Unable to RDP on to Jump Server

Microsoft has recommends following solutions:

http://support.microsoft.com/kb/951037/en-us

Solution :
The following actions solved the problem in our case.
1) Configure TCP Chimney Offload in the operating system
• To disable TCP Chimney Offload, follow these steps:
a. Use administrative credentials to open a command prompt.
b. At the command prompt, type the following command, and then press ENTER:
netsh int tcp set global chimney=disabled
2) Configure TCP Chimney Offload on the network adapter
• To determine the current status of TCP Chimney Offload, follow these steps:
a. Use administrative credentials to open a command prompt.
b. At the command prompt, type the following command, and then press ENTER:
netsh int tcp show global
• To determine the current status of TCP Chimney Offload, follow these steps:
a. Use administrative credentials to open a command prompt.
b. At the command prompt, type the following command, and then press ENTER:
netsh int tcp show global
3) Disable RSS in Windows Server 2008 R2
• To disable RSS, follow these steps:
1. Use administrative credentials to open a command prompt.
2. At the command prompt, type the following command, and then press ENTER:
netsh int tcp set global rss=disabled
• To determine the current status of RSS, follow these steps:
a. Use administrative credentials to open a command prompt.
b. At the command prompt, type the following command, and then press ENTER:
netsh int tcp show global

4) Disable NetDMA in Windows Server 2008 R2
• To disable NetDMA, follow these steps:
1. Click Start, click Run, type regedit, and then click OK.
2. Locate the following registry subkey, and then click it:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
3. Double-click the EnableTCPA registry entry.
Note If this registry entry does not exist, right-click Parameters, point to New, click DWORD Value, type EnableTCPA, and then press ENTER.
4. To enable NetDMA, type 1 in the Value data box, and then click OK.
5. To disable NetDMA, type 0 in the Value data box, and then click OK.
6. If the EnableTCPA registry entry does not exist, enable the NetDMA functionality.

Handling Windows Server 2008 R2 Cluster Log

Failover Cluster Event Tracing for Windows: The Failover Clustering feature in Windows Server 2008 R2 comes with a diagnostic debug logging which captures detailed information about the cluster operations. The configuration settings for this can be found in thefollowing location \Server Manager\Diagnostics\Performance\Data Collector Sets\Event Trace Sessions\Eventlog-Microsoft-Windows-FailoverClustering-Diagnostic. The cluster event tracing is enabled by default when you enable the cluster feature and start the cluster service

The Failover clustering diagnostic log files are stored in %WinDir%\System32\winevt\logs\and are in an *.etl extension. There are three *.etl log files, each time a node is rebooted a new ETL file is generated and logging is conducted on the new log file until the server is rebooted again

Below are some useful settings that might come in handy when troubleshooting cluster failures:

- Generate a Windows Server Cluster Log
- Cluster Log default size
- Cluster Log default logging level

Before we begin, I would suggest you run the command “cluster /prop“, this will list theproperties of the cluster attributes and their current values

1. Generate a Windows Server Cluster Log

- Log onto one of the cluster nodes -> Open the command prompt As Administrator -> Enter the following command: “cluster log /g“. A cluster.log file will be generated and stored in%windir%\Cluster\Reports directory on all cluster nodes

- Another way to generate the cluster log is by using Powershell only on a Windows Server 2008 R2. Click on Start\Administrative Tools\Windows Powershell Modules

- Wait for the system to load all the Powershell commands

- Command1: “Get-ClusterLog“:- This command creates the cluster log file on each cluster nodes in the cluster reports folder

- Command2: “Get-ClusterLog -Destination“:- This command creates the cluster log files for each cluster nodes and copies all logs to a central location or destination specified in the command. This is useful when you want to view all cluster logs from different nodes from a single place

2. Cluster Log default size

The default failover cluster event tracing log size is 100 MB and the logs are handled in acircular logging scheme. In the event that the cluster.log file does not have the needed information due to the older entries been overwritten, you would need to increase the size of the cluster log (*.etl) to retain more data.

- From windows command prompt: cluster log /Size:X

- From PowerShell: Set-Cluster -Size X

3. Cluster default logging level

The default cluster logging level is 3. Anything higher than 3 will give more information but may have significant impact on the cluster. The table below gives complete overview of the different logging levels and what information can be derived from it. Note: Setting the level to 0 (zero) would disable logging.

Level	Error	Warning	Information	Verbose	Debug
1	X
2	X	X
3 (Default)	X	X	X
4	X	X	X	X
5	X	X	X	X	X

- From windows command prompt: Cluster Log /Level:X

- From PowerShell: Set-ClusterLog -Level X

WSUS Synchronize issue with proxy server

When you configure WSUS, after giving proxy information server will check for proxy connectivity. Due to WSUS  bug we will get below error.

Solution:

When we will install WSUS  in windows server 2008sp1 from server manager it will install WSUS default version sp1. It known  issue in WSUS this version, to resolve this issue we have install WSUS-KB2734608-x32/x64 fix-package from Microsoft website.

Once this fix is installed installation will complete smooth.

McAfee Agent does not remove through Add\Remove Programs

The following message displays when select Remove for the McAfee Agent through Add \ Remove Programs on client computers:

” McAfee Agent cannot be removed while it is in managed mode ”

Step to resolve :

Step 1 : Stop the McAfee service's from the client.

Step 2 : Run " frminst.exe /remove=agent" command

Now go the McAfee Agent Service can now be removed through Add \ Remove Programs.

Troubleshooting VMWare HA -Cannot complete the HA Configuration - See more at: http://www.vmwarearena.com/2012/07/troubleshooting-vmware-ha.html#sthash.SL5yyVrQ.dpuf

What the basic troubleshooting steps in case of HA agent install failed on hosts in HA cluster?

If you are facing any issues related to hosts in  the HA cluster , I would recommend to follow the  below basic 10 troubleshooting steps. Most of the time, This will resolve the issues.


Error message will be similar to the below one

1. Check your environment, if any temporary network problem exists

2. Check the DNS is configured properly

3. Check the vmware HA agent status in ESX host by using below commands

  service vmware-aam status

4. Check the  ESX networks are properly configured  and named exactly as other hosts in the cluster.              otherwise, you will get the below errors while installing or reconfiguring HA agent.

5. Check HA related ports are open in firewall to allow for the communication
    
     Incoming port: TCP/UDP 8042-8045
     Outgoing port: TCP/UDP 2050-2250

6. Try to restart /stop/start the vmware HA agent on the affected host using the below commands.
In addition, u can also try to restart vpxa and management agent in the Host.

service vmware-aam restart

service vmware-aam stop

service vmware-aam start

7. Right Click the affected host and click on "Reconfigure for VMWare HA" to re-install the HA agent that particular host.

8. Remove the affected host from the cluster. Removing ESX host from the cluster will not be allowed untill that host is put into maintenance mode.

9.Alternative solution for 8 step is, Goto cluster settings and uncheck the vmware HA to turnoff the HA in that cluster and re-enable the vmware HA to get the agent installed from the scratch.

10. For further troubleshooting , review the HA logs under /Var/log/vmware/aam directory. - See more at: http://www.vmwarearena.com/2012/07/troubleshooting-vmware-ha.html#sthash.SL5yyVrQ.dpuf

For any VMware troubleshooting use to visit http://www.vmwarearena.com. nice !

McAfee ePO Manual Agent Installation

25MAY/102

From time to time, across several infrastructures, I often get people report they cannot push anti-virus agents to workstations from McAfee's ePolicy Orchestrator. This can be time consuming and frustrating, and as you'll know ePO isn't the most user friendly or affective application. You can however manually install the McAfee Agent and then force it to comply with your anti-virus policies or client tasks. To do this, perform the following actions:

1. On the affected machine browse to the following location: \\EPOSERVERNAME\C$\Program Files\McAfee\ePolicy Orchestrator\DB\Software\Current\EPOAGENT3000\Install\0409\

2. Double click the FramePkg.exe file and let the agent install. Please note, you will need administrative rights over the workstation to perform this.

3. Open a command prompt window and type the following: cd "C:\Program Files\McAfee\Common Framework"

4. Once in the aforementioned directory, type the following at the command prompt and press return: CmdAgent.exe /s

5. You will now be presented with the McAfee Agent console, click "Collect and Send Props". This prompts the agent to advertise itself to the ePO server and enforce any policies or client tasks that maybe set, which in my case is usually the installation of the ant-virus product itself.

I hope this eases your ePO frustrations, it certainly did mine.

Active Directory Replication issue

This blog is in regards to the Active Directory replication concerns that we are having.

In a single domain we cannot have Active Directory Replication working only within a site and not between sites.

A domain controller holds replica’s of the domain, schema, configuration and application partition. The domain partition will be replicated between all the domain controller’s of a domain.

However schema and configuration partition are forest wide and will be replicated between all the domain controllers within a forest.

If we disable inbound/outbound replication for a domain controller then the domain controller will not inbound/outbound replicate with any other domain controller.

We can take the above steps in situations where in some Active Directory objects have been deleted accidently and you do not want those changes to be replicated throughout the domain.

Again to re-iterate the point we cannot have Active Directory replication working just within a site and not between sites.

Please let me know if you have any other concerns, I will be glad to assist you.