Fixing SSL Error 61 with Linux ICA Client

Banged my head against the way for a fair time with this error on my CENTOS (could have been RHEL or Fedora) laptop - was simple in the end!

Error

“you have chosen not to trust “verisign class 3 public primary certification authority – G5” SSL error 61

Went to http://www.Symantec.com/page.jsp?id=roots

Scrolled down to “verisign class 3 public primary certification authority – G5”

Right clicked on download now (.pem file)– saved to /opt/Citrix/ICAClient/keystore/cacerts

This fixed it :>

Duplicate SIDs with deployed images \ Sysprep error

Had a quick but interesting issue this week with sysprep in our vCloud environment.

A new windows customized image had been created by one of the engineers, by deploying the standard Windows image and adding some basic software. He then created an image of this by adding it to the ‘Catalog’.

This VM was deployed several times, and the developers started using their VMs. They were getting weird issues though, which  (google?) led them to suspect that all the VMs in the vApp had the same computer SID.

I checked with psgetsid (http://live.sysinternals.com/psgetsid) and they were right!

“No problem” I thought, “the image was probably added to the Catalog as an exact backup, instead of a deployable image. I’ll just create a new SID”.

I powered off the VM in the vCloud console and ticked “Change SID” under Guest Customisation, then chose “Power on and force recustomisation”.

However this didn’t reset the SID!

Next I tried using ‘good old’ sysprep (newsid.exe is now very frowned-upon and not available from Microsoft) selecting “generalise” – and got the below error;

“A fatal error occurred while trying to sysprep the machine”

Checking the log file \windows\system32\sysprep\panther\setuperr.txt showed up an interesting message;

“Failure occurred while executing c:\windows\system32\slc.dll,SLRearmWindows”

This made me think that maybe the maximum number of rearms (which I knew was 3) had been reached?

I leveraged a wider knowledge base (i.e. googled) to find out how to determine the rearm value – this led me to run “slmgr.vbs –dlv”, and the output “rearms remaining = 0”.

After that I realised that I needed to reset the rearm value before sysprep (or vCloud’s “change sid” mechanism”) would work – google offered these instructions;

• Change this registry key’s value to 7;

HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus\GeneralizationState\

• Start -> Run : msdtc -uninstall (wait few seconds)
• Start -> Run : msdtc -install (wait few seconds)
• Restart the machine

This fixed it!

Lesson – unless you have just installed Windows ‘fresh’, I recommend running “slmgr.vbs –dlv” before imaging a windows VM, and ensuring the remaining arm value is not 0. If it is, the deployed VMs will have the same SID!

IF statement and error handling with Get-winevent

Today I had to come up with a way of looking for a certain eventID in the event logs of our VDI estate, using get-winevent.

I had a few challenges which I managed to work around;

 

Challenge 1

When a given PC had multiple results, referencing the first record as $logonevents[0] was fine.

When a given PC had only one result, referencing the first (only) record as $logonevents[0] caused an error, as it wanted to be referenced as $logonevents.

 

Short of forcing the datatype into an array (which I couldn’t work out how to do and wasn’t sure would do the trick), I used an IF statement to check if $logonevents[0] existed, and use $logonevents if it didn’t;

if ($logonevents.timecreated) {$info.lastlogin = $logonevents.timecreated} else {$info.lastlogin = $logonevents[0].timecreated}

 

Challenge 2

My script didn’t provide a value for “last logon event” if there wasn’t one to find, but of course this value was also blank if the query failed (i.e. the VM was off or not working correctly).

I wanted a way to set the result to “None found” if the error was “Get-WinEvent : No events were found that match the specified selection criteria.” – I had 90% of the thinking for this but needed my ex-colleague and powershell guru Stephen Spike to force me to look at it a bit harder. The resulting code was;

 

#resets $error variable to nothing

$error.clear()

#looks for event

$logonevents = Get-WinEvent -computername $hostname -FilterHashtable @{logname="system"; id="7001"; providername="microsoft-windows-winlogon"}

#sets result to “None found” if appropriate

if ("$Error[0]".Contains("No events were found")) {$info.lastlogin = "No logon events found"}

vCloud network bulk change

I have recently started work with an electronic payments company, in the vCloud team. Because of a network re-design, it was necessary to take 100 VMs (once they were powered off), and change the vApp network they were plugged into. There was also a requirement to give each VM a manually specified IP address.

This is how I did it;

A table of vm hostnames (column 1) and target IP addresses (column 2) was created in Excel and saved as a csv.

The below script then reads the file and changes the network to the one in that vapp called “desktop-org<something>”, and gives the VM  the IP address from column 2. The VM must be off.

$csv = import-csv h:\ps1\book1.csv

foreach ($line in $csv) {

 write-host **** Changing $line.vm to new network and $line.ipaddress ****

$targetvm = $line.vm

$targetip = $line.ipaddress

$targetvAppnet = get-civm $targetvm | foreach-object {get-civapp $_.vapp} | get-civappnetwork | where {$_.name -match "Desktops-org"}

get-civm $line.vm | Get-CINetworkAdapter | Set-CINetworkAdapter -IPAddressAllocationMode Manual -ipaddress $targetip -VAppNetwork $targetVAppNet -connected $true

}

Issue with scripts\scheduled tasks on Server 2008 that use Excel or Office I had a problem yesterday scheduling a task to get some data and create an excel file on 2008 R2 Server L1UKASP26. The script ran perfectly on my PC, and also ran perfectly on the server if you double clicked it, but didn't run as a scheduled task. After troubleshooting the task settings, I worked out that it would work if you selected "Run only when user is logged on" (so like "Interact with the desktop" in previous Windows versions), but fail if you selected "Run whether user is logged on or not". After a while searching for ways around this, I came across the below article, which basically says that Office apps need a %profile%\desktop folder to work, and when running in 'headless' mode with 2008 Server, there isn't one. The fix, they said, is to create a couple of empty desktop folders. Surprisingly, this fixed it! If I had used Sysinternals process monitor (http://live.sysinternals.com/procmon.exe) to look for failed file accesses, I might have worked this out myself ;*)

Installing DotNet 3.5 on Windows 8

---

One issue I've had with Windows 8 on my Acer W500 is that some apps I want
to run (like the VMWare vSphere client, and the MCITP Test Simulator) want
DotNet 3.5 installed. Using the Add Windows Features GUI always bombs out
with
A slightly-deeper-than-usual session with Google revealed this gem - due
to known bugs in Windows 8 Consumer Preview, you have to use the below CLI
command;

Dism /online /enable-feature /featurename:NetFX3 /All /Source:DVDLOCATION:\sources\SxS /LimitAccess

Don't forget to reboot, then run Windows Update ;)

Cryptic error when exporting VMs in Windows 8 Hyper V (originally composed March 2012)

I recently had an interesting issue with Hyper V in Windows 8 Consumer
Preview (running fantastically on my Acer W500 tablet without any
additional drivers, available from £350 online). As the laptop only has a
32GB internal hard drive and I wanted to run a few VMs for
testing\learning, I needed more room. The SSD hard drive is upgradeable
according to the W500 community, but I didn't want to spend £120ish on a
128GB SSD right now, so spent £22 on a 32GB Class 10 SD card instead (from
play.com).
When moving my VM onto to SD card from Hyper V Manager, I got the a cryptic error. Same issue and error with exporting the VM. I was also unable to copy and
paste the folder using Windows Explorer, getting a differently worded error. I checked the card
was ok by filling it up with several copies of the photos and movies I had
on the W500. These copied fine (getting a fairly steady 12MBs write rate
BTW), so I knew I didn't have what looked like a 32G card but was actually a much smaller card.
It was then that I had my brainwave - if Windows Explorer can't copy the
files but the media is OK, maybe the files themselves have extra
properties or attributes which cannot be written to the card. I
immediately thought of NTFS extended attributes, and realised that the SD card
would have been formatted with FAT by default. I re-formatted the card
with NTFS and this fixed the issue :)

Searching AD for manually created replication links (Originally composed July 2011)

---

During recent AD troubleshooting by colleagues whilst I was on holiday,
several manual replication links were created. I came up with the below
method to determine manual links in the forest.



Click Start, Run, ldp.exe (get support tools for your OS if not present,
should be on any DC).

Click Connection, Connect, then enter the name of any DC, performance
will be better if its in your site.

Click Connection, Bind, then use currently logged in user even if you
the account doesn't have Domain\Enterprise Admin - only Domain User
rights are required.

Click Browse, then Search.

Enter the Base DN as a the DN of any of your forest domains i.e.
dc=domain01,dc=local or dc=London,dc=rootdomain,dc=local

Enter the filter as objectclass=ntdsconnection

Set the scope to Subtree

Enter the attributes as ms-ds-replicatesncreason

Click Run

Examine the output for any one liners i.e.



The below is NOT manually created as it DOES have a
mS-DS-ReplicatesNCReason value;

Dn: CN=9a9e3868-bc17-456a-891c-cc2dda1829ba,CN=NTDS
Settings,CN=GWDINFR04,CN=Servers,CN=Singapore-DR,CN=Sites,CN=Configurati
on,DC=manfinancial,DC=net

mS-DS-ReplicatesNCReason (7):
B:8:00000060:CN=Configuration,DC=manfinancial,DC=net;
B:8:00000060:DC=intldn,DC=manfinancial,DC=net;
B:8:00000060:DC=tteurope,DC=manfinancial,DC=net;
B:8:00000060:DC=can,DC=manfinancial,DC=net;
B:8:00000060:DC=manchg01,DC=manfinancial,DC=net;
B:8:00000060:DC=manny01,DC=manfinancial,DC=net;
B:8:00000060:DC=ForestDnsZones,DC=manfinancial,DC=net;

whenChanged: 06/05/2011 21:31:35 GMT Daylight Time;

whenCreated: 06/05/2011 21:22:08 GMT Daylight Time;



The below IS manually created as it DOES NOT have a
mS-DS-ReplicatesNCReason value;

Dn: CN=NYWPCORE01,CN=NTDS
Settings,CN=LWPCORE03,CN=Servers,CN=London-IX-Servers,CN=Sites,CN=Config
uration,DC=manfinancial,DC=net

whenChanged: 07/05/2011 16:42:53 GMT Daylight Time;

whenCreated: 07/05/2011 16:38:04 GMT Daylight Time;



If you with to further examine, or delete, the manually created links
in, for example, dssite.msc aka "Active Directory Sites and Services",
you will need to work out which DC object contains the replication link.
This can be worked out by looking at the third, fourth and fifth "CN="
statements i.e. in the below entry, you'd need to browse to the Site
London-IX-Servers (fifth "CN=" value), then expand Servers (fourth "CN="
value), then expand the server LWPCORE03 (third "CN=" value) - you'll
need to expand the NTDS Settings container to see the replication
object. If you are thinking of deleting it, I'd first RDP on to both
servers involved and ensure that a "repadmin