Disabling WSUS on a formerly SBS 2008 network

Windows SBS 2008 networks define the Windows Update server as the SBS 2008 server.  This works well until you decommission the SBS 2008 server, and you need/want your computers to start searching for updates on the internet again.  Personally, I've found that as long as you have sufficient bandwidth, I prefer getting updates from the internet over managing/maintaining an internal WSUS server.  I'm sure many disagree with me.

The WSUS server is defined in Group Policy.  The Group Policy Object on an SBS 2008 network is called "Update Services Common Setting Policy."  Here's a screen shot of where you disable the setting (change the value to disabled):

uninstall SBS 2008 from domain

My broadstroke steps to uninstall SBS 2008 from my domain.

1. delete all offline address books in EMC
2. delete all public folders with these two PowerShell commands: https://technet.microsoft.com/en-us/library/bb201664(v=exchg.140).aspx
3. Disable and then purge all user mailboxes (you do not delete mailboxes as this also deletes the active directory accounts as well)
   a. You do not delete mailboxes, but rather you go to recipient configuration -> mailbox in EMC and highlight all mailboxes and choose "disable"
   b. You'll see all the mailboxes go to the disconnected mailboxes section
   c. Now, you run these two commands to purge the mailboxes in an elevated Exchange Shell:
   d. $users = Get-MailboxStatistics | where-object { $_.DisconnectDate -ne $null } | Select DisplayName,MailboxGuid
   e. $users | ForEach { Remove-Mailbox -Database "Mailbox Database" -StoreMailboxIdentity $_.MailboxGuid -confirm:$false }
   f. Credit for those two commands goes here: http://www.geekyprojects.com/microsoft-server-tutorials/how-to-purge-or-delete-a-disconnected-mailbox-in-exchange-2007/
4. Uninstall Exchange (required following several KBs with steps on deleting things like OAB, user mailboxes, public folders, send connectors, etc)
5. Transfer the 5 FSMO roles to a new domain controller with the global catalog role via these steps
6. Remove Active Directory Certificate Services
7. Demote the SBS server
8. Remove the SBS server from the domain (put in a workgroup)
9. Disable and/or remove WSUS from group policy via these steps

IMPORTANT NOTE - When I did a dcpromo to demote my SBS 2008, it somehow broke my DFS namespace even though the SBS 2008 server was *not* the host of this namespace.  I ended up having to create a new namespace after I had demoted the SBS server.  This is definitely something to check on future SBS uninstallations.

Windows Small Business Server 2008 Repair Guide

I came across this when troubleshooting an SBS 2008 problem, and I just wanted to keep this link as it may be helpful in the future:

http://technet.microsoft.com/en-us/library/sbs-2008-repair-guide(v=ws.10).aspx

SBS 2008 cleanup for low C drive space situations

I was looking for options for cleaning up an 80 GB C drive on an SBS 2008 server that had 4.5 GB free, and I came across this helpful article:

http://alloraconsulting.com/it-solutions/76-windows-server-2008-low-space

I was originally looking for options for reduce the size of c:\windows\winsxs which was 13 GB, but this post recommended against it.

I did two things to get me from 4.5 GB to 14 GB free.

First, I ran "compcln.exe" (which is a built-in utility on SBS 2008) and it cleared up about 1 GB of space.

Then I ran the logs clean up batch file as an administrator:

@echo off

rem Script to clean up disk space on SBS 2008 servers

rem Downloaded from SBSfaq.com

rem V1.0 - March 28th, 2010

rem Certificate Services Logs

net stop "Active Directory Certificate Services"

del c:\windows\system32\certlog\*.log

del c:\windows\system32\certlog\*.chk

del c:\windows\system32\certlof\*.jrs

net start "Active Directory Certificate Services"

rem IIS Log Files

Del C:\inetpub\logs\LogFiles\*.log /f /s

and it cleared up another 9 GB or so in my scenario.

Fixing 800B0001 in Windows Update on SBS networks

If receiving 800B0001 errors on domain connected machines on your SBS 2008 network, it's because an update had strengthened the communication channel between the machine and the SBS server and broken the connection.

Ignoring the absurdity of the issue, the fix is to run an update on the SBS box.  This page talks about it (you can ignore the portions about NLB - network load balancing for your SBS box):
http://support.microsoft.com/default.aspx?scid=kb;en-us;2720211

In essence, the resolution is to download this:
http://www.microsoft.com/downloads/details.aspx?FamilyId=2ba0b137-d85b-4734-9a95-11a04004a355

and run this command from an elevated command prompt:

WSUS-KB2720211-x64.exe /q C:\MySetup.log

autocomplete on Outlook 2011 connected to SBS 2008 not working

I had a user with Outlook 2011 for Mac (running on OS X 10.8) connected to his Exchange account.  The server runs SBS 2008, fully patched (running Exchange 2007 SP 3).

The Outlook account was set up using autodiscover when the user was on the same LAN as the Exchange server.  When the user was not on the same LAN as the Exchange server, autocomplete did not work.

I troubleshot this problem off-site where I was able to replicate the problem.

I'm not sure exactly what I did to fix the problem, but I'm going to document what I did and what I saw.

First, I investigated the user's settings.  Interestingly, the field for server under directory services was blank.  I wasn't sure if there was supposed to be something there.  I assumed yes.

I created a new identity in Outlook 2011 and created a new Exchange account in that new identity that pointed to my personal Office365 account.  I let autodiscover create the Outlook connection settings.  Interestingly, there was nothing there in the server field for directory services either.  The autocomplete was not working in this Outlook profile/account either.

I logged out as the user and logged in as another user (another local account on the Mac).  I opened Outlook and Office update told me there was an update to install (perhaps 10.2.5 - I'm not sure).  I let that update install.  I opened Outlook and set up an Exchange account for a complete separate client that also has an SBS 2008 server (fully patched).  I let autodiscover create the settings.  Autocomplete was not working on this account either, but I did notice that there was a value in the server field in directory services. The value was set to servername.domainname.local.  Clearly, this server would not resolve since the server was not local and there was no route to the server.  This make some logical sense to me that my client's autocomplete was working in the office when he was on the same LAN as the server so Outlook must have been able to route to the server in some way to pull autocomplete data.  So I replaced servername.domainname.local with the FQDN of the server - remote.contoso.com.  I checked the box for SSL.  Directory services said it would use port 3269 so I went to the firewall of my SBS 2008 server and redirected port 3269 to the local IP of my SBS 2008 box.  I closed Outlook and reopened it.  Outlook complained of a certificate mismatch (directory services was pointing to remote.contoso.com but the cert was for servername.domainname.local).  I allowed Outlook to use the server anyway despite the certificate mismatch.  And lo and behold, autocomplete began working.

In addition, Office 2011 also notified me of another update, 10.2.6 i believe - which I allowed to install.

But this is where it gets weird.

I go back into my the user's original profile and autocomplete is working.  I made no changes to his Exchange account.  None at all.  All I did was get aucomplete working on another Exchange account in a completely different Mac profile.  There is no reason that would have any effect on the user's profile.  Autocomplete also began working on my Office365 profile as well.

I rebooted the Mac and the changes persisted (autocomplete still working).  I disconnected from the WLAN the Mac was on and connected the Mac to my iphone's personal hotspot and the changes persisted (autcomplete still working).

I can't narrow this down to a specific thing I did to fix it, but it's working.

SBS Monitoring Log Filled to Capacity Redux

In November 2011, I had a client server whose SBS Monitoring log filled to capacity.  I talked about that here.  The fix I implemented should have been a permanent resolution (or so I read).  In July 2012, I began to get the same event log errors related to this problem.  My log had filled to capacity again.  I had to follow the same procedure.  In this case, I kept these notes:

• it took 1 hour and 10 minutes to run the script
• the SBSMonitoring.LDF file grew to 28 GB

As a reminder, I followed the article listed here to fix this:
http://blogs.technet.com/b/sbs/archive/2009/07/14/sbs-2008-console-may-take-too-long-to-display-alerts-and-security-statuses-display-not-available-or-crash.aspx

Screen shot of the SBSMonitoring.LDF file after running the script:

Screen shot of the place where you shrink the  SBSMonitoring.LDF file:

Screen shot of the SBSMonitoring.LDF after being shrunk:

Annoying issue - but I'm documenting this for my own knowledge and for anyone else who may have this issue.

SBS 2008 - An internal transport certificate expired

On one of my SBS 2008 servers, I was getting this event log error 2 years after I built it:

EVENT # 2048076
EVENT LOG Application
EVENT TYPE Warning
OPCODE Info
SOURCE MSExchangeTransport
CATEGORY TransportService
EVENT ID 12015
COMPUTERNAME   SERVERNAME
DATE / TIME   5/19/2012 10:57:55 AM
MESSAGE An internal transport certificate expired. Thumbprint:98F05ABC27FEB37D5C156FD7E9FFBFFC0B098288

I had a 3 year UCC Exchange certificate on this server that IIS, POP, IMAP, and SMTP were using.  But for some reason, this "internal transport certificate" was using a self signed certificate.  It seems as though the solution was as simple as running "New-ExchangeCertificate" from the Exchange Shell.  I had already run this to replace my internal certificate, but here's what it looks like when you run the command, it prompts you to overwrite the SMTP certificate for internal processing (noting that the 3rd part SSL cert takes precedence for external communications).

SBS 2008 Monitoring Database Fills to Capacity

On one of my SBS 2008 boxes, I began getting a ton of messages in my event log about the SBS 2008 monitoring database filling to capacity. You'll see events like this:

Log Name: Application

Source: MSSQL$SBSMONITORING

Date: 12/16/2009 4:15:47 PM

Event ID: 1827

Task Category: (2)

Level: Error

Keywords: Classic

User: SYSTEM

Computer: xxx.xxx.com

Description:

CREATE DATABASE or ALTER DATABASE failed because the resulting cumulative database size would exceed your licensed limit of 4096 MB per database.

Log Name: Application

Source: MSSQL$SBSMONITORING

Date: 12/16/2009 4:15:47 PM

Event ID: 1105

Task Category: (2)

Level: Error

Keywords: Classic

User: SYSTEM

Computer: xxx.xxx.com

Description:

Could not allocate space for object 'dbo.EventLog'.'PK_EventLog' in database 'SBSMonitoring' because the 'PRIMARY' filegroup is full. Create disk space by deleting unneeded files, dropping objects in the filegroup, adding additional files to the filegroup, or setting autogrowth on for existing files in the filegroup.

This is resolved by using this process:

http://blogs.technet.com/b/sbs/archive/2009/07/14/sbs-2008-console-may-take-too-long-to-display-alerts-and-security-statuses-display-not-available-or-crash.aspx

The description of the fix doesn't match the problem, but it works.

VERY IMPORTANT - this will make the SBSMonitoring_log.ldf very, very large. In my case, it made that file 30 GB, which ate up almost all the space on my C drive, which was a huge problem. See my next post on how to fix that.

Default SBS login page and Outlook Anywhere not working on SBS box

The other night, I installed some updates on an SBS 2008 server and rebooted it. In the morning, no users could connect to Outlook via RPC over HTTP (Outlook Anywhere). In the end, I found that the binding had changed on some virtual web sites in IIS and some built in SBS web sites were broken.

I found that the default web site was bound to 443 which made the SBS web applications web site appear as stopped. This is what the default web site binding should look like:

I found that two of these sites said "offline"

And this is what the bindings on SBS Web Applications should look like:

I adjusted the bindings, and then I was ready to go. I have no earthly idea why the bindings changed. It wasn't the updates. They were standard Windows updates. So odd.

tool for editing/adding SSL certificates to Exchange 2007 / SBS 2008

This tool:

http://www.u-btech.com/products/certificate-manager-for-exchange-2007.html

has been a great help to me in the management of multi-domain SSL certificates (UCC or SAN certificates). Particularly for SBS 2008, you need to use the Exchange shell to add a multi-domain SSL certificate, but this GUI tool will easily help you add it.

installing Exchange 2007 SP 3 on SBS 2008

Installing Exchange 2007 SP 3 on SBS 2008 is pretty easy, with one weird exception. As per this page:

http://www.sbsfaq.com/?p=2140

You need to stop the "Windows SBS Manager" service to allow the service pack to run. In the two service pack installations I've done so far, each time it complained about the datacollectorsvc - which as the above article says is stopped when you stop the Windows SBS Manager.

allowing anonymous sending on SBS 2008 (for scan to email copiers or other devices)

I had put an SBS 2008 box in place for a client. I had to alter settings as the old mail server had allowed anonymous sending on the LAN. I tried a bunch of differnet credential combinations and ports and SSL options and none of them worked. Then I found this post, which walked me through created a receive connector that allowed anonymous senders on the IP addresses you specify.

The short version of the article.

Go to EMC.
Go to Server Configuration -> Hub Transport
Highlight your server in the top middle field and choose new receive connector on the right side
Call the connector "copier" without quotes and type is custom
Note sure if this is necessary, but add the internal FQDN in the bottom box such as contoso1.contoso.local
Leave the local network settings alone
In remote network settings, remove the existing content. Add a single entry for the IP address of the copier like 192.168.0.10)
Hit NEW.
Now, right click on the connector you just created and clear all check boxes on the authentication tab.
On the permission groups tab, check the box for anonymous users.

Then open the Exchange PowerShell and run this command:

Get-ReceiveConnector "copier" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "ms-Exch-SMTP-Accept-Any-Recipient"

On your copier, you can now send over port 25 without SSL and without the need for sending credentials either.

adding a UCC (mulitple name) SSL certificate to SBS 2008

Adding a single name SSL certificate to SBS 2008 is pretty easy using the "add a trusted certificate" wizard in SBS 2008. But it's not as easy if you want a UCC SSL certificate - should you have a DNS host that doesn't support SRV records.

I found sembee's blog post on this exact topic here. His steps are a little convoluted, but here's a short version with just the need to know info:

You're not going to use the wizard. You'll use the powershell.

You'll go to Digicert's wizard for UCC creation:
https://www.digicert.com/easy-csr/exchange2007.htm

Then use the Powershell command it creates on your SBS 2008 box. It'll create a CSR file on the root of your C drive.

Take that CSR file to your SSL cert provider (godaddy or whoever). Buy the UCC cert and put in the CSR as needed.

After your cert is approved, download the cert and use this command to import the certificate:
Import-ExchangeCertificate -Path “D:\Shares\Install\SSL Cert\mail_ExternalDomaiName_com.crt” -FriendlyName “CompanyName UCC Cert”
(altered as appropriate of course for the actual path of your SSL cert)

Also follow the necessary instructions provided by the cert provider about intermediate certification authorities if applicable. Restart the MS Exchange Transport service and run an iisreset.

Then go back to the "add a trusted certificate wizard" in the SBS console and tell it that you'll use an already existing certificate and choose the cert that you just imported.


EDIT - this all makes sense, and I should see this working as I see the certificate in the personal store of the certificates MMC, so I should be able to add the UCC cert in the "add a trusted certificate wizard" - but I don't see it there, so I'm going to go the more manual route and follow these instructions:

http://www.xbarit.com/bradblog/2009/12/14/how-to-manually-install-an-ssl-certficate-on-sbs-2008/

Exchange 2007 Service Pack 2 installation tool for SBS 2008

Microsoft released a tool to enable Exchange 2007 Service Pack 2 installs on SBS 2008. Before this tool, it required a bunch of manual stuff to install Exchange 2007 SP 2. You still have to download Exchange 2007 SP 2 separately, but this tool is a must:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;974271

enabling shadow copy on SBS 2008

For some reason, shadow copy isn't enabled by default in SBS 2008. Or rather - it's enabled on the C drive, but not other drives - where your data is likely located.

Of note - you enable shadow copies for a drive - not a share. So here's how you enable shadow copies for a drive.

Right click on the drive itself and Configure shadow copies. Select the drive and hit enable. This is a no-brainer to set up for clients, but typically, you won't do it until the first time you need it - which will be too late by then.

too many blacklists on SBS 2008 leads to Earthlink delivery problems

I had this problem for several weeks, and I'm documenting it in case anyone else is unlucky enough to be in this situation and needs to find the solution. I was seeing that Earthlink and Mindspring were not able to send to my domain. The senders would get delivery delay emails and the delivery failures eventually on all emails to my domain. With a couple exceptions, everyone else had no problem sending to my domain. So 99% of all email was coming through, but these couple were problematic.

It turns out that I had configured too many real time block list providers (RBLs). When the remote server was connecting to my server, the process of checking the sending server against all 5 RBLs would take some time. In this case, the Earthlink servers wouldn't wait long enough for my server to finish checking - and the Earthlink servers would drop the connection. The solution was to just have one block list provider. In this case I used zen.spamhaus.org

So that was it. Just a note for future reference.

installing Filemaker on Windows 2008 SBS (or Standard)

I had quite an ordeal installing Filemaker Server on Windows 2008 SBS. I won't bore the people who don't care about my troubleshooting and just provide the relevant details:

• Filemaker 10 is necessary on Windows 2008. Filemaker 9 is not supported (I tried and failed).
• If installing on 64 bit Windows (SBS or otherwise), install the 64 bit version of Apple Bonjour first (Bonjour is required and the FMS install tries to install the 32 bit version). Credit for that advice belongs here.
• You need to open ports 5003, 16000, and 16001 on the server for the clients to interact properly with the server
• Filemaker Server 10 can use any level of Filemaker Pro on the desktop end - 8, 9, or 10 (and presumably 7)
• Web publishing should not be used on your SBS box. SBS isn't supported by Filemaker - though it works - but even if you use it - the web publishing stuff will conflict with some of the IIS stuff that SBS uses

using an SBS 2003 box after a 2008 migration

Typically, you wouldn't use your SBS 2003 box after you've done an SBS 2008 migration. In my most recent upgrade, I did need to use it. I had Filemaker Pro 9 on the SBS 2003 box, which apparently can't be installed on 64 bit Server 2008. As part of the 2008 migration, I took the SBS 2003 box out of the domain and put it in a workgroup and demoted it to a member server. Not being in the domain wasn't a big deal - Filemaker didn't need to be in the domain - the clients just needed to see the server over TCP/IP. However, the server kept shutting down every two hours or so saying that the server needed to be a domain controller. The easy solution was to put the server in a new domain and run dcpromo. Problem solved.

notes on SBS 2008 upgrade

I did my first SBS 2008 upgrade from SBS 2003 this week - and it was surprisingly easy - though time consuming. Here are my thoughts on it:

• the Microsoft SBS 2008 migration demo is generally excellent and following it is a MUST. It is here
• After you create the answer file and stick it on a flash drive, you can start the installation using regular non-migration means (in my case, I used the Dell OpenManage CD to start the SBS 2008 installation). There's no real indication that you're doing a migration until you're quite a bit into the process. It doesn't really prompt you for a migration, it just starts doing it when it sees the answer file part of the way into the process
  
• After it detected the answer file and began doing the install, it said "this process may take 30 minutes or more" - it took 2.5 hours. Of note the machine I was installing on was a Dell PowerEdge T310 with 12 GB of RAM, a Xeon X3450 processor at 2.66 Ghz, and 7200 RPM drives
• the mailbox migration took 11.5 hours - going from a 3 Ghz Xeon something with 3 GB of RAM, and 7200 RPM drives to the aforementioned PowerEdge T310. Amazingly, it was only 44 mailboxes and 18 GB of data. I saw a reference to someone else who migrated 57 mailboxes with 50 GB of data in 3 hours 20 minutes.

There are some other parts to it - like the potential necessity of having to change your SSL certificate (the default is remote.domain.com). You are also required to use a certain set of IP addresses - either 10.X.Y.Z or 192.168.Y.Z or 172.X.Y.Z.

Overall, things went great. I'll post more notes when I do my next migration.