Adobe Reader 10 - Access Denied opening PDF - solved

Some Operational team members moved some data to a Windows 2012 R2 server.
The Citrix Environment is currently in a 'change freeze' and was running 10.0.1.0 of adobe readerX.


When a pdf was opened from network share "access denied"
It could be fixed by untick protected mode.. but then we are unprotected right.

Note: Upgrading the Adobe reader also fixed this issue but 'Change Freeze'

so

Root Cause : Citrix version of Adobe Reader PDF is not trusting any de-duplicated pdf files as they have been “modified”

Process to replicate

1. robocopy  "E:\Data\Group" E:\temp   *.pdf /s  /move
2. robocopy   "E:\temp" "E:\Data\Group"   E *.pdf /s /move
3. [pdf file attribute was A]
4. Forced Dedup Job - Start-DedupJob E: -Type Optimization 
   (note our server was set to MinimumFileAgeDays 0)
5. [pdf file attribute was APL]

so either

Set-DedupVolume –Volume E: -ExcludeFiletype pdf

 or
 Just disabled dedup on this volume.

/thx

Troubleshooting Server unable to look up internal FDQN "result too large", unable to RDP to server, but can browse and read eventlogs

 nslookup internaldomain.local

 Troubleshooting Server unable to look up internal FDQN "result too large", unable to RDP to server, but can browse and read eventlogs

Quick answer: port exhaustion, kb out there to fix this stuff.

nslookup

 internalserver.internaldomain.local can't find internaldomain.local: unspecified error

1. clear dns servers

2. added dns servers in Core Data centre

3. tried different dns servers in nslookup

3a. tried local dns server

4. modified host file with internal.local to server

fail

Check firewall (disable)

netsh advfirewall set allprofiles state off

result:

ok

Check Group Policy

Gpupdate /force

result:

Updating Policy...User Policy update has completed successfully.Computer policy could not be updated successfully. The following errors were encountered:The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: a) Name Resolution failure on the current domain controller. b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

To diagnose the failure, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.

check time

w32tm /query /peers

more nslookup

set debug

internaldomain.local

result

-------------

truncated answer

connect failed: result too large

-------------

check server's services

net stop dnscache

net start dnscache

net stop workstation

net start netlogon

Check Ports!

netstat -a -n

problem located - port exhaustion !!! 10000's of time_wait

----Hotfix Time---- (with bonus hotfix)

Windows6.1-KB2553549-v3-x64

Windows6.1-KB2264080-x64

there is a better rollup available(windows6.1-kb2775511-x64) but my server is not SP1. 

enjoy.

Stuck at "Please wait for the Group Policy client..." on Windows 2008 R2

My fellow workmate and myself were working on a two servers that were recently handed over to us.

These servers had multiple nics. Did the usual checked and also change the network provider order to have the "production" network first, because this it the way I roll.

We both joined the servers to the domain, rebooted and everything was fine, could logon etc.
my workmates server was  Stuck at "Please wait for the Group Policy client..."

So did the usual ; trying to view remote event logs, force a remote shutdown (which didn't work).
Decided that it was the fact that the bind order was stopping the logon from working
(Tried remote netsh, that didnt work remotely for some reason, most likely me)

Solutions to fix the problem to allow logon:
Add the blue cable
Add network cable to all NICs on the box (I dont have physical access to the box)
this should give IP address to all NICs


Disable NICs in BIOS
If you in the BIOS disable network card this might also be a option

Remote Connection and Disable the NIC(S) via netsh

1. download psexec from microsoft
2. connect to remote server psexec \\<servername> cmd.exe
3. perform a netsh interface ip show config or ipconfig /all
4. review the network setup, write down the names of the unused NICs or NICS with 169.254 addresses
5. go and disable the nics for example netsh interface set interface "Local Area Connection 3" DISABLED

make sure you don't disable the NIC you are working off! (of course)

Solution to fix the issue:
 change the network provider order to have the "production" network first,

Trusted Domain Authentication issues

Intermittently we had servers that were unable to authenticate to the secondary domain - noobs
It seem that when the PDC2 was restarted the problem was fixed. I believe the servers switched to back to using PDC1 or another DC and were happy.

The trust was verified, etc but I think this was done on PDC1, started to annoy me... so had a look around.

On PDC1 there is a noobs.domainname secondary zone

On PDC2 Primary DNS is itself Secondary DNS being PDC1

On pdc2  was unable to resolve noobs.domainname
ping noobs.domainname
Ping request could not find host noobs.domainname

nltest /SC_Verify:noobs.domainname
Flags: 80Trusted DC NameTrusted DC Connection Status Status = 1311 0x51f ERROR_NO_LOGON_SERVERS
Trust Verification Status = 1311 0x51f
ERROR_NO_LOGON_SERVERS


[FIX] On Pdc2 Added a conditional forwarder for  noobs.domainname  to pdc1

nltest /SC_Verify:noobs.domainname
Flags: b0 HAS_IP  HAS_TIMESERV
Trusted DC Name \\ExternalPDC.noobs.domainname
Trusted DC Connection Status Status = 0 0x0 NERR_
SuccessTrust Verification Status = 0 0x0 NERR_Success

Cleaning up old Windows Drive

Gettings trusted installer errors when trying to delete C:\windows folder
sooo

first tried rename to windows.old incase it a protected folder  - fail
then..
takeown.exe /F D:\windows.old /R /A
icacls "D:\windows.old" /RESET /T /Q /C
rd "D:\Windows.old" /Q /S
or
for /f %i in ('dir /ad /b') do rd %i /s /q

File Server Error - Windows 8 / windows 2012

While using windows 8 or Windows 2012 was getting Extended Error Connecting to NAS or system error 2148073478 or  ("an extended error has occurred")

Soltuion

Reduce workstation security so that can access NAS, linux file server, etc

HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters

REG_DWORD  RequireSecureNegotiate = 0

Java vs Terminal Server 2003 - CLSID

Users were experiencing a Red Cross for the applet, yet my administrative account was able to load the applet.

Looks like java or the installation process for java is not writing all the registry keys to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFECA-00xx…..

In IE, Java has a catch all applet version – which will always work (aka the latest version)

<OBJECT classid="clsid:8AD9C840-044E-11D1-B3E9-00805F499D93

But most java call specific versions of java (for example).

<OBJECT classid=”clsid:CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA




The server(s) for some reason didn't have all the keys in classes root, where compared to my windows 7 desktop.

I believe the install for some reason is writing the keys to HKCU instead of HKLM \classes...etc.

So fix is to add all the version to HKEY_LOCAL_MACHINE\SOFTWARE\Classes

http://pastebin.com/YhmwPTq7 contains my fix for 1.6u24 version

btw, Monitoring the registry when tick/untick the “use next generation java” in the java control panel, it just write all the entries to HKCU.

wmic “Invalid XSL format (or) file name.”

So on my windows 7 box trying to:

wmic product get /format:csv

produces a output:

Invalid XSL format (or) file name.

Located teh csv.xsl file in C:\windows\system32\wbem\en-US

Guessed that it was unable to locate the xsl format file...

so copied it to the local path and it worked !

Confirmed this with Process monitor :-(

It seems to be looking for the correct locale so I added a C:\windows\system32\wbem\en-US to C:\windows\system32\wbem\en-AU

since we all don't live in the US of A... :-|

Alternative options are:

I just copied to C:\windows\system32\wbem\en-US\*.xls to C:\windows\system32

RDP on Citrix

We have a solution to a couple of issue that has been affecting us when using RDP (MSTSC) via AGEE/Citrx to windows 7 or windows 2008 server.

Issue: Lag Mouse when connecting to Windows 7/2008
Once connected to your RDP desktop:
1. Launch control panel
2. Open ‘Mouse’ control Panel item
3. Select Pointers
4. Change to a theme that doesn’t use AERO
a. For example… (none)

------Regfile----

Windows Registry Editor Version 5.00


[HKEY_CURRENT_USER\Control Panel\Cursors]
"Arrow"=hex(2):00,00
"Help"=hex(2):00,00
"Hand"=hex(2):00,00
"AppStarting"=hex(2):00,00
"Wait"=hex(2):00,00
"NWPen"=hex(2):00,00
"No"=hex(2):00,00
"SizeNS"=hex(2):00,00
"SizeWE"=hex(2):00,00
"SizeNWSE"=hex(2):00,00
"SizeNESW"=hex(2):00,00
"SizeAll"=hex(2):00,00
"UpArrow"=hex(2):00,00
@=""
"Scheme Source"=dword:00000000
"Crosshair"=hex(2):00,00
"IBeam"=hex(2):00,00


[HKEY_USERS\.DEFAULT\Control Panel\Cursors]
"Arrow"=hex(2):00,00
"Help"=hex(2):00,00
"Hand"=hex(2):00,00
"AppStarting"=hex(2):00,00
"Wait"=hex(2):00,00
"NWPen"=hex(2):00,00
"No"=hex(2):00,00
"SizeNS"=hex(2):00,00
"SizeWE"=hex(2):00,00
"SizeNWSE"=hex(2):00,00
"SizeNESW"=hex(2):00,00
"SizeAll"=hex(2):00,00
"UpArrow"=hex(2):00,00
@=""
"Scheme Source"=dword:00000000
"Crosshair"=hex(2):00,00
"IBeam"=hex(2):00,00


Issue: The SHIFT key does not work (sporadic capitals and non-capital letters)– Normally impacts passwords

Change the RDP client settings as follows:
1. Click Options in the Remote Desktop Connection User Interface.
2. Select the Local Resources tab.
3. Under Keyboard > Apply Windows key combinations, select ‘On the local computer’.
After doing this, the SHIFT/ALT/CTRL keys work as expected in the RDP session.
More detail: http://support.citrix.com/article/CTX110281