Rebuilding WID Database for WSUS in Windows Server 2012

If you're using Windows Internal Database (WID) for WSUS in WS2012 and you think you've screwed the configuration, you can force the WSUS to rebuild its contents and database.

Steps:

1. Remove WSUS and WID roles from server manager. Reboot server.
2. Go to C:\Windows\WID\Data
3. Move both "SUSDB.mdf" and "SUSDB_log.ldf" to another temp folder
4. Re-install WSUS server role again

Found a comprehensive guide on http://prajwaldesai.com/troubleshooting-wsus-3-0-sp2-on-windows-server/

Files and Folders Copy with NTFS ACL Preservation

To bulk copy files and folders from one place to another and to preserve ACL permissions and folder structure, an easy way is to use Robocopy.exe like this:

> ROBOCOPY [source] [target] /MIR /SEC /SECFIX 

For example, to copy from local drive source to file share destination, the command should be

> ROBOCOPY D:\Shares \\UNC\Shares /MIR /SEC /SECFIX

How to clear old RMS Templates on FCI

If you're using FCI to perform automatic RMS encryption and you're setting up new RMS server, you'll find both old and new RMS templates appearing on the File Management Task like this:

How to remove and clear away old RMS templates? Clear all files under
C:\ProgramData\Microsoft\DRM\Server\Templates\S-1-5-18

Co-existence: Pre-production and Production AD RMS

We have developers wishing to develop AD RMS applications based on AD RMS SDK 2.1. Any applications developed out of this SDK is considered pre-production until its application manifest are signed with certs from Microsoft (a.k.a moving from pre-production to production).

However, pre-production applications won't work with production AD RMS server and vice-versa. Otherwise, you'll see this error: "Cannot use test manifests against production servers"

Hence, you'll have to follow this guide "How to install and configure an RMS Server" for pre-production. If there is already an existing RMS server in your AD, you've to re-setup this server for pre-production. It would effectively remove the production RMS server and Office RMS would stop working as a consequence. So, how can we make both RMS servers (one production server for Office RMS users and another pre-production for developer) to co-exist?

Our strategy is to setup a separate pre-production RMS server for developers to use that server. Remember that RMS clients would always refer to its registry settings before checking the AD SCP. Have the development PCs manually configured with pre-production server while the rest of Office clients refer to the SCP on Active Directory for the production RMS server.

Assuming that you already have a production RMS server, this is the outline plan:

1. Prepare a new Windows server for AD RMS
2. Prepare the registry settings on the new server for pre-production setup.
3. Unregister existing SCP using RMS administrative toolkit
4. Install the AD RMS role on the new pre-production server
5. On the production RMS server, change the SCP back to its original URL

Hotfix patch needed for existing Windows 7 clients when installing new AD RMS server (WS2012) in Crypto Mode 2

The initial default crypto key length for WS2K8 R2 and Win7 is only RSA 1024. After I setup a new WS2012R2 AD RMS server in crypto mode 2 to replace the old WS2008 RMS server in crypto mode 1, the crypto key length is increased from RSA 1024/SHA-1 to RSA 2048/SHA-256. I have to install this hotfix patch for my Win7 RMS clients to increase crypto key length. There is also another update for Office 2010 clients.

If need be, clear the existing AD RMS client caches as well.

More details on AD RMS Cryptographic Modes.

Installing OpsManager Database on AlwaysOn SQL cluster

According to this Technet link, AlwaysOn database instance is supported for System Center Operations Manager 2012/R2. You'll just need to supply the AlwaysOn Group Listener name and port number to the installation wizard. The first management server will use the Group listener to get the primary SQL instance, and will install the databases on that instance. Subsequently, you can manually add it to a Availability Group.

This method won't work. After a long wait, the wizard will return an error asking you to ensure sufficient permissions. A closer look to the installation wizard logs located at (%LOCALAPPDATA%\SCOM\LOGS\OpsMgrSetupWizard.txt) reveals that the wizard was unable to connect to the hidden drive share of the active SQL host

[13:06:59]: Info: :Info:Creating db path: \\SQL_LIS\D$\MSCMDB\MSSQL11.MSCMDB\MSSQL\DATA\
[13:22:21]: Error: :Could not create valid path: \\SQL_LIS\D$\MSCMDB\MSSQL11.MSCMDB\MSSQL\DATA\: Threw Exception.Type: System.IO.IOException, Exception Error Code: 0x80070043, Exception.Message: The network name cannot be found.
[13:22:21]: Error: :StackTrace:   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost)
   at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)
   at Microsoft.EnterpriseManagement.OperationsManager.SetupCommon.SetupUtils.CreateDirectoryForDatabase(String physicalSqlServerInstance, String localPath, Boolean& createdDirectory)
[13:22:21]: Error: :Error:Could not create the directories for the specified DB Path
[13:22:21]: Always: :Database creation permission check failed for CMDB_AG_LIS\MSCMDB instance

You can try to access the hidden SMB share using the listener name, it won't connect. You'll have to supply the actual active host name to the wizard. Hence, the workable approach should be:

1. Supply active host name to the installation wizard. Complete the installation.
2. Ensure that the Operations Manager console can log in successfully.
3. Rename the database server to the Group Listener name using the same procedure as "How to move Operations Manager database"
4. Restart the OM service.
5. Stop the primary SQL service to force a SQL cluster service move.
6. Start the OM console to check the connectivity.

Direct RDP login into Virtual Desktop Pool with Smart Card (Windows Server 2012)

In my earlier post, I've explored about Single Sign On for WS2012 Virtual Desktop. Normally, we have to login through the Remote Connection Web server. Can we do direct RDP with smartcard logon i.e. bypass RDWeb server? Yes, it's possible.

Open up MSTSC, key in the FQDN of your RD Connection Broker, configure whatever RDP settings and save it into a .rdp file. Open the .rdp file with notepad.

Modify this line (change from 0 to 1): use redirection server name:i:1

Add this line: loadbalanceinfo:s:tsv://[TSV URL]

Substitute the [TSV URL] path with your RD collection name. To find out the exact name, go to Event Viewer of your connection broker server. Look for event under TerminalServices-SessionBroker. Do a normal login via the usual RDWeb console. Refresh and look out for event 800. You'll find the TSV URL information.

Test this by double clicking on the new RDP file.