Description:
You notice that there are a couple of event ids 9325 being logged at your exchange server. All function seems to run normally. The error message shown something like “OALGen will skip user entry person name in address list '\Global Address List' because the SMTP address is invalid”.
Resolution:
Using Adsiedit.msc console, go to the SMTP proxy address attribute and proxyaddresses attribute. Check the value and correct or remove any invalid SMTP address. You can refer to the Microsoft KB 926206 (http://support.microsoft.com/?id=926206) for detail info for how to resolve these errors.
Monday, May 18, 2009
Event ID 9321 logged when running Exchange Offline Address Book (OAB) generator
Description:
You notice that there are a couple of event ids 9321 being logged at your exchange server. All function seems to run normally. The error message shown something likes “OALGen could not generate full details for entry person name in address list '\Global Address List' because the total size of the details information is greater than 64 kilobytes.”
Resolution:
The most common cause for this is a large number of certificates published for the user, causing their details to be over the 64kb limitation for the details in the OAB. There is no way to increase this limit, so the solution is to remove any unneeded certificates from the users so that we get the details under 64kb.
To clean out the certificates:
- In ADUC, make sure View, Advanced Features is checked.
- Go to the properties of the user.
- Published Certificates tab.
- Remove any unneeded/expire certificates.
You notice that there are a couple of event ids 9321 being logged at your exchange server. All function seems to run normally. The error message shown something likes “OALGen could not generate full details for entry person name in address list '\Global Address List' because the total size of the details information is greater than 64 kilobytes.”
Resolution:
The most common cause for this is a large number of certificates published for the user, causing their details to be over the 64kb limitation for the details in the OAB. There is no way to increase this limit, so the solution is to remove any unneeded certificates from the users so that we get the details under 64kb.
To clean out the certificates:
- In ADUC, make sure View, Advanced Features is checked.
- Go to the properties of the user.
- Published Certificates tab.
- Remove any unneeded/expire certificates.
Exchange Server - Cannot Generate Offline Address Book (OAB) error 8004010e
Description:
Exchange server cannot generate offline address book. Newly created email address doesn’t appear at the Global Address List. At the event viewer you see error logged with event id 9338, 9330, and 9126. You’ve try changing the server generating OAB to other, but the same error occurs.
Resolution:
The most common reason for failure to generate the OAB with error 8004010e is a mangled attribute in Active Directory.
Use Nspitool.exe to identify which user has the mangled attribute.
1. Save and unzip the attachment to your Exchange server.
2. Click Start, click Run, type in cmd and click Ok.
3. Navigate the directory which you save the nspitool.exe in and run the following command: nspitool -WalkAddressList >c:\nspioutput.txt
You should see something like “QueryRows failed 0x8004010e on entry personname, WalkAddressList ended with 0x8004010e” on the output text.
Next step is to use adsiedit.msc to connect to GC partition to check the attribute value. Go to the user properties and check the manager attribute value. Is it the same with the Active Directory User and Computer (ADUC) version? If not, change the value at ADUC to something else, wait for the replication to occur, and change it back to the correct value.
The attribute value shown through ADUC and through adsiedit.msc should have the same result.
Run the nspitool.exe again and do the necessary fix until there’s no “queryrows” error anymore.
Exchange server cannot generate offline address book. Newly created email address doesn’t appear at the Global Address List. At the event viewer you see error logged with event id 9338, 9330, and 9126. You’ve try changing the server generating OAB to other, but the same error occurs.
Resolution:
The most common reason for failure to generate the OAB with error 8004010e is a mangled attribute in Active Directory.
Use Nspitool.exe to identify which user has the mangled attribute.
1. Save and unzip the attachment to your Exchange server.
2. Click Start, click Run, type in cmd and click Ok.
3. Navigate the directory which you save the nspitool.exe in and run the following command: nspitool -WalkAddressList
You should see something like “QueryRows failed 0x8004010e on entry personname, WalkAddressList ended with 0x8004010e” on the output text.
Next step is to use adsiedit.msc to connect to GC partition to check the attribute value. Go to the user properties and check the manager attribute value. Is it the same with the Active Directory User and Computer (ADUC) version? If not, change the value at ADUC to something else, wait for the replication to occur, and change it back to the correct value.
The attribute value shown through ADUC and through adsiedit.msc should have the same result.
Run the nspitool.exe again and do the necessary fix until there’s no “queryrows” error anymore.
Tuesday, May 12, 2009
Checklists when promoting a Windows Domain Controller
Here are some of the things that you must configure when promoting a domain controller at a forest with multi sites and multi domains topology.
If this is a new Domain Controller at new site:
a. At Active Directory Sites and Services, create a new site.
b. Create a new subnet and link it to the newly created site.
c. Configure the IP site link for Active Directory replication.
· Promote the Windows Server to become Domain Controller.
· Configure the Domain Controller to become a DNS server – Active Directory Integrated (Domaindnszones).
· Configure the Domain Controller to become a Global Catalog server.
· Configure DNS Forwarders.
· Configure the Domain Controller to be the Authoritative Name Servers in the domain.
· Enable Strict Replication Consistency. (more)
· Disable Windows Scalable Networking Pack Components. (more)
· Change Windows Time Service MaxNegPhaseCorrection and MaxPosPhaseCorrection value to 48 hours. (more)
How to disable Windows Scalable Networking Pack Components
Description
Scalable Networking Pack (SNP) is enabled by default as part of installing Windows Server 2003 Service Pack 2. SNP can be used, under specific circumstances, to improve network performance. Most environments, however, do not have SNP capable network adapters/drivers. This can result in unexpected network problem which is why it is recommended to disable SNP unless a server can benefit from it. For Domain Controller, it is recommended to disable this feature.
Resolution
To disable SNP, modify certain this registry values:
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Value: EnableTCPChimney
Value: EnableRSS
Value: EnableTCPA
Data: 0 or 1
Each component can be individually enabled or disabled. Set the value to "0" to disable it.
Scalable Networking Pack (SNP) is enabled by default as part of installing Windows Server 2003 Service Pack 2. SNP can be used, under specific circumstances, to improve network performance. Most environments, however, do not have SNP capable network adapters/drivers. This can result in unexpected network problem which is why it is recommended to disable SNP unless a server can benefit from it. For Domain Controller, it is recommended to disable this feature.
Resolution
To disable SNP, modify certain this registry values:
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Value: EnableTCPChimney
Value: EnableRSS
Value: EnableTCPA
Data: 0 or 1
Each component can be individually enabled or disabled. Set the value to "0" to disable it.
Windows Time Service time correction setting
Description
The Windows Time service by default in Windows 2000 and 2003 allows for a positive or negative time correction of any amount for domain controllers. This can cause serious problems in a forest should a dramatic time shift occur. This can even occur when synchronizing with other authoritative sources as hardware problems, software problems or human error can cause them to provide the wrong time. Some of the problems that can occur from a dramatic time change are Windows Server 2003 based domain controllers may be quarantined, deleted objects may be prematurely purged before end-to-end replication of the deletion is fully replicated (causing lingering objects), user and computer passwords may expire unexpectedly, and trust passwords becoming out of sync.
Resolution
Modify the default value on the following registry.
The registry key(s) are different depending upon the operating system version.
Windows 2003/2008
Path: HKLM\System\CurrentControlSet\Services\W32Time\Config
Value: MaxNegPhaseCorrection
Default data: 0xFFFFFFFF (4,294,967,295)
(Note: there is an accompanying MaxPosPhaseCorrection value to control positive time changes.)
Windows 2000
Path: HKLM\System\CurrentControlSet\Services\W32Time\Parameters
Value: MaxAllowedClockErrInSecs
Default data: 0xFFFFFFFF (4,294,967,295)
(Note: Windows 2000 has a single value to control both positive and negative time changes.)
Change them to a positive/negative value of 48 hours (0x2A300 or 172,800 seconds).
The Windows Time service by default in Windows 2000 and 2003 allows for a positive or negative time correction of any amount for domain controllers. This can cause serious problems in a forest should a dramatic time shift occur. This can even occur when synchronizing with other authoritative sources as hardware problems, software problems or human error can cause them to provide the wrong time. Some of the problems that can occur from a dramatic time change are Windows Server 2003 based domain controllers may be quarantined, deleted objects may be prematurely purged before end-to-end replication of the deletion is fully replicated (causing lingering objects), user and computer passwords may expire unexpectedly, and trust passwords becoming out of sync.
Resolution
Modify the default value on the following registry.
The registry key(s) are different depending upon the operating system version.
Windows 2003/2008
Path: HKLM\System\CurrentControlSet\Services\W32Time\Config
Value: MaxNegPhaseCorrection
Default data: 0xFFFFFFFF (4,294,967,295)
(Note: there is an accompanying MaxPosPhaseCorrection value to control positive time changes.)
Windows 2000
Path: HKLM\System\CurrentControlSet\Services\W32Time\Parameters
Value: MaxAllowedClockErrInSecs
Default data: 0xFFFFFFFF (4,294,967,295)
(Note: Windows 2000 has a single value to control both positive and negative time changes.)
Change them to a positive/negative value of 48 hours (0x2A300 or 172,800 seconds).
Monday, May 4, 2009
Could not start DHCP Client Services
Description:
One day you discover that DHCP client services on some of your server cannot be started. It gives you “access is denied” error message. The DHCP client services already use network service account to logon. You suspect that one of the recent windows patch that causes the issue.
Resolution:
The Network Service requires permissions to open the‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters’ registry keys for the DHCP Client service to start. Some updates can remove the Network Service permissions to these registry keys. Please check and re-add them if necessary.
1) Open Regedit.
2) Navigate to ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp' and click on Parameters.
3) Click on Edit menu then go to Permissions.
4) In the 'Permissions for Parameters' window, click on Add.
5) In the 'Select Users, Computers and Groups' window, type in "Network Service" (without the quotes) and click 'Check Names'. You may need to change the Location to "System".
6) Click OK.
7) In the 'Permissions for Parameters' window, highlight the Network Service group and give it Full Control and Read permission by selecting the check boxes.
8) Click OK
Try starting the DHCP client service again.
One day you discover that DHCP client services on some of your server cannot be started. It gives you “access is denied” error message. The DHCP client services already use network service account to logon. You suspect that one of the recent windows patch that causes the issue.
Resolution:
The Network Service requires permissions to open the‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters’ registry keys for the DHCP Client service to start. Some updates can remove the Network Service permissions to these registry keys. Please check and re-add them if necessary.
1) Open Regedit.
2) Navigate to ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp' and click on Parameters.
3) Click on Edit menu then go to Permissions.
4) In the 'Permissions for Parameters' window, click on Add.
5) In the 'Select Users, Computers and Groups' window, type in "Network Service" (without the quotes) and click 'Check Names'. You may need to change the Location to "System".
6) Click OK.
7) In the 'Permissions for Parameters' window, highlight the Network Service group and give it Full Control and Read permission by selecting the check boxes.
8) Click OK
Try starting the DHCP client service again.
Cannot Upgrade from Windows 2003 Service Pack 1 to Windows 2003 Service Pack 2
Description:
You are having an issue when trying to upgrade your Windows 2003 Service Pack 1 server to Windows 2003 Service Pack 2. The upgrade process runs for a while and stops in the middle because of WMI error. You cannot do the upgrade from Add/Remove program too.
Resolution:
The issue cause by some corrupt files inside %windir%\system32\wbem\repository. Files in this folder is the database of WMI, if the files in this folder are corrupt, the WMI service will not work correctly. Delete the files in the folder %windir%\system32\wbem\repository. After restart the WMI service again, the files in this folder will be rebuilt again.
Below is the script to do it automatically:
################
sc config winmgmt start= disabled
net stop winmgmt /y
%systemdrive%
cd %windir%\system32\wbem
if exist repository.old rmdir /s/q repository.old
rename repository repository.old
for /f %%s in ('dir /b /s %windir%\system32\wbem\*.dll') do regsvr32 /s %%s
regsvr32 /s %windir%\system32\tscfgwmi.dll
wmiprvse /regserver
winmgmt /regserver
sc config winmgmt start= auto
net start winmgmt
for /f %%s in ('dir /b *.mof') do mofcomp %%s
for /f %%s in ('dir /b *.mfl') do mofcomp %%s
You are having an issue when trying to upgrade your Windows 2003 Service Pack 1 server to Windows 2003 Service Pack 2. The upgrade process runs for a while and stops in the middle because of WMI error. You cannot do the upgrade from Add/Remove program too.
Resolution:
The issue cause by some corrupt files inside %windir%\system32\wbem\repository. Files in this folder is the database of WMI, if the files in this folder are corrupt, the WMI service will not work correctly. Delete the files in the folder %windir%\system32\wbem\repository. After restart the WMI service again, the files in this folder will be rebuilt again.
Below is the script to do it automatically:
################
sc config winmgmt start= disabled
net stop winmgmt /y
%systemdrive%
cd %windir%\system32\wbem
if exist repository.old rmdir /s/q repository.old
rename repository repository.old
for /f %%s in ('dir /b /s %windir%\system32\wbem\*.dll') do regsvr32 /s %%s
regsvr32 /s %windir%\system32\tscfgwmi.dll
wmiprvse /regserver
winmgmt /regserver
sc config winmgmt start= auto
net start winmgmt
for /f %%s in ('dir /b *.mof') do mofcomp %%s
for /f %%s in ('dir /b *.mfl') do mofcomp %%s
Invalid FSMO Role Owner for Application Partition
Description:
When running the ADRAP program you found the following warning/error.
The following application partition contains an invalid FSMO role owner:
Partition: cn=infrastructure,dc=forestdnszones,dc=corp,dc=com
FSMO:CN=NTDS Settings\0ADEL:97d…,CN=Server01\0ADEL:67…,CN=Servers,CN=SITEA,CN=Sites,CN=Configuration,DC=corp,DC=com
Resolution:
Use adsiedit.msc and reset the fSMORoleOwner attribute on the infrastructure master of your root domain. Use the value from Distinguished Name (DN) attribute of the corresponding application partition as the new value. You may need to use an account which has Enterprise Admin permission.
When running the ADRAP program you found the following warning/error.
The following application partition contains an invalid FSMO role owner:
Partition: cn=infrastructure,dc=forestdnszones,dc=corp,dc=com
FSMO:CN=NTDS Settings\0ADEL:97d…,CN=Server01\0ADEL:67…,CN=Servers,CN=SITEA,CN=Sites,CN=Configuration,DC=corp,DC=com
Resolution:
Use adsiedit.msc and reset the fSMORoleOwner attribute on the infrastructure master of your root domain. Use the value from Distinguished Name (DN) attribute of the corresponding application partition as the new value. You may need to use an account which has Enterprise Admin permission.
Subscribe to:
Posts (Atom)