Monday, September 14, 2015

Upload Files to VMware ESXi Server From Local Computer

There is a need to transfer some files from the local computer to a VMware ESXi Server.  To carry out the transfer of files, we will have carry out the below steps:

1.    Login to the ESXi server using VMware vSphere client.
2.    Select the ESXi server from the list on the left panel.
3.    Go to the "Summary" tab.
 
4.    Right click and select “Browse Datastore” on any of the Storage device listed under "Storage" in Resources panel.  The  “Datastore Browser” window will pop-up.

5.    Upload the files on the Datastore by pressing the Upload button (4thbutton from left) on the toolbar.

Tuesday, January 13, 2015

Error: 0xC004F04D When Activating Windows Using Given Confirmation ID

We were not able to activate the Windows license after we have re-setup a Windows 2012 R2 Server Core.  The below error was given when we tried using the Confirmation ID given by Microsoft Activation Center:


Error: 0xC004F04D On a computer running Microsoft Windows no-core edition, run ‘slui.exe 0x2a 0xC004F04D’ to display the error text.

We logged a call with with Microsoft APAC/GCR 24x7 Customer Service Center.  The support engineer gives the below steps which resolved the activation problem.

 1. Restart the software protection service,
             net stop sppsvc
             net start sppsvc

 2. Uninstall current key,
             cd c:\windows\system32
             cscript.exe slmgr.vbs -upk

 3. Restart the software protection service once again,
             net stop sppsvc
             net start sppsvc

 4. Install the product key again,
             cd c:\windows\system32
             cscript.exe slmgr.vbs -ipk XQ9T2-J7V39-RJJCR-DY2V9-72X9M

 5. Verify if the installation ID has changed or not,
             cd c:\windows\system32
             cscript.exe slmgr.vbs -dlv

     Check if the IID is the same as the initial one.

 6. Try to activate the server in GUI,
             slui 4

     Follow the instruction to enter the confirmation id.
     (If the IID is the same as the initial one, try the same CID one more time.)
 

Wednesday, October 1, 2014

Checking Backup Files on RSA Appliance

Backups are scheduled on the RSA appliance via the Operation Console.  However, we will need to retrieve the backup at times.  Where are the backup files residing in the system?

1. Login using the account emcsrv and key in the password when prompted.


2. Change to root and key in the password when prompted:


    bash-3.00$
sudo su -

3. Navigate to the directory where the backup files reside:


    [root@Primary/ ]#
cd /var/cap/backups/

6. List the backup files using the below command:


    [root@Primary/ ]#
ls -ltr

7. The backup files will be display as follows:



Tuesday, September 30, 2014

Windows 2012 Server Core: How To Disable And Enable TCP/IPv6?

Internet Protocol Version 6 (TCP/IPv6) has not been implemented in our environment.  For server’s network adapters, we would usually disable TCP/IPv6.

At the Powershell prompt, issue the below command to disable TCP/IPv6 for network adapter NIC2:
PS C:\> Disable-NetAdapterBinding -InterfaceAlias NIC2 –ComponentID ms_tcpip6

If the TCP/IPv6 is disabled, you will get this error message when configuring an IP address using SCONFIG:
C:\Windows\System32\en-US\sconfig.vbs(696, 21) SWbemObjectEx: Invalid index.

At the Powershell prompt, issue the below command to enable TCP/IPv6 for network adapter NIC2:
PS C:\> Enable-NetAdapterBinding -InterfaceAlias NIC2 –ComponentID ms_tcpip6

Windows 2012 Server Core: How To Uninstall A Program?

We would like to uninstall a program but we are not able to do it as Server Core does not have the add/remove program feature.

To uninstall a program in Server Core, we have to do the following steps:

1.     Open Editor (Start > Run > regedit).

2.     Navigate to 
             HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL

or
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL.  

3.     Search through the registry entries to look for the program you intend to uninstall.

4.     Look for the “UninstallString” and note down the registry value.  This value will be used as commandline.

5.     Open a command prompt and run the above copied registry value.  It will start to uninstall the intended program.

6.     Navigate back to the registry keys mentioned in step and you will notice that the registry entries you found earlier are no longer there.  Those program files residing in the hard-disk are also gone.

7.     Exit Registry Editor.

Thursday, July 24, 2014

Changing NTP Server On RSA Appliances

In order to change the NTP server, we will have to carry out the following steps via Putty (An open source telnet and SSH Client for the Windows and Unix platforms):

1. Login using the account emcsrv and key in the password when prompted.

2. Change to root and key in the password when prompted:

    bash-3.00$ sudo su

3. Navigate to the directory where the NTP configuration file resides:

    bash-3.00$ cd /etc

4. Edit the file NTP.CONF and locate the “server” line. Specify the NTP server to be added and save the file:

    bash-3.00$ vi ntp.conf

    For example:
    # server mytrustedtimeserverip
    server 192.168.7.22

5. Enter the below command to enable the NTPD service to start when the appliance is rebooted:

    [root@Primary/ ]# /sbin/chkconfig –levels 2345 ntpd on

6. Restart the NTPD service for the change to take effect:

    [root@Primary/ ]# /sbin/service ntpd restart

7. The appliance immediately synchronizes its time with the NTP server and sets the hardware clock automatically.  You can verify that the NTPD service is running using the below command:

    [root@Primary/ ]# ntpq –p

Repeat the above steps at the Replica.

Wednesday, July 2, 2014

Change The Startup Mode For Windows Store Service

We would like to change the startup mode for Windows Store Service to “disabled” but we are not able to do it successfully as it is greyed out.

To configure the startup mode to “disabled” via registry editor:

1.     Open Registry Editor (Start > Run > regedit).

2.     Navigate to 
               HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WSService\Start.          
             
3.     On the Edit menu, click Modify.  In the Value data box, type 4 and then click OK.

4.     Exit Registry Editor.

5.     Restart the server.

Friday, June 27, 2014

Windows 2012 Server Core: How To Install Minimal Server Interface

The Minimal Server Interface includes Microsoft Management Console (MMC), Server Manager, and a subset of Control Panel.  It is similar to a Server with a GUI installation, but Internet Explorer 10, Windows Explorer, the desktop, and the Start screen are not installed.

In order to install Minimal Server Interface on server core, the following steps need to be carried out:

1.    Create a new folder in C:\ drive by issuing the below command at the command prompt:

       C:\> mkdir c:\mount

2.    Put the Windows 2012 DVD into the DVD drive (i.e. D:\)

3.    Open Powershell, then issue the below command to mount the windows image:

       PS C:\> mount-windowsimage –path c:\mount –imagepath d:\sources\install.wim –index 2 -readonly

4.    At the Powershell prompt, issue the below command to install the “Server Graphical Management Tools & Infrastructure” feature on the server core:

       PS C:\> install-windowsfeature server-gui-mgmt-infra –restart –source c:\mount\windows\winsxs

5.    Restart the server after the installation completed.

The Server Manager and command prompt will appear after you login to the server.

Monday, March 24, 2014

Upgrade Symmetricon SyncServer S300 With Latest Firmware

NTP and other UDP-based protocols can be used to amplify denial-of-service attacks.   Servers running the network time protocol (NTP) that use the default unrestricted query configuration are susceptible to a reflected denial-of-service (DRDoS) attack. The Symmetricom SyncServer S300 is susceptible to this vulnerability as it currently do not restrict the NTP query configuration.

Symmetricom released the latest firmware with a feature to turn off/disable the ntp query. 

Here are the steps to upgrade the firmware:

1.    Log in to Web GUI. Go to SYSTEM > Upgrade page.

2.    Click BROWSE... button to select the firmware. Then click UPLOAD button.

3.    Click the firmware inside Current Files window. Then click INSTALL button.
 

4.    Log into CLI via SSH after the upgrade.

5.    Type “ntp_query” and press Enter. This should show “Queries are not restricted and will be responded to”

 
6.    Type “ntp_query disable” and press Enter. Type “Y” to confirm the change.

7.    Log in to Web GUI. Go to NTP > Sysinfo page. Click the RESTART button below.

8.    Log in to CLI. Type “ntp_query” and press Enter. This should show now “Queries are restricted and will not be responded to”





Wednesday, March 12, 2014

Access To Symmetricon SyncServer S300 Login Page Via HTTPS

A new Symmetricon SyncServer S300 was setup by the vendor.  It was found out that we are able to access its Login page via HTTP.  In order to allow access to the Login page via HTTPS only (i.e. Port 443), there is a need to perform the below configuration steps:

1. Go to the SyncServer Login page by entering the LAN1 IP address as the URL in Internet Explorer.

2. Log in and configure Secure Login using SERVICES > HTTP.

3. Select “Secure (Port 443) Only” and input the following under Certificate Info:

Days to Expiration: 730

ISO Country Code: SG

State: Singapore

Locality: Singapore

Organization: KANDTI

Organization Unit: KANDTI

Email Address: ntp@kandti.com

4. Click “Apply” and the SyncServer will reboot.


 

Friday, February 7, 2014

Windows 2012 Server Core: How To Access The SEP Client Interface?

In order to access the Symantec Endpoint Protection (SEP) client interface, the following steps need to be carried out:

1.    Search for the file symcorpui.exe by issuing the below command at the command prompt:

C:\> dir symcorpui.exe /s/p

2.    Record down the location of the folder containing the file symcorpui.exe.

3.    At the command prompt, change it to the location of the folder

C:\> cd \Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\bin

4.    At the command prompt, type symcorpui.exe and press <Enter>.

The SEP client interface will then appear.
 



Monday, November 18, 2013

Kerberos Client Received KRB_AP_ERR_TKT_NYV Error

Further to the problem mentioned in the previous blog post. It was found that the below entry appears in the Windows System Event log of the member servers:

Event ID 5 - The kerberos client received a KRB_AP_ERR_TKT_NYV error from the server KANDTIDC1$. This indicates that the ticket presented to that server is not yet valid (due to discrepancy between ticket and server time). Contact your system administrator to make sure the client and server times are synchronized, and that the time for the Key Distribution Center Service (KDC) in realm kandti.com is synchronized with the KDC in the client realm.
I did a check on the date and time of the domain controller KANDTIDC1 and found that both the date and time are incorrect. The correct date and time were then keyed in for the domain controller and a re-boot was carried out for all the member servers.

After the re-boot, the abovementioned error message does not appear in the Windows System Event log anymore. I tried connecting to the member servers using the server name and I am able to connect without any problem.


Sunday, November 17, 2013

Remote Desktop Cannot Verify The Identity Of The Remote Computer

I had been able to connect to the Windows 2012 Server Cores from a Windows 2003 Server via Remote Desktop Connection using the server name but somehow I am not able to do so today.  I was greeted with the error message:

Remote Desktop cannot verify the identity of the remote computer because there is a time or date different between your computer and the remote computer. Make sure your computer’s clock is set to the correct time, and then try connecting again. If the problem occurs again, contact your network administrator or the owner of the remote computer.
I checked that the date and time of both the source and target servers are correct.  I tried a suggested solution found on the internet by changing the connection setting for the Remote Desktop Connection from “Automatically detect RD Gateway server settings” to “Do not use an RD Gateway server” under Options > Advanced > Settings.  I was greeted with the same error message when I tried to connect again.

In the end, I managed to connect using the IP address of the targeted Windows 2012 Server Cores instead.  I was then able to connect to it successfully without the initial error message.
 

Monday, October 28, 2013

Security Certificate Issued Was Not From A Trusted Certificate Authority

Since we migrated to the new RSA SecurID Appliances 3.0, we always get a Security Alert notification that the security certificate was not from a trusted Certificate Authority when logging on to the RSA Security Console.

 
To remove this alert, the following steps need to be carried out to save the RSA Self-Signed Root certificate on the RSA Authentication Manager’s admin console:

1.    Log on to the RSA Security Console via URL: https://<FQDN>:7004/console-ims
 
2.    Since this certificate is not trusted by the browser, a Security Alert warning is displayed. In Windows Internet Explorer, click Continue to this website (not recommended).

3.    Next, a red Address Bar and a certificate warning appears.
 

4.    Click the Certificate error button to open the information window
 
 
5.    Click View Certificates to continue. The web certificate is presented to you. Click on the top tab labelled Certification Path.
  
6.    Double click on the untrusted certificate "RSA Authentication Manager Root CA" and click Install Certificate... 
 
7.    The Certificate Import Wizard appears. Click Next to continue.
 

8.    Choose "Automatically select the certificate store based on the type of certificate" and click Next to continue.   
 
9.    Click Finish and follows by Yes to import the certificate when a warning message appears. Click OK to continue.
 
10.  Continue to click OK through the screens to get back to the main window.

 
These steps must be performed with Internet Explorer on any machine that will browser to the Authentication Manager Consoles.

Sunday, October 27, 2013

Removing User's Permissions From Shared Folders

Due to change of job role, a user no longer has the needs to access a specific shared folder.  When we try to remove the permissions she has to the shared folder from the Security tab, the below message appears:

You cannot remove KANDTI\finmgr1 because this object is inheriting permissions from its parent. To remove KANDTI\finmgr1, you must prevent this object from inheriting permissions. Turn off the option for inheriting permissions, and then try removing KANDTI\finmgr1 again.

To remove the permissions which currently KANDTI\finmgr1 has to the shared folder without affecting the rest of the permissions for other users, the following steps were carried out:

1.     Log on to the Windows Server 2012 File Server which is running on Server Core.

2.     Open up the Task Manager by issuing the below command at the command prompt:

C:\taskmgr

3.     Click File > Run new task and click on the Browse… button.  The Windows Explorer will then appear.

4.     On the appeared Windows Explorer, locate the shared folder which we need to remove the user’s permissions.

5.     Right-click on the shared folder and from the context menu, click Properties.

6.     On the Properties box, click on the Security tab and click Advanced button.

7.     On the Advanced Security Settings box, make sure that Permissions tab is selected and click Disable Inheritance button to disable inheritance.

8.     On the Block Inheritance box, select Convert inherited permissions into explicit permissions on this object option to release all inherited permissions while copying the permissions on to the object.

9.     In order to force NTFS permissions of the current object onto the child objects, check Replace all child object permissions with inheritance permissions from those objects checkbox.

10.   Click Ok button to save the changes.

11.   Proceed to remove the user’s permission to the shared folder.

 

Monday, September 30, 2013

RSA Secure Logon via SecurID Passcode

Our RSA administrators are required to use 2 Factors Authentication (2FA) for access to the RSA Security Console.  However, the RSA Secure Logon prompts for Password by default.  The administrator is not able to logon using SecurID Passcode (i.e. RSA 2FA).
  
In order to enable the administrators to access the RSA Security Console using RSA 2FA, the following steps are carried out to enable logon via SecurID Passcode:

1.     Access the Security Console via https://<FQDN>:7004/console-ims and select Authentication Methods under the Setup tab.  You will notice that the Console Authentication was configured to accept either LDAP_Password or RSA_Password.

2.     Append /SecurID_Native immediately after RSA_Password/LDAP_Password under Console Authentication and click Save.

3.     When the Confirmation Required dialog box appears, click on the box beside Update Authentication Methods Configuration Confirmation: to update authentication methods configuration and click on Update Authentication Methods Configuration.
 

4.     The next screen will shows the below message:
              Updated authentication configuration setting.


5.     Logout off from the Security Console and re-access the Security Console via https://<FQDN>:7004/console-ims.

6.     You will notice that the RSA Secure Logon allows the administrator to select the different Authentication Method (i.e. either Password or SecurID Passcode).

 
The administrators will now able to access the Security Console using 2FA via the SecurID Passcode (i.e. PIN + RSA token code).

Friday, September 27, 2013

Error 1324: The path RSA Security contains an invalid character (2)

Due to a security vulnerability found in the older version of the RSA agent, we upgraded the RSA agent for all Windows 2003 servers to 7.1.2.  Majority of the upgrade were smooth except the 2 Exchange 2003 servers.  When trying to upgrade the RSA agent on the Exchange servers to version 7.1.2, we encountered the below error message:

Error 1324: The path RSA Security contains an invalid character.

Removing the RSA related folders and registry settings mentioned in the previous blog post does not help. 
We found out that the service “RSA Authentication Agent Offline Local” still appear under Services although we have uninstalled the RSA agent which is of an older version.  The Status is blank although the Startup Type = Automatic.

Did a search for the registry key related to “RSA Authentication Agent Offline Local” and found the below registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OASVC_Local

We deleted the key and did a reboot of the Windows 2003 x86 server. After that, we re-install the RSA Agent again without any problem.