We came across an issue today where the following two alerts were exceeding there thresholds “”The AD General Response is above the configured threshold” and “AD Op Master response is above the configured threshold”. The DC in question was a x64 windows 2008 machine and interestingly enough we had x86 DC in the same site which did not exhibiy any of the issues.
So we had a look at what version of oomads (AD Management Helper Objects) on the x64 DC only to find the x86 oomads installed , so we simply removed the x86 version and installed the x64 version of oomads and the alerts just disappeared 
Daniel Davies
When trying to create a new distribution group through EMC you may receive the following error message at the end of the wizard:
Error:
Couldn’t find object "UserAccount". Please make sure that it was spelled correctly or specify a different object. Reason: The recipient UserAccount isn’t the expected type.
Exchange Management Shell command attempted:
new-DistributionGroup -Name ‘test’ -Type ‘Distribution’ –OrganizationalUnit ‘OU’ -SamAccountName ‘test’ -Alias ‘test’
The reason for this is that when creating a Distribution Group it tries to add the mailbox of the user creating it as the manager of the Distribution Group and usually the Admin account that creates the Distribution Groups will not be Mailbox enabled.
To get around this you can use the New-DistributionGroup cmdlet with the ManagedBy Parameter:
new-DistributionGroup -Name ‘test‘ -Type ‘Distribution’ –OrganizationalUnit ‘YourDomain/Distribution Groups’ -SamAccountName ‘test’ -Alias ‘test’ –ManagedBy ‘MailboxEnabledAccount’
We came across an issue recently where we were experiencing slow saving speeds in Microsoft office 2007 & 2010 to a Windows 2003 Sp2 File Server.
We experienced a saving dialogue box nearly every time we hit save from our windows 7 desktops.
Resolution
To resolve this issue we had to enable “QOS Packet Scheduler” on the windows 2003 File Server . After around 10 minutes of enabling this all our saving issues disappeared and transfer speeds increased
Daniel Davies
I recently needed to find out which memory slots where occupied on multiple machines. I found a command that allowed me to find this information without opening up a single computer case.
From a Command Prompt, run the following:
wmic MEMORYCHIP get banklabel, capacity, caption, devicelocator, partnumber
Hope you find this useful,
Any RMS protected content can only be consumed or created within the trust boundaries of the domain. It is sometimes desirable to be able to share protected content with other external parties (Partners etc) so what do you do then? Well there are a number of options available, of which the main three used are:
TUD – or Trusted User Domain is primarily used when a company with an RMS infrastructure wants to share protected content with another organization with their own RMS infrastructure. In order to do this a traditional Active Directory trust must first be in place, we can then export the SLC public key of the RMS cluster from the domain wanting to consume content and import it on the RMS cluster in the domain wanting to share content. This of course can be replicated both ways so that both sides can open RMS protected content from the other.
TPD – or Trusted Publishing Domain is usually used in one of two scenarios, one where an AD RMS cluster is being decommissioned and replaced. An example might be where forests are being merged and one cluster is taking over the functions of the others. The other scenario might be when a cluster has to issue licenses for content protected by clusters in another forest (can be used for cross forest RMS protected content exchange) To implement this trust you must export the private key of the cluster you are wanting to consolidate and import it into the TPD section of the remaining AD RMS cluster, this is so use licenses can still be acquired for content protected by the decommissioned cluster.
AD FS support for AD RMS – This is an extremely good feature for collaboration with multiple forests where partners do not have their own AD RMS infrastructure or even don’t have directories based on AD. To implement this solution AD FS must be configured and a federation trust must be in place. You then in AD FS usually create a new claims aware application entry for AD RMS certification URL, you can then define which claims to accept (for AD RMS this is UPN then email) you then do the same for the licensing URL. You must also make sure to add the server role for AD RMS Identity Federation Support and enable federated identity support in the AD RMS console. There are some registry key changes that have to be made on the trusted domain machines (the side without AD RMS) so that the home realm discover works correctly but this can be done via GPO’s*. You will then be able to send and receive RMS protected content from this entity even though they do not have AD RMS implemented!
- *Registry Key – HKLM/Software/Microsoft/
- Create registry key: MSDRM
- Under this create another registry key: Federation
- Under this add a string value named: FederationHomeRealm
- with a value of: urn:federation:YourDomain.com
So as you can see there are many options for expanding your RMS protection outside the boundaries of your domain or forest. Hope you find this useful!
Just a quick PowerShell script to show you tapes that are offsite ready in your tape library. If you save the below into notepad and save it as a PS1 file then run from DPM management shell this should work with no errors
$AllLibraries = get-dpmlibrary -dpmservername servername
$AllTapes = Get-Tape -DPMLibrary $AllLibraries
$outfile = “c:\DPMScripts\Offsite-Ready-Tapes.txt”
“DPM Offsite Ready Tapes” | out-file $outfile
$AllTapes |sort-object location | Where-Object {$_.isoffsiteready} | format-table location, barcode ,isoffsiteready | out-file -append C:\dpmscripts\Offsite-Ready-Tapes.txt
This PowerShell will output the information needed to a text file in the following location “C:\dpmscripts\Offsite-Ready-Tapes.txt “ which will look like below
DPM Offsite Ready Tapes
Location Barcode IsOffsiteReady
——– ——- ————–
Slot 1 AIS783L3 True
Slot 2 YB2417L3 True
Daniel Davies
Just a quick powershell script to make your tape drive be marked as free. If you save the below into notepad and save it as a PS1 file then run from DPM management shell this should work with no errors
$LIB = Get-DPMLibrary –DPMServerName servername
$Tape1 = Get-Tape -DPMLibrary $LIB
$Tape2 = Get-RecoveryPoint -Tape $Tape1
foreach ($rp in $Tape2)
{
Get-RecoveryPoint -Datasource $rp.Datasource | out-null
Write-host "Removing recovery point $($rp.RepresentedPointInTime) from tape"
Remove-RecoveryPoint -RecoveryPoint $rp -ForceDeletion -Confirm:$false
}
Set-Tape -Tape $Tape1 –Free
Write-Host "This Tape is now free"
You will then see the Tape in the drive marked as Free in the DPM Console
Daniel Davies
Just a quick powershell script to produce a text file of every recovery point on the tapes that are currently in the DPM tape library . If you save the below into notepad and save it as a PS1 file then run from DPM management shell this should work with no errors
Add-PSSnapin “Microsoft.DataProtectionManager.PowerShell”
$AllLibraries = get-dpmlibrary -dpmservername servername
$AllTapes = Get-Tape -DPMLibrary $AllLibraries
$outfile = “c:\DPMScripts\DPM-Tapes-Report.txt”
“DPM Tapes Report” | out-file $outfile
Foreach ($tape in $AllTapes)
{$tape| FL | out-file –append $outfile
$tape| get-recoverypoint | fl | out-file -append $outfile }
This script will output the file to the following location “c:\DPMScripts\DPM-Tapes-Report.txt“ and will give the following output.
DPM Tapes Report
Location : Slot-20
Tape label : Dummy – Primary-LT-1Years-Copy0-00000030
Library : Hewlett Packard MSL G3 Series library (x64 based)
Tape barcode : YB23534643
Offsite Ready : False
Protection Group : Dummy
Name : SystemState
Backup Time : 01/03/2010 20:05:59
Datasource : Computer\SystemState on computer test
Location : Media
Name : SystemState
Backup Time : 01/03/2010 20:07:22
Datasource : Computer\SystemState on computer test2
Location : Media
Name : SystemState
Backup Time : 01/03/2010 20:05:59
Datasource : Computer\SystemState on computer test3
Location : Media
Name : SystemState
Backup Time : 01/03/2010 20:12:38
Datasource : Computer\SystemState on computer test4
Location : Media
Daniel Davies
Recently had an issue with our internal RMS infrastructure where users were not able to RMS protect any documents, email etc. Going through some troubleshooting I found that clients were not going through the bootstrapping process correctly and therefore were not getting the needed XrML RMS certificates …..
So I was able to browse to the certification and license pipelines no problems, AD RMS server was contactable, was seeing the traffic hit the server in the IIS logs some with 403 and 404 errors…Resolution??
If you go to internet options >> Advanced >> Security and then uncheck the two options:
Check for the publishers certificate revocation
Check for the server certificate revocation
Then try and RMS protect content then suddenly bootstrapping process works, you get your certificates and all is good!
The reason for this is if your AD RMS certification and licensing pipelines are using an internal CA to issue a certificate for HTTPS and your client machines cant reach the CRL distribution point it will not allow you to connect! The quick fix is to uncheck the two options specified above and go through the bootstrapping process, you will then be able to protect and consume RMS content. However the correct fix is to ensure the CRL distribution is correct for your CA and accessible for your AD RMS clients
Want to implement AD RMS but already have file servers full of unprotected content? No problem! With the AD RMS bulk protection tool and File Classification Infrastructure this can be achieved. In FCI we can create classifications based on business impact (based on Key words e.g. private, or regular expressions such as National Insurance numbers etc) and have RMS templates applied to classifications as we see fit, oh the power! * This can also continue to apply to additional files uploaded to the file servers each time the File Server Resource Manager rules and file management tasks run (which can run on a schedule) You can also using FCI set a flag to apply to files that have been encrypted with a time stamp and can configure it to send an email to the owner of the file which has been encrypted.
Have SharePoint libraries? Again no problem these can be configured to apply protection based on the NTFS permissions on download from the library, it’s all covered! Automation is the new buzz word within RMS and it continues with Exchange 2010’s automatic protection of emails using transport rules to apply pre-defined templates based on email content or recipients.
*Note – By default only the Microsoft Office suite and xps viewer file extensions can be RMS protected, however IRM’s can be downloaded for hundreds of other file types so nearly all file extensions can benefit from RMS protection!
To RMS or not to RMS? I think the former
