How to Upgrade Forefront Unified Access Gateway (UAG) from RTM to SP2

If you have an RTM install of Microsoft Forefront UAG 2010 and want to upgrade to the latest Service Pack 2 it isn't the easiest or most direct process.  You have to jump through a few hoops, and in my case I had errors that prevented me from even running the install, including "Setup failed during Forefront UAG prerequisites installation", and a simple error 1603 saying check the logfiles which weren't helpful.  Eventually, this was my process, i hope this saves somebody else some pain and suffering.



The updates are not cumulative, so to get to UAG SP2 from RTM you must install UAG SP1, then UAG SP1 Update 1, then Threat Management Gateway Service Pack 2 and THEN UAG SP2.

1. Open UAG Manager, and edit any portal sites you have provisioned and make sure the download and upload policies are not set to Sharepoint or CRM specific policies.  I set mine to always for now, and made a note to go back and fix those later.
2. With Service Pack 1 downloaded I was not able to run it directly, I had to extract it using this command: 
1. UAGSP1_KB2285712_ENU.exe
3. Then from an admin command prompt launch the UAG-KB2285712-ENU.msp patch file.
1. Once the install is done restart your server.
4. Once it reboots log in, open an admin command prompt, and install the SP1 Update 1 UAG-KB2585140-v4.0.1773.10100-ENU.msp
5. Open UAG Manager and export the configuration, you will need it later.
6. Stop all of the Forefront services, and then install the TMG SP2 update from the admin command prompt
7. Then install UAG SP2: UAG-KB2710791-v4.0.2095.10000-ENU.msp from the admin command prompt
8. In my case the schema did not work, the server was effectively blank.  Therefore I had to use the UAGSchemaUpgradeUtil.exe file found in common\bin on the exported copy of the configuration to fix everything.  According to the technet article an in place upgrade shouldn't require this, but in my case it did.
9. Then re-assign your upload and download policies, and test everything to make sure your upgrade went smoothly.

HTH!

Credits:
How to fix error 1603
http://social.technet.microsoft.com/Forums/eu/forefrontedgeiag/thread/965f29fd-d7ec-44ab-b5ab-609eb24dc8fc

How To Create a Windows 8 Unattended Answer File For [WDS] Silent deployment

If you want to deploy Windows 8 silently (ex: by using Windows Deployment Services) you will need to create an answer file (aka unattend.xml).

Here are the steps I followed:

1. Install the Deployment Tools feature included in the Windows Assessment and Deployment Kit for Windows 8.
2. Extract your Windows 8 ISO
3. Launch the Windows System Image Manager
4. Under Windows Image right click and select a windows image, navigate to the sources\install.wim file from your extracted ISO or your DVD
5. It will ask you about creating a catalog of the image, say yes
6. Once that is done, under Answer File right click and select new answer file
7. Drag Microsoft-Windows-Shell-Setup_neutral to the "4 specialize" section
1. Enter your product key
8. Drag Microsoft-Windows-International-Core_neutral to "7 oobeSystem"
1. Set InputLocale to 0409:00000409
2. SystemLocal, UILanguage, and UserLocal all to en-US
9. Drag Microsoft-Windows-Shell-Setup_neutral to "7 oobeSystem"
1. In order to make the installation completely silent and not need any user interaction, under OOBE set each of the following to true: HideEULAPage, HideLocalAccountScreen, HideOEMRegistrationScreen, HideOnlineAccountScreen, HideWirelessSetupInOOBE
2. Set NetworkLocation to Work
3. Set ProtectYourPC to 1 (This enables windows update with recommended settings)
10. If you do not specify a local account in the answer file you will be forced to create one during image deployment, so be sure to create a new Local Account under UserAccounts -> LocalAccounts
1. I have found that you can create a new account that is the same name as one that is already in the image for simplicity
11. If you need to join to a domain, drag Microsoft-Windows-UnattendedJoin_Neutral to "4 specialize"
1. Set your domain name in JoinDomain, set UnsecureJoin to false
2. Enter credentials with domain join privileges -- **They WILL be stored in plain text in the file

Save your unattend.xml file.  At this point if you are using WDS you can select the image in the WDS console and attach the unattend.xml file to that image.

If you want to slip the unattend.xml file in to the image itself, copy it to c:\windows\system32\sysprep, and run sysprep like this:
sysprep /generalize /oobe /shutdown /unattend:c:\windows\system32\sysprep\unattend.xml
*I chose not to do it this way so i could easily update the unattend file without having to rebuild my image.

And here is my answer file:

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <InputLocale>0409:00000409</InputLocale>
            <SystemLocale>en-US</SystemLocale>
            <UILanguage>en-US</UILanguage>
            <UILanguageFallback></UILanguageFallback>
            <UserLocale>en-US</UserLocale>
        </component>
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <AutoLogon>
                <Password>
                    <Value>removed</Value>
                    <PlainText>false</PlainText>
                </Password>
                <Enabled>true</Enabled>
                <LogonCount>1</LogonCount>
                <Username>admin</Username>
                <Domain>removed</Domain>
            </AutoLogon>
            <OOBE>
                <HideEULAPage>true</HideEULAPage>
                <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
                <HideOnlineAccountScreens>true</HideOnlineAccountScreens>
                <ProtectYourPC>1</ProtectYourPC>
                <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
                <NetworkLocation>Work</NetworkLocation>
                <HideLocalAccountScreen>true</HideLocalAccountScreen>
            </OOBE>
            <UserAccounts>
                <AdministratorPassword>
                    <Value>removed</Value>
                    <PlainText>false</PlainText>
                </AdministratorPassword>
                <LocalAccounts>
                    <LocalAccount wcm:action="add">
                        <Password>
                            <Value>removed</Value>
                            <PlainText>false</PlainText>
                        </Password>
                        <Description>admin</Description>
                        <DisplayName>admin</DisplayName>
                        <Name>admin</Name>
                        <Group>administrators</Group>
                    </LocalAccount>
                </LocalAccounts>
            </UserAccounts>
        </component>
    </settings>
    <settings pass="specialize">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <ProductKey>XXXXX-XXXXX-XXXXX-XXXXX-XXXXX</ProductKey>
            <RegisteredOrganization>removed</RegisteredOrganization>
            <RegisteredOwner>removed</RegisteredOwner>
            <ComputerName>*</ComputerName>
        </component>
        <component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <Identification>
                <Credentials>
                    <Domain>removed</Domain>
                    <Password>removed</Password>
                    <Username>removed</Username>
                </Credentials>
                <JoinDomain>removed</JoinDomain>
            </Identification>
        </component>
    </settings>
    <cpi:offlineImage cpi:source="wim:c:/isoextract/sources/install.wim#Windows 8 Enterprise" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

How to send email "from" another user in Outlook 2013

I've seen a few people run in to this:

If you have permission to send on behalf of another user in Exchange, and would like to send from that user from Outlook 2010 or 2013, it's quite simple.

1. Open outlook
2. Create a new email message
3. Click the Options tab
4. Click the "From" button
5. In the From: dropdown above To: select the account you would like to send from

Windows Failover Cluster Live Migration Failures with Hyper-V 2012

After moving from one datacenter to another we started experiencing issues live migrating virtual machines from one host to another in our 2 node failover cluster.  The migration would instantly fail, and there would be no error other than:
Live migration of 'Virtual Machine VMNAME' failed.

If I did a quick migration it works, but live did not.  I started looking at the security logs of the hosts and noticed some intermittent errors:

An account failed to log on.

Subject:
Security ID: SYSTEM
Account Name: HYPERVHOSTCOMPUTER$
Account Domain: OURDOMAIN
Logon ID: 0x3E7

Logon Type: 8

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: HYPERVHOSTCOMPUTER
Account Domain: OURDOMAIN.com

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC000006A

Process Information:
Caller Process ID: 0xd30
Caller Process Name: C:\Windows\Cluster\rhs.exe

Network Information:
Workstation Name: HYPERVHOSTCOMPUTER
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi  
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Then I noticed errors in the cluster itself, at the same times:

Cluster network name resource 'Cluster Name' failed registration of one or more associated DNS name(s) for the following reason:

The handle is invalid.

.

Ensure that the network adapters associated with dependent IP address resources are configured with at least one accessible DNS server.

I looked at a domain controller and noticed a lot of Audit Failures for that computer object.  I opened the computer object in ADSI Edit, and noticed that the last login was 11/23 (the day we moved), and the last password reset was 11/24, which is incredibly odd.  The last bad login attempt was a few minutes ago.  I'm not sure how, but I think a password reset may have been attempted while the domain controllers were unavailable.

How I fixed it:

1. Open Failover Cluster Manager
2. Navigate to Cluster Core Resource
3. Right click on the cluster network name and take it offline
4. Right click on the cluster name and navigate to more actions -> repair

A few seconds later the cluster was repaired, I turned the cluster name back on and live migrations work.

Mystery solved.

HTH!

Auto Provision Lync 2010 Users Via LDAP

We have tools that automatically create Active Directory Users, Exchange mailbox, and Microsoft Lync 2010 accounts to simplify the hiring process.  I figured somebody might find this information useful, so in order to provision a user for Lync 2010 automatically I use a slightly altered version of this (in perl, using Net::LDAP):

use Net::LDAP;


$ldap = Net::LDAP->new("ldap://domain.local", debug =>0) or die("Could not connect to LDAP server.");
my $mesg = $ldap->bind('myUserDN',
password => 'myUserPassword')  or die("Could not bind to LDAP server.");

 $mesg = $ldap->search( # perform a search

base   => "dc=domain,dc=local",

filter => "(&(samAccountName=$username))"

  );

$mesg->code && die $mesg->error;

#there should only be one result in here anyway

foreach $entry ($mesg->entries) { 

$userdn = $entry->dn;

}

$rtn = $ldap->modify($userdn, replace => { "msrtcsip-userenabled" => "TRUE"});
$rtn = $ldap->modify($userdn, replace => { "msrtcsip-optionflags" => "449"});
$rtn = $ldap->modify($userdn, replace => { "msrtcsip-primaryhomeserver" => "CN=Lc Services,CN=Microsoft,CN=1:1,CN=Pools,CN=RTC Service,CN=Microsoft,CN=System,DC=domain,DC=local"});
$rtn = $ldap->modify($userdn, replace => { "msrtcsip-primaryuseraddress" => "sip:$email"});
$rtn = $ldap->modify($userdn, replace => { "msrtcsip-line" => "tel:+$astextension;ext=$extension"});
$rtn = $ldap->modify($userdn, replace => { "msrtcsip-deploymentlocator" => "SRV:"});
$rtn = $ldap->modify($userdn, replace => { "msrtcsip-federationenabled" => "TRUE"});
$rtn = $ldap->modify($userdn, replace => { "msrtcsip-internetaccessenabled" => "TRUE"});
$rtn = $ldap->modify($userdn, replace => { "msrtcsip-userpolicies" => [("21=7", "0=1434923910")]});

You may find it best to provision a user the way you like, open the user in ADSI Edit to see all the parameters, and adjust this accordingly.  

That said, this should set you off in the right direction for how to fully provision a Lync user automatically.

Automatically add Remote App connector via command prompt in Windows 8

We've been using the Install-RADCConnection.ps1 (I don't remember where I came across it) script to add the remoteapp connector in Windows 7, but it doesn't work properly in Windows 8.  I've found that a simple change needs to be made.  On lines 40, 42, and 44 change the reference to $connectionKey to be $Id and it works properly.

I was receiving this error when I ran it on Windows 8:


C:\Windows\system32>powershell -File \\server\scripts\Install-RADCConnection.ps1 "\\server\scripts\webfeed.wcx"
HKEY_CURRENT_USER\Software\Microsoft\Workspaces\Feeds\{50250AF5-D0E6-4ED5-BA69-D6CF96A7D55E}
Get-ItemProperty : Cannot find path 'C:\Windows\system32\HKEY_CURRENT_USER\Software\Microsoft\Workspaces\Feeds\{50250AF5-D0E6-4ED5-BA69-D6CF96A7D55E}'
because it does not exist.
At \\server\scripts\Install-RADCConnection.ps1:44 char:32
+         if ( ($connectionKey | Get-ItemProperty -Name URL).URL -eq $URL)
+                                ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (C:\Windows\syst...9-D6CF96A7D55
   E}:String) [Get-ItemProperty], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetIt
   emPropertyCommand

HKEY_CURRENT_USER\Software\Microsoft\Workspaces\Feeds\{50250AF5-D0E6-4ED5-BA69-D6CF96A7D55E}
Get-ItemProperty : Cannot find path 'C:\Windows\system32\HKEY_CURRENT_USER\Software\Microsoft\Workspaces\Feeds\{50250AF5-D0E6-4ED5-BA69-D6CF96A7D55E}'
because it does not exist.
At \\server\scripts\Install-RADCConnection.ps1:44 char:32
+         if ( ($connectionKey | Get-ItemProperty -Name URL).URL -eq $URL)
+                                ~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (C:\Windows\syst...9-D6CF96A7D55
   E}:String) [Get-ItemProperty], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetIt
   emPropertyCommand


Connection setup failed.

Consult the event log for failure information:
(Applications and Services\Microsoft\Windows\RemoteApp and Desktop Connections).

Scripts Disabled

File \\server\scripts\Install-RADCConnection.ps1 cannot be loaded because

running scripts is disabled on this system. For more information, see

about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170.

    + CategoryInfo          : SecurityError: (:) [], ParentContainsErrorRecord

   Exception

    + FullyQualifiedErrorId : UnauthorizedAccess

If you run in to that error, make sure you follow the steps in the link it provides to enable script execution.  We set ours at the GPO level.  http://technet.microsoft.com/library/hh847748.aspx

SQL Server 2012 Availability Group Replica Not Synchronizing

For some reason one of the databases in the availability group was stuck "Not Synchronizing" for a few days. A simple way to fix it was to simply pause & resume it using the SQL command found here: http://msdn.microsoft.com/en-us/library/ff877974.aspx

alter database <databasename> set hadr pause
alter database <databasename> set hadr resume

Synchronization immediately re-started and the database is now catching back up.  I'm not sure what happened, the event logs didn't show anything helpful but this did the trick.
:-\