paulskeewindows

[paulskeewindows]

Setting VMQ

Find out how many cores/logical cores there are.

get-wmiobject -class win32_processor | ft -Property NumberOfCores, NumberOfLogicalProcessors -auto

Find out what VMQs are configured for processors.

get-netadaptervmq | where InterfaceDescription -like "*Ethernet*"

Setting VMQ on adapters.

Set-NetAdapterVMQ -Name "Ethernet" -BaseProcessorNumber 0 -MaxProcessors 4 Set-NetAdapterVMQ -Name "Ethernet 2" -BaseProcessorNumber 8 -MaxProcessors 4 Set-NetAdapterVMQ -Name "Embedded FlexibleLOM 1 Port 1" -BaseProcessorNumber 16 -MaxProcessors 4 Set-NetAdapterVMQ -Name "Embedded FlexibleLOM 1 Port 2" -BaseProcessorNumber 24 -MaxProcessors 4

[paulskeewindows]

SCVMM library share iso

Cause

The share permissions and NTFS permissions on that folder aren't configured correctly.

Resolution

1 library server named LS01 in my lab environment

VMMAdmin is an administrator to manage the library server

VMM library folder named VMMLibrary at D:\.

1 domain controller named DC01 in my lab environment

VMMSvc is a service account of VMM

HV Servers is a group which contains all Hyper-V host members

1. On LS01, log in as VMMAdmin.

2. Launch "Windows Explorer" and then navigate to D:\.

3. Right-click VMMLibrary, select "Properties".

4. On "VMMLibrary Properties" window, select "Sharing" tab.

5. Click "Advanced Sharing".

6. On "Advanced Sharing" window, click "Permissions".

7. Add "VMMSvc" and "HV Servers" and then configure "Allow - Read”.Add all Hyper-V hosts to a group for applying permissions easily.

8. Click "OK" twice.

9. On "On "VMMLibrary Properties" window, select "Security" tab.

10. Click "Edit".

11. Add "VMMSvc" and "HV Servers" and then configure "Allow - Read".

12. Click "OK".

13. Click "Close".

[paulskeewindows]

Removing old network cards from windows

Go to device manager. Select View tab and choose "Show hidden devices".

Navigate to network adapters and delete only the greyed out ones (inactive)

[paulskeewindows]

Finding Enterprise CA

certutil -config - -ping

[paulskeewindows]

Extending drive fails, doesn’t show in correct size in file manager

The fix is simple, open an elevated command prompt and start DISKPART

List all volumes of the server.

DISKPART> list volume

Select the volume that has the wrong file system size. x is the ID of the effected volume.

DISKPART> select volume [x]

Extend the file system

DISKPART> extend filesystem

[paulskeewindows]

Check date/time on when certificate will actually expire

Install openssl.

openssl x509 -in Certificate_File.pem -text

[paulskeewindows]

Install Windows Product Key via cmd

Installing the product key you will need to issue this slmgr.vbs -ipk 12345-12345-12345-12345-12345

In next step you will need now to run same command with the second parameter to activate the product key for the slmgr.vbs -ato

If all is good you will see a dialog box that tells you the product key is installed successfully. Click OK to finish.

[paulskeewindows]

Windows Trust relationship broken fix

If you can gain access to a command prompt on the remote computer, via:

Enter-PSSession BrokenWorkstation

then you can use:

Test-ComputerSecureChannel –Credential YourDomain/DomainAdmin -Repair

There is also the possibility that it is just the system password that is messed up, so could use this too:

Reset-ComputerMachinePassword -Credential YourDomain/DomainAdmin -Server dc.yourdomain.local

That is if you have Powershell v3 on the workstation. If not then try the following:

WMIC /node:BrokenWorkstation process call create "netdom.exe resetpwd /s:dc.yourdomain.local /ud:YourDomain/DomainAdmin /pd:*"

[paulskeewindows]

Migrating folders and share permissions

Note: For this to work, the drive letter on the source server and the new server needs to be the same.

1. On the new server, map a drive letter the the shared drive on the old server.

2. Copy the contents of the OLD drive to the NEW drive with the following command.

xcopy x:*.* e:*.* /D /E /C /F /H /K /O /Y

3. The copy over can take some time, remember if your old server has a slow network card or you only have a 10/100 switch then it may take considerably longer. In this example I was moving approx 140GB – it took a couple of hours.

4. That gets the files over with the correct windows permissions. Lastly we need to migrate the share permissions, on the OLD server > Start > Run > Regedit > Navigate to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanserverShares > Right click the entire “Shares” Key and export it to a file. (I just called it Shares and dropped it on the old servers C: drive).

5. Now I’ve read other sites and posts that say WARNING importing this key will break shares on the new server, but that is NOT the case. If you are worried you can export the same key on the NEW server to back it up.

6. Copy the file you exported from the old server to the new server, then double click it, you will get a warning about adding/merging the file into the registry > Accept by clicking yes.

7. All being well it should say it was successful. Now simply reboot the NEW server and the shares will be recreated.

[paulskeewindows]

Robocopy

Robocopy Step 1

On the root of the destination servers C: drive create a folder called ROBOCOPY-Logs, and within this folder create another folder called Last-Copy, (you will see why later). This will allow us to create logs to see if anything has failed.

Replace the values below

robocopy \\OLDSERVER\d$\FOLDER D:\FOLDER /e /zb /copy:DATSOU /r:3 /w:3 /log:c:\ROBOCOPY-Logs\FOLDER.log /V /NP

OLDSERVER is the source fileserver, D$ is the drive letter on the Source Server, and D is the drive letter on the new server.

Here are the switches for robocopy:

/E Copy subdirectories recursively, (including empty ones.)

/ZB Use ‘restartable’ mode, and if this fails use ‘backup’ mode.

/copy:DATSOU Copy Data, Attributes, Time Stamps, Security, Owner, aUditing information

/R:3 Retry three times, if you don’t specify this, it will retry one million times!

/W:3 Wait time between the retries above.

/log Will output the log to the folder we created above.

/V Produce output in verbose (detailed) mode.

/NP Do not show percentage progress

Robocopy Step 2

The second time, the command is virtually the same, with one extra switch, (see below).

robocopy \\OLDSERVER\d$\FOLDER D:\FOLDER /e /zb /copy:DATSOU /MIR /r:3 /w:3 /log:c:\ROBOCOPY-Logs\Last-Copy\FOLDER.log /V /NP

/MIR This is the ‘mirror directory’ switch, and people are scared of it. Why? Because in the documentation it says it removes or ‘purges’ files. People mistakenly think that it will remove any files from the source that do not exist in the destination. This is incorrect it will only remove files from the destination that no longer exist in the source.

It Has Not Copied Share Permissions!

That’s correct, I never said it would, it copies NTFS permissions, ownership and ACL information.

Can I Copy the Share Permissions Afterwards?

Yes, if you take a look at the following article, (I wrote a while ago,) you can see me doing just that, after a file copy.

Migrating – Folders and Share Permissions

I Can’t Copy Profiles / I get Permissions Errors?

Make sure the user you are using to copy files with, is a member of the ‘Backup Operators’ Group.

Make sure you execute the Robocopy command from an administrative command window.

Try doing the copy from the SOURCE server.

[paulskeewindows]

Creating Self-Signed Windows Server 2012 certificates

Recently, I came across this situation where one of my customer wants to use the Self Signed Certificate to secure his intranet websites. But he wants to use the Self Signed Cert with the sha256 Signature Hash algorithm on Windows Server 2012 R2 as sha1 is retired.

By Default, in Windows 2012 R2 (IIS 8.5) if you generate the Self-Signed Certificate from the IIS Manager Console it will provide a Self-Signed Certificate with the Signature hash algorithm as sha1 .

The SHA-1 hashing algorithm for the Microsoft Root Certificate Program is being decommissioned.

https://blogs.msdn.microsoft.com/spses/2014/10/21/sha-1-decommissioning/

If you want your self-signed certificate should use the sha256 Signature hash algorithm, we have to generate the certificate from the mmc console

You can follow below steps to create and use a Self-Signed Certificate with the Signature hash algorithm as sha256.

1.Open the mmc console >> go to Run >>>type mmc >>>OK

2. You will get the below Window (mmc console). Click on Add/Remove Snap-in

3. Select Certificates >> Add

4. Select Computer Account and Click on Next

5.Click on Finish

6. The Certificates will be added in your snap-in

7. Expand Certificates (Local Computer) >>>Personal >>>>>Certificates >>>>>All Tasks>>>>>Advanced Operations>>>>>Create Custom Request

8. Click on Next

9.Select Proceed without enrollment policy>>>>>>>Next

10. Click on Next

11.Click on Details >>>>>Properties >>>>Next

12.Add the Friendly for your certificate as per your choice

13. Click on Subject >>>>>>Subject Name >>>>Type >>>>>>>Select Common Name (Common Name should be your host name with which you are browsing your site) >>>Add  Alternative Name >>>>Type >>>>DNS>>>>>Add your DNS (domain name here)>>>>Add

14. Click on Extensions tab>>>>>>>>>>>>>>Extended Key Usage (application policies)

15.Click Basic Constraints >>>>>>>Select Enable this extension

16. Go to Private Key tab>>>>>>>>>>>>>>>>Key Options >>>>>>>>>>>>>Select Make private key exportable

17. Go to Private Key tab>>>>>>>>Select Hash Algorithm >>>>>>>>>>>Hash Algorithm >>>>>>>>>>>>>>>>>sha256(Here you will select the Signature hash algorithm )

18. Click on Apply >>>Ok

19. Click Next

20. Click on Browse and give the certificate with CertName.cer and click on Finish

21. Click on Certificate Enrollment Requests >>>>>>>Right click on Certificates >>>>>>>>>>All Tasks >>>>>>>>>>Import

22. Click on Next

23. Specify the file name and the location

24. Click on Next

25. Click on Finish

26. Click on OK

27. You will see your certificate here under Certificate Enrollment Requests >>>>>>> Certificates

28. Double click on the certificate >>go to Details >>>>Click on Copy to File >>>>>>>Next >>>>>>>>Select the Format you want to use >>>give the file name and the import it to the desktop>>>>>>Finish

29. Import the certificate in Personal Store

Now, check the Certificate go to Details tab check for the Signature hash algorithm >>>>it will be sha256

Import the Certificate to the IIS and add the http binding for the site select the cert.

You have to add this certificate on every client machine from where you want to access the site.

On the Client Machines:

Run >>>>>mmc >>>>>file>>>>>>Add/Remove Snap in >>> add the Certificates >>>>>select Computer Account >>>>import the certificate under Trusted Root Certification Authorities

Hope this helps !!!!!..

[paulskeewindows]

How to find user SID

wmic useraccount get name,sid

[paulskeewindows]

Deactivation Windows 10 Licences

Uninstall Windows Product Key

To begin with, you will need to know the Activation ID of your Windows installation. To view licencing status and Activation ID, open an elevated command prompt windows, type the following and hit Enter:

slmgr.vbs /dlv

To get all the Activation IDs for all the installed version of Windows, you can use:

slmgr.vbs /dlv all

The /dlv parameter will display detailed license information for the installed operating system. Specifying the allparameter displays all applicable installed products’ license information.

You may click on any of the images to see the larger versions.

You will see a Windows Script Host window open up giving you details about your Windows licensing and activation status. Here look for Activation ID and note it down.

Now in the same command prompt window, type the following and hit Enter:

slmgr /upk <Activation ID>

Here upk stands for uninstall product key. The /upk parameter  uninstalls the product key of the current Windows edition. After a restart, the system will be in an Unlicensed state unless a new product key is installed.

If you entered it wrongly by mistake, you will see the following error message – Product key not found.

If you entered it correctly you will see the message – Uninstalled product key successfully.

[paulskeewindows]

Bootcamp drivers stuck at Realtek driver

I found a solution, when the installation hangs at realtek audio:

1. DO NOT turn it off 2. go to your bootcamp folder, manually install the realtek driver, DO NOT restart 3. after manully setup, open Task Manage, and kill the "RealtekSetup" process 4. bootcamp will skip the Realte, and have fun

[paulskeewindows]

Boot camp on new macs

Create USB stick using Apple Bootcamp Assistant. This procedure only works with it.

When it Bootamp assitant reboots your machine you need to interrupt the installation.

When you hear the startup sound, hold option until it presents you with login options.

Select your Macintosh HD to boot back into OSX.

Run Disk Utility, select the Macintosh then choose the partitions tab.

The BOOTCAMP partition should be at the bottom. Select this partition by clicking on it. Ensure it is the highlighted partition then press minus to remove it.

Click apply on the bottom right to make the changes.

Now press plus to add a new partition which will likely be names Macintosh HD2

Select this new partition then you can define the settings on the right.

Rename this to BOOTCAMP.

Change the type to ExFAT.

Now click apply on the again to make the changes.

Reboot you Mac, press option again during the boot and this time select the Windows device with the USB logo on it. Its orange.

Now it will start the install process. When it gets to the list of partition you should see four of them. You want the last one. It will say it cannot install on this.

Make sure the fourth partition is selected then click format. When it is done the error message should be gone and you should be able to continue.

During install it will suggest turning on auto updates. I recommend you turn this off until the bootcamp drivers are installed. When it is finished prepping the install it will reboot.

Each time it reboots you will need to intervene by pressing option but from now on select the Windows device with the picture of the hard drive. It is a silver color

It will reboot two or three times during the install. Each time you will need press option during boot to reselect the Windows device on the hard drive.

At the end of the installation it will prompt you to install the Apple Bootcamp Drivers.

[paulskeewindows]

Extracting Certificate and Private Key Files from a .pfx File

Procedure

Take the file you exported (e.g. certname.pfx) and copy it to a system where you have OpenSSL installed. Note: the *.pfx file is in PKCS#12 format and includes both the certificate and the private key.

Run the following command to export the private key: openssl pkcs12 -in certname.pfx -nocerts -out key.pem -nodes

Run the following command to export the certificate: openssl pkcs12 -in certname.pfx -nokeys -out cert.pem

Run the following command to remove the passphrase from the private key: openssl rsa -in key.pem -out server.key

[paulskeewindows]

Installing bootcamp drivers on windows 10

Goto CMD as administrator and navigate to where the bootcamp.msi file is in the download you downloaded. Then enter in the below.

msiexec /i BootCamp64.msi NOCHECK=1