System Management

While installing the latest “Forefront Client Security” product named Forefront Endpoint Protection 2010 (RC version), the prerequisites verification step displayed an error at the “Verifying restart is not required” step. And the error details: “An earlier software installation still has outstanding file rename operations pending. Before Setup can continue, you must restart the computer.”

The more stranger thing happens after you restart your computer and start the Setup again. The same is displayed. Why? Well, maybe because on the FEP 2010 requirement is to have a working Configuration Manager 2007 infrastructure and almost always ConfigMgr will have open files and read/write operations on the computer you’re trying to install FEP 2010.

So, to workaround this problem you have to modify your registry (do it on your own as I did). Open PendingFileRenameOperations key from HKLM\SYSTEM\CurrentControlSet\Control\Session Manager and delete or copy its content to a notepad. Save the key and start Setup now, it should work, at least it for me.

Thanks to Evgeny-D who posted this on Microsoft’s forum. I’m glad that I did not forget Russian language

I had to install a copy of SQL Server 2005 on a Windows Server 2003 R2 SP2 x64. During installation I got a strange error saying that SQLncli_x64.msi file is missing. I was pretty sure that I have the same ISO file as I did while installing SQL so many times before and without any errors… Searching the net, the solution from Microsoft forum was the right one.

Before installing SQL Server, you have to download and install Microsoft SQL Server Native Client x64 file (sqlncli_x64.msi) from Microsoft Download Center.

Note: If you’re going to install Analysis Services too, then make sure to download and install Microsoft SQL Server 2005 Management Objects Collection x64 file (SQLServer2005_XMO_x64.msi) also.

Yesterday I was trying to install a network printer on Windows Server 2008 system. After typing printer’s IP address, I received an “Access denied” error.

The problem was that I tried to install the printer while I was logged on with a user that had domain admin privileges, but not the default domain Administrator account.
When I logged in with domain admin user – Administrator – I was able to install the printer successfully.

Searching the internet, I saw that some people are saying that this error appears only when having UAC turned on.

Today I learned again a lesson I knew for some time but was hoping that I can forget it. The lesson was about: “Trust anyone. Test for yourself.”

Having to install WSUS on a remote SQL 2005 that had WSUS database installed before, I asked one SQL guy if renaming the old WSUS database is enough to install a new WSUS one. He said yes. Ok then, I started installing WSUS.

Needless to say, installation failed:

There is a problem with the windows installer package.A program run as part of the setup did not finish as expected.Contact your support personnel or package

Two hours of troubleshooting permission and connection problems, made me read all WSUS installation log files located in “X:\Users\username\AppData\Local\Temp”. One of the file was 1 KB size so it does not contain much info. Anyway, the file content was:

Changed database context to 'master'.
Msg 1802, Level 16, State 4, Server SQL-SERVER-NAME,  Line 2
CREATE DATABASE failed. Some file names listed could not be created. Check related errors.Msg 5170, Level 16, State 1, Server SQL-SERVER-NAME,  Line 2
Cannot create file 'C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\DATA\SUSDB.mdf' because it already exists. Change the file path or the file name, and retry the operation.
Changed database context to 'master'.

I will not comment the 4^th line as it says pretty much all…

I guess when doing something, you have to test for yourself everything. Lesson learned. Again.

Today a client called me and said that his second domain controller, which is on Hyper-V, is having connectivity problems. For example, running the ping command from DC2 results in very bad response times or timed out requests.

Searching the event viewer, I saw many errors with Event ID 1054: “Description: Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or exist or could not be contacted). Group Policy processing aborted.”

Found a Knowledge Base article on Microsoft website that basically says this is happening if the computer has some AMD technology enabled in the BIOS. Well, my client only has computers with Intel Xeon processors, so this is not the case. Anyway, having experience with such articles vs. errors, I read the article till the end. This way I found similarities with my client’s environment: computers with more than one processors.

Basically, Dual Core or multiprocessor processors may encounter Time Stamp Counter (TSC) drift if certain conditions are met:

• number of processors
• operating system
• technologies enabled in the BIOS
• BIOS version.

This conditions can affect important operations like network communications and performance monitoring tasks that are sensitive to system time

Windows XP, 2000 and 2003 servers use the TSC as a timekeeping source. Each processor core (whether it is a single-core processor or dual-core processor) includes a TSC. When the TSC for different processor cores are not synchronized, the above symptoms and behaviors can occur if the operating system is using the TSC as a timekeeping source.

The KB article’s resolution is to install a newer CPU driver that modifies the boot.ini file by adding a switch in order to force the computer to use the PM_Timer instead of TSC. Also, it says that the boot.ini file can be manually modified.

So, to manually modify boot.ini file follow the following steps:

• Log on to the computer by using an account that has administrative credentials.
• Click Start, click Run, type notepad c:\boot.ini, and then click OK.
• In the Boot.ini file, a line that starts with "default" is located in the "[boot loader]" section. This line specifies the location of the default operating system. The line may appear as follows:

  multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows Server 2003 Enterprise x64 Edition" /fastdetect /NoExecute=OptIn

• At the end of the line, add a space, and then type /usepmtimer. The line should now resemble the following.

  multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows Server 2003 Enterprise x64 Edition" /fastdetect /NoExecute=OptIn /usepmtimer

• Save the file, and then exit Notepad.
• Restart the computer

This resolved the connectivity problem, however I wanted to test one more thing. As DC2 where a virtual machine with 2 cores assigned, I changed it to use only one processor and modified the boot.ini file to its original state. After restarting the VM and monitoring the server for bout 20 minutes, looks like the problem went away. So this can also be a workaround. I used the first method as client preferred this one.

These are the articles I read carefully today and used now to write this post:

• Programs that use the QueryPerformanceCounter function may perform poorly in Windows Server 2000, in Windows Server 2003, and in Windows XP: http://support.microsoft.com/kb/895980
• Explanation for the USEPMTIMER switch in the boot.ini: http://blogs.technet.com/perfguru/archive/2008/02/18/explanation-for-the-usepmtimer-switch-in-the-boot-ini.aspx

Short post that I think might be useful…

If you receive the following error: “An error occurred while retrieving policy for this computer (0x80072EE7)” when Task Sequence Wizard starts, this can happen if you have DHCP or DNS problems.

You should check if you can contact the DHCP server in order to get an IP address or you can configure a static IP address.

If you have a switch with STP enabled, you might want to read this post.

Let’s suppose you create a package with one program and want to advertise it only to a few selected platforms, including x86 and x64 Windows 7 systems. Because Windows 7 is not supported yet with Configuration Manager 2007 SP1, you cannot choose it from the supplied list of platforms. As a result of this, after receiving and downloading the package, the system will give you the following message:
Program rejected (wrong platform). Advertisement "XYZ12345" from site "XYZ" was rejected because the client's platform is not supported.

It is expected that SP2 will add support for Windows 7, but until then we can use the following workaround:

1. Create a collection with all Windows 7 systems
   select sms_r_system.ResourceID, sms_r_system.ResourceType, sms_r_system.Name, sms_r_system.SMSUniqueIdentifier, sms_r_system.ResourceDomainORWorkgroup, sms_r_system.Client from sms_r_system where OperatingSystemNameandVersion like '%Workstation 6.1%'
2. Create a new program (for example Program for Win7) for the same package and select “This program can run on any platform” as a requirement.
3. Create a new advertisement and use “Program for Win7” program. Advertise it to Windows 7 collection created earlier.

That’s it. This may not be the best workaround, but it worked very well for me, at least until SP2 will RTM and I can install it in production.

Usually, extending the Active Directory schema is the last step I do when installing SCCM. This time, while installing SCCM in a virtual machine, you have to provide a path to a folder with SCCM updates or download these updates from the internet. Working in a virtual machine with a “Local only” network adapter, I couldn’t download those updates; so I switch the network adapter to an external one. After downloading the updates, next step is “Installation Prerequisite Check” and at this step I extend the AD schema.

Well, the following error was written in ExtADSch.log file:
Unable to connect to RootDSE - Cannot update Active Directory. Error code = 1355.
Failed to extend the Active Directory Schema.

Error 1355 is: ERROR_NO_SUCH_DOMAIN. That means that the specified domain could not be contacted or does not exist. The problem here is that I did not switched back to “Local only” network adapter and so the Active Directory could not be contacted. Setting the adapter to “Local only”, I could contact the Domain Controller and extending the schema was successful.

Someone just asked how to create a collection with all laptop computers? Well, if there is a good naming convention on site, this query will be easy to make even for me But, otherwise, we need to use chassis type value because laptops and notebooks are not the same things.

The full list with chassis types are bellow (taken from http://www.microsoft.com/technet/scriptcenter/guide/sas_cpm_btnz.mspx?mfr=true):

So, to make a collection with all kind of mobile systems (Portable, Laptop, Notebook, Sub Notebook) we will use 8, 9, 10 and 14 chassis types. The final query looks like this:

select SMS_R_SYSTEM.ResourceID, SMS_R_SYSTEM.ResourceType, SMS_R_SYSTEM.Name, SMS_R_SYSTEM.SMSUniqueIdentifier, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SYSTEM_ENCLOSURE on SMS_G_System_SYSTEM_ENCLOSURE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_SYSTEM_ENCLOSURE.ChassisTypes in ("8", "9", "10", "14")

If you receive the “This query has a syntax error.” error, change the quotation marks when pasting the query, as this one does not work with ConfigMgr.

Suppose you have created a task sequence, advertised it and booted from task sequence media or however you want; if you receive the following error: “Task Sequence: <TS name> has failed with the error code (0×80004005). For more information, please contact your system administrator or helpdesk operator.” at Setup Windows and ConfigMgr step you might want to check the Product Key! Most probably the key is not correct, so either write another one or remove the product key at all from Apply Windows Settings step in your task sequence and you will have to provide it during the install phase.

I left the product key blank and next time I booted the PC from the TS media, at the Setup Windows and ConfigMgr step I was asked to provide a product key. I entered my Business edition product key and everything was ok.