Windows 2008/Windows 2012 to Windows 2019 Server using PowerShell

This is tricky and sometime GUI backup and restore may give you errors like function not supported or cannot import the DataBase.

Using this powershell method, there is no error and using verbose logging you can also see the logs at the same time.

Use below PowrShell to export the scopes from old server to new server.

Export-DhcpServer -File C:\temp\DHCPDB.xml -Leases -Force -ComputerName fra-winapp01.prg.ori.local –Verbose

then move the XML file exported at the c:\temp to new dhcp server.

Then run the below command to import the dhcp scopes to new server.

Import-DhcpServer -File C:\temp\DHCPDB.xml -BackupPath C:\temp\ -Leases -ScopeOverwrite -Force -ComputerName dhcpprg1.prg.ori.local –Verbose

[Solved] Error: The Windows Module Installer must be updated before you can install this package. Please update the Windows Modules installer on your computer, then retry setup

 While installing patches manually on 2008 R2 servers Getting message as

The Windows Modules Installer must be updated before you can install this package.
Please update the windows modules installer on your computer, then retry setup.

We have downloaded MSU installer from below MS link and try to install the KB2533552 on the server but not installing Getting message as " The update is not applicable to your computer&amp

Solution:-

These patches need to be installed in order below.

2020 – 07 : Service Pack Stack Update (KB4565354), then

2020 – 07 : Rollup (KB4565524) or 2020 – 07 Security only (KB4565539)

How to Schedule PowerShell Script using Task Scheduler

Method 1: Schedule PowerShell Script using Task Scheduler

Open Task Scheduler from Administrative tools.

To run a script from Task Scheduler, follow these steps.

1.Open Task scheduler –> Task Scheduler Library –> Create Task

2.In General tab, you can set scheduler name and description about the task like for what purpose the task has created.

Available security options explained below.

  • Specify the user on whose behalf the task will be run.
  • You can specify that a task should run . It can be done by selecting a radio button labelled ‘Run Whether the user is logged on not’. If this radio button selected, the task will not run interactively. To make a task run interactively, select the ’Run only when user is logged on’ radio button.
  • When the ‘Run whether user is logged on or not’ is selected, you may prompt to supply the credentials of the account, regardless of whether you select the checkbox ‘Do not store password’ or not. If the account is not logged on during task execution, saved credentials will be used.
  • If the task requires elevated privileges, then select the option ‘Run with highest privileges.’

3.Switch to the Trigger tab and click the New button. Here, you can set conditions that trigger a task.

  • You can specify when to start the task. For example, you can have it executed on a schedule, at start-up, at logon or whenever a particular event occurs by selecting ‘Begin the task’ drop-down menu.

  • You can configure whether you want to run this task once or daily or weekly or monthly according to your scenario.
  • In the “Advanced settings”, you can choose to delay task, repeat task, stop task if it runs longer than the specified time period and expiry date.
    • Delay task for up to – This adds a random delay, so the task won’t stat at the exact time of the day.
    • Repeat task every – It shows the number of times a task should run after a trigger is fired.
      • Repeat task every – Time interval between each task repetition
      • For a duration of- How long a task should continue to repeat
    • Stop task if it runs longer than- If the task runs longer than the expected time or never quit, task will automatically stop if it reaches the mentioned time limit.
    • Expire – After the time period specified, the schedule won’t be triggered.

4.Then open the next tab ‘Actions’ and click the ‘New’ button.

  • In the Action drop-down, “Start a program” is set by default. You can change it if required.
  • Using Browse, select program/script field. To schedule a script, we need to select powershell.exe.
    You can find powershell.exe in your system32\WindowsPowerShell\v1.0 folder.
  • In ‘Add arguments’, -File parameter is the default one so simply specify the script path. For example, I am going to schedule a script that exports Office 365 users MFA status report.

1

c:\GetMFAStatus.ps1

If the path contains any blank space, it should be enclosed with quotes.

5.Once configured, you can specify conditions to determine whether the task should run. The task will not run if any condition specified here is not true.

6.On the Settings tab, you can set additional advanced settings to control the task execution.

Finally, click Ok to create a scheduled script.

Scheduled script will run as expected according to your schedule without any issue. If you want to check script execution, you can click Run by right-clicking task name.

Automate PowerShell Script from Task Scheduler with Parameters

If you want to schedule the PowerShell script with parameters, use the below format.

1

Script path -Param 1 Value1 -Param2 “Value 2”

For example, I am going to automate one of our PowerShell script: Export Office 365 Users MFA status report

During schedule, you can explicitly pass the credential as parameters as shown below:

1

C:\GetMFAStatus.ps1 -UserName “XXX XX” -Password ****

If the parameter value has blank space, values should be enclosed with quotes.

If you want to pass a switch parameter, you can use below syntax.

1

C:\GetMFAStatus.ps1 -EnabledOnly

Above script exports Office 365 users MFA status whose MFA status is enabled. Here -EnabledOnly is a switch parameter.

For more Office 365 related PowerShell scripts, you can refer O365Reports.com blog.

Method 2: Schedule PowerShell Script from Task Scheduler Using PowerShell

Instead of GUI, you can use PowerShell cmdlets to create schedule task that automate PowerShell script. It involves following steps,

1.Define time for scheduler

2.Set Actions to be performed during execution

3.Save scheduler

Define Time for Scheduler:

New-SchdeuledTaskTrigger creates a scheduled task trigger object. Using this cmdlet, you can specify starting time of a task or starting a task multiple times on a daily or weekly basis.

1

$Time=New-ScheduledTaskTrigger -At 4.00PM -Once

Above cmd creates a scheduled task trigger that starts at 4PM and run once.

1

$Time=New-ScheduledTaskTrigger -At 4.00PM -Daily -DaysInterval 2

Above cmd creates a scheduled task trigger that starts every 2 days at 4PM

Set Actions to be Performed During Execution:

New-SchdeuledTaskAction represent actions that executed when Task Scheduler runs the task. A task can have single action or a maximum of 32 actions. When you specify multiple actions, task Scheduler executes a task sequentially.

1

$Action=New-ScheduledTaskAction -Execute PowerShell.exe -WorkingDirectory C:/Scripts -Argument “C:\Scripts\MFAStatus.ps1 -UserName XXXX -Password ��

This command opens a PowerShell and change the directory to C:/Scripts and then invoke the MFAStatus.ps1 script.

Save Scheduler:

Register-ScheduledTask saves the scheduled task on a local computer.

1

Register-ScheduledTask -TaskName “Schedule MFA Status Report” -Trigger $Time -Action $Action -RunLevel Highest

The above cmd saves a scheduled task with a name “Schedule MFA Status Report” in the root folder. The saved task uses the pre-created action and trigger values that are specified by $Action and $Time variables.

Component-Based Servicing (cbs.log) causes all drive space to be consumed

Because I’ve seen this question asked in many places and not answered, I thought I’d post my issue and resolution here.  I regard this as a Bug, but I’m not invested enough to deal with the support incident process.

I’ve had repeated instances where a Windows 7 x64 client runs out of hard drive space, and found that C:\Windows\TEMP is being consumed with hundreds of files with names following the pattern “cab_XXXX_X”, generally 100 MB each, and these files are constantly generated until the system runs out of space.  Upon removing the files & rebooting, the files start being generated again.

I’ve found that this is caused by large Component-Based Servicing logs.  These are stored at C:\Windows\Logs\CBS.  The current log file is named “cbs.log”.  When “cbs.log” reaches a certain size, a cleanup process renames the log to “CbsPersist_YYYYMMDDHHMMSS.log” and then attempts to compress it into a .cab file.

However, when the cbs.log reaches a size of 2 GB before that cleanup process compresses it, the file is to large to be handled by the makecab.exe utility.  The log file is renamed to CbsPersist_date_time.log, but when the makecab process attempts to compress it the process fails (but only after consuming some 100 MB under \Windows\Temp).  After this, the cleanup process runs repeatedly (approx every 20 minutes in my experience).  The process fails every time, and also consumes a new ~ 100 MB in \Windows\Temp before dying.  This is repeated until the system runs out of drive space.

This can be reproduced by trying to manually create the cab file –

Directory of C:\CBS-BAK
12/11/2019  12:28 PM    <DIR>          .
12/11/2019  12:28 PM    <DIR>          ..
12/11/2019  12:12 PM     2,491,665,966 CbsPersist_20150823021618.log

C:\CBS-BAK>makecab CbsPersist_20150823021618.log
Cabinet Maker – Lossless Data Compression Tool
86.19% – CbsPersist_20150823021618.log (1 of 1)
ERROR: (FCIAddFile)Data-size or file-count exceeded CAB format limits

C:\CBS-BAK>dir %TEMP%\cab*
Volume in drive C is OSDisk
Volume Serial Number is 44DE-0CDD
Directory of C:\Users\USERNAME\AppData\Local\Temp
08/26/2015  02:31 PM       102,786,654 cab_4556_2

12/11/2019  12:28 PM        12,978,919 cab_5860_2
12/11/2019  12:27 PM                 0 cab_5860_3

To resolve this –

Stop the Windows Modules Installer (TrustedInstaller) service

Delete or move the large Cbspersist_XX.log file out of \Windows\Logs\CBS.

Start the Windows Modules Installer (TrustedInstaller) service

How to Disable/Enable Internet Options Tabs in Internet Explorer

As an IT guy, I always encounter problems when untrained users tweak their Internet connection settings.  They always make a mistake somewhere and sometimes the solution is to just keep them away from the Internet Options dialog box altogether.

I have worked at many companies that hide the Internet Options tab in Internet Explorer to discourage users from changing the options, which makes sense since network admins are the only ones who are supposed to access these options.

In a controlled environment, companies usually allow only one type of browser like Internet Explorer and those companies usually don’t allow their employees to change the Internet Options like default the homepage and proxy server.

Below is a typical Internet Options window:

clip_image001

There are several ways to disable the Internet Options tabs in IE and I’ll explain the different methods in this post. The first method uses Group Policy, but will only work if you have the Pro or Ultimate versions of Windows. If you are running Home or Home Premium, then skip down to the registry section.

Disable Internet Options in IE via Group Policy

To disable any tab in the Internet Options window, follow these steps below:

Step 1: Click Start and type GPEDIT.MSC in the search bar and hit enter to launch the Group Policy editor window.

clip_image002

Step 2: In the Local Group Policy editor window expand User Configuration > Administrative Templates > Windows Components > Internet Explorer then click on Internet Control Panel.

clip_image004

Step 3: On the right pane of the window, double click on the item you want to disable. For example, to disable the Advanced tab, double click on Disable the Advanced page option.

clip_image006

Step 4: In the properties window, click on the Enabled option and click OK. The Advanced tab in the Internet Options window will now be disabled and removed.

clip_image007

Step 5: Follow the previous steps to disable other items in the Internet Options window. To enable items, just select the Not Configured option in the properties window and click OK.

There you have it!  For less savvy computer users who don’t know about GPEDIT, it should discourage them from changing the advanced settings in IE.

Disable IE Options via Registry Editor

The second way to disable tabs in IE options is to use the registry editor. This is a bit more complicated, but is the only option if you can’t access group policy editor.

You can open the registry editor by clicking on Start and typing in regedit. Once there, navigate to the following key:

HKEY_CURRENT_USER\Software\Policies\Microsoft

Note that if you want to disable this option for all users on the PC, navigate to the same key, but under HKEY_LOCAL_MACHINE.

If there isn’t already a key called Internet Explorer under Microsoft, you’ll have to create it manually. Just right-click on Microsoft and choose NewKey. At this point, there are two options. If you want to disable the entire Internet Options dialog, you can create another key under Internet Explorer called Restrictions.

clip_image009

Lastly, you’ll create a new DWORD value in the right-pane inside Restrictions called NoBrowserOptions. Give that a value of 1 and restart Internet Explorer. If you try to go to Internet Options, it will give you an error message.

clip_image010

If you don’t want to disable the whole dialog, but instead just a few of the tabs, then you should create a new key called Control Panel under Microsoft instead of Restrictions. Inside of that, you’ll create DWORD entries that correspond to the tabs:

AdvancedTab

ConnectionsTab

ContentTab

GeneralTab

PrivacyTab

ProgramsTab

SecurityTab

clip_image012

As you can see above, I created the Control Panel key under Internet Explorer and then created a DWORD entry in the right-pane called AdvancedTab with a decimal value of 1. This removed just the advanced tab from the IE options window.

Hopefully, these methods will allow you to gain more control over Internet Explorer advanced settings in your environment. If you’re having issues, feel free to comment and I’ll try to help. Enjoy!

Troubleshooting Failed Login Attempts in Windows Active Directory Server

On Event Viewer, we should look for the following information (filter Security log):

Security log, events 4625 and 4771 (format for filtering is: 4625,4771).

We need to filter for these two events since we don’t know if the user failed to authenticate using NTLM (4625) or Kerberos (4771).

References:

4625(F): An account failed to log on

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

4771(F): Kerberos pre-authentication failed

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771

With a view containing only events 4625 and 4771 we can then search (Find…) the user we are troubleshooting.

We should be looking for and see the following information on each of events.

4625:

You can refer to the article above for a full description on the Status and Sub-Status codes.

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 5/21/2019 10:40:19 AM

Event ID: 4625

Task Category: Logon

Level: Information

Keywords: Audit Failure

User: N/A

Computer: DC2.contoso.local

Description:

An account failed to log on.

Subject:

Security ID: NULL SID

Account Name: –

Account Domain: –

Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed:

Security ID: NULL SID

Account Name: test2016 à This should be showing the account you are troubleshooting.

Account Domain: WIN2K16MEMBER

Failure Information:

Failure Reason: Unknown user name or bad password.

Status: 0xC000006D à These are the fields you should be looking also.

Sub Status : 0xC0000064 à We can have either 0xC0000064 or 0xC000006A

Process Information:

Caller Process ID: 0x0

Caller Process Name: –

Network Information:

Workstation Name: WIN2K16MEMBER à This might not show on this event but if it does this is where the bad password is coming from.

Source Network Address: 192.168.0.31 à This might not show on this event but if it does this is the IP where the bad password is coming from.

Source Port: 49735

Detailed Authentication Information:

Logon Process: NtLmSsp

Authentication Package: NTLM

Transited Services: –

Package Name (NTLM only): –

Key Length: 0

If the above event does not show the Network Information details, you will have to enable the Netlogon debug log to have more tracing and NTLM authentication information.

You can refer to the following article for the full instructions on how to enable and disable Netlogon

debugging:

Enabling debug logging for the Netlogon service

https://support.microsoft.com/en-us/help/109626/enabling-debug-logging-for-the-netlogon-service

Although, enabling and disabling Netlogon debugging is quite easy but should only be enabled for troubleshooting purposes and disabled afterwards:

Enable Netlogon debug:

From an elevated command prompt (as administrator), run the following command:

nltest /dbflag:2080ffff

Disable Netlogon debug:

From an elevated command prompt (as administrator), run the following command:

nltest /dbflag:0x0

The netlogon debug log can then be found under C:\Windows\debug\netlogon.log

On the netlogon debug log we should look for (find…) the user we are troubleshooting and should be able to find information similar to the bellow:

08/15 16:38:22 [LOGON] [608] C ONTOSO: SamLogon: Generic logon of CONTOSO.LOCAL\test2016 from ( WIN2K16MEMBER ) (via JUMPSERVER) Returns 0xC000006A

This entry tells you where the bad password came from.

4771:

You can refer to the article above for a full description on the Failure Codes.

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 7/26/2019 11:47:11 AM

Event ID: 4771

Task Category: Kerberos Authentication Service

Level: Information

Keywords: Audit Failure

User: N/A

Computer: DC2.contoso.local

Description:

Kerberos pre-authentication failed.

Account Information:

Security ID: CONTOSO\Administrator

Account Name: Administrator à This should be showing the account you are troubleshooting.

Service Information:

Service Name: krbtgt/CONTOSO

Network Information:

Client Address: ::ffff: 192.168.0.4 à This might not show on this event but if it does this is the IP where the bad password is coming from.

Client Port: 49908

Additional Information:

Ticket Options: 0x40810010

Failure Code : 0x18 à This is the Failure Code we should be looking for: The wrong password was provided.

Pre-Authentication Type: 2

Certificate Information:

Certificate Issuer Name:

Certificate Serial Number:

Certificate Thumbprint:

This was the easy part!

The hard part is often to troubleshoot from the client side as we don’t have any specific procedure to understand what is sending the bad passwords.

An application? A Scheduled Task? A script?

Can be either and/or all of them and for that reason we often need to revisit the client workstation to continue searching for the culprit(s).

Sometimes it is a middle device that connects the user to Exchange, SQL or any other resource and the same steps needs to be taken on each device in the middle that will bring us back to the originating source.

More information:
You can also check the bellow articles for more information on troubleshooting information and tips regarding account lockouts:

Active Directory: Bad Passwords and Account Lockout

https://social.technet.microsoft.com/wiki/contents/articles/32490.active-directory-bad-passwords-and-account-lockout.aspx

Active Directory: Troubleshooting Frequent Account Lockout

https://social.technet.microsoft.com/wiki/contents/articles/23497.active-directory-troubleshooting-frequent-account-lockout.aspx

Troubleshooting account lockout the PSS way

https://blogs.technet.microsoft.com/instan/2009/09/01/troubleshooting-account-lockout-the-pss-way/

how-to-disable-inactive-user-accounts-using-powershell

Inactive Active Directory (AD) user accounts can pose a security risk to organizations, in situations such as when former employees still have active accounts months after leaving the company because HR failed to inform IT, or accounts might be created for a particular purpose but never deleted after the event. Whatever the reason for the existence of such accounts, Active Directory can quickly get out of control, in turn making your systems harder to audit and less secure.

Active Directory Module for PowerShell

The PowerShell module for Active Directory allows system administrators to query Active Directory and generate reports using the resulting data. The AD module for PowerShell is installed by default on Windows Server 2012 domain controllers, or alternatively you can download the Remote Server Administration Tools (RSAT) for Windows 8.1 and install the module using the command below.

Log in as a local administrator, open a PowerShell prompt, type the code below and press ENTER to install the AD module for PowerShell:

Install-WindowsFeature RSAT-AD-PowerShell

Search Active Directory for Inactive Accounts

The Search-ADAccount cmdlet provides an easy way to query Active Directory for inactive user accounts:

Search-ADAccount –UsersOnly –AccountInactive

clip_image002Figure 1

The above command returns all inactive accounts. To narrow down the results to a specific time range, you can add the –TimeSpanparameter to Search-ADAccount. In the example below, a variable defines the value for the –TimeSpan parameter, using the New-Timespan cmdlet to simplify the input:

$timespan = New-Timespan –Days 90

Search-ADAccount –UsersOnly –AccountInactive –TimeSpan $timespan

Alternatively, you can specify the –DateTime parameter to return accounts that have been inactive since a given date. In the command that follows, accounts not active since May 5th 2014 are returned:

Search-ADAccount –UsersOnly –AccountInactive -DateTime ‘5/20/2014’

To get more user-friendly information about the accounts, pipe the results to the Get-ADUser cmdlet and then choose the columns to display in the output using Select:

Search-ADAccount –UsersOnly –AccountInactive | Get-ADuser -Properties Department,Title | Select Name,Department,Title,DistinguishedName

clip_image004Figure 2

The results can also be sorted by a specified field, in this example by the LastLogOnDate attribute, which is derived from the LastLogonTimestamp and converted into a readable format:

Search-ADAccount –UsersOnly –AccountInactive | Get-ADuser -Properties Department,Title | Sort LastLogOnDate | Select Name,Department,Title,DistinguishedName

It’s worth noting that unlike the LastLogOn attribute, LastLogonTimestamp is synchronized between domain controllers, but can be 9 to 14 days out-of-date, so you should bear this in mind when processing your results.

Another way to simplify the output and count the number of inactive users is to pipe the results to the Measure cmdlet:

Search-ADAccount –UsersOnly –AccountInactive –TimeSpan $timespan | Measure

As with any other PowerShell cmdlets, the results can be piped to Out-GridView, or to a comma-delimited file so that the results can be imported into Excel.

Search-ADAccount –UsersOnly –AccountInactive –TimeSpan $timespan | Out-GridView

Disable Inactive Accounts

Once you’ve got the set of results you’re looking for, all you need to do is pipe them to the Disable-ADAccount cmdlet as shown here to disable the accounts:

Search-ADAccount –UsersOnly –AccountInactive –TimeSpan $timespan | Disable-ADAccount

How to Disable IPv6 Using Registry Editor

Press the Windows Key and the R key at the same time to bring up the Run dialog box.



Type regedit in the Run dialog box and click OK



Use Registry Editor to expand the registry tree and browse to:

\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters



Right click on Parameters, expand New, and select DWORD (32-bit) Value



Enter DisabledComponents into the Name field



Double click on the new DisabledComponents value, enter ffffffff into the Value data dialog box, and click theOK button



Confirm the new registry value contains the required data.



After restarting the computer, run ipconfig again at the command prompt to confirm that IPv6 is disabled.

September 2015 Release of MFCMAPI and MrMAPI

The September 2015 Release (build 15.0.0.1043) is live: http://mfcmapi.codeplex.com.

It’s amazing – how much I don’t get to work on MFCMAPI when I’m no longer in Developer Support. That’s no excuse for leaving it alone for a year! I did patch quite a bit in the past year.



Here’s a change list – see the Issue Tracker and ChangeSets on Codeplex for more details:

  • SmartView: Completely rewrote the engine to be much more modular and easier to maintain
  • MrMAPI: Fixed several crashes, leaks, and hangs
  • Migrated a metric ton of old CString and manual string handling to wstring
  • Performance: Did a whole bunch of performance tweaks – everything should be much snappier