Kerberos Client Received KRB_AP_ERR_TKT_NYV Error

Further to the problem mentioned in the previous blog post. It was found that the below entry appears in the Windows System Event log of the member servers:

Event ID 5 - The kerberos client received a KRB_AP_ERR_TKT_NYV error from the server KANDTIDC1$. This indicates that the ticket presented to that server is not yet valid (due to discrepancy between ticket and server time). Contact your system administrator to make sure the client and server times are synchronized, and that the time for the Key Distribution Center Service (KDC) in realm kandti.com is synchronized with the KDC in the client realm.

I did a check on the date and time of the domain controller KANDTIDC1 and found that both the date and time are incorrect. The correct date and time were then keyed in for the domain controller and a re-boot was carried out for all the member servers.

After the re-boot, the abovementioned error message does not appear in the Windows System Event log anymore. I tried connecting to the member servers using the server name and I am able to connect without any problem.

Remote Desktop Cannot Verify The Identity Of The Remote Computer

I had been able to connect to the Windows 2012 Server Cores from a Windows 2003 Server via Remote Desktop Connection using the server name but somehow I am not able to do so today.  I was greeted with the error message:

Remote Desktop cannot verify the identity of the remote computer because there is a time or date different between your computer and the remote computer. Make sure your computer’s clock is set to the correct time, and then try connecting again. If the problem occurs again, contact your network administrator or the owner of the remote computer.

I checked that the date and time of both the source and target servers are correct.  I tried a suggested solution found on the internet by changing the connection setting for the Remote Desktop Connection from “Automatically detect RD Gateway server settings” to “Do not use an RD Gateway server” under Options > Advanced > Settings.  I was greeted with the same error message when I tried to connect again.

In the end, I managed to connect using the IP address of the targeted Windows 2012 Server Cores instead.  I was then able to connect to it successfully without the initial error message.

 

Disable Administration Shares & Auto-Generation of 8.3 Filenames for Servers

When hardening a server, both the Administrative Shares and Auto Generation of 8.3 Filenames are usually disabled.

To disable Administrative Shares for Windows servers:

1.     Open Registry Editor (Start > Run > regedit).

2.     Navigate to

               HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareServer.
              
               AutoShareServer must be set as type REG_DWORD

3.     On the Edit menu, click Modify.  In the Value data box, type 0 and then click OK.

4.     Exit Registry Editor.

5.     Stop and then start the Server service by issuing the below commands at the command prompt:

               Net stop server
               Net start server

The abovementioned steps will remove the administrative shares and prevent them from being automatically created in Windows.

To disable Auto Generation of 8.3 Filenames for Windows servers:

1.     Open Registry Editor (Start > Run > regedit).

2.     Navigate to

               HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NTFSDisable8dot3NameCreation.

3.     On the Edit menu, click DWORD.  In the Value data box, type 1 and then click OK.

              
               0 - Enable 8dot3 name creation on all volumes on the system
               1 - Disable 8dot3 name creation on all volumes on the system
               2 - Set 8dot3 name creation on a per volume basis
               3 - Disable 8dot3 name creation on all volumes except the system volume

4.     Exit Registry Editor.

5.     Reboot the server.

Unable To Connect To The Windows 2003 WTS Server

Today, a user reported that she couldn’t connect to the Windows 2003 WTS server from her Windows 7 client.  She would get the below error:
 

 

The following steps were carried out to resolve the problem:

1.    Open Registry Editor (Start > Run > regedit).

2.    Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ and find MSLicensing folder.

3.    Right-click on the folder and select Delete..

4.    Reboot the computer.

5.    Start the Remote Desktop Client (Start > Run > mstsc) and run as local administrator to rebuild the deleted keys.

Subsequently, when the user tried to logon to the Windows 2003 WTS server from her Windows 7 client.  She would get another error:
 

 

The following events are observed to be logged on the Windows System Event log and Application Event log respectively:

Event ID 1041 – Autoreconnect failed to reconnect user to session because authentication failed. (0x0)

Event ID 5 – An error occurred while retrieving a digital certificate from the inserted smart card.  The keyset is not defined.

We restarted both the belowmentioned services on the Windows 2003 WTS server:

ActivCard Authentication Service

ActivCard Middleware Service

The user is able to logon to the WTS server successfully after that.

Installation Of The Microsoft .NET Framework 3.5 SP1 – KB951847

An installation of the Microsoft .NET Framework 3.5 SP1 (full package) – KB951847 had failed on a passive node Exchange 2003 server. Having spent a number of days looking at it, I finally managed to resolve it today and get the Exchange server to the latest patch status.

Initially I thought the installation failure is due to the corruption of either the MSI software update registration or the .NET Framework installed on the server.

I tried the following methods mentioned in the Microsoft KB articles (i.e. KB922377, KB976982) but were not successful :

1. Manually remove the .NET Framework, and then reinstall the .NET Framework

2. Remove the .NET Framework by using the Installation Cleanup Utility and then reinstall the .NET Framework

3. Fix the MSI software update registration corruption issue by using Microsoft Fix it 50123

A detailed look at the Windows Application Event log after each installation of the Microsoft .NET Framework 3.5 SP1 revealed the following entries:

Event ID 10005 - Product: Microsoft .NET Framework 2.0 Service Pack 2 -- The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2318. The arguments are: C:\WINDOWS\PCHEALTH\ERRORREP\QSIGNOFF\30E8DF.cab, ,

Event ID 1023 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework CLR' could not be installed. Error code 1603. Additional information is available in the log file C:\DOCUME~1\kandti01\LOCALS~1\Temp\dd_NET_Framework20_Setup5306.txt.

Event ID 1023 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework CA' could not be installed. Error code 1603. Additional information is available in the log file C:\DOCUME~1\kandti01\LOCALS~1\Temp\dd_NET_Framework20_Setup5306.txt.

Event ID 1023 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework CRT' could not be installed. Error code 1603. Additional information is available in the log file C:\DOCUME~1\kandti01\LOCALS~1\Temp\dd_NET_Framework20_Setup5306.txt.

Event ID 1023 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework PreXP' could not be installed. Error code 1603. Additional information is available in the log file C:\DOCUME~1\kandti01\LOCALS~1\Temp\dd_NET_Framework20_Setup5306.txt.

Event ID 1023 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update 'Dr. Watson' could not be installed. Error code 1603. Additional information is available in the log file C:\DOCUME~1\kandti01\LOCALS~1\Temp\dd_NET_Framework20_Setup5306.txt.

Event ID 1023 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework 1' could not be installed. Error code 1603. Additional information is available in the log file C:\DOCUME~1\kandti01\LOCALS~1\Temp\dd_NET_Framework20_Setup5306.txt.

Event ID 1023 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework 2' could not be installed. Error code 1603. Additional information is available in the log file C:\DOCUME~1\kandti01\LOCALS~1\Temp\dd_NET_Framework20_Setup5306.txt.

Event ID 1023 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework ASP .NET' could not be installed. Error code 1603. Additional information is available in the log file C:\DOCUME~1\kandti01\LOCALS~1\Temp\dd_NET_Framework20_Setup5306.txt.

Event ID 1023 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework WinForms' could not be installed. Error code 1603. Additional information is available in the log file C:\DOCUME~1\kandti01\LOCALS~1\Temp\dd_NET_Framework20_Setup5306.txt.

In the directory C:\Windows\PCHealth\ErrorRep\Qsignoff, there is indeed a file 30E8DF.cab. 

Further investigation into the permission for the Qsignoff folder, I found out that the group EVERYONE is being assigned with DENY permission to Traverse Folder/ Execute Files and the permissions apply onto the folder itself, subfolders and files. This could be the cause for the Event ID 10005 to occur.

The DENY permission was removed and the 3 files in the directory C:\Windows\PCHealth\ErrorRep\Qsignoff were deleted successfully.

After which the installation of the Microsoft .NET Framework 3.5 SP1 was carried out successfully with the following entries in the Windows Application Event log:

Event ID 1022 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework CLR' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework CA' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework CRT' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework PreXP' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update 'Dr. Watson' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework 1' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework 2' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework ASP .NET' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 2.0 Service Pack 2 - Update '.NET Framework WinForms' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 2.0 Service Pack 2 -- Installation completed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 3.0 Service Pack 2 - Update 'WPF2_32' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 3.0 Service Pack 2 - Update 'WCF' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 3.0 Service Pack 2 - Update 'WPF_1' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 3.0 Service Pack 2 - Update 'WF' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 3.0 Service Pack 2 - Update 'WPF_Other' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 3.0 Service Pack 2 - Update 'WF_32' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 3.0 Service Pack 2 - Update 'WPF2' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 3.0 Service Pack 2 - Update 'XPS' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 3.0 Service Pack 2 - Update 'WCS' installed successfully.

Event ID 1022 - Product: Microsoft .NET Framework 3.0 Service Pack 2 - Update 'WPF_Other_32' installed successfully.

Event ID 11707 - Product: Microsoft .NET Framework 3.0 Service Pack 2 -- Installation completed successfully.

Event ID 11707 - Product: Microsoft .NET Framework 3.5 SP1 -- Installation completed successfully.

The Exchange server was restarted and applied with the Microsoft .NET Framework 3.5 Family Update - KB959209. This update addresses a set of known application compatibility issues and consists of 3 files (i.e. NDP20SP2-KB958481-x86.exe, NDP30SP2-KB958483-x86.exe and P35SP1-KB958484-x86.exe). A reboot was performed for the Exchange server and the server was subsequently patched with those outstanding .NET Framework updates pushed down via the WSUS server.

The MBSA scan was conducted on the Exchange server after all the updates were installed successfully. The patch status report shows that the Exchange server has been updated till the latest patch status.