Removing Windows Intune client (4 methods)

Hi there, just a quick and simple overview on how to remove a Windows Intune client installation.

Method 1

The best way of achieving this would be to retire the client from the Windows Intune admin console. This removes the client software on the target systems.

Method 2

If you don't have access to the admin console (for whatever reasons) uninstalling a recent version of the client can only be done with the help of some batch scripts and an executable which can be downloaded from Microsoft.
Uninstall download

After executing the exe some files will be extracted. Copy these files to the client and execute the batch files (method 2):

• AgentUninstall_AIS.cmd
• AgentUninstall_Intune.cmd

After some time the folder C:\Program Files\Microsoft\OnlineManagement should only hold some logfiles. Reboot the client.

At this moment you can enroll the client into Windows Intune again or install a SCCM client to manage the client again.

Method 3

1. Open an admin command prompt
2. Navigate to C:\Program Files\Microsoft\OnlineManagement\Common
3. Run “ProvisioningUtil /UninstallAgents WindowsIntune” (method 3)

Method 4

Uninstall is also possible via WMI.
wmic product where “name like ‘%intune%'” call uninstall

Adding a Windows 2012 R2 Essential Server to a existing domain

Adding a new Windows 2012 R2 Essentials server to a existing domain is a supported scenario by microsoft.

The new server will then be the primary server for all the ADS roles.

Unfortunally this does not mean it will just work out of the box.

The basic steps for this are:

- Make the basic installtion of the windows server

- Don't follow the wizard after installation, just cancel it
- Important: Set the server name you wish to use now, you won't be able to change it later on
- Install the Active Directory Services on the new server
- Add the new server as a additional ADS server in the existing domain
- Let the wizard finish the essentials configuration

The details can be found on the microsoft product site.

Unfortunally the wizard won't finish, but rather say: Error occured and nothing is logged.

The post-config wizard won't let you configure the Essentials Experience role because it's unable to start the 'Windows Server Essentials Management Service' system service. This service is configured to run under the <domain>\ServerAdmin$ account. This account must have 'Log on as a service' rights.

• Go to Group Policy Management
• Edit your policy, such as the 'Default Domain Controllers Policy'
• Go to Computer Configuration \ Windows Settings \ Security Settings \ Local Policies \ User Rights Assignment
• Edit 'Log on as a service' and add 2 accounts: <domain>\ServerAdmin$ and <domain>\MediaAdmin$

The ServerAdmin$ is enough to let the wizard finish the configuration. The MediaAdmin$ is needed for the 'Windows Server Essentials Media Streaming Service'.

Fix orphan users in MS SQL Server after restore

When you restore a MS SQL Server to a different machine, you might expect orphan users.
This also happens when you detach a database and then attach it on another server.

You see the users in the Security->Users section of the sql server and also in the database itself, but you can't login with it.

The problem is, that MS SQL stores the SID along the users, and when you restore it on another MS SQL server the link between user names and SID won't match any longer.

Fixing this via GUI is unfortunally not possible, when you try to map the user it trys to create a new sql user and fails, because there already exists such a user.

Fortunally there are a few stored procedures (available since sql 2000 version) which help you fix the logins.

First, make sure that this is the problem. This will lists the orphaned users:

EXEC sp_change_users_login 'Report'

If you already have a login id and password for this user, fix it by doing:

EXEC sp_change_users_login 'Auto_Fix', 'user'

If you want to create a new login id and password for this user, fix it by doing:

EXEC sp_change_users_login 'Auto_Fix', 'user', 'login', 'password'

Ever needed to convert a VHD file to a real harddisk?

You probably know the scenario:

The client has started a small project and needed a new server for this.

In these days you useally go for a VM running on a server, and (since it uses few resources) you place the disk content of that VM into a file in the filesystem.
Since it's a small project with small load this is the ideal (cheapest) solution.

A few months later, you realize that this project is not as small as the customer tolds you or is requiring more and more storage place.

So you add more physical disks to the server and make a dedicated mirrored drive for that (once small) VM.

And now you have to transfer the content of the VHD file into the real disk, so you can directly access it with best performance from the VM.
Since MS did not provide a tool for this conversion, you need another tool for it.

There are serveral of them, the simplest GUI tool is Vhd2disk from Sysinternals.

Here is the link to the forum with the download links.

The conversion is very simple, just make sure to select the correct target disk, otherwise you will miss some other data!

Once restored you can change the disk in the Hype-V manager and (if required) expand the volume(s) to take advantage of the additional space.

Automated backups for MS SQL Express

MS SQL Express systems do not allow you to backup the databases via sheduled jobs (Since the job sheduler is one of th emissing features in the express edition)

With this handy script you can however automate it and even compress and send the backup files to a remote resource.

automssqlbackup

http://devio.wordpress.com/category/automssqlbackup/

Installing .net framework 3.5 via ADS GPO

Deploying .net framework 3.5 via group policy is not as easy as it should be.
No idea why microsoft did create packages which can't be used by microsoft products....

To get installable .msi packages you can do the following steps:

Deployment of Microsoft .NET Framework 3.5 SP1 x86 using Active Directory.

Microsoft Windows Installer 3.1 must already be deployed.

1. Download dotnetfx35.exe from http://download.microsoft.com/download/6/0/f/60fc5854-3cb8-4892-b6db-bd4f42510f28/dotnetfx35.exe

2. Run dotnetfx35.exe /x to extract the files

3. Move wcu\dotNetFramework\dotNetFX20 and wcu\dotNetFramework\dotNetFX30 into the root, eg to D:\dotNetFX20 and D:\dotNetFX30

4. To create Microsoft .NET Framework 2.0 SP2 admin install (a prerequisit) run
msiexec /a Netfx20a_x86.msi /update D:\dotNetFX20\ASPNET.msp;D:\dotNetFX20\clr.msp;D:\dotNetFX20\crt.msp;D:\dotNetFX20\dw.msp;D:\dotNetFX20\NetFX_CA.msp;D:\dotNetFX20\NetFX_Core.msp;D:\dotNetFX20\NetFX_Other.msp;D:\dotNetFX20\prexp.msp;D:\dotNetFX20\winforms.msp USING_EXUIH=1 REBOOT=ReallySuppress /log D:\dotNetFX20\netfx20a_x86.txt TARGETDIR=D:\dotNetFX20admin
then copy D:\dotNetFX20\Netfx20a_x86.msi to D:\dotNetFX20admin and move D:\dotNetFX20admin to network share.

5. To create Microsoft .NET Framework 3.0 SP2 admin install (a prerequisit) run
msiexec /a netfx30a_x86.msi /update D:\dotNetFX30\WCF.msp;D:\dotNetFX30\WCS.msp;D:\dotNetFX30\WF.msp;D:\dotNetFX30\WPF1.msp;D:\dotNetFX30\WPF2.msp;D:\dotNetFX30\WPF_Other.msp;D:\dotNetFX30\XPS.msp;D:\dotNetFX30\WF_32.msp;D:\dotNetFX30\WPF2_32.msp;D:\dotNetFX30\WPF_Other_32.msp USING_EXUIH=1 REBOOT=ReallySuppress /log D:\dotNetFX30\netfx30a_x86.txt TARGETDIR=D:\dotNetFX30admin
then copy D:\dotNetFX30\Netfx30a_x86.msi to D:\dotNetFX30admin and move D:\dotNetFX30admin to network share.

6. To create Microsoft .NET Framework 3.5 SP1 admin install run
wcu\dotNetFramework\dotNetFX35\x86\netfx35_x86.exe /x and move vs_setup.msi and vs_setup.cab to network share.

7. Add Netfx20a_x86.msi, Netfx30a_x86.msi and vs_setup.msi in order to an Active Directory GPO.

An x64 version can also be created and deployed using this method.

Running windows 2008 r2 adprep on a server in a different language

When you have a older active directory system, for example based on a Windows 2003 or Windows 2008 server, you have to upgrade the ads schema by running adprep.exe

The adprep.exe tool is found on the windwos 2008r2 DVD in the support\adprep directory.
You can copy over the whole content of the directory (including subdirectories) to your ads master  server.

If the "old" server is running a 32-bit windows, then you can start adprep32.exe instead of adprep.exe.

Now adprep.exe should tell you something about "At least windows 2000 sp4 required"
If you don't get any messages from adprep, then the languages of the windows 2008r2 dvd and your old ads server do not match.

It might be tempting to just type "c" for continue, it will then do some of the work, but unfortunally not everything you need.
adprep does write a logfile, which can be found in C:\windows\debug\adprep (or C:\windows\system32\debug\adprep for a 32-bit system)
You will see error like

There is a syntax error in the input file
Failed on line 169.  The last token starts with 's'.
An error has occurred in the program

The reason for this is, that there are some strings missing for the adprep utility.
To get it working correctly, you have to rename the language subdirectory to match the servers language. (Chaning it in the control panel is not enough)
For example if your new server is running german, then the subdirectory is called de-de.
If the old server for example is installed in english, you have to rename the de-de directory to en-us.

Now you can again run adprep, you will receive the prompts in the original language from the dvd, but everything will process as expected.

MS SQL Server 2008 R2 SP1 fails with error 84C4000E

Windows updates are fine, they make sure your system gets updated when needed.

Sometimes you get strange error numbers with the message that a update did fail.

Today we had a error 84C4000E when installing SP1 of SQL Express 2008R2 on a Windows 2008 Server.
Normaly google helps solving the problem, not (completely) this time:

The only reference to the error number I was able to find was:

http://social.msdn.microsoft.com/Forums/es-ES/sqlserveres/thread/05050d46-d6f9-41e4-8276-46750dabe88f


Spanish... ok, google helps translating....

So it turned down to the following issue:

• Your windows server is installed/configured in a language not supported by SQL 2008R2
• Such "wrong" combinations are for example German-Swiss and trying to install a German edition of SQL 2008R2 (Or aparently also some variants of spanish)

The simplest thing to solve this:

• Just change your user locale from German-Swiss to German-Germany
• Install the service pack
• Change the user locale back to what is was previously

During installation we had similar problems and after some talk with MS support it did turn out that a German SQL Server 2008R2 can't be installed if the user locale was no German-Germany.
So changing it to the requested locale did the trick.

Strange enough, we later on wished to enter the product key... again the same problem and after more talk with MS support, changing the locale again did the trick...

According to MS support it should also be possible to change the locale to English-US and a german SQL Server should also be "installable"...

Yet another mobile OS is history

In the last days HP announced that they stop working on their WebOS.

Not so big a problem for me, since I currently work on Android.



My personal OS history on the desktop is:

• TI-99/4A
• Atari/ST
• Windows NT 3.x
• Different Windows NT+ versions (Up to Windows 7)
• Various Linux versions, mainly Ubuntu on Laptops

The history on my PDA/Phones is:

• PalmOS on a Palm III
• Symbian (On various SE Phones up to the P1i)
• iOS (For 2 weeks)
• Android

What is interesting, is the fact that PalmOS, Symbian and now WebOS all stopped existing in 2011.

PalmOS had a very good start and a lot of applications, but they did stop development when they had a very big market share. They missed the jump into multitasking...

Symbian, was a very promising system, but always had multiple GUI systems. So if you did develop a application for a Nokia Symbian, it did not run on a SE Symbian system.
When apple did then publish it's first (very limited) iPhone, Nokia and SE got hysteric and did mess up things. SE left the Symbian community and Nokia wanted to make it open source, with a single GUI system. But that step did take 1-2 years before even developers could start working on it...

I think still think that symbian has many advantages over iOS/Android, but due to such a weird GUI and horrible mobile data charges in the past, had no chance to survive.
And the Nokia company did a horrible job in press communication, so all developers started looking for other systems. (If you look at Nokia and the current "work" on MeeGo you see many paralels :( )

I'm not sure Nokia will be a big player in the future, this realy depends on what will happen with WM7.

iOS, yes, good marketing, sell a phone which does not even provide MMS, video conferences etc. But a cheap data plan, that did made the trick.
Personally I can't identify myself with iXXX products, but a valuable product, but too much in control of apple.

So we are reaching Android,
when it was becoming clear that Symbian will have not future (About 1 year after the launch of the P1i) I looked out for alternatives, there where only iOS and Android (Ok, Android only promising at the horizont at that time)
After two weeks of testing a iPhone 3 I returned to my P1i and waited for Android 2.x
The HTC device then came with a nice data plan, and it was love to the device. At first touching the screen was a bit strange, but now it works. (But I still miss the keyboard sometimes)
The main advantage of Android is, that I can write and install a application, without having to ask steve if he shows me his grace and allows my application.
Also I don't think that one phone model covers the need of all people of this world.

The main drawback of Android is currently the various versions and the (missing) updates.
Here Google has to make sure that the users get the updates. I had to wait many month for getting Gingerbread on my phone and even that was unsure.
In that area, the iPhone is better situated, of course, only one brand and 2 current phone models to support.

So what the future will bring us?

• More iPhone/iOS devices, but only a few at a time
• Even much more Android devices
• WindowsMobile devices... there will be such devices but I'm not certain that they will have a big market share. MS has enough money to push WM in the next years, but is that enough ?
• Blackberry, no, I don't think they have a big future with their own OS
• Other OS ? No, what for ? 

iOS covers the needs of the "All-in-one" liking users
Android covers the needs of all liking the diversity of the world
WindowsMobile if you still think it works best together with your desktop
There just is no need for yet another mobile OS, and if you see how much the different competitors fight against each other with patetents, then a startup just has no place (And no finance) in these ridiculous patent fights.

What do you think, has another mobile OS chances to reach a considerable market share ?

Webproxy auto configuration, the (hard) MS way

In windows you can use automatic proxy detection to configure all your local clients to use the proxy settings you wish.

In short you do the following:

1. Create a file named wpad.dat on a webserver named wpad.mycompany.local (Or whatever your dns domain is)
2. In that file you put the prxy definition, which ports, urls etc. (See here for the details)
3. Make sure your DNS answers the query for wpad.mycompany.local with the web server delivering the wpad.dat file

So far, everything is simple and easy to understand, but... it does not work if you use microsoft products for DNS and/or Webserver.

There are two pitfalls in the MS products:

1. DNS problem

Do a query for wpad.mycompany.local (Like nslookup wpad.mycompany.local)
You would now assume your DNS server returns you the configured IP.
Nada, nothing, it just return a message telling you it's not a known name. Double check it, it's just not working.
The DNS server does not answer the question properly.

The reason for this is "security", looks like the query for wpad. is a dangerous query, so MS blocks these in the DNS servers. Don't believe it ? Look here

The simplest way is to just disable that queryblocklist on your DNS server(s)

dnscmd [dnsservername] /config /enableglobalqueryblocklist 0

2. IIS problem

When you finally got past the DNS problem and your dns servers answer queries for wpad.mycompany.local correctly, then the next problem jumps in.

Just open your web browser and enter: http://wpda.mycompany.local/wpad.dat
You would expect that you see the content of that text file, but no, IIS thinks it's not something we wish to deliver to the clients.

The reason is, that the .dat extension is not assigned to a mime type, so IIS does not deliver these files and just returns a "File not found"

As the last step you make .dat known as mime type "application/x-ns-proxy-autoconfig"

Migration of MS SBS 2003 to MS SBS 2011

Microsoft has a good document about the steps to migrate a SBS 2003 server to SBS 2011.
It is normally easy and well documented. But as always, there are things not working es expected or documented.

Here a few things:

Migration fails when joining the domain (dcpromo)

• When installing the new server it should automatically join the old domain
• If that join fails, then the migration wizard shows a fatal error and tells you to restart with the whole installtion. (Of course at this point you already had waited about 1-2 hours)
• When you google (or bing) arround, you will see that a "recovery" of the setup process is still possible. Look here for more details.
• One problem might be, that your migration account (usually the Administrator) is using a weak password, one not meeting 2008R2 complex password rules
• Another might be, that your migration user is not member of all required groups

DHCP reservations are not migrated

• Yep, can occure, sometimes it works, sometimes not
• In that case export the leases from the old server and then either add them manually on the new server. See here how to do it almost automatically

After mailbox migration to the new server, the mailboxes are not available and/or the owa shows just a empty screen after login

• Make sure the all required exchange services are running (For example the "MS Exchange RPC Client" is one to not correctly autostart after a server reboot

Other potential MS exchange migration issues

• Access to smtp, pop and imap is no longer allowed with plain text passwords. So you should confiure your clients to use either POP/IMAP with (start)tls or/and with SSL
• IMAP and POP3 connectors are not started by default, you have to enable these services in the service manager
• For external SMTP access to your server (for non-outlook users) it is best to create a SMTP connector on Port 587 (Submission port), that way you can prevent problems when your ISP blocks connections to the standard smtp port
  

Fax migration

• You still have to configure the fax service on the new server before doing the fax migration

Wuala now also available for Android

The secure online storage system Wuala (by Lacie) has just released the Android version of the client software.

Now you can access your files from Windows, OS-X, Linux, iOS and Android (And public files via Webinterface)

Disk partition alignment in windows

When creating partitions under windows, you should take care to get the correct alignment.

With the correct alignment you can gain/loose between 10-40% of performance.

The technical details can be found here:

http://msdn.microsoft.com/en-us/library/dd758814%28v=sql.100%29.aspx

It's a document about SQL 2008 server, but the same applies for "normal" applications too.

Group policy for password changing

Here some nasty info, when adding a password policy to a ADS:

• Password policy can only be set at the domain level.

If you like to have different password policies, you have to

• create a subdomain

or

• change to server 2008, where you can use Fin grained password poliy, that gives you the option for using different password policies.
  

or

• You look out for a a 3rd party tool

What might be the technical reason for this ?

The whole login/authorization of windows (before windows 2008/Vista) is based on NTLM, which basically means you are logging on into a NT style domain.
So all users in that domain have the same (NT style) password restriction.

If all your systems are Windows 2008 or newer, then kerberos is used for authentication/logon, and here apparently password policies are applied as normal users would think.