503 Eror When Configuring CRM 2016 Using PowerShell

When configuring claims / certificates using CRM and PowerShell I was getting the following error:
The remote server returned an error: (503) Server Unavailable
AND
Fail to configure Microsoft Dynamics CRM to use the specified certificate.


I noticed that the Application Pool Service CrmDeploymentServiceAppPool had stopped.


Turns out the service account had Log on as Service enabled but not log on as a batch! Rookie mistake but CRM was working fine (with the AppPool started) so I hadn't noticed it!

Hint & Tip: Rename Networking Adaptors

When renaming network adaptors you can press Tab to skip to the next adapter and rename it instantly!!!!!! No F2 needed! Wowzer!

DPM 2012 R2 Won't Backup System State or Bare Metal Recovery

If you can't backup the system state or bare metal recovery using DPM2012, try installing windows server backup on the affected client :)

Office 365 User Not Syncing to Portal / Duplicate Attributes

Office 365 User Not Syncing to Portal / Duplicate Attributes

If a user isn't syncing to Office 365 (hereby known as O365), the user probably has duplicate attributes. e.g. same e-mail address / proxy address etc

To find the offending item run the following in command prompt:

ldifde -f filename.ldf -d "CN=username,OU=users,DC=domain,DC=com"

open the file and look for objectGUID e.g. yv3teZPLCRijv1MhJ9BeHP==

 

Now open up Azure Powershell and run: connect-msolservice

log on

run

get-msoluser -userprincipalname username@domain.com |fl > c:\sources\username.txt

Open this TXT file

Look for

ImmutableID

This is the O365 version of objectGUID

 

If they are the same, this is probably not causing the sync problem. Investigate other reasons.

If they are different......

 

Open up DirSync (FIM Sync Engine) on the DirSync server

C:\Program Files\Windows Azure Active Directory Sync\SYNCBUS\Synchronization Service\UIShell\miisclient.exe

Go to MetaVerse Search

search for

Source Anchor and the enter the GUID - to see which user is syncing...

Now, on prem, run the following LDIFDE domain dump (yes the whole thing):

ldifde -f domaindump.ldf -d "DC=domain, DC=com"

it may take a long time!

 

Open this file when its completed downloading using notepad++ - normal Notepad will probably crash if you have a large directory.

Now do a search for the objectGUID which is synced to O365, this will show you the offending account that probably has a duplicate mail address.

DPM 2012 R2 Only Administrator Has Permissions to Open DPM Console

DPM 2012 R2 - I had an issue where the only Administrator could log on to the console. There were MMC errors saying the snap-in could not be loaded. I added the appropriate users in to SQL with access to the DPM SQL Database...and it now works! Easy!

DPM 2012 R2 Replica Creation Failed - VSS

To cut a long story short, I had to re-setup a File Server in DPM. The server had been backing up fine before, but when I set up the protection again, the Synchronization Failed with

 

The replica of F:\ on %servername% is inconsistent with the protected data source. All protection activities for this data source will fail until the replica is synchronized with consistency check. 
DPM failed to synchronize changes for  F:\ on %servername% because the snapshot volume did not have sufficient storage space to hold the churn on the protected computer.

 

 

 

I checked the disk space on the server - it has 7TB free!
I ran the usual VSSadmin commands, checked the VSS settings via the GUI, changed the sizes to unlimited etc.
The backup still failed with the same error.



As the server had been in production some time I had a thought...when the server was first set up, Quotas were not configured and they are now.  So I turned off the Quotas and the backup worked!

Broken Windows Server 2012 Cluster

Had fun today with a Server 2012 Cluster.

The Cluster had lost all of its storage. There were errors starting the storage using PowerShell, such "Remote Server has been paused or is in the process of being started."

start-clusternode  -fixquorum is described as a last ditch attempt at getting the Cluster on-line, but it worked.

Now I have the fun task of fixing the storage :)

Adding a new Tree Domain to Your AD Stalls on Preparing AD Schema

Had a fun one today.
Wanted to add a tree domain to an existing AD Forest.
Installed 2012 R2, AD DS, put in all the details...
and the install stalled for hours...nothing happened, just

error 1908 Could not find domain controller for this domain

 

 

Made sure we followed this KB article http://support.microsoft.com/kb/2737935/en-gb

 

 

- but it turns out we did all of this in the first place. Some sites even mentioned putting stuff in the hosts file which was worth a shot, but did not help. Still could not find the domain controller.

 

To fix the problem, reboot.

Log on. Remove the machine from the tree domain you just tried to create and add to a workgroup.

Remove AD DS. Reboot. Remove the computer from AD Sites and Services on your Forest.

 

Now when the machine is back up, add the server to your existing forest. Install AD DS. Run through the set up again. It works. You now have a Tree in a Forest!!!

 

FYI - Part of the setup removes the server from the forest domain (!!!!!!!!!)

.Net 3.5 Installation on Server 2012 (Prerequisite for SharePoint 2013)

I've worked with computers for a long time.
I cut my teeth on NT4. Windows 95.
Then Windows 2000.
Windows 2003 was a game changer, a polished OS that we installed here there and everywhere. After each installation I would copy the CD (I386 files) to the C drive. There would always be one server you were working on that didn't have it (and I would protest that I did not install that one!)
I remember hearing that in Server 2008 those days were gone. Setup would copy the DVD to the C drive for you. Brilliant....

Today I was installing SharePoint 2013 on a Windows Server 2012 box. All RTM versions.

The prerequisite check kept failing for installing the IIS Role. No problem. I can do it myself. It worked. However the prerequisite check STILL failed on IIS.

I then thought, I bet it needs .Net 3.5. Add it in as a Feature. It failed. Turns out, you need to "Specify (an) Alternative Source Path"

 

 

Which actually means you have to type in %dvddrive%\sources\SxS - not even inserting the ISO would sort this one out.

 

Innovation. One step forward. Two back.

 

(oh and don't forget the reboot) :)



Find out Office 2013 Help About Version Number

It's a simple one.

Click File
then
Office Account
then
About

Done.

CRM 2011 / ADFS Renewed Certificates

CRM 2011 is a very particular beast.


I had an issue where the ADFS server was passing the credentials to the CRM box but CRM was not accepting them. A Windows Authentication Box kept popping up then eventually a 401 not authorised error would appear.

The event viewer moaned about a few things, but what's new with CRM?

It turned out that the ADFS Certificates for Token-decrypting and Token Signing, adfs.*.local had expired and my trusty ADFS farm had renewed them for me, because when they were installed we used the switch /autocertrolloverenabled.

However, CRM dislikes not being told about the new cert and requires you to set up Claims and IFD again!
To fix it, I had to follow this process: Obviously do your snap shots first, backup etc

• Open CRM Deployment Manager, Right Click "Microsoft Dynamics CRM" and then click Disable Claims Based Authentication.
• IISReset both front end servers (web farm.)
• Open CRM Deployment Manager, Right Click "Microsoft Dynamics CRM"  and click Configure Claims Based Authentication and follow the wizard (with the defaults as they come from the Database.)
• Then Right Click "Microsoft Dynamics CRM" and click Configure Internet Facing Deployment and follow the wizard .
• IISreset both web servers.
• Cross fingers.
• Cross toes.
• On the ADFS Server, Open ADFS 2.0 Management, Under Trust Relationships click Relying Party Trusts and then right click the URL's and chose Update From Federation Meta Data for all URL's here (relating to CRM.)

CRM 2011 ADFS Time Out

I needed to change the time out for the IFD / ADFS to 10 hours (not as secure as I'd like it!) in CRM 2011.

On the ADFS farm in PowerShell....

Get-ADFSRelyingPartyTrust -Name "externalname.com"

which listed TokenLifeTime: 480....so I changed it to....

Set-ADFSRelyingPartyTrust -targetname"externalname.com" -TokenLifetime 600

CRM 2011 TMG 2010 Error 500 12217

Just installed CRM 2011 published via a TMG box.

Some pages had the 500 Error "the request was rejected by the http filter. (12217)"

Turns out we needed to change the TMG Rule - Under Traffic, then Filtering, Configure HTTP, un-tick the "Verify normalization"

all sorted. good job.

Exchange 2010 SP1 UM Upgrade

Here are a few simple steps to upgrade your UM server to SP

Remove any language pack other than en:US

To find out which ones you have installed, open Exchange Management Shelltype in get:umserver to see what languages you have installed

Then from the source DVD or sources directory run in command prompt
i.e. in my case:c:\sources\exchange%22010\setup.com /removeumlanguagepack:en-gb

Then download and install the following (search for the latest version)
Microsoft Speech Platform Runtime
Microsoft UC MA Runtime x64

Now run the SP1 update!

Afterwards run the UM Language Update (in my case) en:GB

Windows Server 2008 SP1 and More Than 121 LUNS

We have a few large servers here that require more than 121 LUNS in a mount path scenario.

Guess what? Windows Server 2008 SP1 has a bug and can only handle 120 LUNS. What happens is the Performance Counter crashes (!) which prevents the installation of certain software, namely Microsoft Exchange 2007 SP1. The only way of getting a work around is to turn off the Disk Performance Counter using the tool Exctrst. However, this means that we can no longer monitor Disk Performance!
Looking forward to seeing whether SP2 (which RTM earlier this week) fixes the problem...

Windows Update Error 80072EFD on Server 2008

I just installed a Windows Server 2008 Enterprise box for a SCOM R2 implementation we are working on. To finalise the installation I did a Windows Update and got the error 80072EFD and nice litle error message.

After a bit of research I found some posts about adding *.microsoft.com to trusted sites,. but that didn't work.

The next thing I tried was adding a proxy address to Internet Explorer, browsing to a site (and getting an error) and then removing it and trying again...and it worked! Phew...

Google Guilt

Hello and welcome to Google Guilt. I'll explain a little bit on why I have created this blog. I work in IT in the UK and often use Google to help solve many technical problems I have with computers in general, and specifically Microsoft software amongst other things.

I use Google every day to solve the problems I encounter, however the problems I solve myself never get to see the light of day as I'm too busy / too ignorant to post them up on the Internet, until now! Enjoy!