Technical

How to demote a Windows Server 2012 Domain Controller

In this short write up I will go over steps to demote a Server 2012 domain controller.

If you have worked in Active Directory and Windows Domain Administration over the years you may recall that in previous version of Windows Server that you would use the command line tool of ‘DCPROMO’ to promote or demote a server. Since Server 2012, the use of DCPROMO has been deprecated. In fact, if you attempt to use it you will be inform of this via the Active Directory Domain Service Installed.

In Server 2012 and later versions the use of Server Manager or PowerShell is required to promote / demote a server to/from a Domain Controller (DC). Below I provide steps on how to demote a server with some illustration along the way. Also, here is a quick YouTube video on the process: https://youtu.be/sBK2_APaDdg

Log into the domain controller you intend on demoting and Launch the Server Manager, select the Manage drop down menu, select Remove roles and features.

On the server selection page, select the desired server from the pool.

On the Remove Roles and Features Wizard, un-tick the Active Directory Domain Services box

The Remove Roles and Features dialog box will open. Click Remove features

On the Remove Roles and Features Wizard dialog box Validation Results box will appear. The domain controller must be demoted before continuing. Click on Demote this domain controller.

On the Active Directory Domain Services Configuration Wizard enter the required credentials to demote this server, click Next.

You will have several removal options. From the forced remove of failed domain member, to removing of the last domain in your forest. Make the selections which is appropriate for your remove task and click Next

Finally you will arrive on the New Administrator Password, enter and confirm the new local administrator account password, click Next.

On the Review Options verify the information is correct and click Demote.

After the server has restarted it will no longer be a domain controller

And that is it.

Tech Short: Debug VPN in Checkpoint R77.30

The following tech short will provide a list of commands used to enable debugging in Checkpoint’s R77.30 Firewall. To start you must  SSH into firewall host (or active member).

To turn on VPN debug from the expert mode:

# vpn debug trunc

At this point you want to test your VPN connection and verify that IKE Phases. This can be done with the following commands:

# vpn tu (option 1 and 2), you may need to reset tunnel to test. This is done by using (option 7)

To tune off the VPN debug the following commands should be issued:

# vpn debug off

# vpn debug ike off

 

When completed retrieve the logs vpnd.elg and ike.elg – located under $FWDIR/log

Checkpoint has an IKEView tool which is located on their site, and used to review the logs, else using a tool such as Notepad++ for analysis is helpful.

X1 Set-Top Box Issues RDK-03004 & RDK-03033

Excellent Comment from one of my previous post:
http://jermsmit.com/x1-error-code-rdk-03004-unable-to-connect-to-xfinity/

Sharing the information below.  Thanks dude for sharing.

 

Equipment List:

1. Cable Modem -> Xfinity TG1682G internet cable modem (https://tinyurl.com/y7vmfwr9)
2. Main DVR Unit -> Xfinity PX0113ANM main cable box (https://tinyurl.com/ybqa3m6y)
3. Remote Units -> 2 Xfinity PXD01ANI receivers (https://tinyurl.com/y97fawjj)
4. Amplifier -> Commscope CSAPDU5VP 5 port Subscriber Amplifier (https://tinyurl.com/y6vdnuhn)
5. MoCa Filter -> PPC MoCA Ground Block PoE Filter, Combo Wave (https://tinyurl.com/ybhb496l)

Situation:

Xfinity internet was disconnecting frequently, and the main Xfinity cable box (PX013ANM) was rebooting. Basically, service was going in and out.  Neighbors were not having any issues.  Called Comcast a number of times.  Sometimes they customer service representative could ping (i.e. see) the devices, other times they could not.

Complicating Factors

Internet was consistently dropping.  Great performance, then nothing. Reboot the modem, work for a period, then same issue would repeat.

All of a sudden main cable DVR unit would reboot multiple times per day.

Cable would begin randomly freezing on remote units.  I would reboot the remote units, and they would time out, not connect, and display the error: rdk-03036.

I’ll jump to the solution so I don’t bore you to sleep….

Solution:

After hours (possibly days) of internet research, hair pulling, and deep, deep soul searching, I figured out the issue and now (knock on wood) have a speed demon, high-performance Xfinity network.

1.  Make sure your cable line is GROUNDED.  This is important.  My cable line is grounded using the MoCa filter which is explained in #2 below.  Grounding the line really important.  Proper grounding reduces noise/static in the cable line which allows the data to perform better.  Here is a link explaining the situation: https://tinyurl.com/6k3hqb.  Safety note: You also want to ground the line in the rare situation that the cable line outside gets hit by lightning, sending that dangerous current into your house destroying everything in its path (all electronics and possible your home)

2. Make sure you have a MoCa filter (see equipment list above) installed on your cable line BEFORE any amplifier or splitter.  This is very important – also, make sure the directional arrow on the filter points into the house as if data were flowing into your home.  NOTE: My MoCa filter is also the ground point.  I’ll explain this MoCa pain in the a$$ down below.

3. If you are using the Commscope amplifier, it is really important on where you connect your devices.  On my Commscope 5 port, there are four active ports (Out 1 -> Out 4), and one passive port (-4dB VoIP Out).   There is also the line IN port (this is where you connect the cable line coming into the house {assuming the MoCa filter is on the other end connect to the main line from the outside cable}), and the Power In port.

– The cable modem MUST be connect to the VoIP Out passive port.  This is defined as “passive”  since the amplifier does not send any power to it (i.e. amplification).  The main purpose is that if your power goes out, and your cable modem has a backup-battery, the phones will still work (i.e. land lines).
– The rest of your cable devices (main DVR, and remote boxes) should be connected to 1, 2, 3, and 4.  I’m only using 1, 2, 3.  My Main DVR is connected to Port number 1.  Also, if you have an open port, you should cap it with an F-Type terminator -> (aka dummy load) https://tinyurl.com/ydxybeog

4. Make sure the MoCa communications settings on the Cable Modem/Router is DISABLED!.  Using a browser on your home network, go to 10.0.0.1 and login as the Admin.  (Note: the default password is “password”).  Select Communications, find MoCa and disable it.

5. Unplug all your devices, wait a few minutes and plug them back in.  Once they are all up and running, use the Xfinity My Account app on your mobile device, and send a REFRESH single to your system.

If all goes to plan, everything should come back to life.  If you still have issues, check the following:

1. Make sure you limit splitters on your cable network.  If you have any, and require splitting, please make sure they are high-quality.  Also, if you have a one to four, or one to two splitter, and you are not using all the connectors, the ports need to be capped with an f-type male terminator.  Otherwise, you lose signal.

2. If you are having internet issues and are using a downstream router, make sure all your Ethernet cables are high quality.  I had some old cables where the ends did not fit well, and that was causing internet problems.

3.  If you are still having cable issues on the remote boxes, go to the main DVR, grab the remote and perform the following procedure:

– Press and hold the EXIT button for five seconds
– Click the down arrow twice
– Hit the number 2 button

You should be presented with the diagnostics menu. Arrow to the MoCa Diagnostics section and confirm that the MoCa Link Status is set to LinkOn (not NoLink).  If this is set to NoLink, then your cable will not work on the remote boxes. Check to make sure the MoCa filter is installed correctly. Also, make sure MoCa is disabled on the cable modem router page.

*** MoCa PITA (Pain in the A$$) ***

So, I learned a lot about MoCa during this exercise.  Multimedia Over Coax Alliance (“MoCa”) is the data communications method used by the Xfinity devices to communicate.  The remote devices do nothing more than connect to the main DVR for processing. When you are watching cable on a TV connect to a remote PXD unit, all the interaction (guides, internet apps, DVR viewing) is being served by the main DVR unit in the home. All the data is being controlled by MoCa.  If you don’t have the MoCa filter connected to your cable line coming into the house, you can get MoCa traffic into your home network which causes congestion and conflict.  Hence, there is so much traffic that the devices can’t connect to the right host – your main DVR.  By installing the filter, outside MoCa traffic is left outside.

In theory, the MoCa configuration on your Comcast router should not impact the performance of your cable devices.  However, when I had it on, I had internet and cable problems.  By making sure the filter was installed correctly, and MoCa was OFF on the router, the system worked perfectly.

I hope this helps and saves at least one person some time and headaches.

submitted by frustrated xfinity (comcast) customer

OpenVPN Access Server on Ubuntu

I recently retired my OpenVPN Turnkey appliance and needed to get my VPN solution up and running again. I decided to go with installing OpenVPN Access Server on a clean install of Ubuntu Server to create a stable and light weight Virtual Private Network (VPN) to access my network.

I chose to go with OpenVPN AS because its using the OpenVPN I know and trust, but it also has the value added feature of an administrative server used for user and access management.

Setup is straight forward after a few small prerequisites are established.

Requirements:

  • Ubuntu Server – Running the latest version and updates. I am using 16.04.2-as my base
  • Root or possibly sudo access

Software:

Download the latest release of the OpenVPN AS Server
https://openvpn.net/index.php/access-server/download-openvpn-as-sw.html

The direct Ubuntu installs here

 

The following steps can be used to download and install:

  1. Download the install package: wget http://swupdate.openvpn.org/as/openvpn-as-2.1.9-Ubuntu16.amd_64.deb
  2. Install the downloaded package: dpkg -i openvpn-as-2.1.9-Ubuntu16.amd_64.deb
  3. Change the password for the openvpn user: passwd openvpn

When the installation has completed, the Access Server web UIs will be available here:
Admin UI: https://<yourip>:943/admin
Client UI: https://<yourip>:943/

 

And just like that you now can take better control over your privacy, security.

Note: I did not go over the configuration of OpenVPN AS, I may do this in another post. I just wanted to run though the steps of getting this software installed.

Server 2008 R2, ‘Powershell’ is not recognized as an internal or external command …

While working on a task scheduling a powershell script, it was noticed that the powershell command does not execute from the command prompt on a server. When run I would encounter the following error: ‘powersehll’ is not recognized as an internal or external command, operable program or batch file.

After searching around Google / Bing I gave up and made the following attempt which worked out for myself and the system owners.

Looking at the system PATH variable seems correct with the expected path variable included under system variables: %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\

I decided to check with my user only: I added ‘%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\’ to my user variable with success

In the systems path variables and removed the reference and added it to the end of the line which was successful in resolving the system wide issue.

Notes: This is a snapshot of before and after changes introduced which resolved my issue

original:
%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\DTS\Binn\;C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\;C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\;C:\Program Files (x86)\Microsoft SQL Server\100\DTS\Binn\

updated:
%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\DTS\Binn\;C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\;C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\;C:\Program Files (x86)\Microsoft SQL Server\100\DTS\Binn\;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\

Cause of issue is still unknown.  Perhaps an ordering issues in the variables.  If you know please feel free to comment.
Thanks,

Jermal

[SOLVED] Unable to migrate VM’s to other host

I had encountered the following issue when attempting to migrate a live VM to another host w/in my lab cluster.
The error received was: 

Currently connected network interface” ‘Network adapter 1’ cannot use network ‘VM Network’, because “the destination network on the destination host is configured for different offload or security policies than the source network on the source host”.

I was able to fix this by checking the configuration of the virtual switch (vSwitch0) on the ESXi host I was moving the virtual machine guest to.

  1. I click on each host went to the configure
  2. Under the Networking subsection located the virtual switch
  3. Selected edit on that virtual switch.
  4. Reviewed the settings in the Security tab and the Traffic Shaping tab between the hosts.

In my case the issue was with the Security tab.  The destination host did not match the source.
Just another reasons to use host profiles between systems so that settings all match.

 

VMware vCenter 6/6.5: Creating Host Profiles

This post describes how to perform the basic task of creating a host profile.
Description of Hos Profiles:

VMware Host Profiles are available through VMware vCenter Server and enable you to establish standard configurations for VMware ESXi hosts and to automate compliance to these configurations, simplifying operational management of large-scale environments and reducing errors caused by mis-configurations.

Prerequisites:

  1. You need to have a vSphere installation
  2. You need to have admin rights
  3. You need a configured ESXi host that acts as the reference model

Steps:

  1. In vCenter Navigate to the Host profiles view
  2. Click the Extract profile from a host icon
  3. Select the host that will act as the reference model host and click Next
  4. Enter the name and  a description for the new profile and click Next
  5. Review the summary information for the new profile and click Finish
  6. The new profile will appear in the profile list

Video:

Done!

VMware / vCenter: Terms, Acronyms, Glossary {Tag your IT}

Recently I have taken, failed later taken and passed my VMware 2V0–620 – vSphere 6 Foundations Exam and passed. I am now in the process of practicing and studying for proctored exam(s) for the VMware Certified Professional 6 – Data Center Virtualization Certificate.

With that there are many terms, acronyms, and Glossary items I will need to remember.
I am adding a list of terms and will expand on them as I come across new ones.

 

VM: Virtual Machine – a software computer that, like a physical computer, runs an operating system and applications. https://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.vm_admin.doc_50/GUID-CEFF6D89-8C19-4143-8C26-4B6D6734D2CB.html

ESXi: The vSphere Hypervisor from VMware (formerly ESX) is an enterprise-class, type-1 hypervisor.

VMFS: Virtual Machine File System for ESXi hosts, a clustered file system for running VMs

DCUI: Direct Console User Interface

iSCSI: Ethernet-based shared storage protocol.

SAS: Drive type for local disks (also SATA).

FCoE: Fibre Channel over Ethernet, a networking and storage technology.

HBA: Host Bus Adapter for Fibre Channel storage networks.

LUN: Logical unit number, identifies shared storage (Fibre Channel/iSCSI).

IOPs: Input/Outputs per second, detailed measurement of a drive’s performance.

pRDM: Physical mode raw device mapping, presents a LUN directly to a VM.

vRDM: Virtual mode raw device mapping, encapsulates a path to a LUN specifically for one VM in a VMDK.

SAN: Storage area network, a shared storage technique for block protocols (Fibre Channel/iSCSI).

NAS: Network attached storage, a shared storage technique for file protocols (NFS).

NFS: Network file system, a file-based storage protocol.

DAS: Direct attached storage, disk devices in a host directly.

VAAI: vStorage APIs for Array Integration, the ability to offload I/O commands to the disk array.

SSD: Solid state disk, a non-rotational drive that is faster than rotating drives.

VM Snapshot: A point-in-time representation of a VM.

ALUA: Asymmetrical logical unit access, a storage array feature. Duncan Epping explains it well.

VMX: VM configuration file.

VMEM: The page file of the guest VM.

NVRAM: A VM file storing the state of the VM BIOS.

VMDK: The virtual machine disk format, containing the operating system of the VM. VMware’s virtual disk format.

VMSN: Snapshot state file of the running VM.

VMSD: VM file for storing information and metadata about snapshots.

VMSS: VM file for storing suspended state.

VMTM: VM file containing team data.

VMXF: Supplemental configuration file for when VMs are used in a team.

Quiesce: The act of quieting (pausing running processes) a VM, usually through VMware Tools.

NUMA: Non-uniform memory access, when multiple processors are involved their memory access is relative to their location.

Virtual NUMA: Virtualizes NUMA with VMware hardware version 8 VMs.

VSAN: Virtual SAN, a new VMware announcement for making DAS deliver SAN features in a virtualized manner.

vSwitch: A virtual switch, places VMs on a physical network.

vDS: vNetwork Distributed Switch, an enhanced version of the virtual switch.

ISO: Image file, taken from ISO 9660file system for optical drives.

vSphere Client: Administrative interface of vCenter Server.

vSphere Web Client: Web-based administrative interface of vCenter Server.

Host Profiles: Feature to deploy a pre-determined configuration to an ESXi host.

Auto Deploy: Technique to automatically install ESXi to a host.

VUM: vSphere Update Manager, a way to update hosts and VMs with latest patches, VMware Tools and product updates.

vCLI: vSphere Command Line Interface, allows tasks to be run against hosts and vCenter Server.

vSphere HA: High Availability, will restart a VM on another host if it fails.

vCenter Server Heartbeat: Will keep the vCenter Server available in the event a host fails which is running vCenter.

Virtual Appliance: A pre-packed VM with an application on it.

vCenter Server: Server application that runs vSphere.

vCSA: Virtual appliance edition of vCenter Server.

vCloud Director: Application to pool vCenter environments and enable self-deployment of VMs.

vCloud Automation Center: IT service delivery through policy and portals, get familiar with vCAC.

VADP: vSphere APIs for Data Protection, a way to leverage the infrastructure for backups.

MOB: Managed Object Reference, a technique vCenter uses to classify every item.

DNS: Domain Name Service, a name resolution protocol. Not related to VMware, but it is imperative you set DNS up correctly to virtualize with vSphere.

vSphere: Collection of VMs, ESXi hosts, and vCenter Server.

vCenter Linked Mode: A way of pooling vCenter Servers, typically across geographies.

vMotion: A VM migration technique.

Storage vMotion: A VM storage migration technique from one datastore to another.

vSphere DRS: Distributed Resource Scheduler, service that manages performance of VMs.

vSphere SDRS: Storage DRS, manages free space and datastore latency for VMs in pools.

Storage DRS Cluster: A collection SDRS objects (volumes, VMs, configuration).

Shares: Numerical value representing the relative priority of a VM.

Datastore: A disk resource where VMs can run.

vSphere Fault Tolerance: An availability technique to run the networking, memory and CPU of a VM on two hosts to accommodate one host failure.

DPM: Distributed Power Management, a way to shut down ESXi hosts when they are not being used and turn them back on when needed.

vShield Zones: A firewall for vSphere VMs.

vCenter Orchestrator: An automation technique for vCloud environments.

OVF: Standards based format for delivering virtual appliances.

OVA: Packaging of OVF, usually as a URL to download the actual OVF from a source Internet site. Read more here.

VMware Tools: A set of drivers for VMs to work correctly on synthetic hardware devices. Read more on VMware Tools.

vSphere Licensing: Different features are available as the licensing level increases, from free ESXi to Enterprise Plus.

vCloud Suite: The collection of technologies to deliver the VMware Software Defined Data Center.

VMware Compatibility Matrix: List of supported storage, servers, and more for VMware technologies. Bookmark this page!

vSphere role: A permissions construct assigned to users or groups.

Configuration Maximums: Guidelines of how big a VM can be; see the newest for vSphere 5.5.

Transparent page sharing: A memory management technique; eliminates duplicate blocks in host memory.

Memory compression: A memory management technique; applies a compressor to active memory blocks on the host.

Balloon driver: A memory management technique; reclaims guest VM memory via VMware Tools.

Hypervisor swap: A memory management technique; puts guest VM memory to disk on the host.

Hot-add: A feature to add a device to a VM while it is running, such as a VMDK.

Dynamic grow: A feature to increase the size of VMDK while the VM is running.

CPU Ready: The percentage of time that the VM is ready to get a CPU cycle (higher number is bad).

Nested hypervisor: The ability to run ESXi as a VM either on ESXi, VMware Workstation, or VMware Fusion.

Virtual hardware version: A revision of a VM that aligns to its compatibility. vSphere 5.5 is hardware version 10, for example.

Maintenance mode: An administration technique where a host evacuates it’s running and powered off VMs safely before changes are made.

vApp: An organizational construct combining one or more VMs.

Cluster: A collection of hosts in a vSphere data center.

Resource pool: A performance management technique, has DRS rules applied to it and contains one or more VMs, vApps, etc.

vSphere folder: An organizational construct, a great way to administer permissions and roles on VMs.

Datacenter: Parent object of the vSphere Cluster.

vCloud Networking and Security: Part of the vCloud Suite; provides basic networking and security functionality.

vCenter Site Recovery Manager: An automated solution to prepare for a site failover event for the entire vSphere environment.

NSX: New technology virtualizing the network layer for VMware environments. Read more here.

VDI: Virtual desktop infrastructure, also called DaaS (Desktop as a Service) from Horizon View; run as ESXi VMs and with vSphere.

VXLAN: VMs with a logical network across different networks.

vCenter Configuration Manager: Part of vCloud Suite that automates configuration and compliance for multiple platforms.

vCenter Single Sign on: Authentication construct between components of the vCloud Suite.

VM-VM affinity: Sets rules so two VMs should run on the same ESXi host or stay separated.

Storage I/O Control: I/O prioritization for VMs.

NIOC: vSphere Network I/O Control – Enabled by default network I/O control is enabled, distributed switch traffic is divided into the following predefined network resource pools: Fault Tolerance traffic, iSCSI traffic, vMotion traffic, management traffic, vSphere Replication (VR) traffic, NFS traffic, and virtual machine traffic.

 

 

 

Restore of Checkpoint Fails with “The following hotfixes seem to be missing”

Ran into a slight snag when attempting to restore a production backup into a VM(*VMware*) image of Checkpoint R77.30. I was using the Gaia WebUI to restore image returns a message: “The following hotfixes seem to be missing”.

The message points me to a log file located under /tmp/ which indicates missing updates to the firewall I am restoring to. To get around this the following steps were taken.

 

  1. Log into the Checkpoint firewall via SSH to access the console (You could also console in  (i’m using a vm so the terminal would work also).
  2. Enter ‘Expert’ mode (password required.)
  3. The the command: dbset backup:override_hfs t’ from  the expert mode.
  4. Go back into Gain WebUI and attempt the restore of the backup.

Wait … Wait… The system will reboot and the configuration will be restored.

All done.

Cause of this issue was the backup file was taken from a system which had a version different from the system I was restoring into. In some cases, this message can be safely ignored and the restore can be performed without incident.

Please take time to review your configuration after you restore.

Check Point 600 Appliance Software Blade Stuck in Updating status

Recently I had a chance to get my hands on this excellent Firewall by Checkpoint. And as you know not everything goes perfectly, and this is where you get a chance to learn how it works, while you fix.

I encountered an issue where one of the Threat Prevention Blades was stuck in updating mode for several hours. I had logged into the appliance via SSH to view to CPU utilization and observed nothing which would indicate an issue.

I started thinking about what events occurred which may have caused this. So I looked at the auto update schedule for the blades and noticed that all 3 blades where set to upgrade simultaneously.

I have observed that these updated can causes very high consumption of CPU and which that perhaps the blade with the issue became stuck in an upgrading status.

To address this situation, I issued the update command from the CLI :

  1. Log into the firewall via SSH
  2. Enter into expert mode by typing ‘expert’ in the CLI – You will be asked for your expert password. Once in export you will be in a standard Linux bash prompt.
  3. Run the following while in expert mode depending on which update you require:
  • Anti-Virus Blade: [Expert@jermsmit.com]# online_update_cmd -b AV -o update
  • IPS Blade: [Expert@jermsmit.com]# online_update_cmd -b IPS -o update
  • Application Control Blade: [Expert@jermsmit.com]# online_update_cmd -b APPI -o update

 

Now return and refresh your webUI and you should notice that the blade(s) that were once stuck in the upgrading status are now showing up to date.