Sysadminsblog.com

Forcing a full sync with Office 365 Dir Sync

Mischa Oudhof — Thu, 02 May 2013 07:27:15 +0000

There was a warning in the Application part of the event viewer.

The management agent "TargetWebService" completed run profile "Delta Confirming Import" with a delta import or delta synchronization step type. The rules configuration has changed since the last full import or full synchronization.

User Action

To ensure the updated rules are applied to all objects, a run with step type of full import and full synchronization should be completed.

Every time you run the Directory Sync Configuration you will force a delta sync, which is an incremental sync and not a full sync. To force a full sync you'll have to do the following.

Start the registry editor - regedit
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSOLCoExistence
Find the FullSyncNeeded DWORD and set it to 1
Start the Dir Sync Config Shell – %programfiles%\Microsoft Online Directory Sync\DirSyncConfigShell.psc1
Run the CMDlet Start-OnlineCoexistenceSync

You can follow the sync steps by opening the Miisclient located at – C:\Program Files\Microsoft Online Directory Sync\SYNCBUS\Synchronization Service\UIShell\miisclient.exe

Good luck!

Dir Sync: Unable to establish a connection to the authentication service

Mischa Oudhof — Thu, 02 May 2013 07:00:34 +0000

Users reported that they couldn't access their personal archives. The archives are stored on the Office 365 services and should always be accessible. Of course the first clue was located in the event viewer where I found the following errors.

Log Name:      Application

Source:        Directory Synchronization

Date:          2-5-2013 8:31:38

Event ID:      0

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      

Description:

Unable to establish a connection to the authentication service. Contact Technical Support. GetAuthState() failed with -2147186688 state. HResult:0. Contact Technical Support.  (0x80048862)

Event Xml:



  

    

    0

    2

    0

    0x80000000000000

    

    27537

    Application

    

    

  

  

    Unable to establish a connection to the authentication service. Contact Technical Support. GetAuthState() failed with -2147186688 state. HResult:0. Contact Technical Support.  (0x80048862)

Log Name: Application


Source:        FIMSynchronizationService

Date:          2-5-2013 8:31:50

Event ID:      6803

Task Category: Management Agent Run Profile

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      

Description:

The management agent "TargetWebService" failed on run profile "Full Confirming Import" because the server encountered errors.

Event Xml:



  

    

    6803

    2

    1

    0x80000000000000

    

    27539

    Application

    

    

  

  

    TargetWebService

    Full Confirming Import

Log Name: Application


Source:        FIMSynchronizationService

Date:          2-5-2013 8:31:50

Event ID:      6110

Task Category: Management Agent Run Profile

Level:         Warning

Keywords:      Classic

User:          N/A

Computer:      

Description:

The management agent "TargetWebService" step execution completed on run profile "Full Confirming Import" but the watermark was not saved.


 
 Additional Information

 Discovery Errors       : "0"

 Synchronization Errors : "0"

 Metaverse Retry Errors : "0"

 Export Errors          : "0"

 Warnings               : "0"


 
 User Action

 View the management agent run history for details.

Event Xml:



  

    

    6110

    3

    1

    0x80000000000000

    

    27540

    Application

    

    

  

  

    TargetWebService

    Full Confirming Import

    0

    0

    0

    0

    0

When I started the Synchronization Service Manager at C:\Program Files\Microsoft Online Directory Sync\SYNCBUS\Synchronization Service\UIShell\miisclient.exe, it showed the error stopped-server-down.

Seeing that it couldn't connect to some server I had to find out what server it was trying to connect to. In the Synchronization Service Manager I checked the Management Agents where in the properties of the TargetWebService I found the server that it was trying to connect to; https://adminwebservice.microsoftonline.com/ProvisioningService.svc.

After clearing the cache of the DNS services and flushing the DNS locally on the server I forced another full import which ran without problems.

Hope this helps you with solving your problem!

Windows Update encountered an unknown error – 80243004

Mischa Oudhof — Fri, 22 Feb 2013 08:21:06 +0000

This error just showed itself on my Windows 2008 R2 SP1 server and it stopped me from installing any updates. The fix for this error is undoubtedly the strangest I ever came across. Pete Long described this fix on his website.

Strangely enough this error seems to be caused by the taskbar that is not showing all icons. Here are the steps:

Right-click the taskbar and select properties
In the Taskbar tab click Customize…
Check "Always show all icons and notifications on the taskbar"
Confirm all screens with OK

Now try installing the updates again and see that it'll work.

Access denied in SharePoint 2010

Mischa Oudhof — Fri, 22 Feb 2013 07:05:39 +0000

Recently I did an update run on my SharePoint 2010 farm and I fixed some errors that were showing in the event log. This resulted in one specific error that resulted in an Access Denied on one of the sub-sites. The permissions weren't changed and even the Site Collection Administrator account was denied access. Here's what the solution was.

One of the errors that I tried to fix was setting the portal super reader account for proper caching. Unfortunately I didn't take the time to actually read up on it and I just entered an account that "should" work.

This resulted in an error in ULS about the Navigation not being able to be properly accessed. This was directly related to the access denied error. Seems like setting the account wasn't such a good idea. So I reset the property which instantly fixed the problem.

To find out how to properly set the "portal super reader account" and also the "portal super user account" visit the link below:

http://www.sharepoint24x7.com/2011/11/03/fix-it-configuring-object-cache-service/

WSUS 3.0 SP2 gives error during install

Mischa Oudhof — Thu, 17 Jan 2013 07:44:04 +0000

I was trying to install the WSUS 3.0 SP2 patch when it gave me a very non-descriptive error.

There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor

If you go to %temp% you'll find some log files called wsuspatch####.log that will give you more information. For me it stated that the error occurred in the process ExConfigureDb.

MSI (s) (64:9C) [08:23:13:802]: Note: 1: 1722 2: ExConfigureDb 3: C:\Windows\Installer\MSIFFC2.tmp 4: -S  -F  -i "C:\Program Files\Update Services\Database\CreateDatabase.sql;C:\Program Files\Update Services\Database\mwus_database_schema.sql;C:\Program Files\Update Services\Database\ServerSync.sql;C:\Program Files\Update Services\Database\ClientWebService.sql;C:\Program Files\Update Services\Database\Setup.sql;C:\Program Files\Update Services\Database\Reporting.sql;C:\Program Files\Update Services\Database\ReportingSummarization.sql;C:\Program Files\Update Services\Database\ReportingRollup.sql;C:\Program Files\Update Services\Database\AdminAPI.sql;C:\Program Files\Update Services\Database\popdb.sql;C:\Program Files\Update Services\Database\EvtNamespaceImport.sql;C:\Program Files\Update Services\Database\SqlSettings.sql;C:\Program Files\Update Services\Database\Inventory.sql;C:\Program Files\Update Services\Database\PublicViews.sql" -l "C:\Users\ADMINI~1.SPI\AppData\Local\Temp\MWusCa.log"

At the end you'll see that the logging option was used (-l). This file revealed the next clue:

Changed database context to ''.
Msg 1468, Level 16, State 1, Server ,  Line 2
The operation cannot be performed on database "" because it is involved in a database mirroring session.Msg 5069, Level 16, State 1, Server ,  Line 2
ALTER DATABASE statement failed.
Starting WSUSService...
WSUSService is now started.
StartServer completed successfully.

I'm indeed using mirroring so I disabled it and it installed flawlessly! Don't forget to enable mirroring again afterwards!

Mailbox size overview for Exchange 2010

Mischa Oudhof — Wed, 12 Dec 2012 12:55:43 +0000

Once every now and then you'll want an overview of what the mailbox sizes are for your organization. You can then see who is using the most space and perhaps offer them some help archiving their mailbox. However Exchange 2010 doesn't really offer this in a organized way. This is exactly the reason why I created this one-liner. This will output to a GridView or to a CSV which you can then use to organize the data as you wish.

Get-MailboxDatabase | % { Get-MailboxStatistics -Database $_.Name | Select DisplayName, @{Name="Size (MB)";Expression={($_.TotalItemSize).Substring($a.IndexOf("(")).Replace("(","").Replace(" bytes)","").Replace(",","") / 1MB}} }

You could output it to GridView by piping it to Out-GridView

Get-MailboxDatabase | % { Get-MailboxStatistics -Database $_.Name | Select DisplayName, @{Name="Size (MB)";Expression={($_.TotalItemSize).Substring($a.IndexOf("(")).Replace("(","").Replace(" bytes)","").Replace(",","") / 1MB}} } | Out-GridView

Or export it to a CSV by piping it to Export-CSV:

 Get-MailboxDatabase | % { Get-MailboxStatistics -Database $_.Name | Select DisplayName, @{Name="Size (MB)";Expression={($_.TotalItemSize).Substring($a.IndexOf("(")).Replace("(","").Replace(" bytes)","").Replace(",","") / 1MB}} } | Export-Csv C:\MailboxSizes.csv

As a result you can open the CSV in Excel, add some Conditional Formatting and Column Formating and voila! Yes, these are the actual mailbox sizes!

PST Capture errors

Mischa Oudhof — Fri, 07 Dec 2012 14:08:49 +0000

I'm currently in the process of configuring PST Capture in order to migrate all the user's PST files to the recently configured cloud based Online Archive. As this wasn't working properly, I contacted Microsoft and opened a support ticket. I'm getting the error "Import error: Error opening mailbox " when I try to import the PST file into my Online Archive. During the troubleshooting of this error I came across a nice list of requirements for the PST Capture tool to function properly. This might help you to configure everything correctly.

Please make sure that you have the 64 Bit version of Outlook installed and that it is installed on the machine on which PST Capture Tool is running.
Please check if the user has the Mailbox Import Export permissions. If it does not have them, then please assign them using the following command:
New-ManagementRoleAssignment -Role "Mailbox Import Export" -User "PSTImportUser"
Please check that the Microsoft Exchange PST Capture Tool's Service Account has an Exchange 2010 Mailbox.
Please check that the PST Capture Tool's Service Account is a member of Local Administrators Group.
Please make sure that the PST Capture Tool's Service Account is a member of Organization Management and also the Public Folder Management.
Check that the Service Account is mailbox-enabled and has an Outlook profile configured for it.
Please make sure that the correct Service Account is chosen for the PST Capture Tool. To do this, please go to Properties of 'Microsoft Exchange PST Capture Service' > Log on tab and check the Service Account.

Please comment below if you have questions about the PST Capture tool, or the above settings.

PXE boot stopped working for WDS

Mischa Oudhof — Fri, 22 Jun 2012 06:35:49 +0000

After updating the Windows Deployment Service (WDS) server, it didn't seem to work anymore. The clients would try a PXE boot but couldn't find a TFTP server to get the boot image from. A colleague of mine found a great article about this problem.

It seems that when you have a single server that is running WDS and DNS, the DNS server binds to all ports in the WDS port range leaving the WDS server unable to respond to the clients.

Symptoms

TFTP downloads fail
Multicast downloads fail with a possible error code 2
When WDS tracing is enabled you will find one or more errors that resemble the following
[2416] 16:01:36: [d:\w7rtm\base\ntsetup\opktools\wds\wdssrv\server\src\udpportrange.cpp:755] Expression: , Win32 Error=0x2 [2416] 16:01:36: [d:\w7rtm\base\ntsetup\opktools\wds\wdssrv\server\src\regudpendpoint.cpp:192] Expression: , Win32 Error=0x2 [2416] 16:01:36: [d:\w7rtm\base\ntsetup\opktools\wds\wdssrv\server\inc\RegEndpoint.h:354] Expression: , Win32 Error=0x2 [2416] 16:01:36: [WDSTFTP][UDP][Ep=0] Registration Failed (rc=2)
When you run netstat –abn you'll find that 64001 to 65000 is displayed as being used
You've applied security update MS08-037: Vulnerabilities in DNS could allow spoofing

Solution

If you do not require WDS to use a static port range, you can configure WDS to dynamically query WinSock for available ports instead of using a port range. To do this you'll have to modify a registry key on the affected server.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WDSServer\Parameters

Modify the key UdpPortPolicy and set it to 0. Then restart the Windows Deployment Services.

More information can be found here: http://support.microsoft.com/kb/977512/en-us

Room List Distribution Group

Mischa Oudhof — Thu, 21 Jun 2012 06:54:18 +0000

I just came across another Exchange 2010 surprise that I would like to share with you. When you are creating a new meeting and need a room to have the meeting in, you would normally add all the rooms and see which one is available. The guys behind Exchange 2010 came up with a solution for this. They introduced the Room List.

The room list is essentially a distribution group but with an added parameter. Unfortunately you can't create a Room List in the Exchange Management Console, so you'll have to use the Exchange Management Shell (PowerShell) for this. The command is quite straight forward.

New-DistributionGroup -Name "Meeting Rooms" –Members ConfRoom1,ConfRoom2,ConfRoom3,ConfRoom4 -RoomList

As you can see, the -RoomList parameter makes all the difference!

People no longer need to sift through the meeting rooms manually. They can now effectively use the Room Finder to find a suitable room.

Unknown Start Trace Error (183) when starting Exmon

Mischa Oudhof — Wed, 16 May 2012 09:16:05 +0000

I recently used the Exchange User Monitor tool to check the connections because the exchange server was running at 100% CPU constantly. When Exmon.exe crashed I weren't able to restart it again as it presented an error. A quick Google query pointed me in the right direction.

An Exchange trace is initiated when the Exmon.exe tool is started. The trace is not closed properly when the tool crashes and it has to be closed manually.

Make sure that Exmon.exe is not running (use CTRL+SHIFT+ESC)
From a CMD run: logman query -ets
This will show you all tracers that are currently running. Notice the Exchange Event Trace that's used by Exmon
Stop the Exchange Event Trace: Logman stop "Exchange Event Trace" –ets

If that didn't resolve the issue, check if there's still some space left on the disk or if another user is already running the Exmon tool.