Is there an easy way to update over 1000 Windows hosts with an additional permitted manager? I have tools to remotely run scripts on hosts, but it is a little bit difficult to filter out specific hosts, and you end up having to type each hostname into the program then add it to a list of hosts to run the script on. I have scripts that will update permitted managers, and other SNMP settings in the registry; but I need a better way to run the script on multiple hosts. Does anyone know of an easy way to do this?

Why don’t you just put the list of servers in a text file and delete the ones that you don’t want it to run on. Then just use psexec‘s @file feature to feed the list of servers to psexec. It will then iterate through the list of servers, running the specified command(s) on each.

Or, even better, put all of the machines in an AD security group and use Group Policy Preferences Registry Settings to push the change out to the servers. You can use Item Level Targeting to apply it only to servers in the specified security group. When new servers get spun up, just make including them in this group part of the provisioning process.

Check more discussion of this question.

I’ve got a website running Windows Server 2003 and IIS 6 and I’ve got an SSL certificate.

Our website order form is encrypted with that SSL certificate, but the login form is not.

Is this something that needs to be fixed in the code behind the page or can it be fixed in the administration of the server or the installation of the SSL certificate?

You don’t need to add any code to your application, once you go through https protocol, every information is encrypted, not just some of them.

you maybe have to check out for some links that could be link the user to http protocol, but you can avoid it redirecting all http request(port 80) to https (port 443) on the server side, for example setting the virtual host on your apache configuration on the https port.

EDIT: here’s the steps
1. Open the Computer Management snap-in on your Exchange server. Expand the Services and
Applications node, then the Internet Information Services node.
2. Expand the Default Web Site node, then find the Exchange directory. Right-click it and
choose the Properties command.
3. Click the Directory Security tab. In the Secure Communications control group, the View
Certificate and Edit buttons should be active. If they’re not, your certificate isn’t
installed properly—you’ll have to fix it before proceeding.
4. Click the Edit button in the Secure Communications group. You’ll see the Secure Communications dialog box.
5. Check the “Require secure channel (SSL)” checkbox. You can optionally check the “Require 128-bit encryption” box as well. Doing so gives you better security, but some clients may not be able to connect.

Check more discussion of this question.

I’ve got an old win 2003 VM (VMware) on a blade cluster of VMs that I’m moving a considerable amount of files to our new DFS array. There are two main folders with about 1.7 million and half a million smaller files (letters, memos, and other smaller files) respectively. Total size is ~420 GB and ~100 GB.

We’re using the gui version of robocopy on the server to copy the files. We had initiated a file copy about a month ago to test the process and found that it was taking around 4 hours for the large file. Now that I’m in the process of actually switching the files over it has been taking 18-20 hours. Nothing has changed on the server side and nothing has changed on the settings of the copy (no logs, 1 retry with a wait of 1 second).

Our intent is to shut off the share and force the copy over again to get all the files that have been left out of the copy due to being locked by users. I can’t take a 20 hour outage to do that though.

Does anyone have any theories about what could be causing such a delay for robocopy compared to previously shorter runs?

Edit: I discovered last night the copy must be freezing. It stops at a certain time (seems to be variable) and doesn’t continue at all.

We’ve been fiddling with this one. Looks like there was something odd going on with the gui interface. When I specifically set the retry and wait to “1″ it went through normally. This may have been coincidence, but it began working normally on the first try with those settings.

Check more discussion of this question.

We’re having a strange problem that we can’t fathom out. We have inherited a 2003 FFL/DFL domain that has a mix of 2008 R2 and 2003 DC’s. The Workstation Admins group was in Builtin\Administrators, not great I know. We removed said group from the elevated permissions only to find it had returned the next day.

Checking the permissions on the group Builtin\Aministrators only Domain Admins can affect it, as it should be. We used the repadmin to track down when the change happened:

repadmin /showobjmeta DC01 "CN=Administrators,CN=Builtin,DC=Domain,DC=co,DC=uk"

This showed us where and when the change occurred:

PRESENT       member 2012-11-27 10:32:23             Site1\Site1-DC01 2773346 3067148  13    CN=Workstation Admin,OU=Management Services,OU=HO,OU=Offices,DC=Domain,DC=co,DC=uk

On looking at the security logs on the Site1-DC01 we found:

Event Type: Success Audit
Event Source:   Security
Event Category: Account Management 
Event ID:   636
Date:       27/11/2012
Time:       10:32:23
User:       NT AUTHORITY\SYSTEM
Computer:   STD-DC01
Description:
Security Enabled Local Group Member Added:
    Member Name:    -
    Member ID:  CENTRAL\Workstation Admin
    Target Account Name:    Administrators
    Target Domain:  Builtin
    Target Account ID:  BUILTIN\Administrators
    Caller User Name:   STD-DC01$
    Caller Domain:  CENTRAL
    Caller Logon ID:    (0x0,0x3E7)
    Privileges: -

So, we assumed Group Policy was to blame. On going through all GPO’s there is use of User Rights Assignment, Restricted Group Access or Local Users and Groups Assignment. We have also gone through all login scripts and nothing is set there either.

On checking the ADDS logs we can see that replication is working as it should.

It’s also worth mentioning that Site1-DC01 holds no FSMO roles nor is it a GC.

We are stumped as to how it gets re-added. Can anyone point out what we’re missing?

Sure sounds like a GPO to me…specifically the Restricted Group Access.

Run a “gpresult /Z > gpresult.log”

Then open the log file and look through it.

The only other thing would be to check and see if it gets applied at the same time each day/night. If so, look for a scheduled task somewhere or 3rd party management software that kicks off and changes the permissions.

Check more discussion of this question.

Our IIS server was recently patched with the latest Microsoft Security Updates and since then, I am unable to enable the “Run WWW service in IIS 5.0 isolation mode” setting. This setting was enabled prior to patching and somehow changed during the updates. I have tried both using the IIS Manager console and the adsutil.vbs approach to change it. Either way, after resetting IIS for the change to take effect, when I go to verify that the isolation mode setting is enabled (true) I find that is reverts back to being disabled (false).

Now… The patches have already been rolled back, however the setting still does not persist when I enable it. While I am trying to research the patches that were applied to see if there is a known issue (or perhaps a change in this setting’s behavior) I was hoping someone else might have come across the same problem. Any help towards a workaround would be greatly appreciated!

>cscript adsutil.vbs set W3SVC/IIs5IsolationModeEnabled TRUE    IIs5IsolationModeEnabled        : (BOOLEAN) True>iisreset    Attempting stop...
    Internet services successfully stopped
    Attempting start...
    Internet services successfully restarted>cscript adsutil.vbs get W3SVC/IIs5IsolationModeEnabled    IIs5IsolationModeEnabled        : (BOOLEAN) False

I found that the root cause of this issue was that my change had not been persisted to the IIS metabase on disk before the IISRESET command forcefully terminated the service (thus wiping out my change from the in-memory metabase cache).

Further information from Microsoft KB 286196 confirms that this behavior occurs for any changes to the IIS metabase if they have not been saved to disk before the reset occurs.

You can either wait for the changes to be saved (2 minutes I think), or use the following workaround:

>net stop iisadmin /y>net start w3svc
>net start msftpsvc
>net start smtpsvc
>net start <short name for any other services that are listed when you stop IIS>

I also found that if I use “IISRESET /noforce” it will fail to restart IIS the first time after making my config change but then succeed on the second attempt and my changes are persisted correctly when the service comes back online; Issuing 2 “IISRESET /noforce” commands in succession seems to do the trick without having to wait at all for changes to be saved to disk.

Check more discussion of this question.

Our web site is working great for 99.99% of our users, but a few people (all of whom use Internet Explorer) are running into an error. Most pages on the site load fine, but for one specific page (the same page for all affected users), all they get is:

Internet explorer cannot display the webpage

It doesn’t matter whether the page is accessed over http or https – it fails to load either way. Every other page on the site, as far as I can tell, works fine for them. Not only that, the same users can load that specific page fine in Firefox.

I’ve checked the web server logs and I can’t find any smoking guns there. The site is running IIS on Windows Server 2003.

Is there any way to get IE to give the user more information than just “cannot display the web page”? There’s a “More information” button, but all it tells you is to make sure that your DNS servers are working, make sure you’re not working offline, etc.

Personally, this is the point where I’d crack out either Fiddler or Wireshark to see the actual request / response that is being delivered to the server. IE can be next to useless in terms of telling you what’s going on (IE9 is better with the dev tools), so proxying the request or packet sniffing is the only way forward.

Check more discussion of this question.

Within our AD set-up there are a lot of security groups, but only 1 distribution group (that a previous admin created).
Both types of group contain lists of domain objects (users in the one I was looking at).

What is the difference between a Security Group and a Distribution Group?

Security groups can be associated with ACLs, whereas distribution groups can’t.

Both security groups and distribution groups can be mail enabled.

http://technet.microsoft.com/en-us/library/cc781446(v=ws.10).aspx

Check more discussion of this question.

Is it possible to run IIS7/7.5 on Windows Server 2003?

No, since IIS4, the IIS version has been tied to the OS version.

IIS7, specifically, has many hooks into Server 2008 features that don’t exist in Server 2003. So even if you were able to force the installer to complete on 2003, IIS would not work. Upgrade to a newer OS, or live with IIS 6.

Check more discussion of this question.

This feels like a stupid question, and one that should (although I can’t find it) have been asked before.

I have a shared folder on a Windows Server 2003 R2 setup. We do NOT use AD, just local accounts. What if a user is deleted from the server, what happens to the files that (s)he owns in a shared folder? Will they be left with a link that points to a now non-existing user or will Windows automatically adjust for this and appoint someone else as owner?

I want to ask before I do something stupid.

And before you ask, yes I know I can disable accounts, but in this case I need to delete the account.

The files will still be owned by the non-existent user. An administrator can still add permissions to the files that were owned by that user, or change the permissions or owner at any time.

Sometimes the permissions GUI is a bit annoying… and there are tricks to deal with them. Here is a random command line fix example I just found and have not tested. http://www.mydigitallife.info/delete-undeletable-files-in-windows-vista/

Check more discussion of this question.

I am trying to provide taskpads to few admins to operate on few tasks delegated to them at OU level.I ran into the following problem;

lets say i delegated access to the admin on OU X and which is ability to modify groups such as sample group X1 , he must be able to add any users from OU X to the group X1.

The issue here is while testing i found out the admin can do the above but also can add a user Y1 from the OU Y(which he doesnt have delegated permissions) to the group X1.What am i missing? how to restrict admin from adding users out of OU to the groups he has modify access to?

Please ask me if any more details/clarification required.

You can’t really do this. If you give a user the ability to add users to a group, they can add any user that their account can read. Since you need to fundamentally change how AD permissions are laid out to restrict limited user accounts from reading basic attributes of other users, it’s typically an unsupported config that will break plenty of things that you didn’t mean to break.

In short, there’s no real functionality in place to say “you can add [user]to this group as long as [user] exists in this one OU” without a major modification to the default AD permission layout.

Check more discussion of this question.