Koldov

I am constantly walking past the ICT Suite and noticing pupils sitting in the dark staring at bright screens... going in and turning the lights on... to puzzled looks from the teachers... I asked the head to email all the teachers as I believed it was bad for the children's eyesight (eye strain) I mean, I remember my mum telling me I'd get square eyes sitting too close to the TV in the dark... and this was in the 70s - yes, I'm that old kids... so I just presumed it was common knowledge. I am in the middle of a follow up email as it still seems to be happening, but actually finding little actual, concrete, black & white evidence... did I make it up, is it an urban myth...? There isn't even really any guidance in the HSE - DSE! https://www.hse.gov.uk/pubns/indg36.PDF "Adjust the brightness and contrast controls on the screen to suit lighting conditions in the room" I'm not about to let them all start playing with the monitor buttons... EDIT: Obviously more noticeable today as the blinds are all closed and everybody is making sure they take their ICT lesson in the ICT Suite (because... air-con)!

I reckon somebody left the thermometer out next to their cup of tea on the 9th of August 1911...

There are some more serious solutions, but I figure you might be close to needing them... https://docs.microsoft.com/en-us/troubleshoot/windows-server/deployment/fix-windows-update-errors and stuff you might have already researched: https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-troubleshooting There are also some more nuclear options... https://serverfault.com/questions/625332/windows-update-not-working-on-windows-2012-r2-standard I did notice in your manual update failing in the DISM log: 2022-07-15 13:30:55, Error DISM DISM.EXE: Failed validating command line: dism /Online /Add-Package/PackagePath:"C:\Temp\KB5009624\Windows8.1-KB5009624-x64.cab" I would just use 'find' to look for 'error' if the new log is very detailed. Also, just noticing KB5005613 was installed twice, was it uninstalled in-between (this was one of the 'Print Nightmare' updates)? It may be a little drastic and I'm not sure what will happen (can it get any worse though?), but this is where it all seemed to start going wrong as no more CUs install after that.... maybe uninstall it if you can?

Luckily there's always been air-con for our servers since before I started. There was even a separate room (large cupboard) built for them and air-con installed, however last year I decided to move them into the plant/electricity/core switch room. This also has air-con, but this is a more industrial unit paid for and maintained by the LEA as it's a main school thing. This has the advantages of being able to plug directly into the 1Gbps core (instead of the 100Mbps switch it used to be on) and save on maintenance and running costs of the old server room air-con as well. Our ICT suite will be in use today as it has air-con too and over the last couple of weeks have seen the evening cleaners in there on their break and even a couple of meetings! I sent the email last week to all the teachers about things that usually run hot (projectors etc.) being even hotter, but that will probably be ignored as usual...

Not necessarily... Even if it is a in-place 2012R2 reinstall(?) it must just be what it needs to shake things loose, fix corruption etc. Anyway, as this started with the Print Nightmare update, could it be that it was messed around with a little as we were all trying to stop it/uninstall it/reinstall it/patch it...? Could be that it is borked and stopping/holding everything else up, maybe it actually needs removing - this from a Google on the error number '2148468785'? https://social.technet.microsoft.com/Forums/ie/en-US/a2dd207e-e25f-449f-8250-edd2dabc82fa/kb3149090-failed-to-be-changed-to-the-installed-state-status-0x800f0831?forum=WSAppCompat Did you try the advise of the Windows Update Troubleshooter, or did you try anything basic (not that I want to sound like a copy/paste MS help and support forum) like sfc, dism, scandisk...? Probably won't help, but won't hurt... Have you tried installing the latest SSU manually? https://support.microsoft.com/en-au/topic/kb5016264-servicing-stack-update-for-windows-8-1-rt-8-1-and-server-2012-r2-july-12-2022-3d08ad01-6d15-4507-b413-b8d4d4dc9614 I can't see it installed on my 2012R2... but I have got: https://support.microsoft.com/en-us/topic/kb5014025-servicing-stack-update-for-windows-8-1-rt-8-1-and-server-2012-r2-may-10-2022-5cbf26bb-09d8-4bf2-95e9-09fd746aafbe

That actually sounds like you've just been locked in an office and forgotten about (how do you get in and out)! One key, is that actually allowed? Yeah, I would see that as a big loophole... I guess you could just say you are not 'most staff' and it is not 'most appropriate'. I suppose it also depends a little on the 'type' of school you are working in as well? If you are in one of the schools whose handbook was written on a cold, dark day in the early 1900s, you might not have much luck asking for it to be reviewed for the modern age... but as it seems to be generally accepted this sort of summer temperature will become the norm, you could ask when the air-con for each room is going to be put in the budget...? About time someone chipped in with some rules and regulations on maximum working temps...? https://www.gov.uk/workplace-temperatures There’s no law for minimum or maximum working temperatures, eg when it’s too cold or too hot to work. However, guidance suggests a minimum of 16ºC or 13ºC if employees are doing physical work. There’s no guidance for a maximum temperature limit. Employers must stick to health and safety at work law, including: keeping the temperature at a comfortable level providing clean and fresh air Employees should talk to their employer if the workplace temperature isn’t comfortable.

Is this any help? https://kb.vmware.com/s/article/2042141

And therefore don't need to worry so much about consistency, if it's just for a total DR job.

Is there something in your dress code that says you cannot wear shorts (If so, don't argue... wear a skirt!) or is it that you must wear trousers...? No air-con here, luckily I do have a window (although only small top vent opens) and I managed to find a smallish desktop fan in a cupboard a few years ago when it was last silly hot (nobody seems to have missed it yet, so it's now officially mine). Come Monday, I think I will have a lot of work to do in the server room (because at least that has air-conditioning)...

Yeah, that does seem to be the general consensus... So why bother with backing it up, if I'm never going to restore it? Although I do need to make sure I have just the FSMO DC in a backup for complete DR, but in that case restore it first and it will be the only one to start with, so it doesn't matter if it's 100% accurate to the others (because there won't be any) and any I create after that will be blank and replicate from it.

First go at Server 2019... I first noticed that the uptime didn't seem to be reconciled with the last time I knowingly rebooted the server (although I will admit I have rebooted it a lot lately, so could be wrong). Then I noticed it had apparently installed the latest CU all by itself, I did one of the VMs (but was leaving this one until I was sure the first one worked). I don't have much configured by way of GPO to control it, only that it 'should' be set to "Configure automatic updating: 2 - Notify for download and auto install"(and these do appear to be in 'Some settings are managed by your organization - Policies set on your device')... Therefore I'm presuming it should do what the 2012R2 host server does and just let me know there is an update and I can choose what to do with it. But I'm almost 100% sure it has installed the latest CU and rebooted itself! Not what I want at all... Anyone seen this behaviour? Or am I going crazy due to the heat and it being so close to the end of term...?

Honestly, the more I try to research it the more complicated it gets... This from MS (obviously I've paraphrased): Supported methods to back up Active Directory on domain controllers... Use an Active Directory-aware backup and restoration utility that uses Microsoft-provided and Microsoft-tested APIs. Use an Active Directory-aware backup and restoration utility that uses Microsoft Volume Shadow Copy Service APIs Restore the system state. Software and methodologies that cause USN rollbacks... Starting an Active Directory domain controller whose Active Directory database file was restored (copied) into place by using an imaging program Starting a previously saved virtual hard disk image of a domain controller. The following scenario can cause a USN rollback: 1. Promote a domain controller in a virtual hosting environment. 2. Create a snapshot or alternative version of the virtual hosting environment. 3. Let the domain controller continue to inbound replicate and to outbound replicate. 4. Start the domain controller image file that you created in step 2. There's a lot more, but basically reading this it seems that there's a lot that could go wrong with any kind of restoration of a snapshot/image... Yet, in the MS link @mavhc posted it seems that a Hyper-V DC has its own check on boot-up and can't really go wrong (with Generation-Id and virtualisation safeguards)... as long as the DC knows it is not in sync with the latest changes (so it can't be a straight-up clone or a back-up that didn't trigger the DC to let it know it was being backed-up). It seems from the other link Veeam is the way to go, but I wonder even if I do a back-up and test restore it to another machine (off-Domain) how do I check it will behave in the way it should without actually letting it back on the Domain...? Typical behavior that occurs when you restore an Active Directory-aware system state backup... When Active Directory is restored on a domain controller by using the APIs and methods that Microsoft has designed and tested, the invocation ID is correctly reset on the restored domain controller. domain controllers in the forest receive notification of the invocation reset. Therefore, they adjust their high watermark values accordingly. Also, are Hyper-V snapshots/checkpoints AD/DC aware?

Would it possible that SOLUS has a database that has already marked the computer as having SIMS installed and doesn't look any further than that...? If that's the case then I also think you'd have to remove the computer from SOLUS.

Obviously I don't have the knowledge to explain properly, but I thought it would be a reasonably simple thing to do. Backing up a Hyper-V isn't the main issue (any modern back-up software should be able to do that), but the DC part especially AD is very different and apparently needs specific things to happen in the back-up to make AD aware it is being backed-up... once it is restored it should then know it has to get updated from another authoritative DC and not start until it has. I have become slightly wary as recently I did what I thought was a minor alteration to change from dynamic to fixed disk. Shut down the VM properly and then converted it to fixed. This unexpectedly created a new disk for some reason, so I attached the VM to it and booted up... OK so far... Shrunk the partition, then shut down the DC VM properly (again) and shrunk the disk. It all came up OK or so I thought but a little later it started getting refused replication and it seemed to point to a USN rollback, the only advice I found to clear it was demote and promote (which was a pain but as it was only a secondary DC and only a VM it wasn't that bad - primary was still on the host). I don't really understand why it happened as the information on the disk should have all been the same as before it was converted and shrunk, nothing changed inside the VM, in the OS, or the AD part, only really the Hyper-V manager knew what happened... Anyway as I said it made me think (that as a lot of the research I did seemed to suggest this is a fairly common scenario if you restore VM DCs and the backup wasn't VM and AD aware) that I would need to do a lot more research on how to do it.

So there's no 'real' point in taking a back up/snapshot/checkpoint of these Hyper-V DCs...? They are just throw away instances and if one goes badly wrong just spin up another one?

Is there a 'free' backup solution that is both VM and DC aware...? Would this do it and if so has anyone actually restored a VM DC using it? https://www.veeam.com/virtual-machin...tion-free.html Had a quick look on the Veeam forum and found a similar question (specifically mentioning "it's a Domain Controller so AD must be in-tact", here were the first few answers: "You will be able to backup with free edition, but there will be no central management." "You can use Veeam Backup & Replication Community Edition 9.5 to backup your Hyper-V vms. Cheers!" "With Veeam Backup & Replication Community Edition you can backup up to 10 VMs for free."

I'm sitting on quite a few changes at the moment.... can't wait for them to leave! Getting an itchy trigger finger to be honest, but I know I don't want the hassle of it all going wrong in the last week or so...

Sounds great! Not a fan of 'untested' though... Maybe I should stay old school.

Yes, that makes sense and describes our set-up. "In a forest that contains a single Active Directory domain, there are no phantoms. So, the infrastructure master has no work to do. The infrastructure master may be placed on any domain controller in the domain, whether that domain controller hosts the global catalog or not." So I'm going with the fact that it's OK. The MS article didn't explain why, just said don't do it... I guess it was written to encompass more complicated set-ups. Right, I guess by now there's a one line PS script to get it all done... Anyone?

Just spun up a VM and promoted to a DC and looking to transfer all the FSMO roles. According to MS there are 5 roles: Schema master Domain naming master PDC emulator RID master Infrastructure master Further down the page it says the following: "Do not put the Infrastructure master role on the same DC as the global catalog server." 'The' Global Catalog Server...? I've checked and all my DCs are GCs... including the current FSMO holder...

OK, next 'adventure' on my Hyper-V 'voyage of discovery'... I made some changes to my VM DC yesterday which required some downtime. I moved to a fixed disk which somehow just created a new disk, so then reattached to the new disk and shrunk it (as it was configured with defaults of 127GB) . This has resulted in it somehow being out of sync with the main DC and so it has stopped replicating due to a USN rollback (main DC is refusing it) and I've come in today to lots of errors... I've followed the MS article which basically seems to suggest this will happen a lot with a VM DC, (if creating and restoring from a snapshot, alternative version, or backup without 'system state') and details a scorched earth policy of completely demoting and clearing up metadata. Now I've promoted it again and everything appears OK for now... What does everyone do to stop this sort of thing happening? Is there any point in snapshot/checkpoint for these servers within Hyper-V (hopefully with more than one DC it would never really need to be restored as I could trash it, start again and let it replicate from a good one but that isn't a good DR policy)? Is there a 'free' backup solution that is both VM and DC aware ....?

Yeah, funny thing is though I had come across it in my research, but only to disable it in the Hyper-V settings, so once I'd done that and it didn't improve I started down all the other rabbit holes on the internet... Didn't actually see the info on disabling it on the NIC itself through PS! Should have known to come here first!

Thanks! It would appear so...

Just started on my Hyper-V 'voyage of discovery' and finding lots of little quirks to keep me busy, but whilst working on the Hyper-V I've found a major problem which is going to stop me As this is an old spinning rust tower server (so not really trying to have super fast storage, big clusters/failover or anything exciting), I'm just trying to split the roles up to aid backup/DR etc. I'm not sure if this is a hardware or Hyper-V issue, so thought I'd ask here before I start changing anything (everything is set to Hyper-V defaults at the moment as I've only just started). The set-up is an old Dell T420 with a Broadcom NetXtreme dual Gigabit Ethernet NIC (BCM 5720), one NIC for the host and one dedicated to the Hyper-V virtual switch (both patched directly into a Gigabit Cisco core). The host server can ping everything else at <1ms, but when the Hyper-V machine pings anything it seems to be all over the shop... and the same when I am pinging it from any other machine. Also a lot of the time the RDP connection to the Hyper-V says it is poor and the file copy can crawl to Kb/s (which could be disk, memory, cpu etc.), but I think mainly networking issues...? Anyone else had this on similar hardware and can point me in the right direction?

Can't be much help on the actual issue as we don't use hosted SIMS, but from the sound of it you are just logging in RDP style. That session is frozen so no matter where you log in from or how many times you log off and back on to it you are logging into that frozen session... and it will still be frozen when you connect to it. I'd imagine only SIMS support can kill the session (or as you say there may be a job that clears them overnight). The other option (not that I recommend this sort of thing you understand) might be log in as someone else with the necessary options, just to get the job done. Of course if the report you were running makes hosted SIMS unstable you run the risk of freezing their log-in session too...