During a DHCP Server 2008 R2 to Windows 2012, moving from one virtual machine to a new virtual machine I ran into error 32 during exporting the DHCP configuration from the source server.
btw: I like SMIG because it also moves all the active leases to the new server. A regular backup/restore don't.
PS C:\system\smig> Export-SmigServerSetting -FeatureID dhcp -path c:\system\dhcp
3 -verbose
cmdlet Export-SmigServerSetting at command pipeline position 1
Supply values for the following parameters:
Password: **********
Export-SmigServerSetting : Error 32: Feature DHCP Server could not be exported.
At line:1 char:25
+ Export-SmigServerSetting <<<< -FeatureID dhcp -path c:\system\dhcp3 -verbose
+ CategoryInfo : InvalidOperation: (:) [Export-SmigServerSetting]
, Exception
+ FullyQualifiedErrorId : 32,Microsoft.Windows.ServerManager.Migration.Com
mands.ExportSvrMigSettingCommand
ItemType ID Success DetailsList
-------- -- ------- -----------
WindowsFeature DHCP False {DHCP}
VERBOSE: Details:
VERBOSE:
VERBOSE: ID: DHCP.
VERBOSE: Title: DHCP Server
VERBOSE: Result: Failed
VERBOSE: Error 32: Feature DHCP Server could not be exported.
VERBOSE:
Export-SmigServerSetting : Gathering the specified migration data failed.
The migration operation encountered an error that could not be skipped.
At line:1 char:25
+ Export-SmigServerSetting <<<< -FeatureID dhcp -path c:\system\dhcp3 -verbose
+ CategoryInfo : InvalidOperation: (:) [Export-SmigServerSetting]
, MigrationException
+ FullyQualifiedErrorId : Microsoft.Windows.ServerManager.Migration.Comman
ds.ExportSvrMigSettingCommand
PS C:\system\smig>
I did that many times before to migration from 2003 to 2008 R2. This time I just forgot to stop the DHCP service on the source server before running Export-SmigServerSetting.
Good luck!
Saturday, July 14, 2012
Friday, June 15, 2012
How to find a good name for your Certificate Authority
It is a often ask question. How should I name my new Certificate Authority. Well, this is not an easy job but I want share my thoughts.
Think this name should be used for next 10 or 20 years from now and is not changeable (or a name change would be very hard to do)
Items to consider:
- Should have some sort of identification between
- Should not include brand names from others, may also not from your company
- Should be short and simple to read (even for your end-users)
- Avoid special characters or signs, best is characters A-Z, a-z and numbers 0-9
- Remember: a company name or legal form can change
- Probably you will have more than one root CA over the years, as a second PKI or as a replacement for the CA you plan today, so add some version information or a generation name to the CA name e,g, R1
bad example: My Root CA
better: SEC Root CA R1 (Security Attic Root CA generation 1)
And if you use acronyms you can flexible read or interpret them in the future. :-)
Tuesday, May 1, 2012
TEC2012: What is new in Windows 2012 for RMS
Updates for RMS in Windows 2012
- stronger key encryption (RSA 2048 SHA256) - patch available for Windows 2008 R2
- Logging is not using MSMQ anymore, writes straight to the database. Sounds like a little bit more overhead for logging but lessen the time for troubleshooting MSMQ
- As a result of the new server manager you can install RMS cluster from a single console
- RMS cluster servers can be core servers, installed from a server with full server version -OR-
- install RMS running the server gui and then switching to core server (switching between core and full is a new feature in Windows 2012)
- Delegation for e-mail protection, so the assistant can read the e-mail sent to the manager - available as patch for Windows 2008 R2
- stronger key encryption (RSA 2048 SHA256) - patch available for Windows 2008 R2
- Logging is not using MSMQ anymore, writes straight to the database. Sounds like a little bit more overhead for logging but lessen the time for troubleshooting MSMQ
- As a result of the new server manager you can install RMS cluster from a single console
- RMS cluster servers can be core servers, installed from a server with full server version -OR-
- install RMS running the server gui and then switching to core server (switching between core and full is a new feature in Windows 2012)
- Delegation for e-mail protection, so the assistant can read the e-mail sent to the manager - available as patch for Windows 2008 R2
Monday, April 30, 2012
TEC2012: Windows 2012 Dynamic Access Control
Dynamic Access Control is a new feature in Windows Server 2012 (aka Windows 8).
It gives you:
- centralized policies
- rules to define attributes on user object, device object and resource object
user.departement == "HR" and device.managed=true and file.department=="HR" -> allow access
So if a user logs from manged machine in the office her/she can access that data, if he/she trys to access the data from their home computer he/she will get an access denied error.
Btw: the Acess Denied error dialog got some improvements as well, so the user can now request access from the dialogue. Let's see if the FIM product group is implementing this into the group membership management as well.
Dynamic Access Control is a integrated feature with Windows Server 2012.
http://technet.microsoft.com/en-us/library/hh831717.aspx
It gives you:
- centralized policies
- rules to define attributes on user object, device object and resource object
user.departement == "HR" and device.managed=true and file.department=="HR" -> allow access
So if a user logs from manged machine in the office her/she can access that data, if he/she trys to access the data from their home computer he/she will get an access denied error.
Btw: the Acess Denied error dialog got some improvements as well, so the user can now request access from the dialogue. Let's see if the FIM product group is implementing this into the group membership management as well.
Dynamic Access Control is a integrated feature with Windows Server 2012.
http://technet.microsoft.com/en-us/library/hh831717.aspx
Monday, December 19, 2011
Office 365: Rich coexistence failure because DirSync cannot write back to local AD
DirSync makes it very easy to populate all user account etc from the internal AD to Office 365. Error during exporting and syncing user data are reported via emails, so you can follow up on that.
For rich coexistence DirSync writes certain attributes back to AD, e.g proxyaaddresses.
Errors are not reported and you have to find them in the DirSync's "unofficial" UI.
If you see there "Insufficient access rights to perform the operation.” then the user MSOL_AD_SYNC does not have permissions to write those attributes.
This can happen because you assigned permissions on the user level and you have disabled the "include inheritable permissions from this object's parent" option.
From there you have two options; enable the option to use inheritance or add the permissions manually to each account.
For rich coexistence DirSync writes certain attributes back to AD, e.g proxyaaddresses.
Errors are not reported and you have to find them in the DirSync's "unofficial" UI.
If you see there "Insufficient access rights to perform the operation.” then the user MSOL_AD_SYNC does not have permissions to write those attributes.
This can happen because you assigned permissions on the user level and you have disabled the "include inheritable permissions from this object's parent" option.
From there you have two options; enable the option to use inheritance or add the permissions manually to each account.
Office 365: Off-boarding a mailbox
On-boarding a mailbox to Office 365 is a quite simple to do with the Exchange Management Console. But how to off board a mailbox. So you might ask why should I do that, well just to be prepared, just in case you have to.
First create a powershell session to O365:
$cred365= Get-Credential
$CloudSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/
Import-PSSession $CloudSession -Prefix 365
Now run the move request:
New-365MoveRequest -Outbound -Identity 'user@domain.com' -RemoteHostName mail.domain.com -TargetDeliveryDomain domain.com -RemoteCredential $credOnP -RemoteTargetDatabase 'Mailbox Database 041637xxxx'
Afterwards you can find the new move request in EMC under your Office 365 tenant in "Move requests".
First create a powershell session to O365:
$cred365= Get-Credential
$CloudSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/
Import-PSSession $CloudSession -Prefix 365
Now run the move request:
New-365MoveRequest -Outbound -Identity 'user@domain.com' -RemoteHostName mail.domain.com -TargetDeliveryDomain domain.com -RemoteCredential $credOnP -RemoteTargetDatabase 'Mailbox Database 041637xxxx'
Afterwards you can find the new move request in EMC under your Office 365 tenant in "Move requests".
Saturday, November 19, 2011
Office 365 DirSync 64bit based on FIM 2010
Office 365 for 64bit servers (2008 and 2008 R2) is here.
http://community.office365.com/en-us/w/sso/555.aspx
Still best practice is to have at least one of those servers for a setup with federated identities and Exchange rich-coexistence:
- ADFS server (plus ADFS proxy oder TMG or similar)
- DirSync server
- Exchange 2010 Hybrid server
btw: If you try to install DirSync 64bit on a Windows 2008 R2 DC you will see this message.
And it has still the same "scary" error about MSOLCoExistence registry key. Run the config wizard with elevated rights.
http://community.office365.com/en-us/w/sso/555.aspx
Still best practice is to have at least one of those servers for a setup with federated identities and Exchange rich-coexistence:
- ADFS server (plus ADFS proxy oder TMG or similar)
- DirSync server
- Exchange 2010 Hybrid server
btw: If you try to install DirSync 64bit on a Windows 2008 R2 DC you will see this message.
And it has still the same "scary" error about MSOLCoExistence registry key. Run the config wizard with elevated rights.
Error: Access to the registry key 'HKEY_LOCAL_MACHINE\Software\Microsoft\MSOLCoExistence' is denied.
Subscribe to:
Posts (Atom)