Category: Servers

Carbonite Backup External Drive Errors

While performing a network evaluation for a perspective client, it came time to gather specification information from the server. Immediately noticing that Carbonite had not successfully completed a Mirror Image backup and needed to be updated, I headed to the Carbonite InfoCenter to find out what could be done. After installing the required update, I noticed that the USB 3.0 external drive was not recognized by the software. This was solved by going into Computer Management and adding a drive letter to that drive. Once recognized by Carbonite, selected that drive to be used for the Mirror Image backup but began to receive Carbonite Backup external drive errors – “Mirror Image was unable to use the selected target drive.” Took a bit of research to find out the two parts that comprised the issue.

Identifying Cause of Carbonite Backup External Drive Errors

Found a Carbonite support article that details requirements for the Mirror Image Drive to be used. Included in the list – “RAID configuration is not supported – Carbonite currently doesn’t support creating snapshots from drives configured in a RAID array.” Since this server was configured with RAID 5 for a mix of performance and redundancy, it was not able to use the Mirror Image function of the software at all.
Found that the clients Windows Server 2012 R2 Essentials server had the Carbonite Personal Plus software installed on it. As per the Carbonite Website – “Personal Plans are not designed to support Windows Server OS.” Immediately recommended the client upgrade to the Carbonite Server Backup plan.

If your company is using Carbonite for your backup and need support or you are looking for an affordable backup solution, then contact us for assistance as we are a trusted Carbonite Partner.

Configure cPanel Email Distribution Group

The local volunteer fire department wanted to have a feature typically only seen in Microsoft Exchange called Mail-Enabled Distribution Groups, the only problem is that they used cPanel for their cloud email provider instead. So I was tasked with determining if it were possible to create a cPanel email distribution group with similar functionality. To my surprise this is an option and works quite well.

Create a cPanel Email Distribution Group

This tutorial is based on the Go Daddy Pro version of cPanel which is just a skinned version of the standard cPanel control panel.

Login to the cPanel Main Page
Scroll down to the “Email” section and click on “Forwarders”
Click on the “Add Forwarder” button
Here is where decisions have to be made like the vanity name of the cPanel email distribution group can be something like AllStaff or Techs which would go in the “Address to Forward” box. This does not have to be an existing email box as it will be treated as an alias.
In the “Destination” section in the “Forward to Email Address” box type in a list of existing email addresses separated by commas with no leading or trailing spaces. Click on the “Add Forwarder” to complete the creation process.

It will be easy to see now that the comma separated list actually was used to create individual rules for each of the existing email addresses. This is a huge time saver in comparison to manually creating each one. This has been tested and verified to work. If your company is using cPanel as your cloud email hosting platform or need help setting up a cPanel email distribution group, then contact us for assistance.

Microsoft Office 2007 EOL risks and secure migration path to Microsoft 365 cloud services

Microsoft Office 2007 EOL Approaches

All good things must come to an end and all software will one day reach End-of-Life (EOL). Microsoft Office 2007 EOL is coming in October 2017 as per the Microsoft Support Lifecycle Site. This will mean that all patching and extended support for the product will end and anything new that goes wrong with the product is ignored by Microsoft. This allows malicious hackers to use these flaws to easily infect systems, encrypt data, exfiltrate data or basically have their way with your systems. Now is the time to consider updating your systems to Office 365 which includes the opportunity to use their fabulous new Exchange Online service along with many other useful cloud based services.

Office 365 Azure AD Connect Upgrade

Administrators who have been using the tried and true DirSync utility from Microsoft will be pleasantly surprised by the upgrade / replacement by the Windows Azure AD Connect utility for password sync with Active Directory or Hybrid configurations. Here are the basics on an upgrade for a site with only password sync enabled:

Office 365 Azure AD Connect Upgrade

The way to see if your organization is ready for the upgrade is to check under Admin > Users > Active Users > Active Directory Synchronization > Manage in the Office 365 portal.
Click on the Upgrade link which will redirect to the download site for the Microsoft Azure Active Directory Connect utility.
Download and run the utility as administrator which will bring up the following welcome screen which requires agreement to continue the conversion process.
The tool will then examine the current DirSync setup for your organization.
Once done it will present you with the option to continue with the upgrade.
Enter your organization’s Office 365 global administrator credentials.
Enter local domain administrator credentials
Then there is the option to enable hybrid configuration or start a manual first sync. Choose the first sync and continue.
After much labor on the part of the tool it will finish successfully.
Finally a couple notes to make life easier. First is to add a shortcut to the Synchronization Service Manager on the desktop pointing to the following:

%systemdrive%\Program Files\Microsoft Azure AD Sync\UIShell\miisclient.exe
Second is to create a powershell script to start a manual sync as follows:

Set-ExecutionPolicy RemoteSigned
Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Delta

This will then begin to use the Azure AD Connect utility to run the password sync to Office 365 from local Active Directory domain. If you company needs any help with Office 365, Exchange or Active Directory then don’t hesitate to contact us for assistance.

Issues After Office 365 Migration

Keep running into this issue at client sites where an on-premise Microsoft Exchange Server (especially from Microsoft SBS Server) to Office 365 migration has taken place. Client workstations are unable to connect to Office 365 servers via Autodiscover for their migrated email accounts. During Outlook first run it would pre-populate their email correctly but then try to connect to the old email server instead. If the DNS settings for the workstation were changed to non-domain external DNS servers then the email would not pre-populate but the setup would complete successfully. Checked the Autodiscover URL using NSLOOKUP to the Microsoft servers from local domain DNS servers successfully, so felt a little stumpled. Research pointed to the Service Connection Point (SCP) object in Active Directory which can be either deleted from the server or excluded on a per workstation basis, so both will be shown here. Starting with the server first:

Deleting SCP from Server after Office 365 Migration

Login to a server with Active Directory Domain Services installed as administrator
Launch ADSIedit from the Start Menu
Right click on the root of the console and choose “Connect to…”
Under “Select a well know Naming Context” choose Configuration
Navigate down through the tree as follows (these are always listed from the bottom up on other tech sites for some reason):

CN=Autodiscover,CN=Protocols,CN=,CN=Servers,CN=Exchange Administrative Group,CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services
Delete the entire CN=Autodiscover object if you no longer have any on-premise Exchange Servers
Reboot the workstation to clear the DNS / AD cache and try to connect to Office 365 servers again

Deleting SCP from Workstation after Office 365 Migration

Lauch Regedit from the Start Menu
Navigate to the following key based on your version (16.0 for Office 2016):

HKEY_CURRENT_USER\Software\Microsoft\Office\x.0\Outlook\AutoDiscover
Add a 32-bit DWORD called ExcludeScpLookup with the value of 1 to enable
Next navigate to the following key based on your version (16.0 for Office 2016):

HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\x.0\Outlook\AutoDiscover
Add a 32-bit DWORD called ExcludeScpLookup with the value of 1 to enable
Reboot the workstation to effect the Registry changes and try to connect to Office 365 servers again

If your organization needs any help with troubleshooting issues with Office 365 or with migrating from on-premise Microsoft Exchange Server, then don’t hesitate to contact us for support.

Configure Multiple DHCP Option 66 Settings

Recently ran into an issue where a company wanted to use multiple types of VoIP phones that required seperate settings to download their configuration with a vendor – this is usually done in a homogeneous environment via DHCP option 66 settings. (Option 66 is part of IETF RFC 2132 which states that this option uses FQDN or IP address to point to a TFTP server.) In this particular setup only one VoIP phone vendor at a time could be specified in the option 66, so custom settings were going to be needed to make all the other vendors phones work properly. Found that this could be done via DHCP reservation on either their Windows Server 2012 R2 Standard or on their Cisco 871w router, but I am sure their are ways to do it on other vendors equipment (which is outside the scope of this article). So here is how to configure the

Windows Server DHCP Option 66 Reservation

Turn the phone on its back and record the MAC address of the device.
Start the DHCP administrative tool on the server.
Expand the tree into the IPv4 then into the Scope needing the reservation.
Right Click on Reservations and choose “New Reservation…”
Give the new reservation a name, specify IP address and MAC address previously recorded.
Right click on the new reservation and choose Configure Options.
In the Reservation options scroll down to 066 Boot Server Host Name and enter the URL or IP of the vendors configuration server.
Make sure the vendor has reset the authorization token and factory reset the phone to pull the new reservation and configuration files.

Cisco 800 Series DHCP Option 66 Reservation Setup

Something to remember is that each reservation is treated as its own DHCP pool by the router. (I recommend exporting the configuration file to a local workstation and manually editting if there are more than a couple edits to make.)

Login to router and enter configuration terminal mode:

Router#configure terminal
Enter the name of the DHCP pool as follows:

Router(config)#ip dhcp pool Pool_Name
Enter the IP address of the device:

Router(dhcp-config)#host 192.168.1.100 255.255.255.0
Enter the MAC address of the device:

Router(dhcp-config)# hardware-address AABB.CCDD.EEFF
Enter Option 66 information:

Router(dhcp-config)#option 66 ascii http://vendor.url/configuration.xml
Enter Default Gateway:

Router(dhcp-config)#default-router 192.168.1.1
Enter DNS servers:

Router(dhcp-config)#dns-server 8.8.8.8 8.8.4.4
Make sure to copy the running configuration to startup configuration:

Router(dhcp-config)#end
Router#copy running-config startup-config
Clear the current DHCP bindings to make sure the phone will grab the correct address:

Router#clear ip dhcp binding *
Make sure the vendor has reset the authorization token and factory reset the phone to pull the new reservation and configuration files.

That is all there is to it. Enjoy a multi-vendor VoIP environment. If you need help configuring your Windows Server or Cisco IOS based router please contact us for support.

Install Remote Desktop Gateway Role

Here are the basics, as promised earlier, for deploying the Remote Desktop Gateway role on Windows Server 2012 platform. Here are the basic steps to add only this role on a single server:

Install Remote Desktop Gateway Role on Windows Server 2012

Once logged in a administrator, open Server Manager and select “Add servers roles and features”
If you have not already check the box next to “Skip this page by default” then click “Next >”
It is important to select role based installation here before clicking “Next >”. This article only explains how to install RD Gateway, not a full deployment.
Select your server that will host the RD Gateway rolethen click “Next >”
Select Remote Desktop Services role
Skip feature selection as you don’t need anything here
On the Remote Desktop Services role click “Next >”
On the Add Roles and Features Wizard click “Add Features”
Make sure Remote Desktop Gateway role is selected and click “Next >”
On the Network Policy and Access Services (NPS) click “Next >”
Make sure Network Policy Server role is selected and click “Next >”
Make sure leave the defaults for the Web Server Role (IIS) role is selected and click “Next >”
Checked the “Restart the destination server automatically if required” check-box then click “Install”
You may notice that Server Manager states there are no RD Connection Broker servers in the server pool. This is as designed since this is not a complete Remote Desktop Session host environment as we want to have only RD Gateway
In Server Manager go to Tools > Terminal Services > Remote Desktip Gateway Manager and you will see that Remote Desktop Gateway server is not configured. One of the most important things to keep things simple for the user is the RD Gateway certificate (the SSL certificate needs to be installed on BOTH the server and on the client workstation for this will not work). It is highly recommended to get an external SSL Certificate for this process.
Click on “View or modify certificate properties” then click on “Import Certificate…”
Navigate the file downloaded from your certificate provider and import it.
On the right hand side click on the “Create New Authentication Policies Wizard”
In the wizard select “Create RD CAP and a RD RAP (recommended)” then click “Next >”
Name the Remote Desktop Client Access Policy policy then click “Next >”
Leave the default of Password authentication then select an Active Directory User Group (I usually create a specific one for this purpose and add the needed members to it) then click “Next >”
Device redirection and session time out are left at their defaults, so click “Next >”
Name the Remote Desktop Remote Access Policy policy then click “Next >”
Select an Active Directory Computer Group (I usually create a specific one for this purpose and add the needed endpoints to it) then click “Next >”
Leave the default port as 3389 then click “Next >”
Finish the wizard and you will receive successful message the RD RAP and RD CAP policies have been created.
The server is now configured. Go to the client workstation and import the SSL certificate from your provider.
Open the RDP client, click on the “Show Options”, click on the “Advanced” tab then “Settings…”
Specify the RD gateway server here. (The RD Gateway address here and the server name on the certificate needs to be the same.) Then select “Use my RD Gateway credentials for the remote computer” and then click “OK”
On the General tab, specify local computer name of the workstation or server inside the network and full username including local domain then click “Next >”

RDP Gateway NULL SID errors

Recently converted a client’s Windows Standard 2012 R2 terminal server into a Remote Desktop Protocol (RDP) Gateway server so that remote users could connect to their workstations inside the corporate network. (The details of how to do this properly will follow soon in another post.) Once the setup was completed it was time to test the connectivity as follows:

Testing RDP Connectivity

Log into a remote workstation
Open Microsoft Terminal Services Client (MSTSC)
Type in the Computer name and User name into the General tab:
Click on the Advanced tab and then on the Settings… button.
Choose Use these RD Gateway server settings then type in the external URL of the RDP Gateway
Choose Bypass RD Gateway server for local addresses
Choose Use my RD Gateway credentials for the remote computer then click OK
Should then be able to click Connect to tunnel into that workstation

Issues with NULL SID as follows:

Getting errors during login process about inability to connect, noticed that it allowed for credentials at RDP Gateway but then failed when trying to login to local worksations.
Attempted to connect from machines without the KB2592687 and KB2830477 installed, but same errors occurred.
Checked the event logs for the local workstation and found Event ID #4625 NULL SID errors. Which should have pointed to issues with authentication.
Tested NTLMv2 login issues via changing the following registry entry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] – LMCompatibilityLevel set above 3
Did the same thing via Group Policy using the following setting:

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options – “Network security: LAN Manager authentication level” set to Send NTLMv2 response only
Finally narrowed it down to NTP settings on the router not being set and mismatch of time.

LeChiffre Ransomware Hits Server

Recently had a non-managed client hit by the LeChiffre Ransomware which encrypted their entire data share on the Windows Small Business Server 2008 that they have been using for some time. Here is what the virus left in every folder along with adding the word LeChiffre (aka encrypt) to the end of all files:

LeChiffre Ransomware Traces

This company was at least partially protected – even though they made the cardinal mistake of not having anti-virus on the server, they did have recent backups that were usable. Used the backup to restore the files that were affected by the virus, and everything seemed good for a couple weeks until they realized that the backup set was incomplete and didn’t include some vital files related to their website. Found and used the LeChiffre Decryptor from Emisoft to try and recover the remaining files from the server but ended up having mixed results. They were able to open GIF and PNG files but DOC and PDF files were hopelessly corrupted.

This infection of the LeChiffre Ransomware is just another lesson to those who think that their systems are just fine. Please take the time to contact us for a free security evaluation, so that a proper plan can be put in place to protect vital company documents from being lost to situations like these.

UPS battery backup systems protecting servers from power outages in disaster scenarios

Server Battery Backup Best Practices

It is astounding to think that many servers in small businesses are plugged directly into the wall for power without any protection from outages or dirty electric current. It is easy to mitigate up to 44% of data loss incidents that are due to hardware failure by providing clean and consistent power to servers on the network. Installing a server battery backup is quite easy to do and the possible return on investment will never be seen due to the possible issues being taken care of. Here is a basic list of best practices for purchasing and setting up the monitoring software that comes with the unit:

Server Battery Backup Purchasing:

Budget to purchase new battery backup devices every 5-6 years
Replace internal battery on unit at the 3 year mark
Based on maximum load (think power supply total watts) select an Uninterupted Power Supply (UPS) that will not be loaded over 80% which protects the unit from undue wear and allows for some growth
Consider redundant UPS configuration for larger servers with multiple power supplies
In high production environments, consider adding an UPS for each workstation to allow for file saves before file server shutdown occurs.

Server Battery Backup Setup:

Make sure buildings elecrical breakers are rated to handle the 80-100% load of the UPS
If single UPS used in multiple power supply server scenario then put one plug into the wall and the other into the UPS, but please consider redundant power supplies.
Plug in serial, usb or network management and install the management software that comes with it
Configure the management software to gracefully shutdown the Operating System (OS) of all connected servers
If using sequential shutdown of servers then shutdown database servers first, file servers second and domain controllers last.
Configure either SNMP alerting or email alerting to get status updates from the device
Configure regular self-test of the battery to make sure there is no failure of the internal battery before the replacement period

Taking the time to do this right the first time will save headaches later when things go wrong. Call or email us to do an evaluation of your power infrastructure.

Category: Servers

Carbonite Backup External Drive Errors

Identifying Cause of Carbonite Backup External Drive Errors