Description:
All about Information Technology infrastructure and system. Helpdesk & support issue, deployment guide, and daily activity in managing an information technology operation.
Search This Blog
Tuesday, January 2, 2024
Another Error code 0x80070643 when installing Microsoft Defender for Identity sensor
Monday, September 25, 2023
Cannot Install PowerShell Module - Unable to find module repositories
Description:
You try to Install a new PowerShell Module. But you got an error saying "No match was found for the specified search criteria and module name ' ' Try Get-PSRepository to see all available registered module repositories". However when you try to run Get-PSRepository command you got "Unable to find module repositories error".
You have try the following, but still have the problem:
- Make sure to Run as Administrator,
- Make sure to use TLS 1.2
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
- Unregister and Register
- Unregister-PSRepository -Name PSGallery
- Register-PSRepository -Default
Modifying AdminSDHolder Permission Delegation
department
, use dsacls
:Friday, August 25, 2023
Windows 2019 NPS Server Firewall Exclusion
Description:
You have completed the NPS configuration using Windows Server 2019. You have put the correct secrets at the VPN servers. You also have make sure there's no Network Firewall between the VPN server and NPS Server.
However client machine cannot connect to the VPN. And you cannot see the traffic reaching the NPS Server. There's nothing in the NPS Server event viewer.
Resolution:
At the NPS server, open command prompt with elevated permission and type:
sc sidtype IAS unrestricted
Restart the server after that.
Windows Defender Firewall on the NPS should be automatically configured with exceptions, during the installation of NPS, to allow this RADIUS traffic to be sent and received.
With Server 2019 this firewall exception requires a modification to the service account security identifier to effectively detect and allow RADIUS traffic. If this security identifier change is not executed, the firewall will drop RADIUS traffic. The above command changes the IAS (RADIUS) service to use a unique SID instead of sharing with other NETWORK SERVICE services.
Monday, July 24, 2023
Failed F5 Big-IQ connection to Azure MFA
You have setup Azure MFA with NPS Extension in your Organization. You have make sure the firewall from and to your NPS server is configure properly. You have also make sure the internet connection from NPS Server to Azure MFA is working properly
Now, you want to test the the connection from your F5 Big-IQ to the NPS Server. However you got an error saying "Failed while connecting to radius server, server responded with: Access-Challenge".
Go to NPS Server, open the Registry Editor.
- Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AzureMfa.
- Create the following String/Value pair:
- Name: OVERRIDE_NUMBER_MATCHING_WITH_OTP
- Value = FALSE
Saturday, March 11, 2023
Cannot Delete DNS Zone - Access was Denied
How to Fix "Trust Relationship Failed" error without Rejoin Domain
Description:
One of your users suddenly sees the error message "Trust Relationship Between This Workstation And The Primary Domain Failed" when trying to logon to their machine.
You have verify the Computer Account is exist on Active Directory. DNS settings are properly set and there's no problem with port or networking.
You wish to remediate the issue without having to disjoin and rejoin the computer to the domain.
Resolution:
On the problematic machine, logon using local admin credential. Open PowerShell and run as Administrator.
Type the following:
Reset-ComputerMachinePassword -Server DomainController -Credential
DomainAdmin
If the command completed successfully, logoff and try to logon again.
Sunday, March 5, 2023
Migrate from Windows Hello to Windows Hello For Business (WHFB)
You have deployed Windows Hello in the past to several machines in the organizations. Recently you got direction from Management to deploy Windows Hello For Business (WHFB) for your organization.
You have enable the Hybrid Cloud Kerberos trust and the configured required group policy. However, on the test machine, no WHFB got the prompt for provision. You have try to restart and make sure the WFHB group policy apply correctly.
Go to "Computer Configuration\Administrative Templates\System\Logon\Turn on convenience PIN sign-in". Make sure it is Disabled.
Multiple Prompt when creating Azure AD Kerberos Server object
Description:
You want to Deploy Windows Hello For Business with Hybrid Cloud Kerberos type in your environment.
You have met all the require prerequisites. However when trying to create Azure AD Kerberos Server object using below PowerShell command you encounter multiple prompt asking for Azure AD credential.
# Kerberos Server object will be created in this Active Directory domain.
$domain = $env:USERDNSDOMAIN
# Enter an Azure Active Directory global administrator username and password.
$cloudCred = Get-Credential -Message 'An Active Directory user who is a member of the Global Administrators group for Azure AD.'
# Enter a domain administrator username and password.
$domainCred = Get-Credential -Message 'An Active Directory user who is a member of the Domain Admins group.'
# Create the new Azure AD Kerberos Server object in Active Directory
# and then publish it to Azure Active Directory.
Set-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCred -DomainCredential $domainCred
Resolution:
Make sure the Azure AD Global Administrator account that you are using during configuration are not included in any of Azure AD Conditional Access rules. You may also need to close the previous PowerShell session and try again.
Saturday, October 22, 2022
ADRMS and SharePoint IRM Integration Error - 0x80020009
Description:
You have configure ADRMS properly in your environment. Now you want to make SharePoint to use ADRMS. At the SharePoint Central Admin, you specify the location of the RMS Server.
However when you try to open a document protected with RMS, there's a pop-up error saying couldn't find the document. At the SharePoint event viewer you saw the following error:
Information Rights Management (IRM): There was a problem while ensure IRM client. Status value: -1, error value: 0x80020009.
[Information Rights Management (IRM): There was a problem while creating the generic issuance license template.
All issuance licenses for protected documents are constructed from a generic, base issuance license template.
Additional Data
Error value: 0x800704DC
Resolution:
Please go to the SharePoint Central Admin and make sure you already select or type in the correct RMS cluster server address. Use HTTPS instead of HTTP when typing the RMS cluster address.
Friday, June 3, 2022
Cannot Publish or Missing Certificates Template
Description:
You created a certificate template in your Windows Enterprise CA. However when you want to publish it, you cannot saw the templates inside the "Enable Certificate Templates" wizard. All other Certification Authority function works normally and you've used the account which has proper permission.
Resolution:
Try to use the following command:
Certutil -setcatemplates +templatename
Note: The plus (+) sign is mandatory. Otherwise it will replace all of the other published template.
Error while creating Windows 2016 Cluster at "Find a suitable Domain Controller"
You want to create Windows 2016 cluster on Windows 2012 R2 Domain. You run the Wizard, however encountered error and the cluster cannot be created.
"Check whether the computer object "clustername" for node "hostnameFQDN" exists in the domain. More data is available".
"Failed to find suitable DC. Error 234"
"Searching for object "clustername" on first choice DC failed. Error 234"
"Couldn't resolve RPC binding to cluster, Status = 1753"
Resolution:
First, verified the DNS record in your DNS Server. Especially the record for all of your Domain Controllers. Make sure the Active Directory required Zones has the correct NS records, CNAME records, A Records, and also SRV DNS records. Remove the stale records for old or unknown broken Domain Controllers.
Second, check the Application partition (DomainDnsZone and ForestDnsZone) in your Active Directory. Use ADSIedit to connect to the application partition and try to browse the content. If you encountered error, you may need to delete the application partition using NTDSUtil.
Saturday, April 9, 2022
Error Event ID 345 on ADFS Server
Description:
You recently just upgraded your ADFS to newer OS version. After a while you notice Event ID 345 on one of the secondary ADFS server. It said "There was a communication error during AD FS configuration database synchronization. Synchronization of the data from primary federation server to a secondary federation server did not occur". You are sure that all of the network port requirement are met.
The previous ADFS upgrade process is somehow causing the farm behavior level (FBL) on the secondary server doesn't match with the FBL on the primary server.
We need to remove the ADFS role and WID database feature on the problematic secondary ADFS server. After that try to re-install the ADFS role and finish the post configuration.
The secondary server will then use the correct version of ADFS configuration database and synchronization will works as expected.
Thursday, February 3, 2022
DNS Event 4015 on Windows 2012 R2 Domain Controller
Description:
At DNS Server which also a Domain Controller, you notice the Event Viewer is full with the following error.
The DNS server has encountered a critical error from the Active Directory.
Check that the Active Directory is functioning properly.
The extended error debug information (which may be empty) is 0000051B: AtrErr: DSID-031508EF, #1:0: 0000051B: DSID-031508EF, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 20119 (nTSecurityDescriptor).
Resolution:
Enabled AD diagnostic logging, Enabled Directory access key and set the value to 5.
Look for Event ID 1175 at event viewer and noticed the Object Distinguished Name. You may need to change the ownership of that AD Object to SYSTEM and restarted the DNS service on the domain controller.
ADFS Error - MSIS8022: Unable to find the specified user account.
Description:
You saw several error at ADFS server event viewer. The error was saying "MSIS8022: Unable to find the specified user account."
Resolution:
First, always double check on the user name, make sure they are exist inside Active Directory. After that check for Extranet Lockout feature in ADFS.
When the Extranet Lockout is enabled, ADFS needs to query the badPwdCount attribute of the user, so it tries to look for it in AD before even trying to authenticate. If the user does not exist, you get the error message you see.
WAP and ADFS trust certificate lifetime
Description:
The proxy trust certificate between WAP and ADFS is a rolling certificate which valid for 2 weeks and periodically updated. This is stored in an internal, protected store so we can't see it in any of the usual certificate stores.
What we see in the local machine store is the initial temporary certificate thumbprint used while the proxy trust is first being established. This explains why the WAP event log error included a strange, unknown certificate thumbprint.
If we leave our WAP server offline for more than 2 weeks, the proxy trust certificate will expire and we’ll need to re-initialise the proxy trust (Install-WebApplicationProxy cmdlet).
This can also happen when we move the VM’s configuration to another storage.
Resolution:
We can solve this issue by setting the following registry key to 1 on the WAP server and re-running post-install config from the Remote Management console:
HKLM\Software\Microsoft\ADFS
ProxyConfigurationStatus
- 1 (not configured)
- 2 (Web Application Proxy is configured)
Tuesday, January 25, 2022
Invalidate RID Pool Script
To invalidate the current RID pool in Active Directory
Open an elevated Windows PowerShell session, run the following command and press ENTER:
$DomainSid = $Domain.objectSid
$RootDSE = New-Object System.DirectoryServices.DirectoryEntry("LDAP://RootDSE")
$RootDSE.UsePropertyCache = $false
$RootDSE.Put("invalidateRidPool", $DomainSid.Value)
$RootDSE.SetInfo()
Monday, January 10, 2022
Cannot Install .Net Framework on Windows Server
Description:
You try to install .Net Framework 4.7.x to a Windows Server.
However the installation seems to be hang or stuck forever.
Resolution:
Go to "services.msc" and check for Windows Installer services. Make sure the services is running. If not, perform a manual start and wait for a while. The installation should continue and completed within a couple of minutes.
Log Files Deleted or Missing after Running Performance Monitor on Windows Server
Description:
You run a performance monitor on Windows Server. You use one of the existing template to collect the data. You leave it running for 5 minutes (default). After it completes, no report being generated and the log files seems to be gone. However if you run it for only 1 minutes, the report can be generated normally.
Resolution:
Go to Data Manager section in Data Collector. Uncheck at the Maximum root path size option.
Try to run the data collector again.
Clear Cached Kerberos Tickets
To clear the cached Kerberos tickets:
Open Command Prompt with Administrative permission
Type:
Klist purge
klist purge –li 0x3e7