CoNetrix

Blog

While making sure a server was being automatically patched every month through Windows Updates, I logged on and made the necessary changes to get the server into WSUS, but then I wanted to verify that this server would install and reboot automatically. Opening the Group Policy Management Console, I was greeted with "The Network Name could not be found."

Troubleshooting this message, I found that if I connected to the other domain controller, I could load the GPMC without any issues. Furthermore, the DC I originally attempted work on was reporting the following error:

Event Type:       Error
Event Source:     NtFrs
Event Category:   None
Event ID:         13568
Description:      The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.

Further troubleshooting showed that this DC didn't seem to have any replicated data from the other domain controller. Fortunately, this same event had a resolution in the log as well.

Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.

  1. At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
  2. At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.

WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.

To change this registry parameter, run regedit.

Click on Start, Run and type regedit.
Expand HKEY_LOCAL_MACHINE.
Click down the key path:
   "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.

If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.

After running through the steps listed above, everything synced up like it was supposed to and the GPMC started working on the original DC.

Networking, WSUS, DC, group policy,
 
 

After upgrading a PC to Office 2013 (including Lync 2013), one of our systems wasn’t able to screen share with 2010 users.  The user could share her screen with everyone else, but wasn’t able to view any 2010 screens.  After doing some research, it appears to be caused by two Lync updates, KB2760512 and KB2760556.  [more]Unfortunately, Microsoft hadn’t released a fix for these updates, but we were able to make it work by doing the following steps:

  1. Uninstall the two Lync patches and reboot:
  2. Install the updates individually (Install KB2760512 first and reboot, then install KB2760556 and reboot)

Here is a link to another forum that also discusses the issue:
http://social.technet.microsoft.com/Forums/en-US/lyncconferencing/thread/71fca51a-64ed-41c3-8079-0f290588a716

Lync 2013, Patch,
 

We needed to clear disk space on a hard drive containing WSUS and other applications.  WSUS was taking up about 40 GB of the 50GB drive. 

WSUS has a cleanup wizard you can use to remove unneeded and superseded updates, but when we ran it only a few megabytes worth of data was cleaned.  The trick to clean up a lot of disk space and remove superseded updates[more] is to filter your view to see all the approved updates in WSUS, then select the approved updates marked as superseded (can be in the hundreds), and decline these updates.  The next time the cleanup wizard is run, it will remove the unneeded install files.

It appears, by default, the cleanup wizard does not touch approved superseded updates when it runs; however, by declining these superseded updates, we were able to remove over 17GB of unneeded installation files.

Networking, updates, WSUS, cleanup, disk,
 

I had two 8 GB USB flash drives that suddenly started showing up as only one GB (983 MB).  A little research showed that through creating various live CD images for antivirus, freeNAS, Ubuntu, part image, etc., the drives had been partitioned and Windows was only recognizing the first partition.  Windows disk manager won't change the partitions on the flash drive, either. [more]

A solution is to use command-line diskpart.

Diskpart

- LIST DISK

- SELECT DISK X (Make sure you get the right disk!)

- DETAIL DISK

- CLEAN

- CREATE PARTITION PRIMARY

- EXIT

Then format the drive.

General, Partition, Diskpart, USB,
 

If you have difficulty scheduling meetings with multiple people outside of your company Exchange environment when you can't see everyone's calendar, take a look at ScheduleOnce.  It provides several scheduling options for organizing meetings with multiple people.  One option is to upload your calendar to Google Calendar, and others can see your availability without seeing any of the details of your appointments.  ScheduleOnce is free to try with a few basic features and more advanced features start at $5/month.

http://www.scheduleonce.com/

General, Exchange, Calendar, Schedule,
 

Recuva (they pronounce it "recover") is a free utility that can be run from a USB drive or installed on a system.  It's easy to use and has options to pick the type of file (pictures, email, music, documents, etc.) and file locations - or just show all undeletable files on a specific drive. [more]

There is a deep scan option, but if this is necessary, it may be difficult to restore the files.

This is a good way to restore files that may have been accidently deleted or files that have disappeared because of disk errors.  It may be a good thing to use in combination with SpinRite (not free, but a very useful utility when disk hardware errors occur).

http://www.piriform.com/recuva

http://www.grc.com/sr/spinrite.htm

Networking, Recovery, Deleted, Lost,
 

Was working on a Dell PC that had a failed Seagate hard drive. The drive would spin up but could not be detected by the system. I was able to order a new drive and get the PC back up and running. However there were tons of photos and documents that need to be recovered if possible. I found that  some Seagate Barracuda 7200.11 hard drives have known firmware bugs. There are two common errors.

  • 0 LBA error: it happens when your BIOS can recognize your HDD at POST moment, but as an 0MB drive.
  • BSY error: it happens when your HDD enter on a halt state, or BuSY state. In this condition, your HDD will not be recognized by BIOS at POST moment.

The error I encountered was the BSY error, which is recoverable. But it requires connecting to the drives serial interface which is located next to the SATA connector.
I purchased the required RS232-to-TTL Adapter from eBay, followed one of the better sets of directions I found on Google and was able to recover all the data from the drive. [more]

How to recover from BSY error - https://sites.google.com/site/seagatefix/

RS232-TTL Adapters on eBay - http://www.ebay.com/sch/i.html?_trksid=p2047675.m570.l1313&_nkw=MAX232CPE+Transfer+Chip+RS232+To+TTL&_sacat=0&_from=R40

General, Seagate, Dell, HDD,
 

Download link: http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

What is PsExec?  "PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems." [more]

I needed to reset some WSUS IDs on systems that were cloned in order to get them to check in to WSUS properly.   I used psexec to run commands as though I were typing them into the PC locally to start/stop services, delete a registry key, and check for updates from WSUS Server in the following example.

psexec \\remotePC net stop wuauserv
psexec \\remotePC REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f
psexec \\remotePC net start wuauserv
psexec \\remotePC wuauclt /detectnow

You can also use this to run ipconfig and it will show you the results from the REMOTE system which could come in handy. 

General, Windows,
 

The other day I got a call from a customer whose laptop was having some major performance issues.  The hard drive was full of bad sectors and was causing Windows to perform very poorly, if at all.  I got the laptop from them and started down the road of data recovery and hard drive replacement.  Thankfully, I was able to boot the laptop with a Fedora Live CD, mount the NTFS OS partition and recover most of the files in the various user profiles.  I purchased a replacement hard drive that was the same size as the bad one and thought I'd first try to image the old drive to the new one.  This proved to be very slow (because of the 1000s of bad sectors) and never really worked.  The old hard drive had a recovery partition at the tail end of the disk.  Unfortunately, I wasn't able to get Windows to perform well enough to burn recovery media from the recovery partition.  So, I was a little stuck.  I decided I'd try to capture the partition table and the recovery partition off the failing hard drive.  To do this, I used the Fedora Live CD and the 'dd' command. [more]

To capture the partition layout from the first sector of the disk:
dd if=/dev/sda of=partition_layout.img bs=512 count=1

To capture the recovery partition:
dd if=/dev/sda2 of=recovery_partition.img bs=512k conv=noerror

Thankfully, since the recovery partition is put on the hard drive long before it starts to fail, and isn't ever re-written, it didn't have any errors.

After successfully capturing the images, I was able to replace the failing hard drive with the new drive.  I booted the machine again with the Fedora Live CD and restored the images using similar dd commands.

Restore partition layout:
dd if=partition_layout.img of=/dev/sda

After restoring the partition layout, I had to run 'partprobe' to have the OS re-read the partitions on the disk.  Then I restored the recovery partition.
dd if=recovery_partition.img of=/dev/sda2

I used 'fdisk' to set the recovery partition as the "active" partition (so it would boot).
fdisk /dev/sda

After this, I rebooted the machine and the HP recovery process started up and I was able to get the laptop back to its original factory condition.

General, Windows,