Occasionally a computer will come “disjoined” from the domain. The symptoms can be that the computer can’t login when connected to the network, message that the computer account has expired, the domain certificate is invalid, etc. These all stem from the same problem and that is that the secure channel between the computer and domain is hosed. (that’s a technical term. )

The classic way to fix this problem is to unjoin and rejoin the domain. Doing so is kind of a pain because it requires a couple of reboots and the user profile isn’t always reconnected. Ewe. Further if you had that computer in any groups or assigned specific permissions to it those are gone because now your computer has a new SID, so the AD doesn’t see it as the same machine anymore. You’ll have to recreate all of that stuff from the excellent documentation that you’ve been keeping. Uh, huh, your excellent documentation. Double Ewe.

Instead of doing that we can just reset the secure channel. There are a couple of ways do this:

1. In AD right click the computer and select Reset Account. Then re-join without un-joining the computer to the domain. Reboot required.
2. In an elevated command prompt type: dsmod computer “Computer DN” – reset. Then re-join without un-joining the computer to the domain. Reboot required.
3. In an elevated command prompt type: netdom reset MachineName /domain DomainName /User0 UserName /Password0 {Password | *} The account whose credentials you provided must be a member of the local administrators group. No rejoin. No reboot.
4. In an elevate command prompt type: nltest /Server:ServerName /SC_Reset:Domain\DomainController  No rejoin. No reboot.

Third Tier can help you with this problem.

If you’ve been opening tickets with us then you’re familiar with our staff. You know that they can fix problems in a jiffy that would take others hours to resolve. Well, we have a new program that will allow you to add a Third Tier staff member to your business.

Here’s what you get from us:

 We have two programs:

Quarterly Block Hours: $1,400

Ready to get started? Head over to www.thirdtier.net/my-third-tier and send me an email from there.

Here are a couple of the items that have made my Best Practices list so far:

Protecting from Accidental Deletion Now here is an under the radar item that is going to prove very useful. You can now protect OU’s, Containers, Groups and Objects from accidental deletion. It is as simple as a checkbox and for most new items in AD the box is checked by default. But for existing items it is not. You’ll need to go in and retro fit those with protection.

If you have a big complex AD then you can use PowerShell to fit the whole thing with this protection. But what is that Check box actually doing? It is changing the ACE permissions on the object. When that box is checked an ACE is added to Deny Everyone group Delete and Delete Subtree.

This isn’t the kind of thing that you’ll find yourself needing often (I hope) but now that you’ve read this, if you don’t go and set that check box you’ll kick yourself later.

Redirecting the Default Computer and User Containers New computers and users being left in the Computers and Users containers for long periods of time has long been one of my pet peeves. It distresses me that no one notice that this person or computer has not been subject to Group Policy, as the rest of the domain is. So when I found this little gem, it made my day.

The commands are: RedirCmp and RedirUsr to redirect anything that lands in the Computers container and the Users container respectively.

The command is entered in an elevated command prompt like this: redircmp “DN of OU for new computer objects”  So simple!  But you do need to be careful. Take a look at the Computers containers after you do this, there is no reference that it’s been redirected. Therefore, TODO make a note in the description of the container to remind you and future IT admins that this container is redirected and to where.

I have a few more items that have made my BP list but I’ll save those for another post. Keep reading!

Open Documents from Word and other MS Office Apps

This concludes the series on integrating Sharepoint into things you do already without visiting the website. Remember this:  Sharepoint is not a website. Sharepoint has a website

—
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

The symptoms of a corrupt TCPIP stack on a server are: after reboot it hangs at applying computer settings, users are unable to browse network shares, network browsing in general is slow, user can’t log in to the computer with message that the domain is unavailable or your computer account does not exist.

These problems can look like a lot of different things: DNS could be down, if you think the problem is the PC then you might try rejoining it to the domain or checking its DNS settings, you might think that AD service is not started, perhaps the switch failed, maybe we should reboot? If you’ve gotten to the maybe we should reboot option that’s when you know that you’re out of real ideas.

But these are all symptoms of a corrupt TCPIP stack on the server. Sure not every user will complain about problems at first, that is because much of the work we do on our computers is async and not dependent on our computer being able to interact with the server in real time. So while it might seem like the problem started with one computer and then spread through the network in reality the bomb went off but not everyone noticed at the same time.

I can’t tell you what causes a corrupt TCPIP stack. But I can show you how to reset it. Fortunately Microsoft has made this a very simple task. Just visit this kb article:

http://support.microsoft.com/kb/299357 and use the FixIt. After you have run the FixIt you will need to re-enter your TCPIP settings into the NIC properties. Be sure to read the manual process so you understand what the FIxIt is going to do for you.

The reset command is available in the IP context of the NetShell utility. Follow these steps to use the reset command to reset TCP/IP manually:

1. To open a command prompt, click Start and then click Run. Copy and paste (or type) the following command in the Open box and then press ENTER:

   cmd

2. At the command prompt, copy and paste (or type) the following command and then press ENTER:

   netsh int ip reset c:\resetlog.txt

   Note If you do not want to specify a directory path for the log file, use the following command:

   netsh int ip reset resetlog.txt

3. Reboot the computer.

When you run the reset command, it rewrites two registry keys that are used by TCP/IP. This has the same result as removing and reinstalling the protocol. The reset command rewrites the following two registry keys:

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\
SYSTEM\CurrentControlSet\Services\DHCP\Parameters\
				

To run the manual command successfully, you must specify a file name for the log, in which the actions that netsh takes will be recorded. When you run the manual command, TCP/IP is reset and the actions that were taken are recorded in the log file, known as resetlog.txt in this article.

The first example, c:\resetlog.txt, creates a path where the log will reside. The second example, resetlog.txt, creates the log file in the current directory. In either case, if the specified log file already exists, the new log will be appended to the end of the existing file.

Especially note that the Parameters registry key is replaced. This explains why you need to reenter your TCPIP values but it should also alert you to the fact that if you have any custom settings in there you will need to reapply those as well. In a recent case, the server had IPv6 disabled to support Peachtree and that entry in Parameters/DisabledComponents had to be recreated.

We’ve gotten used to Exchange hogging all the memory on the server, but in pre-2007 versions it was pretty good at sharing that memory with other applications. But no more. Exchange grabs that available memory and doesn’t let go. When the server comes under load it then becomes unresponsive to additional requests. Wait for a long time and the problem will go away. Reboot and the problem will go away. Restart the Exchange Store and the problem will go away. But what we really need to do is prevent it from happening in the first place.

The solution to this problem is to tune Exchange caching to your environment. TechNet has an article on how to calculate how much cache and therefore memory that Exchange will need. You can find that article here: http://technet.microsoft.com/en-us/library/ee832793.aspx. This is a great article in that it gives you the formula for determining the minimum and maximum memory allocation your environment will require and also point us to another TechNet article that shows us where to make this change. (Interestingly enough this later article is from Exchange 2000 days.) That second article is here: How to modify the Store Database maximum cache size in Exchange 2000 Server

If you do nothing then this is now much ram the Store service is taking on your server right now:

The amount of ram that you want to set aside for Exchange will vary based on the number of emails sent by the organization so you will want to perform the calculation outlined in the article above.

I’m a small business consultant with many clients running exchange on-premise. For my purposes I needed to find a standard that fit the majority of my clients. We can of course tweak said standard when the situation warrants, say the client is very small or very large. So I calculated a number that I felt would never be exceeded. My number is 10GB maximum and 5GB minimum. You should note that although it doesn’t say so in the article, the one written for the 2000 era, setting a minimum and a maximum was required in order to have the desired effect on freeing up the ram. You should also know that the value you enter into msExchESEParamCacheSizeMax and Min must be an increment of 32k. Thus 10GB is 326780 an 5GB is 163840. (Many thanks for Michael B Smith for assisting with the calculation and pointing out the importance of 32k)

Where is this parameter? It’s in Active Directory. You’ll need to enable Advanced Features viewing. Browse to the Information Store object and modify the attributes. Yes you will need to restart the Exchange services for this change to take effect.

Many thanks also to our fabulous staff at Third Tier for getting to the bottom of this issue.

—
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

Managing shared Contacts is one of the biggest pain points that every clients has. It’s probably the first painpoint they encounter when they hire their first employee. Sharepoint will allow your clients to provide access to all corporate contacts by permission. Allow the sharing of contacts between departments and people (or not your choice). It will allow them to take the contacts with them on the road while offline. It will allow them to access their contacts anytime from any device. It will keep them updated and in sync. And most importantly, they won’t get lost when an employee leaves or accidentally deletes them.

Here’s how we do it:

Connect a Sharepoint contact list to Outlook

Make a new Sharepoint contact from Outlook

Make a new contact in Sharepoint and view it in Outlook

Use Contacts when Offline

—
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

Here’s how to do it:

Connect a Sharepoint Calendar to Outlook

Now that we have our calendar available to us, let’s see how to use it.

Make a new Appointment in the Sharepoint calendar from Outlook

—
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

“People have wanted Office in the cloud. Office 2010 is now in the cloud. People have wanted the ability to have online communications, OCS, and Exchange online in the cloud, Live Meeting in the cloud. SharePoint Online, the fastest-growing product in the history of Microsoft to $1 billion. SharePoint will be the fastest-growing product to $2 billion in the history of Microsoft this next year and in the next 18 months.” – Kevin Turner COO, Microsoft at WPC 2010

So why should your clients use Sharepoint?

• Available from anywhere on any device
• Yes, that’s right. Sharepoint is a mobile app
• Recycle Bins
• Users and Administrators get recycling bins. Try that with any other network share
• Workflows
• You can automate paperwork processes and make it less painful for everyone
• Version History
• Sort of like “previous versions” in Windows only better because you can preserve every change in real time.
• Check-Out
• Prevent two people from editing a document at the same time
• Form Standardization
• Where is the latest expense form? Did everyone get a copy? Eliminate that hassle.

What objections do your customers have to using Sharepoint?

• My customers like Files and Folders
• They are used to Files and Folders but they don’t really like them
• We tried it, no one used it
• Did you make them go to the website? Then you lost them there.
• They already have access to everything they need
• If they can find it and if they are in the office to gain access to it. With ever increasing mobility they need access to everything from any device they have at hand.
• They won’t go to the website
• Good, they don’t need to
• My files are stored in a SQL database?
• This is your fear not your customers. You need to know very little about SQL to be a Sharepoint admin.
• It’s too difficult to use
• I will show you how to make it simple
• My clients are too small
• No they aren’t. Even two people will find value in Sharepoint.

Repeat after me. Sharepoint is not just a website

In the rest of this series I will demonstrate how to access the data in Sharepoint without ever visiting the website.

—
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

I would like to point you to a nice blog by Ronnie Pot in the Netherlands that provides an excellent set of instructions for resolving this error. The error your server does not have a name server record in DNS is puzzling because if you look for the NS records you will find them. Ronnie ran into this problem and discovered a Microsoft KB article that will guide you to the solution. http://blog.ronnypot.nl/?p=879

—
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN