Reverse lookup of AD SID

Netapp's data ONTAP OS has this nice command...

cifs lookup textual_sid_S-x-y-z

The cifs lookup command translates a Windows NT user or group name into its corresponding textual Windows NT SID (Security ID), or a textual NT SID into its corresponding Windows NT user or group name.
domain\name is the name of an account in a specified Windows domain. If the domain is omitted, then the name is looked up in the domain in which the Filer is a member server. Conversely, given a Windows Security ID (SID), cifs lookup will return the corresponding account name.

Reference:
http://www.wafl.co.uk/cifs_lookup/

The EXECUTE permission was denied on the object ‘xp_prop_oledb_provider’, database ‘mssqlsystemresource’

How to Fix this?

1.Map the User to MASTER Database( By Def. It will be added to Public Role)

2.USE MASTER

GO

GRANT EXECUTE ON SYS.XP_PROP_OLEDB_PROVIDER TO LOGIN

 

Reference:

http://mssqltrek.com/2011/12/05/the-execute-permission-was-denied-on-the-object-xp_prop_oledb_provider-database-mssqlsystemresource/

 

 

Netbackup jobs failing with 48 status code

To resolve, check the hostname resolution from media server to client and vice versa.

Try below from media to client and client to media:

• Bpclntcmd -hn clientname
• Bpclntcmd -ip client ip
• Bptestbpcd -client clientname

If there is name resolution issue, resolve it.  Ie. put entries in HOSTS file, etc...

If changes have been made recently, remember to clear NBU host cache - even on client:

• bpclntcmd -clear_host_cache
• also clear ipconfig /flushdns

SQL 2008 Cluster installation fixes

Spent all day working on trying get one named instance of SQL 2008 installed on a Win 2008 R2 cluster.

Anyway, these are the things I encountered:

• SQL server 2008 failover cluster 'RequireKerberos' error;  The fix was to slipstream SQL 2008 SP1 into the installation process
• SQL cluster resource would not startup at end of installation; Name resource could not come online.  The fix was to give cluster computer name FULL CONTROL of the virtual instance names in Active Directory using ADUC.
• Verification check prior to installation would fail and not allow me to install SQL.   After manual verification that things should be ok, I used this command "setup /SkipRules=Cluster_VerifyForErrors /Action=InstallFailoverCluster /PCUSource=c:\SP1" to finally start up the installation process.

References:
http://trilist.blogspot.com/2010/02/fix-sql-server-2008-failover-cluster.html

Controlling issuance of RDS CALs

Problem:
Running out of RDP licensing for your terminal servers.  Win 2008 & Win 2008 R2 licenses.  You need to restrict/control what servers are allowed to get RDP licenses from the your pool of licenses. 

Solution:
On the license server, there is a local security group called Terminal Server Computers.  Add the client servers (computer names) that are allowed to get RDP licensing for their clients to the security group.  Once all the servers are in the group, enable policy "License server security group" found in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\RD Licensing using GPEDIT.MSC. 

Caveat:
This solution should only be done when Licensing server is a domain member.

Reference:
http://technet.microsoft.com/en-us/library/cc725704.aspx

Configuring multiple SSL DNS URLs for same IP/port in IIS 7.5

Basically, you have a website that has to be SSL enabled, but different URLs for different groups of users.  Ie. internal company users might use www.abc.edu vs external might use www.abc.com, or whatever. 

To do this, you need a SAN Certificate (Subject Alternative Name Certificate).  A SAN cert allows for multiple domain names to be protected with a single certificate.

The SOP to generate it is below in the reference.  Send the certreq file to your preferred CA (Certificate Authority) and they will send back a SAN cert.  Bind that new cert to your SSL binding for the website and either any and all URLs in the SAN cert will work as a SSL link.

Adding another DNS to the SSL, would require a new SAN cert be generated with all the valid DNS' listed, including the new one.

Reference:
http://blogs.msdn.com/b/andrekl/archive/2008/09/24/how-to-generate-a-csr-for-an-iis-website-using-the-windows-vista-server-2008-certificates-mmc-plugin.aspx

http://blogs.msdn.com/b/varunm/archive/2013/06/18/bind-multiple-sites-on-same-ip-address-and-port-in-ssl.aspx

How to remove cluster warning: ESXi Shell for the Host has been enabled

When taking Vmware ESXi hosts out of maintenance mode, I used to see this all the time.  You can ignore if you know that you have the shell enabled, but found this method to suppress the warning...

Reference:
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2003637