Son of Friday the 13th

I had the third worst day of my IT career yesterday, and it wasn't even anything I had done, knew about or was even expecting.

I suppose the 2 or 3 things I learned from the experience and that is at the end of the day what it is all about are as follows;

1. Never ever trust the trustworthy - A KVM, brand new and out of the box, worked fine on another 3 connected machines caused a new server to hang on boot-up, it never got past the black Server 2003 splash screen.

2. SQL ain't easy - The server in question was hosting a VM machine with SQL on it, all set, configured, patched and ready. It was a temporary fix while their new funky DL580 comes in. Of course with the host machine hanging, SQL had to be installed onto a new machine, one of the other servers on site.

3. When all else around you goes to pants Exchange wants to join in - Exchange always the trustworthy, was obviously feeling left out from all of the attention the new server was getting so it decided to throw a few wobblies.

I suppose the important things again are the lessons learned and what I can take from it and carry forward so here are some of them

Recovering deleted emails from Outlook;

The obvious way, click on deleted items, click on tools, recover deleted items.

A second way, exmerge out the mailbox and import the pst file to another, possibly administrator account and try the following
locate the pst in an easy accessible location
From the command line type the following lines, it corrupts the pst enough for scanpst to run on it

DEBUG C:\fullpath_to_pst\OutlookFile.PST
- f 107 113 20
- q

then find scanpst.exe, it can be in a few places,
Office 2003 it will be in \program files\microsoft\office 12\scanpst
Office 2000 \Program Files\Common Files\System\Mapi\1033

I was told on lots of occasions not to use SA authentication is SQL as its an easy attack, SQL programmers don't use decent passwords. So I installed SQL using windows authentication thinking I was doing good. I generated a new SQLAdmin account and gave it all the permissions I though it would need, knowing I could remove any necessary permissions etc ( I made it an administrator, domain admin etc). But no a SA account was needed and yes they don't really use strong passwords do they.

So to change Authentication mode on a SQL 2005 back to mixed mode and using the SA account follow this helpful article from Microsoft.

http://msdn2.microsoft.com/en-us/library/ms188670.aspx

And now for a whole new day of new problems.

Ain't google spell checking great!

Large File Copy

Got this from a friends blog, mention of using esutil to copy large files;



http://ultankinahan.spaces.live.com/



The full article is here;



http://blogs.technet.com/askperf/archive/2007/05/08/slow-large-file-copy-issues.aspx



It mentions that eseutil is a better option for moving large files, yet someone on the above mentioned they tried to copy a 2GB file and it was slower. On the grand scheme of things I would not consider a 2GB file a large file, anything over 50GB is a large file. Migrating data from an old server to a new server generally means min file size of 10GB and normal 'Drive' backup files of 40 to 80GB at time.



I've never seen Exchange fail to move its database file from one drive to another, so I'm hopeful that tomorrow I'll try out using eseutil to move a 40GB file off a NAS onto a server and see what happens.

Swing Migration

I've been busy between different jobs recently and I keep misplacing my notes, so hopefully if I put all these things in the one blog, with some sort of standard tag I'll find them all the time.

Several issues that I had on today's swing are new, some are old, and some are just plain odd.

I had to start the w32time service
I had to start the Ismserv service

I was getting several errors in the event logs, 1722, 1815, and a few more, my notes are on site so hopefully tomorrow I'll edit this better.

The Windows Firewall started on both servers at several occasions, even though I had stopped the service.

I had to kick start several services in an attempt to get replication to start, the ones that had the biggest effect were as follows
net stop netlogon
net start netlogon
net stop ntfrs
net start ntfrs
repadmin /kcc this will get the KCC to try to start a connection and hopefully start replication

Even though I tried rebooting the swing server several times, the GC still would not start replicating for me. I went back to my notes and did the following;
Removed the GC option from the swing server, reboot the server, turn on the GC option, and then depending on if your a belt and braces person, reboot the server.
Hopefully the Directory Services event log will give you event ID 1110, which means that you may well see event 1119 5 minutes later.

Odd little bits

All stuff that you know, but all handy.

Shutting down a server or pc from another pc;
Use Computer management, either your own machines 'manage' or a mmc and computer management, choosing a remote server or pc.

Right click on the computer, advanced, startup and recovery, shutdown and REMEMBER to use restart, especially if your remote.

Sometimes, a server is locked, or otherwise madly locked up, and the above option won't work try the following;

open a command line, and type the following
shutdown /f /m \\swing (your server or pc name) /r
/f force
/m this is a remote machine, followed by \\ and then the machine name
/r shutdown and re-start.

Software - Antivirus

NoNav;
http://www.mickelson.org/files/zips/nonav.zip

A way to delete Norton/ Symantec Antivirus. To date I haven't tried this product yet, but tomorrow will see it in use.

On previous occasions I've used MSIZap.exe ;
http://support.microsoft.com/default.aspx?scid=kb;en-us;290301

I've generally used this in conjunction with the registry cleaning instructions from Symantec to remove their product;
http://entkb.symantec.com/security/output/n2002031914291648.html

I have found on occasions thought that unfortunately sometimes the best thing to do is copy out the user data and re-install the OS, if you spend more than 3 hours trying to fix a client machine, you better have a good reason to want to keep it.

Joe