Occasionally a computer will come “disjoined” from the domain. The symptoms can be that the computer can’t login when connected to the network, message that the computer account has expired, the domain certificate is invalid, etc. These all stem from the same problem and that is that the secure channel between the computer and domain is hosed. (that’s a technical term. )

The classic way to fix this problem is to unjoin and rejoin the domain. Doing so is kind of a pain because it requires a couple of reboots and the user profile isn’t always reconnected. Ewe. Further if you had that computer in any groups or assigned specific permissions to it those are gone because now your computer has a new SID, so the AD doesn’t see it as the same machine anymore. You’ll have to recreate all of that stuff from the excellent documentation that you’ve been keeping. Uh, huh, your excellent documentation. Double Ewe.

Instead of doing that we can just reset the secure channel. There are a couple of ways do this:

1. In AD right click the computer and select Reset Account. Then re-join without un-joining the computer to the domain. Reboot required.
2. In an elevated command prompt type: dsmod computer “Computer DN” – reset. Then re-join without un-joining the computer to the domain. Reboot required.
3. In an elevated command prompt type: netdom reset MachineName /domain DomainName /User0 UserName /Password0 {Password | *} The account whose credentials you provided must be a member of the local administrators group. No rejoin. No reboot.
4. In an elevate command prompt type: nltest /Server:ServerName /SC_Reset:Domain\DomainController  No rejoin. No reboot.

Third Tier can help you with this problem.

If you’ve been opening tickets with us then you’re familiar with our staff. You know that they can fix problems in a jiffy that would take others hours to resolve. Well, we have a new program that will allow you to add a Third Tier staff member to your business.

Here’s what you get from us:

 We have two programs:

Quarterly Block Hours: $1,400

Ready to get started? Head over to www.thirdtier.net/my-third-tier and send me an email from there.

Here are a couple of the items that have made my Best Practices list so far:

Protecting from Accidental Deletion Now here is an under the radar item that is going to prove very useful. You can now protect OU’s, Containers, Groups and Objects from accidental deletion. It is as simple as a checkbox and for most new items in AD the box is checked by default. But for existing items it is not. You’ll need to go in and retro fit those with protection.

If you have a big complex AD then you can use PowerShell to fit the whole thing with this protection. But what is that Check box actually doing? It is changing the ACE permissions on the object. When that box is checked an ACE is added to Deny Everyone group Delete and Delete Subtree.

This isn’t the kind of thing that you’ll find yourself needing often (I hope) but now that you’ve read this, if you don’t go and set that check box you’ll kick yourself later.

Redirecting the Default Computer and User Containers New computers and users being left in the Computers and Users containers for long periods of time has long been one of my pet peeves. It distresses me that no one notice that this person or computer has not been subject to Group Policy, as the rest of the domain is. So when I found this little gem, it made my day.

The commands are: RedirCmp and RedirUsr to redirect anything that lands in the Computers container and the Users container respectively.

The command is entered in an elevated command prompt like this: redircmp “DN of OU for new computer objects”  So simple!  But you do need to be careful. Take a look at the Computers containers after you do this, there is no reference that it’s been redirected. Therefore, TODO make a note in the description of the container to remind you and future IT admins that this container is redirected and to where.

I have a few more items that have made my BP list but I’ll save those for another post. Keep reading!

Open Documents from Word and other MS Office Apps

This concludes the series on integrating Sharepoint into things you do already without visiting the website. Remember this:  Sharepoint is not a website. Sharepoint has a website

—
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

The symptoms of a corrupt TCPIP stack on a server are: after reboot it hangs at applying computer settings, users are unable to browse network shares, network browsing in general is slow, user can’t log in to the computer with message that the domain is unavailable or your computer account does not exist.

These problems can look like a lot of different things: DNS could be down, if you think the problem is the PC then you might try rejoining it to the domain or checking its DNS settings, you might think that AD service is not started, perhaps the switch failed, maybe we should reboot? If you’ve gotten to the maybe we should reboot option that’s when you know that you’re out of real ideas.

But these are all symptoms of a corrupt TCPIP stack on the server. Sure not every user will complain about problems at first, that is because much of the work we do on our computers is async and not dependent on our computer being able to interact with the server in real time. So while it might seem like the problem started with one computer and then spread through the network in reality the bomb went off but not everyone noticed at the same time.

I can’t tell you what causes a corrupt TCPIP stack. But I can show you how to reset it. Fortunately Microsoft has made this a very simple task. Just visit this kb article:

http://support.microsoft.com/kb/299357 and use the FixIt. After you have run the FixIt you will need to re-enter your TCPIP settings into the NIC properties. Be sure to read the manual process so you understand what the FIxIt is going to do for you.

The reset command is available in the IP context of the NetShell utility. Follow these steps to use the reset command to reset TCP/IP manually:

1. To open a command prompt, click Start and then click Run. Copy and paste (or type) the following command in the Open box and then press ENTER:

   cmd

2. At the command prompt, copy and paste (or type) the following command and then press ENTER:

   netsh int ip reset c:\resetlog.txt

   Note If you do not want to specify a directory path for the log file, use the following command:

   netsh int ip reset resetlog.txt

3. Reboot the computer.

When you run the reset command, it rewrites two registry keys that are used by TCP/IP. This has the same result as removing and reinstalling the protocol. The reset command rewrites the following two registry keys:

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\
SYSTEM\CurrentControlSet\Services\DHCP\Parameters\
				

To run the manual command successfully, you must specify a file name for the log, in which the actions that netsh takes will be recorded. When you run the manual command, TCP/IP is reset and the actions that were taken are recorded in the log file, known as resetlog.txt in this article.

The first example, c:\resetlog.txt, creates a path where the log will reside. The second example, resetlog.txt, creates the log file in the current directory. In either case, if the specified log file already exists, the new log will be appended to the end of the existing file.

Especially note that the Parameters registry key is replaced. This explains why you need to reenter your TCPIP values but it should also alert you to the fact that if you have any custom settings in there you will need to reapply those as well. In a recent case, the server had IPv6 disabled to support Peachtree and that entry in Parameters/DisabledComponents had to be recreated.

First, I launched the OnLive Desktop app:

OnLive Desktop Splash Screen

After the splash screen displayed, I was prompted to log in with my OnLive credentials. I had created these earlier in the week when I requested notification of the service availability.

Sign into OnLive account

Once I got signed in, I was prompted to agree with their Terms of Service and other policies, which I did.

OnLive Terms of Service

Then it attempted to connect. I wasn’t terribly surprised to see this “currently full” message, since I think the service went live in the last 24-48 hours and there are probably a lot of people like me trying to connect in and see how this thing works.

OnLive Service Full

After a brief wait (less than 5 minutes), the service cleared and I got a connection. I was presented with a full Windows 7 desktop, including desktop shortcuts to the Office applications, the Documents folder, and other resources.

OnLive Windows 7 Desktop

I looked in the Video Library of the documents folder and perused a couple of the online videos provided. The streaming quality of the video files was not bad, although there were a couple of points where I experienced network congestion and the video image artifacted (is that a word?) pretty badly. It cleared up within seconds, however.

OnLive Sample Video Files

I also checked to see what else was on the Start menu for the virtual desktop.

OnLive Windows 7 Start Menu

In one of the guides I read while waiting for the initial connection to be made, I saw a note that said you should upload one or more files to the desktop using the http://files.onlive.com address. That link requests your credentials for your OnLive account.

OnLive Files Web Sign-in

Once I signed in, I could see that there were no files in the document library. But by this point, the application had come back up.

OnLive Files Web View (empty)

I launched Microsoft Word, and it opened up pretty quickly on the screen.

OnLive Desktop Word 2010

I created a basic document and started to enter text using the on-screen keyboard. This was relatively clumsy to use, especially given my familiarity with the iPad on-screen keyboard, but it worked.

OnLive Desktop Keyboard Entry

I also tried the handwriting tool, and despite my absolutely horrible handwriting (I’m just not used to “writing” on the iPad screen), it was able to translate my scribble correctly.

OnLive Desktop Handwriting Tool

I went to save the file and made sure to save it in the Documents folder, Fortunately, that was the default.

OnLive Desktop File Save

After quitting Word, I went back to the document library on the virtual Windows machine, and there was my highly important file, showing exactly where it should have been.

OnLive Desktop Documents Folder

I also checked the web files area, and sure enough, the document was showing there as well. Synchronization time was pretty fast (of course, this was a really small file).

OnLive Web Files Documents Folder

For grins, I uploaded a larger file to see how long it would take to synchronize. I opened the web upload tool, and it allows you to select 5 files at a time for upload, if needed.

OnLive Files Upload Tool

I selected my one file, uploaded it, and checked that it showed in the web files Documents folder.

OnLive Files Document Uploaded

Almost immediately, the file also showed up in the OnLive Desktop documents folder. I saw the note in the taskbar that it was synchronizing the files, and it was less than a minute before I saw the “files synchronized” notice and was able to open the new file.

OnLive Desktop Document Synchronized

This PowerPoint document was created using PowerPoint 2011 for the Macintosh, but it had no problems opening in PowerPoint 2010 on the OnLive Desktop machine.

OnLive Desktop PowerPoint Document

I went through the slide desk in presentation mode, and periodically noticed some video artifacting during the display. I tried to grab a shot of the artifacting, but this was as close as I could get after multiple attempts, so I stopped trying.

OnLive Desktop PowerPoint Presentation Artifacting

After that, I quit PowerPoint and logged off the virtual machine. OnLive Desktop then told me my session was complete and that I would need to open the app again to sign into my account again.

OnLive Desktop Log Off

All in all, I was pretty impressed with the performance of the virtual machine during this quick look. My iPad is connected to an Apple AirPort Express at home, and we have a 20/10 FiOS connection at the house, so our bandwidth is really good here. In future testing, I’ll connect my iPad over my Verizon MiFi and see how the network performance is there. I’ll also do more testing and looking at the tablet tools that are provided to help you get more effective with the tablet interface of the virtual machine. Out of the box, and for no cost for 2.0GB of hosted storage, this is pretty much a win-win for someone who needs to edit or display Office documents on their iPad. I’ll have other posts as I find other meaningful uses of the application.

We’ve gotten used to Exchange hogging all the memory on the server, but in pre-2007 versions it was pretty good at sharing that memory with other applications. But no more. Exchange grabs that available memory and doesn’t let go. When the server comes under load it then becomes unresponsive to additional requests. Wait for a long time and the problem will go away. Reboot and the problem will go away. Restart the Exchange Store and the problem will go away. But what we really need to do is prevent it from happening in the first place.

The solution to this problem is to tune Exchange caching to your environment. TechNet has an article on how to calculate how much cache and therefore memory that Exchange will need. You can find that article here: http://technet.microsoft.com/en-us/library/ee832793.aspx. This is a great article in that it gives you the formula for determining the minimum and maximum memory allocation your environment will require and also point us to another TechNet article that shows us where to make this change. (Interestingly enough this later article is from Exchange 2000 days.) That second article is here: How to modify the Store Database maximum cache size in Exchange 2000 Server

If you do nothing then this is now much ram the Store service is taking on your server right now:

The amount of ram that you want to set aside for Exchange will vary based on the number of emails sent by the organization so you will want to perform the calculation outlined in the article above.

I’m a small business consultant with many clients running exchange on-premise. For my purposes I needed to find a standard that fit the majority of my clients. We can of course tweak said standard when the situation warrants, say the client is very small or very large. So I calculated a number that I felt would never be exceeded. My number is 10GB maximum and 5GB minimum. You should note that although it doesn’t say so in the article, the one written for the 2000 era, setting a minimum and a maximum was required in order to have the desired effect on freeing up the ram. You should also know that the value you enter into msExchESEParamCacheSizeMax and Min must be an increment of 32k. Thus 10GB is 326780 an 5GB is 163840. (Many thanks for Michael B Smith for assisting with the calculation and pointing out the importance of 32k)

Where is this parameter? It’s in Active Directory. You’ll need to enable Advanced Features viewing. Browse to the Information Store object and modify the attributes. Yes you will need to restart the Exchange services for this change to take effect.

Many thanks also to our fabulous staff at Third Tier for getting to the bottom of this issue.

—
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

Managing shared Contacts is one of the biggest pain points that every clients has. It’s probably the first painpoint they encounter when they hire their first employee. Sharepoint will allow your clients to provide access to all corporate contacts by permission. Allow the sharing of contacts between departments and people (or not your choice). It will allow them to take the contacts with them on the road while offline. It will allow them to access their contacts anytime from any device. It will keep them updated and in sync. And most importantly, they won’t get lost when an employee leaves or accidentally deletes them.

Here’s how we do it:

Connect a Sharepoint contact list to Outlook

Make a new Sharepoint contact from Outlook

Make a new contact in Sharepoint and view it in Outlook

Use Contacts when Offline

—
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN

Here’s how to do it:

Connect a Sharepoint Calendar to Outlook

Now that we have our calendar available to us, let’s see how to use it.

Make a new Appointment in the Sharepoint calendar from Outlook

—
So who wrote this blog and what do they do for a living anyway?
We’re Third Tier. We provide advanced Third Tier support for IT Professionals.
Get Support Blog Twitter Facebook LinkedIN