SCCM 2012 R2 with once CAS and 4 primary sites having issues with delayed patching and scan failures.

Hi All,

I had issues with SCCM and upon checking with Microsoft they told to do WSUS cleanup activity on all and we did below steps.

cleanup activities on WSUS server.

Backup the WSUS database
Run the WSUS Server Cleanup Wizard
Re-index the WSUS database.
Decline Superseded updates
Delete Obselete updates from Database

After performing these activities All the sites (A,B,D performing normal Expect Site C.Microsoft telling us to wait and it almost two weeks we didn't see any progress.now Microsoft telling to offload wsus role to new server which cannot be done due to additional cost for getting VM host resource.

below are Site details.

Site A( managing 8000 Clients)

Site B(Managing 1000 Clietns)

Site C(Managing 3000 Clients)

Site D (managing 1000 Clients)

Site C is still having issues even after WSUS maintenance can some one help why this site still having issues also any more troubleshooting can be done instead of offloading wsus role to new server.

Moved by TorstenMMVP Tuesday, June 20, 2017 6:21 AM
Changed type Shaik537 Tuesday, June 20, 2017 3:26 PM

Reply:

First off, you have posted to the wrong forum this is to CMCB and not CM12. Wait for one of the moderators to move it to the right forums.

Secondly, you don't need a CAS with so few clients. When you move to CMCB, you should move to a single primary site.

Thirdly, what exactly isn't working at Site C?

Garth Jones

Blog: http://www.enhansoft.com/blog Old Blog: http://smsug.ca/blogs/garth_jones/default.aspx

Twitter: @GarthMJ Book: System Center Configuration Manager Reporting Unleased

------------------------------------
Reply:

Site A( managing 8000 Clients)

Site B(Managing 1000 Clietns)

Site C(Managing 3000 Clients)

Site D (managing 1000 Clients)

That's 13k clients in total? Using a CAS is the least optimal design then. Plus moving the thread the the CM12 forums ...

Please add Details about what's not working.

Torsten Meringer | http://www.mssccmfaq.de

------------------------------------
Reply:

Hi All,

we have one CAS and four Primary Site Servers.all of sudden SCCM Clients patches getting delayed and exceeding normal time for patches to install on client machines.Later we came to know WSUS maintenance activity was not performed so we did that on all the Site servers and also on CAS Server.

WSUS cleanup:

Backup the WSUS database
Run the WSUS Server Cleanup Wizard
Re-index the WSUS database
Decline superseded updates
Delete Obsolete updates from Database

After performing WSUS cleanup we still have still with one of the site. can anyone please let me know what else can be done at this site where we haev issues.

Merged by Garth JonesMVP Tuesday, June 20, 2017 9:04 PM duplicate thread

------------------------------------
Reply:

Hi Iam new here,

At site C still Client Scan and patch installation is delayed and exceeding normal times basically it's very slow. so we took all the necessary troubleshooting steps like WSUS cleanup and it worked all sites except Site C and it's still having issues.could you please help.

------------------------------------
Reply:

Without and error message there isn't a lot anyone can do to help you.

Garth Jones

Blog: http://www.enhansoft.com/blog Old Blog: http://smsug.ca/blogs/garth_jones/default.aspx

Twitter: @GarthMJ Book: System Center Configuration Manager Reporting Unleased

------------------------------------

PowerPivot or SSAS Tabular - importing Dynamics 365 data for reporting

I am trying to use Dynamics 365 OData feed URL in (Office 365) PowerPivot (using From OData Data Feed), but getting the following error -<v:shapetype coordsize="21600,21600" filled="f" id="_x0000_t75" o:preferrelative="t" o:spt="75" path="m@4@5l@4@11@9@11@9@5xe" stroked="f"><v:stroke joinstyle="miter">
<v:formulas> <v:f eqn="if lineDrawn pixelLineWidth 0">
<v:f eqn="sum @0 1 0">
</v:f></v:f></v:formulas></v:stroke></v:shapetype>

<v:shapetype coordsize="21600,21600" filled="f" id="_x0000_t75" o:preferrelative="t" o:spt="75" path="m@4@5l@4@11@9@11@9@5xe" stroked="f"><v:stroke joinstyle="miter"><v:formulas><v:f eqn="if lineDrawn pixelLineWidth 0"><v:f eqn="sum @0 1 0">How do I resolve it?</v:f></v:f></v:formulas></v:stroke></v:shapetype><v:shapetype coordsize="21600,21600" filled="f" id="_x0000_t75" o:preferrelative="t" o:spt="75" path="m@4@5l@4@11@9@11@9@5xe" stroked="f"><v:stroke joinstyle="miter"><v:formulas><v:f eqn="if lineDrawn pixelLineWidth 0"><v:f eqn="sum @0 1 0"> </v:f></v:f></v:formulas></v:stroke></v:shapetype>

Sonal<v:shapetype coordsize="21600,21600" filled="f" id="_x0000_t75" o:preferrelative="t" o:spt="75" path="m@4@5l@4@11@9@11@9@5xe" stroked="f"><v:stroke joinstyle="miter"><v:formulas><v:f eqn="if lineDrawn pixelLineWidth 0"><v:f eqn="sum @0 1 0"><v:f eqn="sum 0 0 @1"><v:f eqn="prod @2 1 2">
  <v:f eqn="prod @3 21600 pixelWidth">
  <v:f eqn="prod @3 21600 pixelHeight">
  <v:f eqn="sum @0 0 1">
  <v:f eqn="prod @6 1 2">
  <v:f eqn="prod @7 21600 pixelWidth">
  <v:f eqn="sum @8 21600 0">
  <v:f eqn="prod @7 21600 pixelHeight">
  <v:f eqn="sum @10 21600 0">
</v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:formulas>
<v:path gradientshapeok="t" o:connecttype="rect" o:extrusionok="f">
<o:lock aspectratio="t" v:ext="edit">
</o:lock></v:path></v:stroke></v:shapetype><v:shape alt="" id="Picture_x0020_1" o:spid="_x0000_i1025" style="width:336pt;height:246.6pt;" type="#_x0000_t75">
<v:imagedata o:href="cid:image001.png@01D2E9CD.C94E6010" src="file:///C:/Users/junnasx/AppData/Local/Temp/msohtmlclip1/01/clip_image001.png">
</v:imagedata></v:shape>

Media Feature Pack doesn't work on Windows 10 Pro N (x64) build 10586.3

After the upgrade to the last version of Windows 10 Pro N, Media Feature Pack doesn't work.

I have downloaded and installed the package from https://www.microsoft.com/en-US/download/details.aspx?id=48231, but Groove and other software, for example pdf reader on Edge tell me to install Media Feature Pack although it is already installed.

Reagards

Alberto

Reply:

Could you create another User Account with Admin privileges and recheck the issue?

S.Sengupta, Windows Experience MVP

------------------------------------
Reply:

Thank you for the quick reply!

But with other new account with administartor privileges the issue isn't resolved

------------------------------------
Reply:

Thank you for the quick reply!

But with other new account with administartor privileges the issue isn't resolved

There is an updated version of Media Feature Pack. Kindly install it.

http://www.microsoft.com/en-us/download/details.aspx?id=49919

S.Sengupta, Windows Experience MVP

------------------------------------
Reply:

With this update the issue is been resolved! Thank you!

------------------------------------
Reply:

Thanks for providing the link to the updated version of Media Feature Pack. I have been trying for days (since the last Win 10 update) to get icloud to work with Win 10 again and this was what was needed to get it to once again work.

------------------------------------
Reply:

Is there a more recent version? In any case, when I try to install this I get the alert "Feature Pack for Windows (KB3010081) is already installed on this computer". But there is still no WMP & a search for "Feature Pack" gives nothing.

------------------------------------
Reply:

I've the same question. I tried to install all version of the feature pack I could find. But there is no Media Player to activate, no indecations of a media pack...

------------------------------------

Forums editor problem wont start a new line at the end of the post sometimes...

Dear Microsoft,

I posted this problem here and the very helpful forum members gave me many work arounds trying to help.

https://social.msdn.microsoft.com/Forums/vstudio/en-US/e5a99270-37e2-4469-add3-bfe14e50774c/forum-editor-problems?forum=vbgeneral

Then I had these thoughts:

Ok thanks gang.

BTW Microsoft, when my customers report a problem I dont tell them use the competitions software then. Or go edit the work you do for us in html then. Or go post it in a dead forum somewhere then.

I use the browser that came with my windows. I figured it would work on a microsoft forum.

PS I love Visual Studio and the MS forums !!!!

Edited by tommytwotrain Tuesday, June 20, 2017 3:16 PM

Reply:

I use the browser that came with my windows. I figured it would work on a microsoft forum.

You didn't say what version but I believe IE9 or later and Edge browsers are the current microsoft browsers supported.

Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management

Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

------------------------------------
Reply:

I use the browser that came with my windows. I figured it would work on a microsoft forum.

You didn't say what version but I believe IE9 or later and Edge browsers are the current microsoft browsers supported.

Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows Server] Datacenter Management

Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

I see. Thanks.

Here is what I was using when having the problem this morning on Win7 64. with all updates as far as I know.

------------------------------------
Reply:

Issue is pretty vague but should be no problem with IE11. Might try from another pc and or reset IE.

https://support.microsoft.com/en-us/help/17441/windows-internet-explorer-change-reset-settings

------------------------------------

powershell scripting

Great have fun

Edited by P Sinha Wednesday, June 21, 2017 9:45 AM
Moved by Bill_Stewart Wednesday, June 21, 2017 3:37 PM Unanswerable drive-by question

Reply:

You script makes absolutely no sense. There is no way to even guess what it is supposed to do.

It appears that you copied this from a web page and the code is badly broken and missing important pieces.

We do not fix code copied from the web.

See the following for guidance: This forum is for scripting questions rather than script requests

\_(ツ)_/

------------------------------------
Reply:

Sorry, the "question" still makes no sense.

-- Bill Stewart [Bill_Stewart]

------------------------------------
Reply:

Sorry, but this is not a free consulting forum, and we can't answer questions about your automation tool.

-- Bill Stewart [Bill_Stewart]

------------------------------------

SCCM 1702 Primary site or Secondary site on multiple locations?

Hi,

We have 4 office on different locations

USA, UK, Germany, Australia

I have to deploy SCCM 1702 for all these locations. My question is should I configure primary sites on each location?OROne primary site on one location and secondary sites on other three location?

What could be the best solution in this case?

Kindly tell me the reason also with your suggestion.

Thanks in advance

Regards,

Ali

Edited by Ali-N Tuesday, June 20, 2017 2:22 PM

Reply:

Hi,

It depends on number of clients, WAN speed as well. But try to avoid a CAS as it will increase the complexity so if you don't need it because you exceed the number of clients... a secondary site is one option but again more information on number of clients and so on would be welcome to give you a better answer.

Regards,
Jörgen

-- My System Center blog ccmexec.com -- Twitter @ccmexec

------------------------------------
Reply:

Hi Jörgen

Thank you for your prompt reply.

Number of clients is around 150 in each office. So total clients would be 600-650.

WAN speed is much better among USA, Germany and UK offices. But Australia office connectivity with UK and Germany is good (above average) but not much better.

I am not going for CAS.

I m more concerned about management and configuration of all SCCM sites to choose Primary-Secondary model or each site should be primary?

One more thing that Primary site contains centralized MS SQL database of each site?

Best Regards,

Ali

------------------------------------
Reply:

For each site to be a primary, you would need a CAS. Thus, no each site in no way needs to be a primary site.

With the number of clients you have, I wouldn't even use secondary sites either. A simple DP in each office should be sufficient.

Jason | http://blog.configmgrftw.com | @jasonsandys

------------------------------------

Proxying RPC/HTTP using a Hardware LB

Hello,

We have a 4-node DAG. Each node is a multi-Role and all sitting behind a HWLB (See Picture). My mailbox is on MBX-CAS1 which has active DBs. I am using outlook 2010 in online mode pointing to a VIP on the HWLB which then proxies me to my mailbox server. I noticed that sometimes if I reboot MBX-CAS2 (passive node or any passive node in the DAG) my outlook freezes for few seconds, sometimes up to a minute and then becomes responsive. I am assuming it's because the HWLB is point traffic randomly to MBX-CAS2. The question I have is:

1- What is the behavior I should see when we have no Session Affinity on the HWLB?

2- What is the behavior I should see when we have Session Affinity on the HWLB?

Reply:

Let's step back a second - how are your mailbox databases configured, WRT the RPCClientAccessServer setting? Is it pointing to the VIP, or to your individual servers?

That being said, and assuming you point to the VIP, the HWLB can't determine if your Exchange server is available, so unless you drain the systems and ensure there are no connections going through it, the HWLB will hold the connection until your server won't ping. Then, when your client first goes on to the next server, it will re-authenticate and determine where it "left off" before it gives you the reins again. Something that can speed this is to use Kerberos for the HWLB namespace, and to do this, you need to follow the guidance in the following: https://technet.microsoft.com/en-us/library/ff808313(v=exchg.141).aspx

Will Martin ...
-join ('77696c6c406d617274696e2d66616d696c6965732e6f7267' -split '(?<=\G.{2})' | ? { $_ } | % { [char][int]"0x$_" })

------------------------------------
Reply:

We are using a VIP mapped to a name space outlook client ---> outlook.domain.local (Name space in outlook anywhere setting) ----> VIP (HWLB) ---> Random MBX/CAS Servers in the DAG. Did I mention these are Exchange 2013 servers? So RPCClientAccessServer should not really be a factor here unless I am missing something. I guess my questions still stand though. what happens with and without session affinity on the HWLB.

Edited by Mike Logan Tuesday, May 30, 2017 5:06 PM

------------------------------------
Reply:

Ex2013 doesn't need session affinity. Is your load balancer checking the healthtest.htm web page for the service? If it is, it should catch the server going offline and immediately move the connected clients to other systems. I take it that your certificates on your Exchange servers are internally signed, since no externally trusted certificate will allow you to have a .local namespace. Is this cerrtificate also installed on your HNLB appliance?

And the RPCClientAccessServer setting is still used by Ex2013 for determining what system the clients connect to, unless you have forced OL Anywhere both internally and externally.

Will Martin ...
-join ('77696c6c406d617274696e2d66616d696c6965732e6f7267' -split '(?<=\G.{2})' | ? { $_ } | % { [char][int]"0x$_" })

------------------------------------
Reply:

I get that Ex2013 does not need Affinity. What happens if the HWLB is configured with affinity. Does Exchange just ignore it? Our HWLB is checking the healthtest.htm so based on what you are saying it should move the client onto the next CAS and start proxying which is not happening. Do client need re authenticate with the next CAS? Our cert is internally signed and it's not installed on the HWLB. Do we need to even if we are not offloading SSL at the HWLB level?

------------------------------------
Reply:

If the HWLB isn't inspecting traffic (and it appears from your explanation of your architecture that it isn't - otherwise, the clients wouldn't be able to connect in the first place), it won't need the internal certificate installed on it.

Now, have you tested your HWLB to determine how long it takes it to determine that one of your servers isn't responding?

Will Martin ...
-join ('77696c6c406d617274696e2d66616d696c6965732e6f7267' -split '(?<=\G.{2})' | ? { $_ } | % { [char][int]"0x$_" })

------------------------------------

Security-SPP Event 16385 Error 0x80070005

I am getting these error messages twice a minute in the Application Log on my Server 2012 RC:

Log Name: Application  Source: Microsoft-Windows-Security-SPP  Date: 7/18/12 6:27:46 PM  Event ID: 16385  Task Category: None  Level: Error  Keywords: Classic  User: N/A  Computer: E35M1m-Server.Borg.local  Description:  Failed to schedule Software Protection service for re-start at 2013-01-01T23:58:46Z. Error Code: 0x80070005.

From what I can tell, this is an access is denied message. I checked the policy RSOP and the SPPsvc is run by Network Service which has all the required privileges SeAuditPrivilege, SeChangeNotifyPrivilege, SeCreateGlobalPrivilege, and SeImpersonatePrivilege.

Has anyone else seen this? Does anyone have any ideas what is causing this?

Thanks, Brian

Changed type Brian Borg Wednesday, July 18, 2012 11:41 PM
Edited by Brian Borg Wednesday, July 18, 2012 11:43 PM
Changed type Brian Borg Tuesday, July 24, 2012 6:40 AM

Reply:

Hi,

Please make sure that the Task Scheduler service is started.

If it does not work, please also backup, export the following registry from another working Windows Server 2012 RC server and import to the problematic one to check the result.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Schedule

Regards,

Arthur Li

TechNet Community Support

------------------------------------
Reply:

Thank you, Arthur

I had been looking at the Schedule Service and the RequiredPrivileges versus RSOP. They seem to all be either the default, explicitly permitted, or inherent for Local Service:

SeIncreaseQuotaPrivilege       Adjust memory quotas for a process
SeChangeNotifyPrivilege        Bypass traverse checking
SeAuditPrivilege               Generate security audits
SeImpersonatePrivilege         Impersonate a client after authentication
SeAssignPrimaryTokenPrivilege Replace a process-level token
SeTcbPrivilege                 Act as part of the operating system
SeRestorePrivilege             Restore files and directories

Some of them are "Not Defined". I assume they would take their defaults but I could be wrong. Do you think I should make sure all of them are defined?

When I tried to import an exported .reg file for the Scheduler Service I got an instant blue screen with SYSTEM_SERVICE_EXCEPTION. I tried to stop the service but I cannot, not even by using sc in an elevated command prompt. I guess I will have to do it offline.

------------------------------------
Reply:

Importing it offline did not work either.

This error message is like the pink bunny that keeps on going, and going.

------------------------------------
Reply:

I tried sfc, sfc offline, and inplace upgrade. Sfc reports no problems but upgrade fails. I might have to start over.

------------------------------------
Reply:

Hi,

If so, I agree with you to backup all the important data and reinstall the system.

Regards,

Arthur Li

TechNet Community Support

------------------------------------
Reply:

Hello.

Please check Volume Shadow Copy service if it is started. If it is not started, go and start the process.

Regards,

Vladimir

------------------------------------
Reply:

Managed to fix this, I added full rights for network service user to C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform.

------------------------------------
Reply:

I'm seeing similar situation where such errors are logged every few seconds, 2-3 per min on 2012 std server. I checked the access right for C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform and they are same on the server where I'm seeing problem and on one where there is no problem. Network service doesn't have full right on either server.

------------------------------------
Reply:

Bom dia pessoal,

Estou passando pelo mesmo problema aqui.

Nosso servidor é licenciado com Win. Server 2008 Enterprise Edition R2 e não usamos DOMINIO.

Essa mensagem pode me gerar algum problema relacionado a software pirata?

Estou preocupado com isso, uma vez que minha rede é licenciada.

Att,

Att, A. Angeli

------------------------------------
Reply:

I got lots of the same errors on Windows 8 Pro:

"Failed to schedule Software Protection service for re-start at 2113-08-13T01:01:44Z. Error Code: 0x80070005."

I also got the same events with Error Code: 0x80070002 and a few others.

I was seeing error dialogs when I tried to view Task Scheduler.
The SvcRestartTask xml file (among others) in C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform folder was corrupted and broke the scheduled task.

The fix, in my case, was to delete the SvcRestartTask task in Task Scheduler.

Next, I made sure the SvcRestartTask file was removed from C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform folder.

Then, since I had no spare Win 8 machine to obtain a clean copy of SvcRestartTask xml file, I found one on PasteBin via a Google search: http://pastebin.com/p06ErcTN

I copied the text from PasteBin and created a new text file and pasted the xml text in and saved it as SvcRestartTask.

Next I selected the SoftwareProtectionPlatform branch of Task Scheduler (Task Scheduler > Task Scheduler Library > Microsoft > Windows > SoftwareProtectionPlatform). I right clicked on it and selected Import Task...

I browsed to the folder where I created the new SvcRestartTask file, selected it and clicked Open.

When I checked the Event viewer all was good. The sppsvc service had started/stoppped properly and it automatically did all its validation. I saw no more Event 16385 errors.

Here is the complete, clean SvcRestartTask xml file:

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Source>$(@%systemroot%\system32\sppc.dll,-200)</Source>
<Author>$(@%systemroot%\system32\sppc.dll,-200)</Author>
<Version>1.0</Version>
<Description>$(@%systemroot%\system32\sppc.dll,-201)</Description>
<URI>\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask</URI>
<SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628)(A;;FR;;;S-1-5-87-2912274048-3994893941-1669128114-1310430903-1263774323)</SecurityDescriptor>
</RegistrationInfo>
<Triggers>
<CalendarTrigger>
<StartBoundary>2012-11-02T07:00:10Z</StartBoundary>
<Enabled>true</Enabled>
<ScheduleByDay>
<DaysInterval>1</DaysInterval>
</ScheduleByDay>
</CalendarTrigger>
</Triggers>
<Principals>
<Principal id="NetworkService">
<UserId>S-1-5-20</UserId>
<RunLevel>LeastPrivilege</RunLevel>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
<AllowHardTerminate>false</AllowHardTerminate>
<StartWhenAvailable>true</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>true</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
<UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
<Priority>7</Priority>
<RestartOnFailure>
<Interval>PT1M</Interval>
<Count>3</Count>
</RestartOnFailure>
</Settings>
<Actions Context="NetworkService">
<ComHandler>
<ClassId>{B1AEBB5D-EAD9-4476-B375-9C3ED9F32AFC}</ClassId>
<Data><![CDATA[timer]]></Data>
</ComHandler>
</Actions>
</Task>

Importing the task xml is the way to go.

I don't think copying the file to C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform folder will fix the problem.

I hope this helps someone.

------------------------------------
Reply:

It seems to have worked! Thanks.

Thanks, Mark

------------------------------------
Reply:

This worked for me as well. Item of note the folders under c:\windows\tasks did not even exist for me and after creating the folder structure, ensuring the security settings for Network service and local service was in place, and recreating the task by deleting it and creating the new xml file and pasting what you have here then stopping the sppsvc and starting the sppsvc cleared up the issue. Thanks for the time and effort you put into this and the solution.

------------------------------------
Reply:

Hi, one of my Windows Servers 2012 started to report exactly same error ("Failed to schedule Software Protection service")- would you recommend trying same fix?

How much difference (in design) there is between Windows 8 and Windows Server 2012?

------------------------------------
Reply:

I had the same problem with my Windows 8.1 the "failed to schedule..." and the date that it was trying to reschedule was about 14 days in the past. As the date changed so did the time and date of the error but always in the past.

I did three things, not all were good. This got rid of the error message.

#2 I removed the folder Windows\system32\tasks\softwareprotectionplatform ( bad move ). I did this as I couldn't find help on the original problem in that I could not get Window Defender virus definition updates.

#3, in order to get the defender virus definitions to download I had to install a missing update. MS has been messing around with this at recently, but I was missing both the latest and a prior update for unknown reasons, kb3135449 I believe.

------------------------------------
Reply:

I had a similar problem, and I solved following this link

http://www.edugeek.net/forums/windows-server-2012/175145-software-protection-service.html

------------------------------------
Reply:

This works on a Windows 10 Build 1607 [10.0.14393] Machine, thanks

------------------------------------

AD Migration - problems after

Hi,

preparing for AD Migration. Can you please type what problems can show up for users after migration? For Microsoft users and Office? I've got few in my mind but I want to also know your experience about it :)

thanks in advance!

wrong disk space showing

<p>Hi All,</p><p>One of Windows server 2008 R2 server showing wrong disk space.  On disk management it's showing 5GB on volume pane and 295GB on Disk pane. Actual size is 295GB. Please advice how to fix the issue. Attached is screen shot of the disk Management

WSFC stopped to communicate outside primary subnet

Hi All,

I have really strange issue happened yesterday and was take me a few ours to troubleshoot this with the networking team. My WSFC along with SQL AGL stopped to communicate outside primary subnet (communication was OK between two nodes on the same site, WSFC, AGL and Windows server file share witness). My network team detected as the requests successfully reaching WSFC and SQL AGL however was no responses back from it. We did failover between sites and AD resolving a new IP for both however was still no luck to reach it. The resolution was to remove Virtual IPs for each site and add them back in.

overview:

Site A

Node 1:

IP: 10.10.10.11

Mask: 255.255.255.0

DG: 10.10.10.1

Node 2:

IP: 10.10.10.12

Mask: 255.255.255.0

DG: 10.10.10.1

Site B

Node 3:

IP: 10.10.20.11

Mask: 255.255.255.0

DG: 10.10.20.1

Node 4:

IP: 10.10.20.12

Mask: 255.255.255.0

DG: 10.10.10.1

WSFC 10.10.10.22 or 10.10.20.22

SQL AGL 10.10.10.23 or 10.10.20.23

Keyboard popup automatic

Hey,

i use the RDP-Client on a Bluebird Scanner.

When im on my Machine (Windows 10) and im scanning a Barcode, the Keyboard automatic popup.

Is there a setting to fix it ?

Greetings SLS

Changed type Eva SeydlMicrosoft employee Tuesday, June 27, 2017 8:00 PM

Reply:

Hi,

What's the version of your RDP client?

Is it normal before?

Have you tried performing the same operation using another machine?

Best Regards,

Alvin Wang

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

------------------------------------
Reply:

Hi,

dont have this problem in other apps.

The Version is: 8.1.54.288

On a other VM i have the same problem.

Best Regards
SLS

------------------------------------
Reply:

Hi,

Please try to uninstall and reinstall the Android RDP client to have a test.

Also try a different Android device to have a test.

Best Regards,

Alvin Wang

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

------------------------------------
Reply:

HI SLS-DE!

Looks like some bar code readers are detected as external keyboard. You could try change the setting for the physical keyboard option in "Language & Input" > "Current Input Method".

Another thing you might try is to turn off sending scancode in our app and see if this changes the behavior of the on-screen keyboard. Open the Remote Desktop App and tap settings. In the general tap you will find this option.

Thank you.

Eva

------------------------------------
Reply:

Hi,

Just want to confirm the current situations.

Please feel free to let us know if you need further assistance.

Best Regards,

Alvin Wang

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

------------------------------------

Quit Script If User Does Not Enter Number in a Select Case Input

Hello Scripters,

I am working on a utility with very little input from the user. Mostly point and click. Most the user would need to do is enter a number which will correspond to a string of text which will be used to generate the commandline further down into the script.

I would like to introduce error handling which will end the script if the user enter anything else beside 1, 2 or 3. I have tried Select Case Else with no success.

I tried an example (excerpt below) found in the Microsoft WSH and VBScript Programming for the Absolute Beginner, 4th ed.

Select Case strAnswer   Case "rock"   If intGetRandomNumber = 3 Then strResults = "Tie"   If intGetRandomNumber = 2 Then strResults = "You Win"   If intGetRandomNumber = 1 Then strResults = "You Lose"   Case Else   objWshShell.Popup "Sorry. Your answer was not recognized. " & "Please type rock, paper, or scissors in all lowercase letters."   WScript.Quit  End Select

Thanks,

Thanks, CAZan

Changed type Bill_Stewart Tuesday, November 21, 2017 6:49 PM
Moved by Bill_Stewart Tuesday, November 21, 2017 6:49 PM This is not "do my homework for me" forumn

Reply:

Is this a homework question?

-- Bill Stewart [Bill_Stewart]

------------------------------------
Reply:

where ever you get the input from the user, run the check there. I know you're working in VBScript but in PowerShell, you could run something like the below:

do {$input = Read-Host "enter 1, 2 or 3"}while (("1","2","3") -notcontains $input)

Hopefully, this gives you some inspiration :)

Edited by I.T Delinquent Monday, June 12, 2017 4:00 PM

------------------------------------
Reply:

Homework Question?

Thanks, CAZan

------------------------------------
Reply:

Hi Mark,

Unfortunately, I have to stick with the VBScript. Everything else is working except for this. I actually performed a check on the Input with an IF THEN for as little as "", no input. That didn't work out.

Thanks, CAZan

------------------------------------
Reply:

Your question and code make no sense. Try asking a complete question or describe what you want to do in a way that makes sense.

strNum = "2"  num = CInt(strNum)    if num >= 1 and num <= 3 Then   ' good number  Else   ' bad number  End If

\_(ツ)_/

Edited by jrv Monday, June 12, 2017 11:17 PM

------------------------------------
Reply:

It was a broad question to prompt a variety of options. I didn't want to be too specific. I used an excerpt from a script referenced in a scripting book. But, if you are having trouble following me on this, I'll try again.

I wanted to know if anyone had worked on this type of method where they wanted the script to quit when the user didn't enter anything into the Input box. It seems to work all right if anything else is entered besides 1,2 and 3 as in numbers. Text and no characters seems to be ignored and it defaults to the first item, "MD5".

Thanks, CAZan

Edited by CAZan Tuesday, June 13, 2017 12:00 AM

------------------------------------
Reply:

if strInput = "" Then Wscript.Quit 99

\_(ツ)_/

------------------------------------
Reply:

Unfortunately, I have to stick with the VBScript.

Why?

-- Bill Stewart [Bill_Stewart]

------------------------------------
Reply:

I have restrictions in my environment, which allows more flexibility with VBScript. I can do quite a bit with VBScript. I did come across a method to use a .NET form with PowerShell. It has a very nice lay out with radio buttons and such. But, PowerShell is highly restricted due to GPOs running in the domain.

What were your thinking as an alternate option. Now, this question was only dealing with a smaller part of a larger script. In this part of the script, I needed to create options which would ultimately become command-line options further down into the script.

After doing some more research into what I was doing, I had a funny feeling I was running my test in the wrong place. Needed to run it outside of the Select Case to remove any non-numeric characters and null entries. So, below is what I came up with.

strAnswer = InputBox(message,Title,Default) If Not IsNumeric(strAnswer) Then MsgBox Wscript.Quit ElseIf strAnswer = "" Then MsgBox Wscript.Quit End If Select Case strAnswer Case "rock" If intGetRandomNumber = 3 Then strResults = "Tie" If intGetRandomNumber = 2 Then strResults = "You Win" If intGetRandomNumber = 1 Then strResults = "You Lose"

' The other Case options for "paper" and "scissors" goes here but omitted it to save space. Case Else objWshShell.Popup "Sorry. Your answer was not recognized. " & "Please type rock, paper, or scissors in all lowercase letters." WScript.Quit End Selec

Thanks, CAZan

Edited by CAZan Monday, June 19, 2017 10:12 PM

------------------------------------

Divide by zero error encountered

cast((([totalAR]-[totalAP])/(totalAR))*100 as DECIMAL(10,2)) AS 'Gross margin %',

This is my equation and I get the [S0001][8134] Divide by zero error encountered

I tried this but it still didn't work

nullif(cast((([totalAR]-[totalAP])/(totalAR))*100 as DECIMAL(10,2)),0) AS 'Gross margin %',

Any ideas?

Reply:

It's the divide by that's at issue - so somewhere along the line totalAR is 0 so put the nullif on this part of your equation

/nullif(totalAR,0)

------------------------------------
Reply:

What about this?

nullif(cast((([totalAR]-[totalAP])/(case when totalAR=0 then totalAP else totalAR end))*100 as DECIMAL(10,2)),0) AS 'Gross margin %',

This will only work if TotalAP and TotalAR are never both 0 together.

------------------------------------

xp7 32 bit

My XP7-32 bit can no longer support internet explorer version I have

Moved by Carey FrischMVP Saturday, June 17, 2017 5:36 AM Relocated

Reply:

Hi kerrville.

The highest version of Internet Explorer that can run on Windows XP (including the XP Mode virtual machine that you can use in Windows Virtual PC on Windows 7) is Internet Explorer 8; furthermore, Windows XP is out of support since April 2014.

Bye.

Luigi Bruno
MCP, MCTS, MOS, MTA

Edited by Luigi BrunoMVP Monday, June 19, 2017 7:50 PM

------------------------------------

Need help in installing snmp services through remotely

Recently we have started using what's up gold application for monitoring all network device including pc's for these we require to enable snmp on all pc's we have around 600 pc's it's very painful job to do this manually. To avoid this I have tried with scripting ND deployed it through group policy in computer configuration and as well as for user configuration and also tried in user logon script also nothing as happened so far it doesn't give me any error it simply not exceuting but when I run it on user pc's manually snmp is enabling plz suggest what is the best way to resolve this issues.I have windows 7 ND windows 10 client pc's .

Here is the script I am using as a batch file.

Dism /online /Enable-Feature /FeatureName:SNMP

PLZ HELP ME

Need help in installing snmp services through remotely

Here is the script I am using as a batch file.

Dism /online /Enable-Feature /FeatureName:SNMP

PLZ HELP ME

Reply:

This is not a system management consulting forum.

Please read this first:

This forum is for scripting questions rather than script requests

-- Bill Stewart [Bill_Stewart]

------------------------------------

Server 2012 R2 keeps crashing and lossing a month of Existence

Hi all,

I have a Windows Server 2012 R2 in a cluster which keeps crashing and upon starting up it is back to a point in time 15th May 2017. Even if I manually restart this will occur. Any data or apps installed after 15 May 2017 are gone. From my investigations windows update had been installed at this time 15th May. The server starts and first entries in the event viewer are for the 15th May. System time is ok after reboot. While starting up it displays windows is finishing updates every time. It is stuck in this loop. There is no snapshots/checkpoints. I have used DSIM to try and repair. I've ran disk clean up to clean-up windows updates. I removed windows updates installed on the 15th May. Anyone else ever seen this behaviour? Hope someone can help.

Reply:

Does the cluster validation wizard give any warnings or errors?

Have you tried evicting the node from the cluster and then rebuilding the node from scratch and re-adding it back into the cluster? Sometimes that is faster than trying to find the reason for a random error.

tim

------------------------------------

Can someone explain just exactly why xp_cmdshell is such a massive risk?!

XP_CMDSHELL. I love it. It makes things so easy but our IT department is having none of it. However, they will not explain why. All I hear is "everyone knows". Well, I don't.

And no, SISS is not the answer I want to hear. Nor parroting of .NET or CLR or Windows scheduled tasks. I like everything self-contained within a sql database where the code is easily auditable via sys.sql_modules and portable as you like with a few control tables.

So, I want to know, step by step, how someone would exploit the xp_cmdshell security hole. How do they get access to the server or the SQL instance in order to run xp_cmdshell in the first place? What would they run? How would they run it? Only once I know the sequence can I think of ways to mitigate the risk.

Many thanks in advance!

JCEH

Reply:

Hello,

Withou setting up a xp_cmdshell proxy account this command is executed with the permissions of the SQL Server service account and if this account do have high privilege a command like "FORMAT C:" can hardly harm your system.

As long as the service account or better: the proxy account has only less privilges/permissions are less then the use is OK

See
xp_cmdshell (Transact-SQL) => Remarks
sp_xp_cmdshell_proxy_account (Transact-SQL)

for further details

Olaf Helper

[ Blog] [ Xing] [ MVP]

------------------------------------
Reply:

Our friend Jeff Moden had a rant on this quite a while ago, can remember the full story, but a bit like this:
since the only person who can use xp_cmdshell is a person who already must have the rights to enable it, and thus must already have the rights to potentially do a lot of nasty stuff, there is no additional risk enabling it (once that person has those rights).

Under the hood stuff like SSIS must use very similar techniques, but as you already noticed SSIS is not versatile enough if you have to deal with changing file formats, and changing formatting of Excel sheets.

Would suggest you ask your 'IT' to come up with feasible (and tested) solutions for the problems you solve with xp_cmdshell, or shut up.

I have lost the patience to deal with 'IT' who just parrot something they've heard somewhere without coming up with something feasible themselves. All a bit like the worrying about the potential collusions of hashing algorithms without looking what these are used for (irrelevant if these are only used for identifying records that potentially need reprocessing as in case of collusion you'd only reprocess a few more).

Cheers

------------------------------------
Reply:

>So, I want to know, step by step, how someone would exploit the xp_cmdshell security hole.

All you have to do is google 'how to exploit xp_cmdshell' and you'll get lots of hits.

As Olaf points out, there are safer alternatives available, so why take the risk.

For example:
Using CLR to replace xp_cmdshell for specific tasks

You can also perform OS level tasks within a SQL Agent jobstep, even while xp_cmdshell is disabled, by choosing 'Operating System' from Type:

HTH,

Phil Streiff, MCDBA, MCITP, MCSA

------------------------------------
Reply:

Yes, I have the utmost respect for Jeff Moden but at the end of the day that is an opinion, not a white paper. I agree with him insofar as I can tell.

It is not Information Technology (IT) people causing the problem but Information Governance (IG) people. Hence why I want to get to facts rather than opinions. The IT have actually done a very good job. There are different accounts for each service that are Windows Domain accounts, each allowed only the barest minimum of permissions to function. In this instance the box is on a VPN that does not face the web and has no access except by Windows domain accounts for developers and a SQL user account that has no rights whatsoever other than GRANT SELECT permissions on the objects it needs to read data from.

Phil, yes, I can do that but immediately it becomes a PITA. For example, if I have a stored procedure that polls a directory with a DIR command to see what files to load I have everything nicely in 1 proc. The code is searchable and easily transferable - it can work anywhere. As soon as I have to muck about building up jobs then I might as well switch to SISS packages, although SISS has already demonstrated it cannot handle changing dimensions so that's a lost cause before it starts. Ideally things should be modular with all code in one place, easily searchable and transferable, e.g. just backup the database, restore to another server and the you should be up and running, whether that be a development server, QA server, testing server or production server.

So, why bother if there is a theoretical risk? Because the alternative is messy, inefficient and unproductive. So why put yourself out and cause great expense if you do not need to? You need to quantify the risk before you decide whether to run with it or take appropriate measures to minimise it. If you want to eliminate all risk, unplug the server from the network, switch it off and bung it in a Faraday cage. But then it isn't much use. Clearly the Faraday cage is useless if we connect it to the network. So we can ditch that. It has to be switched on to use it so we have to run that risk. It has to be connected to the network to be any use. So now we have some risks. We need to list out what they all are and then decide how best to deal with them.

So, opinions are out. Let's look for facts.

JCEH

------------------------------------
Reply:

It did occur to me that using a proxy account and giving that proxy account only permissions to a Windows folder containing the DOS commands I required (like TREE, DIR, DEL, XCOPY) and the folder where the data is might be a possibility. I seem to have a vague memory of the account requiring access to a temp folder somewhere too but I am sure that won't be an issue.

But that's a mitigating action and one that may not be required in the environment we are running. However, in order to understand the risks in the environment we are running I need to understand what those risks are ... which bring me back to the point of the original post.

JCEH

------------------------------------
Reply:

There is not a "problem" with xp_cmdshell, if you control the commands being run via xp_cmdshell.

The problem occurs if you open your SQL Server up to users and/or the Internet. Then a user could, and virus' have, use xp_cmdshell to run DOS commands which hurt your system. So the knee jerk reaction is "shut it down then we don't have to worry about it".

However, SQL Server does not normally need to interact with the OS at that level. Whatever you are using it for, should and can be done a different way. What are you using it for?

Edited by Tom Phillips Monday, June 19, 2017 11:56 AM

------------------------------------

Desktop icons rearranging (all moving to the left)

Under certain conditions (e.g. restarting or changing screen resolution or adding a second monitor), all the desktop icons bunch up on the left of the screen. This seems to be an issue for many people judging by the Win10 Feedback Hub and and this 20+ page thread on tenforums.com. I'm guessing there's more than one cause which might make it difficult to pin down.

I've started using an application called "Icon Restorer" as a sort of workaround until this is fixed (if it ever is).

Ms Support forum

Monday, January 24, 2022