wehuberconsultingllc.com » SBS2K-SBS2K3

The Case of the Messed Up Fax

Bill — Sun, 15 Aug 2010 13:27:36 +0000

We use a web application to create purchase orders. We send purchase orders to our vendors by printing the web page to our fax server. Two days ago we sent out two faxes with large black blotches on the page. There were purchase orders that were sent out before and after these faxes that were fine. Something was different about these purchase orders. We found that we could duplicate the problem on different workstations. When I previewed the fax on my laptop I could see that it was already corrupt. If I printed the web page to the printer or created a PDF it was fine. My boss thought it might have to do with our recent roll-out of the new Windows 7 laptops. So I checked the HTML for odd characters and did not find anything. It was about this time I noticed that the two problem purchase orders were about the same size. One purchase order had 36 line items while the other purchase order had 37 line items. I also found out that I used Firefox or Google Chrome to print the web page, it created the fax correctly. This printing problem was specific to Internet Explorer. The final clue was found when I went to my old laptop and it displayed the faxes correctly. When I checked its page setup I noticed that it was using an A4 paper size rather than the standard Letter size. After a little fiddling with the page settings, I determined that when I changed the bottom margin on my new Windows 7 laptop to 0.5 or 1.0 inch the fax would be created correctly.

My boss remained unconvinced. Why did we not see this problem before? That was a good question. After a little investigating of our fax log I found a corrupted fax over a month ago. Since this problem is rare and the subsequent faxes went out successfully, they resent the fax manually and did not bother to tell anyone of the problem.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Adding IP Restrictions to IIS 6

Bill — Sun, 25 Jul 2010 14:04:33 +0000

A big thanks goes out to the obligatorymoniker and his script for programmatically adding IP restrictions to IIS6. I was looking for a better script to add IP restrictions. My previous script added the restrictions one IP range at a time. This script was adequate for a small number of IP restrictions but recently I was asked to add IP restrictions for every country we do not ship to. We had credit card fraud transaction from one of these countries and the boss was mad. After using Perl and a CIDR to merge the adjacent networks, I still had over 18,000 IP ranges to deny. Using my old script I tried to add these IP ranges to our test system this took over an hour to load. Your script loads the ranges in a couple of seconds. Here is how I did this:

I went to http://www.countryipblocks.net/ to get the IP ranges I wanted to block. Beware these ranges include bogon networks(e.g. 192.168.0.0). The first time I applied the IP ranges I blocked myself out.
I used the perl script below to merge the networks.
I used the obligatorymoniker IP Security.vbs script to load the ranges. You will have to change the "IIS://localhost/smtpsvc/1" to the site you want to add the IP restrictions to.

use Net::CIDR::Lite;
use NetAddr::IP::Lite;
my $cidr = Net::CIDR::Lite->new;
# Disallow IPs

open (IPDISALLOW, "ip_disallow.txt") || die "couldn't open the file!";

while ($record = ) {
 if (substr($record,0,1) != '#'){
#print $record;
 $cidr->add($record);
 }
}

close(IPDISALLOW);
#print "$_\n" for $cidr->list;
foreach ($cidr->list) {
my $ip = new NetAddr::IP::Lite $_;
#print "The address is ", $ip->addr, " with mask ", $ip->mask, "\n" ;
print $ip->addr, ",", $ip->mask,"$_\n";
}

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Event ID 7024 on SBS 2003 computer

Bill — Fri, 19 Mar 2010 00:14:01 +0000

If you get “The Certificate Service terminated with service-specific error 2148204801(0x800B0101)” you need to renew the certificate the certificate authority for your domain. If you are renewing a certificate for a self-signed domain, you can follow the procedure below. In my case the certificate is valid for 5 years.

Go to Admin tools > Certification Authority.
Highlight your server and right click. Then select All Tasks > Renew CA Certificate.
If everything works, you should be able to start the certificate service. Highlight your server and right click. Then select All Tasks > Start Service.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Fixing store.exe process is allocating more memory than usual

Bill — Wed, 02 Sep 2009 13:31:08 +0000

Sometimes I forget how I fixed problems in the past and this error is an example. In my case the fix was simple. I followed the instructions in http://support.microsoft.com/kb/867628 and increased the threshold from 104857600 to 704857600. I made an … Continue reading → No related posts. Related posts brought to you by Yet Another Related Posts Plugin.

Notes on a SBS Disaster Recovery

Bill — Mon, 03 Aug 2009 17:40:04 +0000

On the last Friday of June I came into the office and found myself confronted with one of the more unique disaster recovery scenarios I have ever encountered. The primary symptom was that no one could get to their email. The cable modem and the router attached to it looked like they were turned off. Turning the power on got the lights to blink for only a few seconds before they went off. Our Small Business Server server appeared to be working but the lights on the LAN adapters in the back were off. Even when we inserted a known good LAN connection the lights would not come on. I rebooted the server and it stopped seeing the disk drive array. It was about that time I noticed the aroma of burnt insulation. Ah! The smell of burnt insulation in the morning! The cable modem, router, and server were fried. During the night the RoadRunner cable serving us must have been hit by lightning.

It is not surprising that we were not prepared for this disaster recovery scenario. Here are my notes on how we recovered our original server and migrated it to a new server.

Probably one of the more interesting aspects of this disaster recovery story was that I took half of a mirrored drive pair and used it to create a Virtual Server of the SBS server. Since our development server(HP DL380) is similar to the server(HP DL360) that got fried, I was able to put the mirrored drive into the development server chassis. Everything on the drive looked good except for Exchange partition. The Exchange partition was missing. The lightning strike occurred during our backups, so our backups were not complete. We were looking at losing Thursday’s email. Since the development server had sufficient processing power and disk space, I decided to see if we could bring up the Small Business Server as a Virtual Machine. Using a virtualized server could allow our office to be fully operational while we worked on getting a new server delivered. It looked like a fast way to recover the Active Directory and the office email. So I gave VMware vCenter Converter a try and I was amazed that the Small Business Server came up with only minor errors. The Exchange software complained that it could not find the Exchange partition and the HP diagnostic software complained about the hardware. Other than those problems the active directory, print queues, and the fax server were all operational.
The good news was that I had a virtual server running. The bad news was having problems recovering Exchange. The backup located on an external USB drive was restoring with errors. The first time I tried to restore Exchange I got a file corruption problem. This probably was due to USB problems with virtual servers. The next morning I decided to try something different. I downloaded some partition recovery software off of the Internet and to my surprise it found the partition on the mirrored drive. Using the EASEUS Data Recovery Wizard, I was able to recover the Exchange partition. The database had some integrity problems but it looked promising. So I followed this article, Using the Exchange tools ISINTEG and ESEUTIL to Ensure the Health of your Information Store, to repair the Exchange database. My final trick to getting Exchange to mount was to delete the Exchange log files. A little bit more than 24 hours after the lightning strike, our Small Business Server was operational and we had not lost any emails.
About a week later we had a “new” server delivered. Actually it was an old server we got off of eBay but it was identical to the server that had failed. Although it was tempting to leave the SBS server in virtualized form, we opted to install the server natively using the SBS Migration procedure. In this case both our SourceDC server and the MigrationDC server were virtualized servers.The first time I tried the SBSMigration procedure I failed. It took me awhile to figure out why but the SYSVOL share was not getting created on the MigrationDC. I traced the problem back to a communication configuration problem. The DNS parameter on the LAN adapter configuration for the SourceDC was pointing at the office router rather than itself. Although normal communications with the server appeared to be working fine, the active directory communications with the backup domain controller was not working. The domain controller could not find itself. ;( After I changed the DNS parameter the domain communications and file replications worked correctly. As Jeff Middleton reminded me, a good indication that the backup Domain Controller is working properly occurs when the SYSVOL share is created on the MigrationDC sever.
My next mistake was installing the Exchange database to a new drive letter. Exchange is very finicky about this. I had to “repair” Exchange to get it to recognize the database at the new location. It was after I had started the repair operation that I figured out how long the repair was going to take. I ended up running the repair overnight. In hindsight we would have been up and running much earlier if I restored it to its original drive letter location and moved it to a new drive letter at a later time.
My final mistake was made when I upgraded the NewDC to Windows 2003 SP2 before completing the SBS installation. I had to uninstall SP2 and install SP1 before I complete the SBS installation.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Adventures with iRedMail – Part II

Bill — Mon, 25 May 2009 01:16:36 +0000

In the first installment of Adventures with iRedMail I got it to send emails but I left the MS Exchange integration for another day. Since then I have updated my DNS zone with the DKIM information, set up local DNS information, decided on naming standards, and reconfigured Postfix several times before I got it right.

Updating the DNS with DKIM information

This task was relatively easy. I copied the DKIM information in the iRedMail.tips into a trouble ticket with my web provider. About 24 hours later it was ready to test. I sent an emails to my Yahoo account, sa-test@sendmail.net, and autorespond+dkim@dk.elandsys.com. Although the email from dk.elandsys.com was the first to respond, it said it did not work. When I checked my Yahoo account the headers said the email was signed correctly with DKIM. Ironically the return email from sendmail.net ended up in my Junk Mail folder. It said that everything worked correctly. For one more test I created a Gmail account and sent an email to it, too. It said the email was signed correctly.

Local DNS, naming standards, and more Postfix problems

The next challenge was to configure Postfix to accept both local email addresses and email addresses for the exchange server under the same domain. I used PostFixAdmin to create Aliases that pointed to the Exchange server emails(e. g. myemail@mybusiness.com points to myemail@mybusiness.local). PostFix complained about the DNS records for my Exchange server so I added mybusiness.local as a relay_domain and set up a psuedo DNS so that PostFix can find the IP address for my Exchange server. In my case I decided to let my pfSense firewall act as a local DNS server to serve up the local IP addresses. At this point I can email to everyone from a local iRedMail account but I cannot get replies until I set up iRedMail as the SMTP gateway and the Exchange server as a relay domain.

PostFix domain checks get me again!

It took me a long time to figure this out. When I changed the firewall to redirect SMTP traffic to the PostFix gateway I could not get any mail. I thought I had messed up the firewall settings so I kept trying different settings. I was pretty limited with my testing tools. If I could Telnet into port 25 I could see what is happening but I could not make the connection work as long as I was located on this side of the firewall. Fortunately I found a solution on the Internet. The dnsqueries.com site provides a page, http://www.dnsqueries.com/en/smtp_test_check.php, that allows me to check my local SMTP connection using their server. Within minutes I figured out that my email server did not like my sender’s domain. In fact it did not like anyone’s domain. This was the same type of problem I had with the Postfix recipient domain check, so I removed the sender domain check and the emails starting flowing.

What have I achieved?

I have a gateway that checks all incoming mail for spam and viruses. Postini offers a similar service for about $1 per user per month. We use MXLogic at work.
I have an alternate email server that allows me to send email that passes the SPF and DKIM checks. One of the reasons I investigated iRedMail was to use it for sending out a newsletter at work. Like many Internet retailers we get a chunk of our business as a result of our biweekly newsletter. In our case DKIM is another piece of the puzzle to improve our sender reputation. Since both Yahoo and Gmail require DKIM signing in order to set up feedback loops, DKIM is probably essential if you have ambitions of having a pristine email list. For those folks looking at ways to cut the umbilical cord to Microsoft this is one of several low cost, low maintenance migration alternatives to a local Exchange server.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Getting McAfee to work behind an ISA 2004 Firewall

Bill — Sun, 17 May 2009 14:05:58 +0000

It has been a long time since I actively worked with Microsoft’s ISA Firewall so it took me some time to fix this problem. Buy.com periodically offers a 3 computer version of McAfee at a very cheap price. Since I am somewhat ambivalent about the merits of one virus checking software over another, I bought a copy to replace a TrendMicro version up for renewal. The installation did not flag any errors or warnings so it took about a week before I noticed that the patterns had not updated. Yesterday I decided to fix the problem and write down for posterity how I accomplished it.

Unlike many firewalls Microsoft’s firewall typically restricts anonymous access. This typically is not a problem for most applications that run on Windows computers since the users are logged into the Active Domain. Occasionally there are applications that fail to connect to the internet despite the user being logged into the domain. Most of the time you need to open some non-standard ports to fix the problem. In this case McAfee is using standard HTTP and HTTPS ports and still failing to connect.

The solution is to create an anonymous access rule to the McAfee update site and to configure the client to not use the ISA Firewall client for these sites. One way to accomplish this is to configure Internet explorer(Tools-Internet Options-Connections-Lan settings-Advanced) to not use the proxy. This is the way I got McAfee to update. Another way is to configure the properties for the internal network in ISA to use direct access for these sites. You can configure a GPO, too.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

NEC PCI to USB Open Host Controller – Everything USB Community

Bill — Tue, 20 Jan 2009 16:46:45 +0000

I found myself troubleshooting a Verizon PC5470 wireless broadband issue today. This setup worked a couple of months ago when I last touched it. When my boss inserted the PC5470 card into his PC, the VZAccess Manager software could not talk to the card. We noticed that his PC would create two NEC PCI to USB Open Host Controller when the card was inserted and the device manager showed that a Curitel modem was unknown. At the time I did not know what the Curitel modem was used for. When the card was installed on another PC only one NEC PCI to USB Open Host Controller was created and VZAccess manager was able to create a wireless broadband connection. After exhausting my troubleshooting tricks I found this conversation on the Internet, NEC PCI to USB Open Host Controller – Everything USB Community. Although my solution was different than their recommendation, their ideas helped lead me in the right direction. My solution was to uninstall both NEC PCI to USB Open Host Controllers and force Windows to re-install all of the drivers. Disabling or uninstalling one driver did not work for me. When I inserted the PC card, Windows proceeded to re-install the drivers as expected. First it installed two NEC PCI to USB drivers. Next it tried to install the Curitel modem driver. During this process the PC announced that it was disabling a hardware device. When the driver installation was complete the Device Manager showed that the second PCI to USB driver was disabled and the Curitel modem was installed and functioning. When I started the VZ Access manager it found the PC5470 and configured itself to use the Curitel modem. After a little bit more automatic updating by VZ Access manager, we were able to establish a wireless broadband connection. Whew!

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Interesting Computer Problem

Bill — Sun, 18 Jan 2009 14:41:01 +0000

When you are grateful you have a job you can’t be picky about the applications you support. This week I spent a lot of time on my one of my least favorite applications, credit card processing. To give you a little background I was not employed at the firm when it was originally installed in 2007 so almost everything I hear is secondhand. The application is pretty simple and it runs on its own computer. It downloads credit card orders from our orders data base, transfers the authorizations over to the bank, and then updates the orders data base. Despite its relative simplicity I hear that the application was a painful install with lots of support issues. The folks before me got it to work and it seemed to be working okay until the the middle of 2008. That was when intermittent response time problems started to crop up. Attempts at technical support lead us down that primrose path again without success. The folks in technical support recommended we re-install the software but they really did not have an explanation for our response time issue. The statement that sent us in a completely different direction was when they said that our transaction volume was too large for their application. Our bank took that statement back a week later but the damage was done. The bank and the credit card processing application were going to be replaced.

This fun and games started when the credit card processing computer rebooted after the “Patch Tuesday” updates. It came up okay but it was coming up with strange errors during credit card processing. At first we could not process any credit cards but we finally got the cards processed. Since it was “working” I did not look at the problem until Friday. That was when I found out that the problems had continued on every morning and it had reached the critical stage. After spending three hours of “quality time” with an upset user(my boss) getting the credit cards processed, I was convinced that there was more to this problem than “Patch Tuesday” problems and I was determined to fix the problem today.

It did not take too long before I found a disk corruption problem. It looked like DISKCHK might fix the problem so I needed credit card processing folks to complete the end of day tasks so I could take an immediate backup and reboot. So at 530 pm on a Friday evening we rebooted. The computer would not reboot. I tried safe mode and it would not reboot. I tried to boot from a CDROM and it would not reboot. I called the boss to let him know. He said he would meet at the office on Saturday morning. This had a really good chance of being a super catastrophe. Oh well! There goes my weekend!

On Saturday it took us about an hour to identify the problems. The boss actually found the problem. I heard a unusual spin up sound on either the disk drive or a fan. My little power supply tester showed we were missing –5v. I installed a new power supply and now we could boot off of the CDROM. Unfortunately now that we could boot up properly we could confirm that the disk drive was trashed. So I installed a new drive. About two hours later I had completed re-installing the operating system and the application from my backup. An hour of testing confirmed that we would be able to process credit cards on Monday and the business would continue for another week. This is probably the first time I have seen a double failure on a PC.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Oops! Could not start error

Bill — Wed, 03 Dec 2008 11:25:47 +0000

I had not looked or touched my “dogfood” server in a long time. It appeared to be happily doing it’s thing. Appearances can be deceiving. I found that my scheduled jobs were not running according to the schedule. I had about a dozen jobs with the “Could not start error” message. What a mess! I am not sure how this happened but the fix is easy. Just enter the password again!

How to troubleshoot scheduled tasks in Windows XP and in Windows Server 2003

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.