Citrix Presentation Server Installation fails with Error 26013. Function InitializeTree2 returned failure in CTX_MF_IMA_InitializeTree2

If you encounter an error installing Citrix Presentation Server with a similar screen below informing you that the database username and password that you have entered maybe wrong, put in the domainname\username format on the screen for Data Store Access. I did spend some time figuring this out as I knew I entered in correct credentials. If you see the screen below it also does not mention to enter the domain name. Sometimes the simplest things can make you scratch your head too!

For those that are setting up Citrix Farm with an SQL server as the farm database, here is a good link.

Presentation Server and SQL 2005 Configuration

http://support.citrix.com/article/CTX112524

Rename a Computer that Hosts SQL Server 2005

I decided to posts this out to make it more available for others. Did spend some time looking for this article on the net. Here is the exact link.

http://msdn.microsoft.com/en-us/library/ms143799(SQL.90).aspx

.

Note that the procedures below does not apply for some conditions such as if you are running a failover cluster and if your server uses reporting services. There are separate procedures for these that is also mentioned on the link above.

.

When you change the name of the computer that is running Microsoft SQL Server 2005, the new name is recognized during SQL Server startup. You do not have to run Setup again to reset the computer name. The following steps cannot be used to rename an instance of SQL Server 2005. These steps can be used only to rename the part of the instance name that corresponds to the computer name. For example, you can change a computer named MB1 that hosts an instance of SQL Server named Instance1 to another name, such as MB2. However, the instance portion of the name, Instance1, will remain unchanged. In this example, the \\ComputerName\InstanceName would be changed from \\MB1\Instance1 to \\MB2\Instance1.

To rename a computer that hosts a stand-alone instance of SQL Server 2005

For a renamed default instance, run the following procedures:

sp_dropserver

GO

sp_addserver , local

GO

Restart the SQL Server instance.

For a renamed named instance, run the following procedures:

sp_dropserver

GO

sp_addserver , local

GO

Restart the SQL Server instance

Just before you apply those update rollups to your Exchange 2007 servers....

I am sure you know by now if you have deployed a couple of Exchange 2007 Servers, that applying update rollups does not seem to be as easy as Next-Next-Next (haha promoting my blog my title). So just before you apply those update rollups for Exchange, you may want to take a look at the following articles.

Exchange Server 2007 managed code services do not start after you install an update rollup for Exchange Server 2007
http://support.microsoft.com/kb/944752

Managed code services does not start is usually because of the update rollups containing digital signatures which during the installation attempts to do a validation a certificate revocation list (CRL) at crl.microsoft.com/pki/crl/products/CSPCA.crl

So it is quite common for the organizations not to allow their Exchange Servers to go out to the Web and causing this validation during the installation of the rollup for the Exchange Services not to start.

A recommended fix out there is point crl.microsoft.com to 127.0.0.1 in the local hosts file of the servers before the upgrade. I can attest that this might work for some of the servers but in case it does not for all, you can still continue and modify your Exchange Services configuration file manually based on the article above.

For those who have Exchange 2007 servers in different server roles like CCR clustered mailbox servers, you can check the links below before you apply your rollup updates.

How to Install Update Rollups in a Single Copy Cluster
http://technet.microsoft.com/en-us/library/bb885045.aspx

How to Install Update Rollups in a CCR Environment
http://technet.microsoft.com/en-us/library/bb885047.aspx

Deploying 802.1x Dynamic VLAN authentication for Wired Networks using Cisco ACS 4.2 and Microsoft IAS Radius Servers (Part 2)

In part1 of our Deploying 802.1x Dynamic VLAN authentication for Wired Networks using Cisco ACS 4.2 and Microsoft IAS Radius Servers. We have discussed about setting up the AD security groups and Certificate Infrastructure. We also discussed setting up our RADIUS servers and policies for authentication and VLAN allocation. Now we will discuss configuring the AAA clients which in our scenario right now are Cisco Switches that will be performing 802.1x port authentication by passing Machine credentials to the defined RADIUS servers.

Defining AAA clients on RADIUS servers

Next step in our setup is to define our AAA clients on the RADIUS servers, it involves simply pointing the AAA client's IP on the network and a preshared key that will later be defined on the switch as well. Once you are done you will have a screen similar below.

Configure Authenticating Switches

Now its time for us to configure our Cisco Switches to pass authentication to RADIUS servers and perform per port 802.1x authentication to connecting end devices. You should have a bunch of global commands instructing the switch to perform 802.1x authentication similar to the one below. You can go to Cisco's website to get more information on the commands although I will try to comment on some of the lines.

aaa authentication
dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
aaa accounting system default start-stop group radius
dot1x system-auth-control ( define this to see Dot1x commands per interface level )

ip radius source-interface value
radius-server host x.x.x.x auth-port 1645 acct-port 1646 timeout value key value
radius-server host x.x.x.x auth-port 1645 acct-port 1646 timeout value key value

The next 3 commands above instructs the switch where the source RADIUS server's VLAN is located when you have multiple VLANs and also points the RADIUS server hosts. The primary will be the first one defined and secondary will be the second one. The key value is the same pre-shared key used when you define your AAA client on the RADIUS servers.

Once you have these commands set, its time to go per port level and allow switch ports to do dot1x authentication.

switchport access vlan id
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x host-mode multi-domain
dot1x timeout tx-period value
dot1x auth-fail vlan id
dot1x guest-vlan id
spanning-tree portfast

You can lookup this commands further but basically on this configuration for the guest-vlan and auth-fail vlan, you are configuring where clients will be dumped to if they fail dot1x authentication with the RADIUS servers.

Configure wired client computers for PEAP-MS-CHAP v2 802.1x authentication

Ok now we almost have everything set, the last set is to configure our Dot1x clients which are Windows XP machines in this example. Basically what we need to do is to configure the clients NIC card to perform Dot1x authentication. You can research about GPO policy extension to set this one for the clients but I believe at the time of this writing it is only available in Windows Vista and a Windows 2008 Domain Controller. Just follow the screen below and you should have configured your clients appropriately.

Note that I have cleared the screencap, if the environment is more restrictive, you can define the value of the "Connect to these Servers" field on the client's NIC card. This prevents man in the middle attacks when you are doing the dot1x authentication to your RADIUS servers. Do note that if you are configuring a Windows XP SP3 client note the changes in configuring Dot1x for the network card in this kb article "Changes to the 802.1X-based wired network connection settings in Windows XP Service Pack 3"

http://support.microsoft.com/kb/949984

Also there are two registry values that you would likely change to control supplicant behavior on the clients. The first one defines that you are performing only Machine Authentication and the second one allows the supplicant client to send stop and start messages for Dot1x. Based on experience, you should set the second registry value as listed below as I have found that some clients do not get authenticated if this value is not set.

HKEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters\General\Global\AuthMode=2

HKEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters\General\Global\SupplicantMode registry value to 3 (REG_DWORD data type). The default value of SupplicantMode for wired connections is 2.

Verify Wired Connections

Now that you have done configuring your dot1x clients. Verify that you can authenticate to your RADIUS servers and get your VLAN assignment based on your grouping. You can move the clients to another AD security group and test the new VLAN segment once you unplug and replug the network cable for the machine. Lastly I need to mention that for Cisco ACS you may need to install this hotfix on your Windows Dot1x clients as the Windows clients don't work well by default with 3rd party RADIUS servers for PEAP see "PEAP authentication is not successful when you connect to a third-party RADIUS server" on kb http://support.microsoft.com/kb/885453

Before I forget here are the links you can use as reference for your own deployment:

Microsoft:

http://www.microsoft.com/DOWNLOADS/details.aspx?familyid=05951071-6B20-4CEF-9939-47C397FFD3DD&displaylang=en

http://www.microsoft.com/downloads/details.aspx?FamilyID=c9ed3609-49fc-439b-92f4-266b187cae5a&displaylang=en

Cisco:

http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080921f67.shtml

http://www.ciscopress.com/articles/article.asp?p=29600&seqNum=3

http://www.ciscosystems.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/ACSugP.pdf

Hope you guys enjoyed this article. Do comment for additional info or corrections.

Deploying 802.1x Dynamic VLAN authentication for Wired Networks using Cisco ACS 4.2 and Microsoft IAS Radius Servers (Part 1)

Today I am sharing a deployment of 802.1x Dynamic VLAN Authentication for Wired Networks using Cisco's ACS and Microsoft IAS RADIUS Servers. If you are using Microsoft Operating Systems as clients such as Windows XP and Vista machines, two common 802.1x authentication methods that will be supported for use based on Extensible Authentication Protocol (EAP) are EAP-TLS or PEAP-MS-CHAP v2.
.

For this deployment we will be using PEAP-MS-CHAP v2 as the authentication method between our clients and RADIUS servers. You can read about the difference between the two methods but PEAP-MS-CHAP v2 is the preferred method for its effectiveness and lesser administrative overhead. (EAP-TLS requires you to install user certificates aside from computer certificates as well) Another least known authentication method is EAP-MD5 CHAP but it is lessed widely used in 802.1x deployments.

..

As usual let me outline what is needed for our deployment scenario:

• Configure Active Directory for accounts and groups
• Configure a certificate infrastructure for PEAP-MS-CHAP v2
• Configure the RADIUS servers and Policies
• Deploy and configure authenticating switches as AAA clients defined on our RADIUS servers
  Configure wired client computers for PEAP-MS-CHAP v2 802.1x authentication
  Verify Wired Connections

Caveats when doing Dynamic VLAN authentication with Windows

Before we start I would like to mention that if you are doing this deployment setup, you have to be aware that when doing Dynamic VLAN authentication, your group policies and logon scripts may fail to work if you are performing both Computer and User authentication. The reason I say this is that a Machine doing computer authentication will get an IP address during the bootup process after it has authenticated. Now let us say that you are implementing User authentication as well, if it happens that the user should belong to another VLAN based on your policy, it will trigger a change in VLAN segment during the logon process simultaneously while your logon scripts and GPO are being processed the scripts to fail. Currently this is documented in KB article 935638. http://support.microsoft.com/kb/935638

.

For this reason if you plan to implement Dynamic VLAN with both Computer and User authentication, you should consider investing in a third party supplicant such as Cisco's Secure Client. I will not be dealing with Cisco's Secure Client for this post but once you see how the native MS supplicant is setup you should be able to configure Cisco's Secure Client as well.

.

Configure Active Directory for accounts and groups
.

Ok we are assuming that you already have Active Directory already in place in your environment. With this you could already provision your AD security groups containing Computer Accounts and User Accounts that you would wish to group to a particular VLAN.

.

Configure a certificate infrastructure for PEAP-MS-CHAP v2
.

Next step is to configure a Certificate Infrastructure, you may opt to use Internal Microsoft Certificate Authority, but I do need to mention that you should select an Enterprise Edition of Windows Server if you are using Cisco's ACS for your deployment, ACS requires a duplication of a V2 certificate template which will only be available on Enterprise Edition of Windows. Read my previous post here. Later I will be providing a listing of related links that you can use to start your deployment.

.

Configure the RADIUS servers
.

I will not be dealing with setting up ACS but instead you can read othe guides I will be providing at the end of the article. In this setup we will have ACS as our primary RADIUS server and IAS as the secondary RADIUS server. For IAS, you can proceed with ADD/REMOVE Windows Component on your server and enable the Internet Authentication Service component. Need to note that is recommended to have your RADIUS running on probably one of your Domain Controllers for faster authentication. Once you have IAS running, you would like request for a Server Certificate to support your PEAP infrastructure. Main thing to note is that PEAP only requires a Machine Server Certificate on your IAS server and your authenticating clients only need to have a trusted root certificate of the issuing CA of your RADIUS servers. This simplicity also makes PEAP a favorable choice over EAP-TLS. Ok I have been talking a lot regarding the deployment and now its time for some screenshots.

Ok I have cleared some of the details on the screencap as this represents my actual deployment for one client, two things you need to note is that PEAP certificate field should contain your IAS Server Certificate. If you are using a Domain Controller installed with IAS service, then you will probably have the Domain Controller Certificate already ready to use. This will do as long as the certificate has the Server Authentication key usage attribute. You can check this when you open the certificate and check details tab for the Enhanced Key Usage attribute. For the edit profile tab, the advanced tab is where you configure the policy for Dynamic VLAN. This tells you exactly where to place the machine when it is authenticated. The Tunnel-PVT-Group-ID will actually correspond to your VLAN NAME defined on the switch (case sensitive) and the Tunnel Tag corresponds the VLAN number. After defining our policies we can proceed with configuring the AAA client switches in part2 of our article.

Side Note to Changing Expiration Date of Certificates that are issued by a Windows Server 2003 or a Windows 2000 Server Certificate Authority

If you do have a requirement of changing the default certificate validity issued by your Windows 2000 or 2003 Certificate for your deployment (Default 1 year for Standalone CA, 2 years for Enterprise CA) then you might have followed the guide on the KB article below.

http://support.microsoft.com/kb/254632

The summary and registry hack is posted below.

SUMMARY

This article describes how to change the validity period of a certificate that is issued by a Windows Server 2003 or a Windows 2000 Server Certificate Authority (CA). By default, the lifetime of a certificate that is issued by a Stand-alone Certificate Authority CA is one year. After one year, the certificate expires and is not trusted for use. There may be situations when you have to override the default expiration date for certificates that are issued by an intermediate or an issuing CA.The validity period that is defined in the registry affects all certificates that are issued by Stand-alone and Enterprise CAs.

For Enterprise CAs, the default registry setting is two years. For Stand-alone CAs, the default registry setting is one year. For certificates that are issued by Stand-alone CAs, the validity period is determined by the registry entry that is described later in this article. This value applies to all certificates that are issued by the CA.

For certificates that are issued by Enterprise CAs, the validity period is defined in the template that is used to create the certificate. Windows 2000 and Windows Server 2003 Standard Edition do not support modification of these templates. Windows Server 2003 Enterprise Edition supports Version 2 certificate templates that can be modified. The validity period defined in the template applies to all certificates issued by any Enterprise CA in the Active Directory forest. One exception is the Subordinate CA certificate templates. There is no validity period defined in this template. Instead, the CA's registry validity period determines the validity period of the Subordinate CA certificate. A certificate that is issued by a CA is valid for the minimum of the following periods of time:

•The registry validity period that is noted earlier in this article.

This applies to the Standalone CA, and Subordinate CA certificates issued by the Enterprise CA.

•The template validity period.
This applies to the Enterprise CA.

Templates supported by Windows 2000 and Windows Server 2003 Standard Edition cannot be modified. Templates supported by Windows Server Enterprise Edition (Version 2 templates) do support modification.

The expiration date of the CA certificate

A CA cannot issue a certificate with a longer validity period than its own CA certificate. For more information about certificate templates, see the "Implementing and Administering Certificate Templates in Windows Server 2003" white paper. To do this, visit the following Web site:
http://technet2.microsoft.com/WindowsServer/en/library/c25f57b0-5459-4c17-bb3f-2f657bd23f781033.mspx?mfr=true (http://technet2.microsoft.com/WindowsServer/en/library/c25f57b0-5459-4c17-bb3f-2f657bd23f781033.mspx?mfr=true)

Note The Request Attribute name is made up of value string pairs that accompany the request and that specify the validity period. By default, this is enabled by a registry setting on a Standalone CA only.

To Change the Expiration Date of Certificates That Are Issued by a Windows Server 2003 or a Windows 2000 Server Certificate Authority

To change the validity period settings for a CA, follow these steps.

1.Click Start, and then click Run.
2.In the Open box, type regedit, and then click OK.
3.Locate, and then click the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CertSvc\Configuration\
4.In the right pane, double-click ValidityPeriod.
5.In the Value data box, type one of the following, and then click OK:

•Days
•Weeks
•Months
•Years
6.In the right pane, double-click ValidityPeriodUnits.
7.In the Value data box, type the numeric value that you want, and then click OK. For example, type 2.
8.Stop, and then restart the Certificate Services service. To do so:

a. Click Start, and then click Run.
b. In the Open box, type cmd, and then click OK.
c. At the command prompt, type the following lines. Press ENTER after each line.
net stop certsvcnet start certsvc
d. Type exit to quit Command Prompt.

I have highlighted important points to consider like the availbility of duplicating templates only being available on Enterprise Edition of Windows. One implementation I can site as an example is Cisco's ACS which required a duplication of templates for its Server Cert so its more likely you would use an Enterprise Edition of Windows as your Root CA or subscribe to a third party CA.

One more note I wanted to add which was why I actually blogged about this article is that If you Duplicate a certificate template and specifiy a longer validity period that what is specified in the registry. The value that will be taken will still be the lesser value of the two.

Meaning Microsoft domain-rooted CA will use either the issuing certificate template validity period or the maximum CA cert validity period defined in the CertSvc registry key, whichever is less.

Increasing Logical Disk Capacity on a drive stored on SAN Storage IBM DS3300

Most of us will be presented with the need of increasing logical disk capacity on drives that are stored in SAN. It may happen that these drives were already presented to the respective Operating Systems and in time, the need to increase the storage space on the server may arise.

I would like to share an experience of performing such an activity. First of all we need to note if your SAN Storage supports the capability of adding space to the hardware RAID container before we can perform this. On the IBM DS range of storage systems, this is supported by either doing the ADD FREE CAPACITY task on the GUI or Storage Manager or via CLI using the script editor.

After you have expanded the array, you can expand the logical drive with the additional free space from the array. On the DS 3300 series, with the Storage Manager 2 client, this can only be done using the script editor.

With which you can use the command below to perform the operation.

set logicalDrive ["DriveNameonSAN"] addCapacity=20 GB;

Now that you have added capacity on the SAN drive, this will be visible on the Operating System and you can use your OS tools to extend the volume. Note that there are conditions that need to be met before you extend the drive and is documented here

http://support.microsoft.com/kb/325590

Fortunately Windows Server 2008 has the extend feature on Disk Management so you can perform the steps on the GUI similar to the screen below.

Note that before you perform this procedure make sure you know the impact to your applications hosted on the drive to be extended. It does not hurt to do a backup as well but you already know that ;)

Control RMS client Not To Use Outlook By Default in searching Address List

Active Directory Rights Management Services (AD RMS) provides services to enable the creation of information protection solutions. It allows organization to protect sensitive documents and control its consumption through publishing licenses and user rights.

Using AD RMS-enabled applications, such as Office 2003 and Office 2007 a document owner can apply rights to a document file to be consumed by an intended consumer. RMS as a Microsoft feature, is tightly intergrated with MS Office suite of applications.

I would like to share a deployment scenario with RMS which was currently used to apply document permissions to Word, Excel and PowerPoint documents. This organization was not using Outlook as their main mail client since they do not have Exchange in their environment. The way that RMS works is that when someone attempts to publish or consume a rights-protected document, AD RMS identifies the consumer through the Simple Mail Transfer Protocol (SMTP) e-mail address assigned to the consumer's Active Directory logon account. In an organization that uses Exchange, the RMS enabled application uses Outlook to validate email addresses entered in that dialog. This causes an instance of Outlook to be started when restricting permissions. However, if an organization does not use Exchange and uses another mail client but at the same time the users use Outlook probably for their personal POP3 accounts in example, this could present a nuissance. The default behavior is that the RMS enabled application such as Word will launch an instance of the Outlook address book to query users which on this environment would be empty since there is no Exchange in the environment. (see below)

Ok enough for all that background, there is a registry key that can be used to control this behavior. The following registry key is stated below.


DoNotUseOutlookByDefault
Location:HKCU\Software\Microsoft\Office\12.0\Common\DRMDWORD:DoNotUseOutlookByDefault
Value:
0 = Outlook is used
1 = Outlook is not used
Description:The permissions dialog uses Outlook to validate email addresses entered in that dialog. This causes an instance of Outlook to be started when restricting permissions.
Users can disable this option using this key
Exists in Office 11:Yes
Exists in Office 12:Yes
Can Be Set by GPO in Office 11:No
Can Be Set by GPO in Office 12:No

After setting this, you will be provided with the default lookup method of browsing through your AD similar to a window when adding Local Users and Groups in Computer Management. One more note to add, make sure your Office 2003 has the latest service pack or this fix would not work. Check out this kb article. http://support.microsoft.com/kb/892542

Certificate Services Web enrollment pages together with Windows Vista or Windows Server 2008

So you have brought in your brand new Windows Server 2008, hooked it up on the network and joined it as a member server in your domain. You decided to make this brand new server a Web Server and enable it for SSL. You open up an IE browser type in your Internal Certificate Authority Servername / certsrv page as you always do and you are suprised to receive an error.

.

.

This is due to the fact that Windows Server 2008 and Vista rely on a different ActiveX component named Certenroll. Your existing Windows 2003 CA uses an ActiveX controll named Xenroll which is now depracated on Windows Server 2008 and Vista. You can make your existing Windows Server 2003 support web enrollment requests from Windows 2008 and Vista by applying the hotfix on this kb article.

http://support.microsoft.com/kb/922706

The Curious Case of the Missing File Shares on SAN

Every once in a while, we will be dumbfounded by strange issues that we encounter during our course of deployment setup and support. One case that I encountered was the case of the missing file shares on SAN.

a

In this case, a file server using disks presented from an iSCSI SAN hosts normal NTFS files shares that are mapped to user logon scripts. Apparently after rebooting the file server, all the shares disappear though all the contents are there. This does seem strange and can make an IT admin scratch their head, but thinking logically will lead you to suspect of the Server service running on the file server. After all the Server Service is responsible for file, print, and named-pipe sharing over the network. Indeed restarting this service on the file server will reapply all the file shares.

a

The cause of this case is documented on

a

MS KB article 870964 "File shares on iSCSI devices may not be re-created when you restart the computer"

a

According to the symptom, "You use the Microsoft iSCSI Initiator service to connect to an Internet SCSI (iSCSI) disk device. The file shares that you create for folders that are located on your iSCSI device may not be re-created when you restart the computer that the shares are created on."

a

The cause is stated as "This issue may occur when the iSCSI Initiator service is not initialized when the Server service initializes. The Server service creates file shares. However, because iSCSI disk devices are not available, the Server service cannot create file shares for iSCSI devices until the iSCSI service is initialized."

Apparently the Server service may start first during a restart causing it not to apply shares on the disks on iSCSI as the iSCSI service has not started yet. To resolve the issue, you can make the Server service dependent on the iSCSI service using the services.msc console or through regedit.

a

Windows XP and Windows Server 2003

Start Registry Editor.

Locate and then click the following subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer
On the Edit menu, point to New, and then click Multi-String Value.
Type DependOnService to name the new registry entry, and then press ENTER.
Double-click DependOnService, type MSiSCSI in the Value data box, and then click OK.
Exit Registry Editor.

a

For more on the KB article, you can click on this link

http://support.microsoft.com/kb/870964