BJG

...very helpful, thanks. We've agreed to leave it on as the default but turn it off if someone hits a problem. (Shared mailbox in this case.)

I'm just having an argument with someone about whether cached Exchange mode should be set on or off for wired office machines. Personally I think it's a PITA and causes nothing but problems. WDYT?

...any suggestions for a free utility to monitor server disk space...? Ideally a GUI, or just threshold alerts, ta...

I'm currently trying to change a 2012 Hyper-V failover cluster with three nodes to a different address range. (Yeah, I know I shouldn't be on 2012, I told them that.) I can change the IP range of the hosts and their solitary virtualised DC OK (from 192.168.1.x to 192.168.21.x), but after doing that I can't connect to the Failover Cluster, the IP of which is still on the old range. I've Googled changing the IP address of the cluster and I can't see how to change it without connecting to it first. What's the route out of this...? Should I change everything back to how it was, then presumably I'll be able to connect to the cluster again, and start by changing the IP range for that? (The system is currently an offline/isolated backup with no other VMs running apart from the DC.)

I'm currently being asked to do some stuff I'm doubtful about, so I just wanted a reality check. 1) Maintaining a 2012 Hyper-V host with two 2012 VMs at a remote site that I don't think we need. 2) Setting up a new DR 'mirror' system for our main 2019 Hyper-V host...based on Datacenter 2012 R2. The idea is to save licensing costs. I've tried to explain that 2012 has less than a year left, and then all this will need to be replaced with 2019 hosts. And I don't think they can possibly afford it. It's going to be...quite expensive, isn't it...? (No educational discounts here.)

I'm currently supporting a network that still has Windows Server 2012 Standard DCs. (Not my fault, honest. They're still resisting moving beyond 2012 yet because of licensing costs, but I need to get things onto R2 at least to move their AV over to Defender. I've spent most of my career supporting antiquated networks for people who can't afford proper ones and this doesn't look likely to change soon.) Although most of it is running on 2012R2 VMs under a 2019 host, the PDC is a separate physical box, and this is one I need to upgrade to 2012R2. There's a secondary 2012R2 DC running as a VM. Should I consider making the 2012R2 VM the PDC first, move the FSMO roles etc., or just cross my fingers and go for it...?

...simple/newbie question but, the IT Dept have global/tenant admin accounts in the 365 online console which are separate from their regular staff accounts, and not licensed for email. By default, there are various notifications that go to global admins. Do you change everything so that it's redirected to the regular staff account instead, or do you configure things so that the admin account shares the same email address with your regular account...? I just came across a note about setting up different accounts with the same email address and different passwords, which sounds a bit confusing, but...?

Currently running Azure AD Connect 1.6 on 2012. Any thoughts on whether it's going to be easier to move it to a 2019 server or switch to Connect Cloud Sync...?

I'd be interested to know whether people generally rely on Microsoft's own backup, or add a third-party solution.

Apparently "Security Defaults" is now enabled by default, but wasn't in older tenants (like ours). I'm wondering whether to turn it on, but I'm slightly puzzled by the comment that: "Users have 14 days to register for Azure AD Multi-Factor Authentication by using the Microsoft Authenticator app...Security defaults users are required to register for and use Azure AD Multi-Factor Authentication using the Microsoft Authenticator app using notifications." https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults Users already have MFA enforced, but the majority are via text message. So will enabling Security Defaults force them to use the app instead...?

I've recently been asked to arrange VPN access for a couple of Macbook users, which is proving difficult; I haven't yet managed to get them to cooperate with the protocols like IKEv2 and MS-CHAP that have been set up for Windows users. But with the increasing adoption of cloud services like OneDrive, Sharepoint, Azure etc., I'm wondering if VPNs are on the way out anyway. I've been browsing articles like this one. "One of my clients had VPN access for staff (it's a small school), we disabled that about 3 years ago. No one has remote access to on-prem (except for me and I don't use VPN) but they all get by through storing their files in OneDrive for Business, and of course they have access to Teams and email from anywhere (Office 365)." No doubt VPN is still useful/essential for some things, but these Mac users only want access to a shared folder, so I'm thinking VPN probably isn't the best way forward anyway...? We're just starting testing OneDrive as a substitute for personal network folders, and I guess shared network folders would ultimately be replaced too, eg by Sharepoint sites...? (Sharepoint on-prem is widely used here, recently started looking at Sharepoint online.) I guess I'm wondering if anyone here has moved away from VPN towards cloud-based alternatives, and whether Teams sites are a future substitute for shared folders in the same way that OneDrive replaces personal network folders.

I just tried this free QNAP utility to back up a Hyper-V VM to a NAS. Seemed very straightforward; I wondered if anyone was using it. https://www.qnap.com/en-uk/software/hyper-data-protector

We're starting to look at migrating users' personal network folders to OneDrive. I've just enabled it for myself. Being old-school, I'm currently thinking, hmm, not sure about this download/sync business, I quite liked just opening files instantly from the server. I can see the benefits from an IT admin point of view, and with most users here now working from home it seems to make sense and be the way forward. I'm not fully aware of the benefits from a user perspective yet though. Some people in the IT Dept are in favour, some are more sceptical. I'd be interested to know folk here have done this, are planning to do it, and not planning to do it, and why...

...thanks for looking at it; planning to demote it.

We have a couple of DCs replicating OK at the main site, and one with broken replication at a remote site. It's in a rural area and the connectivity isn't great. There's only a handful of people using it. Although it's providing DNS/DHCP, the home/group folders for those users are at the main site. This seems a bit daft to me, and I've suggested simply pointing DNS at the main site too (it's already included as an option), then demoting it and leaving it as a member server. Or preferably just ditching it and using cloud services instead. Anyway...in the meantime I'm still seeing if it's possible to get it back how it was before. SYSVOL replication hasn't worked since January and no-one's even noticed. There are no IT staff at the remote site, no-one will have made any changes on that server, so it just needs an updated copy. The problem started when I noticed Event 4012 in the DFSR log for the remote server. The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL_DFSR\domain. This server has been disconnected from other partners for 136 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter (60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder until this error is corrected. To resume replication of this folder, use the DFS Management snap-in to remove this server from the replication group, and then add it back to the group. This causes the server to perform an initial synchronization task, which replaces the stale data with fresh data from other members of the replication group. I initially tried following these instructions, but they don't work; it's not possible to remove servers from a SYSVOL replication group via the DFS Management console. I've since read elsewhere that you should ignore this and follow the well-documented process for an authoritative / non-authoritative sync. https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/force-authoritative-non-authoritative-synchronization Unfortunately, before I discovered that, I tried removing it from the group by deleting it from the topology as described above, and now I can't sync it or add it back. https://www.oreilly.com/library/view/active-directory-administration/9781789806984/2dda7ed1-ca4b-40e1-89fc-0c463ef1d443.xhtml There's now a new and more vicious error in the remote DFSR Event Log preventing replication, which is 6002. As I say, I haven't come across any solution so far except demoting it. I think I might have to do that...? The DFS Replication service detected invalid msDFSR-Subscriber object data while polling for configuration information. Additional Information: Object DN: CN=Domain System Volume, CN=DFSR-LocalSettings Attribute Name: msDFSR-MemberReference

One of our servers had a problem with SYSVOL DFSR replication, and the warning in Event Viewer said it was so out of date that the server would need to be removed from the replication group and added back in. After Googling for some info on how to do this, I deleted it from the DFSR topology container via Active Directory Administrative Centre by following these instructions: https://www.oreilly.com/library/view/active-directory-administration/9781789806984/2dda7ed1-ca4b-40e1-89fc-0c463ef1d443.xhtml Unfortunately this seems to have been the wrong thing to do (?), and I'm now trying to figure out how to get it back. One solution is apparently to demote it and promote it again, though it's the DHCP/DNS server at a remote site on a different subnet so that sounds like a major hassle. The only link I've found that talks about rebuilding the toplogy without going through demotion/promotion is this one... https://community.spiceworks.com/how_to/160786-how-to-re-build-sysvol-dfsr-replication-group-without-demoting-promoting-dc ...but not only does that also sound like a major hassle, it was written in 2019 and the first registry key it mentions doesn't exist, so it's probably for a different OS and might mess things up even more. There are also various tutorials on forcing an authoritative synchronisation for DFSR SYSVOL... https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/force-authoritative-non-authoritative-synchronization ...but I'm not sure if this will work after vandalising the toplogy...? I'd be inclined to just do away with it but I haven't managed to sell that idea to the boss yet.

(...things are getting back under control now...)

I've recently started digging into the DNS setup on the network in my new(ish) workplace and wished I hadn't. It seems to be completely messed up. For one thing, a lot of the entries in the Forward section are mismatched with the Reverse section. I've seen all the stuff about scavenging and clearing the cache etc., but it doesn't seem to fix this. I'm not sure how it got this way or how to sort it out. Can I somehow tell DNS to recalculate all the Reverse entries...? (DNS isn't my forte. DHCP looks OK as far as I can tell, and the DNS settings in DHCP seem sensible. I'm not blown away that they've got two different DHCP servers on separate scopes that don't talk to each other, but that's another story. The two DHCP servers are also both DNS servers, but these are in sync. They're wrong, but at least they tally.) Another weird thing that's happening is that laptops from remote workers are getting mapped to completely inappropriate IPs. Eg yesterday I found one staff laptop that showed up in DNS with a duplicate entry for the IP of one of the Hyper-V hosts, which is a bit concerning. People take laptops home, which they can log into offline, or log into / connect to the VPN. The organisation has a 192.168.x.x address range, and I'm told that in the past they had a problem where IP addresses corresponding to users' home networks were getting registered in DNS, and this never seems to have been sorted out properly. From Googling I've found some discussion of the IPv4 client setting to "Register this connection's addresses in DNS", but I'm not sure if this is the root cause of the problem or how to fix it. Things generally work (surprisingly), apart from the odd glitch, but it looks overdue for a fairly drastic overhaul. (The only problem I came across with the twin DHCP servers was that clients would abandon their reservations on one and defect to the other; I've now prevented this with MAC filtering. I'm aware of "split scope", which is probably what the person who set this up was attempting to do, and I need to revisit this sometime...but as I say, I think DHCP basically looks OK, but DNS seems quite messed up.) (...oh, and the main DC/DHCP/DNS is on Windows 2012 Standard. The other one is on Windows 2012 R2. Lots to do, but one thing at a time...) Help!? *edit* I see there are plenty of warnings to avoid 192.168.1.x/24 due to clashes with home networks for VPN users, which looks like part of the problem.

...just started looking at this again and trying to get my head round the licensing options. Do people generally go for perpetual or subscription...? A company we approached suggested we look at one of these two: Veeam Backup Essentials Universal Subscription License Includes Enterprise Plus Edition features. 1 Year Subscription Upfront Billing & Production (24/7) Support. Veeam Backup Essentials Universal Subscription n/a Subscription Upfront Billing New License (Qty 4) Veeam Backup Essentials Standard 1 year of Basic Support is included. 2 socket pack. Veeam Backup Essentials Standard Perpetual New License (Qty 3) I realise it depends on the particular hardware/VM/data requirements we have here; just trying to get a clearer idea of the alternatives at the mo. (Around 20 virtual servers running on a couple of hosts, each Intel Xeon Gold 5218 @ 2.3GHz with 2 processors.)

Currently IT staff here have a regular account, and a separate admin account. When they need to do something that requires admin credentials, they can use 'elevated' permissions with this account; "run as" with admin etc. I'm wondering what the simplest method is to apply this to network folder access, so that regular accounts have typical limited folder access to group shares, but it's possible to 'elevate' the session to obtain full access. At the moment the only way I can see is to remote into the fileserver as admin, or disconnect the current drive mappings then re-establish them with different credentials. Am I missing a simpler way...?

I've been asked to organise a replacement for our network's ancient and crumbling tape-based system. We have about 20 virtual servers (mostly 2012 R2) hosted on 2019, running off a SAN showing 6TB usage. At the moment we're only backing up data, but we also want to start backing up VMs. There's an existing plan to arrange for a company to install and configure Veeam with a new 8x6TB QNAP TS-1273AU-RP-8G NAS. I'd be interested in any recommendations for companies to approach for a quote to help with this project, and any thoughts on how we should integrate Cloud backup, which isn't currently used but which I'm keen to introduce. (I've been looking at the suggestions in the Cloud Backup thread.) One of the concerns around that is whether the current broadband speed will be enough. I'm currently looking at 65Mb/s down, but only 20Mb/s up. I'm not sure what kind of speeds a Cloud system would need...presumably it's very efficient in only transferring what it needs in a compressed way. Any thoughts appreciated...

...the problem these days is that you can't predict when computers are going to be available. People with a laptop at home only keep it on when they're using it so you can't schedule overnight tasks, and forcing reboots without an on-screen timer is risky...

The antivirus system we're using here (ESET Protect) isn't very effective when it comes to insisting on the reboots that clients regularly need in order to update. You can only send popup requests, or force instant reboots. Other better systems I've seen are: a) Force a reboot at logon b) Present a stubborn on-screen countdown timer warning that the computer will restart in 5 mins Any recommendations for a good solution to this, preferably free, without heavyweight system management solutions like SCCM?

...thanks, not heard of dual scan, just reading up on it. Yep, there's a VPN...what impact does that have...? (Does the idea of directing laptops to Microsoft servers online make sense...? Is it still possible to control what updates clients receive in this way via a WSUS server...?)

Yesterday a bunch of remote users started raising tickets that the network was running very slowly, and a Broadband speed check in the office showed 70Mbp down but only 1.5Mbp up. We decided this was because we'd approved a round of WSUS updates that were being deployed to all the users now working remotely on laptops. Has anyone else seen this problem with the move to remote working...? We're wondering what the best solution is; eg breaking up the remote laptops into smaller groups or directing them to online servers instead of our central one. It's quite an old version of WSUS, still running on Server 2012, and I expect things may be better using SCCM on a modern OS, but I don't know when that's likely to happen. Any ideas welcome.