worcestertech

Does anyone have any experience with user monitoring software? I have zero experience with this kind of thing and I've been tasked with monitoring an employees usage, web browsing, key logging, everything. Any suggestions?

Hi Howartp, our posts crossed. As you can see it's not an exchange issue, well not directly anyway. I can see no anomalies in the reply-to or any other part of the header but WatchGuard insists that any reply is spam so there must be something that I'm missing.

***Update*** Denial is being carried out by the spamblocker service on our WatchGuard XTM505. As a temporary measure I've changed the proxy action to add a label rather than block the message. However, this begs the question: why would WatchGuard suddenly start to see any replies to our emails as "confirmed spam"? I've made no changes either to Exchange or WatchGuard. I can't see anything in the mail headers that's untoward. Does anyone have any idea what I could / should be looking for?

Hi everyone. This issue started happening around mid day yesterday. Exchange 2007, outlook clients (2007 - 2013) We can send and receive emails OK with one big exception; anyone outside our organization who replies to an email gets bounced with a "571: Delivery not authorized" message. An external sender can send us a new email absolutely fine but if the same person replies to one of ours it's bounced. Nothing (that I know of) has been changed at this end and until yesterday there were no problems. I'm not coming up with any conclusive answers, does anyone have any ideas? I could do with a very quick fix here.

Hi Adon Many thanks for such a comprehensive answer and an offer to help further :-) Due to multiple time pressures I have cobbled together a "solution" that works but is not ideal for me. I do need to get the switches configured correctly. Anyway, at the moment I have this set up: The gateway device is a Watchguard XTM505 configured thusly: IP 192.168.1.1 4 x interfaces configured, the first two being our leased lines and failover ADSL. 3rd interface is "tagged" as the interface handling 192.168.1/24 traffic connected to one of the 2910 switches. Also "tagged" as a trusted interface. 4th interface is "tagged" as the interface handling 10.20.28/22 traffic connected to the 3500 switch. Also "tagged" as a trusted interface. Watchguard is configured to send traffic to the appropriate interface and between interfaces depending on the request from the originating device. It has a static route set up to route 10.20.28/22 traffic to interface 4. Currently I have disconnected the fibre link, and hence the default VLAN (on the 3500) between the 3500 and 2910. The two DHCP (one on each subnet, although in reality there are two each working as failover clusters) servers are set up to give out the gateway address of the Watchguard device, either 192.168.1.1 or 10.20.30.1 depending on the subnet used for the originating DHCP request. These are the IP addresses of interface 3 and 4 respectively. This setup works but it's not the best way of doing it; I want to be rid of Watchguard doing the routing and let the switches handle it. The 3500 currently has this in the routing table: [ATTACH=CONFIG]23122[/ATTACH] VLAN1 (default_vlan) contains the fibre uplink port only which has 192.168.1.250 configured on it. All other ports are on the default VLAN. All ports untagged, no trunk ports. The appropriate part of the config is: IP Default gateway 192.168.1.1 IP Route 0.0.0.0 0.0.0.0 192.168.1.1 IP Route 192.168.1.0 255.255.255.0 192.168.1.1 IP Routing Router RIP VLAN1 Name default_vlan no untagged 1-23 untagged 24 IP Address 192.168.1.250.255.255.255.0 VLAN2 untagged 1-23 IP Address 10.20.28.1 255.255.252.0 IP directed-broadcast IP Helper address 192.168.1.2 IP Helper address 192.168.1.5 Spanning Tree Both 2910's have this in the routing table: Both 2910's have only the default VLAN configured. No tagged or trunked ports. IP Gateway 192.168.1.250, IP Route 0.0.0.0 0.0.0.0 192.168.1.1, ip routing on. We do not have any devices broadcasting routing information. I did originally have a static route set on Watchguard pointing to 192.168.1.250 but this has now been removed. So... I should turn off RIP and go with static routes + IP helper addresses + static route on Watchguard? Or leave ip routing configured and remove the static routes?

I misunderstood you, sorry. From the gateway (192.168.1.1) I can ping both gateway addresses on the 3500 although pinging 10.20.28.1 gives variable reliability - sometimes total loss, sometimes one or two packets are lost, sometimes 100% received. Cannot ping between clients on different subnets at all. From the 3500 I can ping both gateway addresses and the gateway appliance.

No. On a HP switch I understand port trunking to be another term for LACP? The only port options I can see are tagged and untagged in a particular VLAN. Should I enable tagging of the uplink port in both VLANs?

I did do that on the 3500 switch and also on the 2910 it uplinks to. Also added a static route to reach 192.168.1/24 from 10.20.30/22 via 10.20.28.1 on the 3500. I also put in ip helper addresses. It didn't help... I'm not a switch expert and this is confusing the hell out of me. My biggest uncertainty is tagging. Do I need to tag port 24 (fibre) in both VLANs on the 3500 in order to get traffic from one VLANS to the other? All ports are currently untagged on all VLANs.

I do have those routes in the routing table though I've noticed it doesn't show in the config I posted. Also have the gateways in the DHCP servers. I also originally put the helper addresses in but subsequently took them out. I can ping the gateway from the switch so it knows the way but anything other than ICMP traffic doesn't get through.

If it's any help this is the config of the 3500 switch: module 1 type j86xxa timesync sntp stack commander " Switch1" stack auto-grab stack member 1 mac-address 001db3-49fa00 stack member 2 mac-address 0026f1-8ccd40 ip default-gateway 192.168.1.1 ip route 0.0.0.0 0.0.0.0 192.168.1.1 ip routing snmp-server community "public" unrestricted snmp-server contact "Administrator" router rip redistribute connected enable exit vlan 1 name "DEFAULT_VLAN" no untagged 1-23 untagged 24 ip address 192.168.1.250 255.255.255.0 exit vlan 2 name "VLAN2" untagged 1-23 ip address 10.20.28.1 255.255.252.0 ip directed-broadcast exit spanning-tree no autorun no dhcp config-file-update no dhcp image-file-update password manager

This should be a simple issue to address but I can't seem to make it work. Scenario Two subnets: 10.20.30/22 behind a HP 3500 switch connected to 192.168.1/24 subnet. The 3500 switch has two VLANs. VLAN2 has IP 10.20.28.1 containing ports 1 - 23 all untagged. VLAN1 has IP 192.168.1.250 and is just port 24 (fibre) untagged. Port 24 (fibre) on the 3500 is the uplink to a HP 2910 switch on port 28. All ports untagged in one VLAN. There is another 2910 switch uplinked via copper from the first 2910, all ports untagged on one VLAN. These 2910 switches carry 192.168.1/24 subnet clients. Internet gateway appliance is 192.168.1.1 linked to the first 2910 switch. I need two-way communication between all devices in both subnets and for all devices in the 10.20.30/22 to be able to access the Internet via 192.168.1.1 gateway. The aim is for the 10.20.30 subnet to host all DNS and DHCP + file storage. Most clients and all legacy servers will remain in the 192.168 subnet but they obviously need to be able to obtain DN resolution and DHCP from the 10.20.30 subnet devices. I have tried many configurations using IP Helper addresses, static routes etc but I cannot get the clients on 192.168 to see the DHCP or DN servers on 10.20.30. Neither can I get devices on 10.20.30 to get to the internet. Neither can I get server - client access from 192.168.1 to 10.20.30 Curiously I can ping and tracert the gateway but not access it in a meaningful way. What do I need to reconfigure on the 3500 and / or 2910 switches in order to get cross-VLAN traffic running freely?

Bit more info that might help. I've looked at the switch config in depth today. Added IP helper addresses and a static route / next hop address into each of the three switches. It seems that clients can now see the dhcp server but I still have DNS / gateway issues. Most clients still have no internet access. Interestingly, if I point some clients at one of the 2610 switches address as the gateway internet access is restored. This doesn't work for all clients by any means though. Any thoughts anyone?

What started off being a simple if complex task is turning into a stubborn set of problems. In essence I am moving from an SBS2008 based domain to a server 2012 based VMWare domain. The existing setup had to and has to be maintained until I have the new setup ready for a weekend switchover. In the meantime I needed to get the two forests talking to each other and both accessing the internet via the same gateway, an XTM505 on the existing 192.168 subnet with a static route set up to the 10.20 subnet. Existing network is one SBS 2008 box and 5 other physical servers communicating over two flat HP 2610 switches. 192.168.1/24 subnet. DHCP and DNS have been disabled on this subnet. New network one physical DC / DHCP server and 10 or so VMs. VMs running on two ESXi hosts with iSCSI SAN storage. The cluster communicates internally via two Dell Powerconnect switches. 10.20.30/22 subnet. Interconnectivity is performed by a HP 3500 switch over a fibre link to one of the existing 2610 switches. The 3500 has two IP addresses, one on each subnet, these are the gateway addresses from and to each subnet. Gateway addresses are 192.168.1.250 and 10.20.28.1 on the 3500 switch. Firewall / Internet gateway is on 192.168.1.1 and is connected via a trusted interface to one of the 2610 switches which in turn is linked by fibre to the 3500 switch. Static route set up on the firewall as 192.168.1.250 which is an IP on the 3500 which in turn in connected to the 10.20 subnet. DHCP server holds the above gateway addresses. I've had the switch config checked out by a HP networking specialist who says all is well on the routing side. Transitive forest trust has been set up from new forest to old. Trust cannot be set from old to new as SBS does not support trust (thanks Microsoft!) DNS and DHCP are handled by the new DC on the 10.20 subnet. There are two DHCP scopes, on the 10.20 and on the 192.168 subnet. I have two main issues that are proving stubborn to resolve: 1. Client PCs and servers on the "old" side are not seeing the DNS, and sometimes not the DHCP servers, i.e. they're not getting a response to the broadcast looking for DHCP. 2. The old gateway address of 192.168.1.1 appears to be persistent, ipconfig shows this address as one of the gateway addresses along with the new gateway. This address no longer exists in any DHCP server on the network yet if I carry out an ipconfig /release /flushdns /renew it reappears. So, long preamble leading to a simple question: what am I doing wrong? Does anyone have an idea of what steps I can take to resolve the situation? Any suggestions will be gratefully received.

This is running and running for me. Robocopy is grumbling whichever way I use it, mainly it stalls accessing the original files with an "access denied error" which I cannot seem to overcome whichever options I use. I'm thinking that I need to strip all the permissions so what's the correct switch combination with robocopy to achieve this? The new domain is completely fresh, new user accounts created with different usernames and passwords from the existing domain. I need to create the appropriate file structure within the User$/FolderRedirections folder and then copy the files across with permissions recreated when the user opens, then saves the file. Or is this notion too simplistic?

I'm currently creating an entirely new domain for a company of around 80 employees. Complete new VMWare infrastructure and we have no intention of re-using the existing servers. The existing system runs on SBS 2008 and the new is Svr 2012 / Exchange 2013. Everything will be freshly created, new user accounts etc. I've no intention of migrating the existing environment, just user data. Folder redirection for docs and desktop will be used. What is the best way to migrate the data to the new 2012 file server? I'm thinking of ADMT but that requires a 2008R2 DC and lowering the functional level of the new domain to 2008. I can create a 2008 DC as a VM no problem and obviously I can demote the functional level and then raise it after the migration but is this this the best way to go about the move? How else could I do it without giving myself permission headaches? Any thoughts?

Yes, I had tried logging off and on several times both on the DC and the workstation. However, the next morning it was OK. No idea why but it just seemed to take ages to propogate.

Hi everyone. I was on here before (Number6) but haven't posted for a while. Now I can't get into my old account so hence this new one. Anyway, I have a problem that's been bugging me most of the day. I have a brand new 2012 DC on which I've created a folder redirection GPO pointing users docs and desktop to a newly created share. I have created a new global security group for folder redirection users, the group currently contains only me. The GPO scopes to the folder and is applied to the OU containing the user. Now, on a W7 PC logged in as me I have run gpudate /force followed by gpresult. This shows the new policy not applied (Denied: Security). It does not show me as a member of the folder redirection group. Obviously the GPO is denied because I'm not showing as a member of the relevant security group. The same result ensues if I run gpresult on the DC. whoami /groups does not show me in the group also. Simple question. Why am I not showing as a group member? This is completely "doing my head in" and I need to resolve it yesterday, any ideas anyone?