....
On the server side, the exchange server was spewing event id 1008 into the event log.
Other users had no problem, but this was the first time this user had attempted to sync with exchange.
To make a long story short and after some googling I found, Cannot sync iPhone with Exchange ActiveSync.
This article talks about a permissions problem on the server. The solution was to verify that the user has the "Include inheritable permissions from this object's parent" checked on the Active Directory user's permissions.
1. Open "Active Directory Users and Computers" (dsa.msc).
2. Go to "View" and make sure "Advanced Features" is checked, if it isn't - check it.
3. Find the problematic user and open its "Properties" (right click --> Properties).
4. Go to the "Security" tab and click on the "Advanced" button.
5. Verify that the "Include inheritable permissions from this object's parent" checkbox is checked. If it is, you may try to reset the user's permissions by clicking on the "Restore defaults" button.
After fixing the permissions and then newly adding the email account on the tablet, everything worked but the initial sync did seem to take a little while. It is interesting that this is the same root cause of a similar problem I had before.The interesting thing is that I checked this on all of the users last time and I also checked all of the users again this time. Probably I missed this one user the last time around though....
Tuesday, July 26, 2011
Network Discovery Windows 7
At some point in the recent past I noticed that I could not browse the local network.
I had recently upgraded to SBS 2011 after the upgrade I was able to browse the network but not now.
I could still access all of the resources on the network, so it was not a permission problem.
Network Discovery was turned on in the Advanced Sharing Settings of all of the Windows 7 computers.
After googling and bingleing many people wrote that they turned on the Computer Browser service.
However in Windows 7 and Server 2008, the browser service is deprecated and no longer used.
Dom's Techie Blog pointed to the services that need to be running for Network Discovery to work.
All of mine were set to the correct settings and running except that Function Discovery Resource Publication was set to manual and not running. Everything I could find stated that it should be set to manual.
On a hunch I started the Function Discovery Resource Publication service on a few computers and I was able to browse to them on the network almost instantly. I am not sure why I am not able to browse with the services set to default but I created a new Global Policy to set the service to Automatic and applied it to all of the computers in the domain.
I can now browse all of the computers but I still do not have a valid cause for what happened. I am going to try to research this one some more and see what happens.
I had recently upgraded to SBS 2011 after the upgrade I was able to browse the network but not now.
I could still access all of the resources on the network, so it was not a permission problem.
Network Discovery was turned on in the Advanced Sharing Settings of all of the Windows 7 computers.
After googling and bingleing many people wrote that they turned on the Computer Browser service.
However in Windows 7 and Server 2008, the browser service is deprecated and no longer used.
Dom's Techie Blog pointed to the services that need to be running for Network Discovery to work.
All of mine were set to the correct settings and running except that Function Discovery Resource Publication was set to manual and not running. Everything I could find stated that it should be set to manual.
On a hunch I started the Function Discovery Resource Publication service on a few computers and I was able to browse to them on the network almost instantly. I am not sure why I am not able to browse with the services set to default but I created a new Global Policy to set the service to Automatic and applied it to all of the computers in the domain.
I can now browse all of the computers but I still do not have a valid cause for what happened. I am going to try to research this one some more and see what happens.
Monday, July 25, 2011
Exchange 2010 Activesync Issue
I upgraded my Exchange server from Exchange 2007 to Exchange 2010 as part of the migration to SBS 2011. After the upgrade I was making good progress ironing out issues until I tried to sync my android phone.
The native android email in Android 2.2 was failing with an unspecified error. I then tried Touchdown by Nitrodesk. It was also failing but they have nice logging built into their software and I was able to see the following:
Checking Certificate...
Checking ActiveSync with SSL...
Server is Microsoft-IIS/7.5
ActiveSync was found
ActiveSync Version :Versions:Microsoft-IIS/7.5,2.0,2.1,2.5,12.0,12.1,14.0,14.1
Trying activesync protocol -116...
ActiveSync provisioning returns HTTP:200
Error provisioning ActiveSync: Policy status is 0
Trying activesync protocol 2.5...
ActiveSync provisioning returns HTTP:200
ActiveSync provisioning success
The following policies have been requested :
The error refreshing folders was the key and NitroDesk support pointed me to the Nick MacKechnie blog. The main idea is that there is an issue with upgrading to Exchange 2010 and some of the permissions are not set correctly.
Another good Exchange troubleshooting tool I found is the Microsoft Exchange Remote Connectivity Analyzer . This tool pointed right to the HTTP 500 error I was getting which pointed me to a Technet Article that described essentially the same issue.
I followed the steps but in my case I had about 10 Exchange server entries so I selected the first one and chose "include inheritable permissions from parent". After the obligatory OK clicks I ran the Exchange checker again and it passed. Then I tried my Droid in both Touchdown and the Native app and everything worked.
The native android email in Android 2.2 was failing with an unspecified error. I then tried Touchdown by Nitrodesk. It was also failing but they have nice logging built into their software and I was able to see the following:
Checking Certificate...
Checking ActiveSync with SSL...
Server is Microsoft-IIS/7.5
ActiveSync was found
ActiveSync Version :Versions:Microsoft-IIS/7.5,2.0,2.1,2.5,12.0,12.1,14.0,14.1
Trying activesync protocol -116...
ActiveSync provisioning returns HTTP:200
Error provisioning ActiveSync: Policy status is 0
Trying activesync protocol 2.5...
ActiveSync provisioning returns HTTP:200
ActiveSync provisioning success
The following policies have been requested :
Refreshing AS folders
Error refreshing folders
Checking 2007 with SSL...Error refreshing folders
The error refreshing folders was the key and NitroDesk support pointed me to the Nick MacKechnie blog. The main idea is that there is an issue with upgrading to Exchange 2010 and some of the permissions are not set correctly.
Another good Exchange troubleshooting tool I found is the Microsoft Exchange Remote Connectivity Analyzer . This tool pointed right to the HTTP 500 error I was getting which pointed me to a Technet Article that described essentially the same issue.
I followed the steps but in my case I had about 10 Exchange server entries so I selected the first one and chose "include inheritable permissions from parent". After the obligatory OK clicks I ran the Exchange checker again and it passed. Then I tried my Droid in both Touchdown and the Native app and everything worked.
Subscribe to:
Posts (Atom)