CertificationsCategoriesRSS |
Monday, November 24. 2008Revisiting the Windows 2008 cluster creation failure of "The parameter is incorrect"
A few months ago I blogged about a particular situation with cluster creation under Windows Server 2008. Typically, as long as the cluster validation tool passes, cluster creation completes successfully. However, in our case, the issue ended up getting escalated all the way up to the clustering group at Microsoft.
Strange as it might seem, the root cause was the fact that the root of Active Directory had too many individual ACLs assigned. These were inherited by every object further into the AD tree structure, as long as inheritance wasn't blocked. AD has an architectural limit of 64K ACLs per object. The cluster creation process needed to assign a few more ACLs to the newly created computer object and this hit the limit of Active Directory. At the time, we were the 5th case in the world to have something like this to happen, but those cases were still unresolved. Due to the numerous TTT (Time-Travel-Trace) dumps of the cluster creation process before, during and after the failure, we were able to nail the root cause with Microsoft PSS. The deceiving part of all of this is that it was not readily apparent that this "ticking time bomb" of a problem existed. After a certain amount of ACL entries (I suspect around 2000), "Active Directory Users and Computers" will not show any additional ACLs. Only after removing duplicate/unneeded ACLs, more would show up in the console. Using ADSIEDIT.msc directly would show all the entries, but I like to tread lightly at customer sites when I can. Once the ACL entries were cleaned up, the showstopper issue of "The parameter is incorrect" went away and we could create the cluster. Months later, either as a fluke or as an emerging issue overall, this happened at another customer site with a different group of engineers within our organization. They already had a case open with Microsoft PSS but thankfully how we fixed the problem at the other site allowed us to fix the error and close the issue before PSS could dig into this issue. The common denominator, software-wise, at both companies? The use of Bindview. It might be a fluke, or it might be a case of "Bindview gone wild" with creation of excess ACLs. Hopefully, someone out there will benefit from this information. If you run into this error, especially with Bindview, I'd like to hear about it. Here are the notes from PSS on the case, if you are curious: ISSUE: - The existing DACL on the computer object is near the size limit of an ACL (65532) - Cluster Setup adds an ACE to the DACL, which exceeds the size of an ACL but ADSI Security Descriptor objects do not check for this limit. - Cluster Setup builds the ADSI Security Descriptor (including the new ACE added by Cluster) and then attempts to overwrite the existing ADSI security descriptor of the computer object with the new ADSI Security Descriptor using the PUT method (of the IADS computer object) and passing the "ntSecurityDescriptor" attribute and the variant of new ADSI Security Descriptor. - The PUT method converts the IADS Security Descriptor and its sub components to native Security Descriptors and Access Control Lists - The native Windows API for ACL creation checks the requested size limit against the max size limit of 65532 and fails returning STATUS_INVALID_PARAMETER RESOLUTION: - Remove the number of ACEs within the original Security Descriptor protecting the computer object to allow Cluster Setup to add the required ACE and still be within the maximum size of the ACL Go green(er) with Windows 7 and powercfg -energy
Windows 7 has a new power management debugging option built into powercfg.exe that can be used to expose potential power hogging drivers and configuration issues that could be eating away at your battery life and driving up your power bill.
![]() As the description states, it is best to run while the system is idle, much like the WinSat "Windows Experience Index" process. Running powercfg -energy, you end up with results like this: Enabling tracing for 60 seconds... Observing system behavior... Analyzing trace data... Analysis complete. Energy efficiency problems were found. 21 Errors 17 Warnings 10 Informational Using the default options, a file called energy-report.html will be created in the current directory from which powercfg.exe execute and gives you a snapshot of your system energy consumption over a 60 second period. My laptop's report during idle was not particularly interesting, so here is an example of energy-report.html while my system was under light load with the usual devices I have plugged in my docking station. I seem to have many Suspend unfriendly USB devices. Update to Mitigate MS08-037 UDP Behavior Across NAT for Microsoft ISA Server 2006
This update causes ISA Server to use random source ports for UDP sessions created by access rules which serve hosts in networks for which ISA Server defines a network address translation (NAT) relationship.
This update resolves the issue described in Microsoft Article 956910, DNS queries that are sent across a firewall do not use random source ports after you install security update 953230 (MS08-037). With this update, ISA Server allocates a large set of random UDP ports and then selects a port from this set for use in new UDP sessions. You can disable it programmatically (there is no user interface). Windows 7 and VMWare Workstation 6.5.1 still have networking issues
Just a quick FYI which I expect to be resolved in future builds (post-PDC/etc), but for right now, networking of guest VMs in VMWare Workstation 6.5.0 and 6.5.1 is rather broken. I have some workarounds/hacks that I will document when I get a moment but they aren't pretty, but they at least get working networking.
There are also some issues with guest USB support, but considering W7 isn't even considered beta yet, the fact that this is the only piece of software I use everyday that doesn't work 100% correctly for me, compared to Vista, is pretty good. Using a USB-over-network solution seems to work as a workaround for the USB issue - yes, I go to extraordinary lengths to self-host new operating systems, but it is worthwhile in the end. If I had permission from my wife and kids, they would all be running W7 right now on their machines and we'd have a 100% W7 house. For now, it is just the machines I control. Thursday, November 20. 2008Exchange 2007 SP1 Update Rollup 5 - fixes the multiple diversion header issue and Server 2008 web-based OAB distribution issue plus many other fixes.
There have been three bugs in Exchange 2007 SP1 that have been a thorn in my side for a few months now and they are finally fixed in RU5, which can been downloaded here.
#1: KB 949968 - Unified Messaging does not handle the diversion header correctly in Exchange Server 2007 Service Pack 1. I originally posted about it here a while ago. Sweet! #2: KB 954197 - Exchange 2007 CAS cannot copy the OAB from the OAB share on Windows Server 2008-based Exchange 2007 CCR clusters. #3: KB 957978 - The OAB generation is unsuccessful and Event IDs 9328 and 9373 are logged in the Application log in a Windows Server 2008-based Exchange 2007 Single-Copy cluster environment. Of course, there are many other fixes listed in KB 953467, but these are the ones I keep running into out in the field! Tuesday, November 18. 2008KB 957692 - Cumulative post-SP1 Outlook 2007 update - October 28, 2008 - Performance and scheduling improvements
This hotfix package fixes the following issues that are not previously documented in a Microsoft Knowledge Base article:
In Outlook 2007, you open a Rich Text format (.rtf) e-mail message that has a Word 2007 document attached. When you do this, Word 2007 may stop responding. Additionally, the Opening Mail Attachment dialog box appears unexpectedly behind the Word 2007 window. In Outlook 2007, data will be saved to disk on a schedule. In this case, Outlook 2007 may stop responding for several seconds when the data is written to disk. Consider the following scenario: You add a delegate for an Outlook 2007 mailbox. You enable the "Cache Shared Folders" feature for the mailbox. In this scenario, when the delegate tries to open an appointment in the Calendar, the delegate may receive the following error message: Cannot open this item Outlook 2007 may stop responding when you de-select a shared calendar in the navigation pane. Microsoft Windows has predefined colors that are used for many elements on the screen. For example, there is a predefined color for the background of all windows and a predefined color for the text for all windows. You can specify a custom color for the background for all windows and for the text for all windows. However, after you do this, some applications still use the predefined colors instead of the custom colors for the background of all windows and for the text for all windows. This problem may occur in Outlook 2007. In Outlook 2007, when you try to send a calendar by using an e-mail message, the Free/Busy information in an iCalendar Format (.ics) file that is attached to the e-mail message is correct. However, the Free/Busy information in the body of the e-mail message is incorrect unexpectedly. In Outlook 2007, a user has a managed add-in installed. This managed add-in is listening to an Application level event. As a meeting organizer, the user sends a meeting request to an attendee. Then, the organizer opens the meeting appointment to make some changes. After that, the organizer clicks Send Update to try to send the meeting update. During the sending of the meeting update, the organizer cancels the send and clicks Don't save changes. In this scenario, a meeting update is sent to the attendee unexpectedly. Additionally, the changes to the meeting appointment are also saved in the organizer's calendar. Outlook 2007 stops responding when you try to print a calendar in the monthly style. This problem may occur if the Print exactly one month per page check box is not selected in the Page Setup: Monthly Style dialog box. When you try to delete lots of messages in Outlook 2007, only some selected messages are deleted. Some messages still remain in the original folder unexpectedly. When you use the Outlook object model to programmatically delete multiple attachments from an e-mail message that is in the Rich Text Format, you may receive the following error message: Operation failed If you have two overlapping appointments for the same day in Outlook 2007, the Busy information appears only for the first appointment. This problem occurs when the overlapping appointments start at the same time. You open any one of the occurrences for a recurring meeting in Outlook 2007. When you try to open another occurrence for the recurring meeting, you may receive the following warning message: Cannot read one instance of the recurring appointment. Close any open appointments and try again, or recreate the appointment When you close this warning message, you receive an Open this occurrence dialog box or an Open the series dialog box. Consider the following scenario: You receive a meeting request from a meeting organizer in Outlook 2007. You are in a time zone that differs from the time zone of the meeting organizer. In this scenario, when you try to propose a new time for the meeting request, you notice that the Propose New Time dialog box uses the meeting organizer's time zone unexpectedly. After you apply the hotfix, the following changes occur: The Propose New Time dialog box uses the meeting attendee's local time zone as expected. The meeting attendee sees the time zone controls are shaded for the meetings. As a meeting attendee, you can view the time zone information. However, you cannot change the time zone. As a meeting attendee, you cannot change the meeting to an all day event. In Outlook 2007, you open your calendar and a shared calendar of another user in the Day view that has Daily Task List shown. When you resize Daily Task List in the Day view, you notice that the main and shared calendars are offset vertically from the list of times on the left side of the calendars. In Outlook 2007, you save an e-mail message that contains an attachment as an Outlook Message Format (.msg) file. When you open the .msg file and then try to save the attachment, you experience one of the following issues: If the attachment that you try to save is an Outlook e-mail message, you receive the following error message: A resource is busy or you lack sufficient access rights or permissions If the attachment that you try to save is another kind of document, such as a Word document or an Excel workbook, nothing occurs. An InfoPath 2007 form template contains Check Box controls and Option Button controls. The form template also has a data connection for submitting the form data to a specific recipient by using an e-mail message. In this case, when users submit the forms, the recipient receives the e-mail messages that have the submitted forms attached. When the recipient opens the submitted form in Outlook 2003, the controls may be displayed incorrectly as the telephone icons. Word 2007 may stop responding when you use Mail Merge to send personalized e-mail messages to an e-mail address list that contains a large amount of recipients, such as 10,000 recipients. When you attach a file to an Outlook 2007 e-mail message, the icon of the attachment may not be displayed as expected. In Outlook 2007, you receive an encrypted e-mail message that contains a large attachment. When you try to open the message, you experience slow performance in Outlook 2007. You also notice that the CPU usage is at 100%. You are running Outlook 2007 in non-Unicode mode. In this case, when you expand the distribution list in a new e-mail message, you may experience any one of the following symptoms: No names are expanded from the list. The names expanded from the list are populated with semi-colons. When you try to post a reply to a discussion board by using Outlook 2007, you may receive the following error message: You cannot make changes to contents of this read-only folder. Monday, November 17. 2008Official Windows 7 Preview ATI Radeon drivers
If you are looking for Windows 7 Radeon drivers, go to ATI's site here. They work well so far from what I can tell. You can also modify them with Driver Heaven's Mobility Modder in case your mobile chipset isn't quite "officially" supported.
Considering the in-box driver in the recent builds of W7 dates back to 2006, it is nice to be able to take advantage of the newer display drivers. Thankfully, there will be no radical driver support changes between Vista and W7, so Vista drivers should work with W7 without any changes. I have yet to find a device that has a Vista driver that does not work under W7. With that said, I've finally been able to abandon the WIDCOMM/Broadcom Bluetooth stack for good and rely on the in-box Bluetooth stack. It is much improved. Ditto for HDMI/HDMI audio support. Sunday, November 16. 2008KB 956389 - Office Communications Server 2007: November 2008 - mostly for interop between R1 and R2
This update package fixes the following issues:
KB 958560 - When a Communicator 2007 user calls a Conference Auto Attendant access number, the call always uses Mediation Server instead of going to the Conference Auto Attendant directly KB 958561 - Communications Server 2007 R2 remote users cannot make public switched telephone network (PSTN) calls when Communications Server 2007 servers or proxies are in the call path Although not well documented yet, you will need to the October 2008 Communicator update to be able to interact with OCS 2007 R2 servers and users. Forefront Client Security v1 standalone GPO .ADM available - great for FCS installations without a management server backend
There is now an end user created Forefront Client Security v1 Group Policy Object (GPO) available for use for setting Forefront Client settings without a back-end management server involved. Most commonly called a '/nomom' installation because the client is installed without a management server specified on the command line. This is also ideal for non-domain joined computers and you want to lock down settings locally.
Originally spotted here talking about a Technet message forum post here. You can download the .ADM file here. Tuesday, November 11. 2008Lots of Windows 7 posts and other goodies coming soon |
