Printer driver problem

Recently I was asked to fix printer driver installation. In this case, it was HP Officejet Pro 8620, but it is not important and later on, you will see why.

I downloaded fresh drivers full and compact versions from HP site. Actual error message was saying

Call to DriverPackageInstall returned error 1726 for package C:\Program FIles\HP\HP Officeject Pro 8620\DriverStore\Yeti\hpvyt13.inf

Error code 1726 is “The remote procedure call failed”. But which one and how this is related to printer drivers?

Google was not helpful on troubleshooting of this exact error message so I took some basic steps, that are usually done when you have troubles with software installation.

1. Uninstall all previous driver installation
2. Cleaned driver folders
3. Cleaned registry
4. Restarted computer

 

Unfortunately all these steps were not successful. So I decided to look for some older versions of the same driver. However HP do not provide them and I’m bit scarred to install drivers from unknown web sites.

Then I tried to install driver manually, without installer with PnPUtil, which is a part of windows operating system.

PnPUtil -i -a C:\OJ\hpvyt13.inf

Where C:\OJ\hpvyt13.inf is a path to driver file, which I extracted from setup.

Here I got exactly the same error. Remote procedure call failed. I start to suspect it is something wrong with windows system files and run

sfc/scannow

Log for it is located here: %WinDir%\Logs\CBS\CBS.log

It was able to find some faults, but most of them were about wrong file or folder owner so I skipped that.

For now it was not enough information to think about the root cause so I decided to search for more logs. And I found them. Windows have some logs for device installation located here C:\Windows\INF\setupapi.dev.log

Error message there was saying

“Failed to install catalog ‘hpvyt13.cat’ as ‘oem2.cat’. Error = 0x000006BE”

Catalog oem2.cat is located in C:\Windows\System32\CatRoot

I was able to open it and seemed it was working fine. Tried to place hpvyt13.cat to catroot folder, but that made no changes.

Then I tried to do repair of catroot database, which is located in C:\Windows\System32\CatRoot as described here

I remember old trick with HP dirvers, when installation was possible only with local computer administrator account. I created new account and tried to log in with it. Got error message:

The user Profile service failed the sign in user profile cannot be loaded

I recreated hidden “Default” folder in C:\Users and then I was able to login. However it was working very slow and I had to log off. Afterwards I was able to log in, but a lot of things were not working there, like press “Start” button and so on.

Here I started to suspect that there might be some problems with physical disk. Checked that with command

chkdsk C: /f /r /x

And restart. Checkdisk found some minor errors, but installation of printer still was not working

It was still not working to install driver. I checked windows application/system logs and found there some interesting events:

Windows cannot access the file C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_864_for_KB3200970~31bf3856ad364e35~amd64~~10.0.1.5.cat for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program Host Process for Windows Services because of this error.

 

Program: Host Process for Windows Services

File: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_864_for_KB3200970~31bf3856ad364e35~amd64~~10.0.1.5.cat

Faulting application name: svchost.exe_CryptSvc, version: 10.0.14393.0, time stamp: 0x57899b1c

Faulting module name: bcryptPrimitives.dll, version: 10.0.14393.0, time stamp: 0x57899aef

Exception code: 0xc0000006

Fault offset: 0x0000000000005707

Faulting process id: 0x1340

Faulting application start time: 0x01d2d7070b3da4a9

Faulting application path: C:\WINDOWS\system32\svchost.exe

Faulting module path: C:\WINDOWS\System32\bcryptPrimitives.dll

Report Id: 99e8b755-375f-4984-bf1d-060d42364687

Faulting package full name:

Faulting package-relative application ID:

 

Cryptographic Service was starting and crashing all the time.

Since Package_864_for_KB3200970 should be somehow related to KB3200970 I decided to reinstall this update. Guess what? It failed as well.

I tried to open C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_864_for_KB3200970~31bf3856ad364e35~amd64~~10.0.1.5.cat, but got an error that this file is not valid cat file. I tried to open it with notepad, but it was saying that file cannot be found.

Then I deleted file above and restarted Cryptograpic Services. After few minutes I got the same error message as above, but for another file. So I had to delete like 15 files to get Cryptographic Services working stable.

Afterwards printer installation was smooth.

Windows 10 does not allow installation of unsigned drivers. Cryptographic services are required to sign drivers on windows with digital signature. Installer was trying to connect this service, but failed since it was stopped all the time, so alarmed about PRC call failed. Hope this will help someone and you will not spend so much time like I did.

Terminal license troubles

Heya!

Today I will tell you about issue I discovered recently with terminal license server. It was windows 2012R2 with 100 per user licenses installed. I configured license usage report for it which was described here. For about 1 year it was showing usage of about 10 from 100 licenses. That was confusing so I started investigation. First I checked license usage report from RD Licensing Manager and noticed there:

Failed Per User License Issuance Detail

User,CAL Version,CAL Type,Tried Issuance On

ddc.com\m_okla,Windows Server 2012,RDS Per User CAL,”den 7 april 2017 14:00:10″

ddc.com\m_dvbl,Windows Server 2012,RDS Per User CAL,”den 7 april 2017 14:00:20″

ddc.com\m_lpdn,Windows Server 2012,RDS Per User CAL,”den 7 april 2017 16:06:33″

ddc.com\m_opda,Windows Server 2012,RDS Per User CAL,”den 10 april 2017 09:44:58″

ddc.com\d_elam,Windows Server 2012,RDS Per User CAL,”den 10 april 2017 09:48:33″

Failed Per User License Issuance Summary

DomainName,FailedPerUserLicenseIssuanceCount

ddc.com,5

First I checked logs on server and there were no any recent events regarding terminal licenses. So I asked a question on MS support forums and got reply to search for event 4105 in windows application log.

I searched and found a lot of such events. So this issue is about permissions for RD License server on user accounts in AD. You can check this permissions on security tab of user account in AD, but before you need to enable “Advanced Features” in AD Users and Computers

In our case “Terminal Server License Servers” group was added as Allow entry in users ACL, but did not had any permissions on user account at all.

It should be “Read/Write Terminal Server license server”

First I was planning to write some script to update permissions for each user object, but then I found this article from MS. It is not stated there that it applies for windows 2012 and windows 2012R2, but it does 🙂

I used both methods from scenario #2 and each of them worked.

1 warning here. Permissions for “Terminal Server License Servers” group will not be updates, new ACL entry will be added for each user object instead. So keep it in mind when checking results, just look at all ACL entries to make sure it worked.

After correct permissions were applied license usage increased twice during 1 day only!

 

Terminal Services Licensing problem

Hi,

today I faced an issue with Terminal Server Licensing problem. It was not possible to start its service.

It failed with:

The following error occurred:Can’t initialize Cryptographic – error code 5

An error occurred during the Terminal Services license server initialization phase

The terminal Services licensing service terminated with service-specific error 3221295105 (0xC0011001)

After googling a bit I found out that it is about permissions to folder

C:\Users\all users\Application Data\Microsoft\Crypto\RSA\MachineKeys (in my case it was windows 2008, for windows 2003 path is different)

So it was necessary to grant read permissions for “Network Service” account to this folder and files inside. Unfortunately inheritance is broken for files inside of folder and I did not had any permissions for them. I used “takeown” tool to get necessary permissions

takeown /F “C:\Users\all users\Application Data\Microsoft\Crypto\RSA\MachineKeys” /A /R /D Y

/F specifies folder or file

/A key sets owner to be local administrators group, ofc you need to be a member of this group

/R is necessary to operate on files and subfolders of specified directory

/D Y used to disable popup warnings

Afterwards I navigated to “MachineKeys” folder properties > “Security” tab > “Advanced” button > “Edit” button > “Add” button. Type “Network Service” as service name. Choose permissions as specified on picture and make sure “Apply to” is set to be same as on a picture below.

Now you will be able to launch Terminal Server Licensing service without any troubles. Files for this service are located under C:\Windows\system32\LServer, so if you need backup it is enough to copy this folder.

Good luck!

# Can’t initialize Cryptographic #3221295105 #0xC0011001 #Terminal Services licensing service #Cryptographic – error code 5

AD group members accounts and password expiration

Hi everyone! Here i want to introduce my first professionally written PS script, well at list it is close to be professional cause it can handle all exceptions and have nice comments.

So here is the situation which forced me to make it. Our company has a lot of contractors who are working remotely through VPN. They have AD accounts, which expire each year, unless prolonged for 1 year. Password change requirement for them is 60 days. Since they might not connect to servers during 60 days their password might get expired and they cannot change it through VPN. Each of contractors has local company’s manager, this property is configured for each of them in AD. So the goal of this script was to check members of specific group and sent mail notifications to their managers that user account will expire in 60 days or users password will expire in 30 days. I know it is bit stupid system, but all is because of security policies. Script requires Quest AD cmdlets, which can be downloaded here 
#Created by Iurii Iashchenko
#————————————#
#Defenition section

#Change to your Exchange server IP address (or any other opened mail relay).

#If authentication is needed add it in Send-MailMessage cmdlet
$smtp = “10.10.10.1”
#Sender name
$from = “noreply@company.com”
#AD group name
$AdGroupName = “contractors”
$StandByManager = “some_manager@company.com” #who will receive mails if user do not have manager in AD
$StandByManager1 = “some_manager1@company.com” #who will receive mails if user’s manager do not have mail address in AD
$DomainName = “company.com”
$Attach = “C:\scripts\list.csv” #by default it is not created and not sent. SHould be uncommented in script text
#Style for mail message formatting, nothing to change here.
$a = “<style>”
$a = $a + “TABLE{border-width: 2px;border-style: solid;border-color: black;border-collapse: collapse;}”
$a = $a + “TH{border-width: 2px;padding: 1px;border-style: solid;border-color: black;}”
$a = $a + “TD{border-width: 1px;padding: 1px;border-style: solid;border-color: black;}”
$a = $a + “</style>”

#Functions Section
#————————————————————
function SendMail
{
param(
[string]$MailRecepient,
[string]$WhatWillExpire,
[string[]]$table,
[string]$TexttoAdd
)
#Write-Host “What will expire” $WhatWillExpire
switch ($WhatWillExpire)
{
Password {$body = “Password expires within 30 days for users below.” + $table;
$subject = “Contactor users. Password will expire soon”+$TexttoAdd; break}

Account {$body = “Account expires within 60 day for accounts below.” + $table;
$subject = “Contractor users. Account will expire soon”+$TexttoAdd; break}
}
#Trying to send message. In case of delivery failed notification will be sent to the sender ($from variable)
Write-Host $(Get-Date) “[INFO]:Trying to send message to” $MailRecepient ” in case of delivery failed notification will be send to” $from “`r`n”

Send-MailMessage -SmtpServer $smtp -To $MailRecepient -From $from -Subject $subject -Body $body -BodyAsHtml <#-Attachments $Attach#> –DeliveryNotificationOption OnFailure -Debug
}
#————————————————————
function ParseUsersByManager #create user list to be sent to manager
{
param(
$result0
)
#Unique list of manager to avoid sending duplicates
$ManList = @()
foreach ($user in $result0)
{
$Current_Manager = $user.Manager
if ($ManList -notcontains $user.Manager) #Check for unique managers
{
$resultByManager = @()
foreach ($person in $result0)
{
if ($person.Manager -eq $Current_Manager)
{
$resultByManager += $person #writedown user list by manager
}
}
if ($resultByManager -ne $null)
{
$resultByManager = $resultByManager | Select -Property * -ExcludeProperty Manager

if ($Current_Manager -ne $null)
{
$ManagerObject = Get-QADUser -Identity $Current_Manager
Write-Host $(Get-Date) “[INFO]:For manager” $Current_Manager “results are ” $ResultByManager “`r`n”
$resultByManager=$resultByManager |ConvertTo-Html -Head $a
if ($ManagerObject.Email -ne $null)
{
Write-Host $(Get-Date) “[INFO]:Attempting to send mail to manager ” $ManagerObject.Email “`r`n”
SendMail $ManagerObject.Email $Expiring $resultByManager
}
else
{
Write-Host $(Get-Date) “[WARN]:There was no mail address for” $ManagerObject.DisplayName “so sending results to standby manager:” $StandByManager1 “`r`n”
SendMail $StandByManager1 $Expiring $resultByManager ” You received this mail cause there was no mail address for manager of these people”
}
}
else
{
Write-Host $(Get-Date) “[INFO]:For users without manager results are ” $ResultByManager “`r`n”
Write-Host $(Get-Date) “[INFO]:Attempting to send mail to standby manager” $StandByManager “cause these users do not have any`r`n”
$resultByManager=$resultByManager |ConvertTo-Html -Head $a
SendMail $StandByManager $Expiring $resultByManager ” You received this mail cause people listed below do not have any manager configured in Active Directory”
}

$ManList += $Current_Manager
}
}

}
$ManList = $null
$ResultByManager = $null
$ManagerObject = $null
$Current_Manager = $null
}

#————————————————————————-
#Main program section

cls
Write-Host $(Get-Date) “[INFO]:Trying to load Quest Powershell AD cmdlets`r`n”
try {
Add-PSSnapin Quest.ActiveRoles.ADManagement -ErrorAction Stop
}
catch [System.Management.Automation.PSArgumentException]
{
Write-Host $(Get-Date) “[ERROR]:Quest AD Powershell module cannot be loaded, check if it is installed on server. Exiting`r`n”
Break
}
Write-Host $(Get-Date) “[INFO]:Connecting to domain controllers of:” $DomainName “`r`n”
try {
Connect-QADService -service $DomainName -ErrorAction Stop
}
catch [Quest.ActiveRoles.ArsPowerShellSnapIn.DirectoryAccess.ServerNotOperationalException]
{
Write-Host $(Get-Date) “[ERROR]:Unable to connect to domain:” $DomainName “`r`n”
Write-Host $(Get-Date) “[ERROR]:Exiting `r`n”
Break
}
Write-Host $(Get-Date) “[INFO]:Getting group membership of” $AdGroupName “NOTE! Already expired accounts are not included`r`n”
try {
$result = Get-QADGroupMember $AdGroupName -Indirect -ErrorAction Stop | where {$_.accountisexpired -ne $True} |select Name, Samaccountname, Company, Email, Accountexpires, Passwordexpires, AccountIsDisabled, UserPrincipalName, Manager, @{Name=”Manager_Name”;Expression={(Get-QAduser $_.Manager).DisplayName}}
}
Catch [Quest.ActiveRoles.ArsPowerShellSnapIn.DirectoryAccess.ObjectNotFoundException]
{
Write-Host $(Get-Date) “[ERROR]:There is not such group in Active Directory:” $AdGroupName “`r`n”
Write-Host $(Get-Date) “[ERROR]:Exiting” “`r`n”
Break
}
#Filtering group members by account expiration and password expiration. It is hadcoded below, 30 days for password expiration and 60 days for account expiration
$resultp=$result |where {$_.passwordexpires -ne $null -and $_.AccountIsDisabled -ne $true}| Where-Object { $_.Passwordexpires –lt (Get-Date).AddDays(30) } |select Name, Samaccountname, Company, Email, Passwordexpires, UserPrincipalName, Manager, Manager_Name |sort PasswordExpires
$resulta=$result |where {$_.accountexpires -ne $null -and $_.AccountIsDisabled -ne $true}| Where-Object { $_.accountexpires –lt (Get-Date).AddDays(60) } |select Name, Samaccountname, Company, Email, Accountexpires, UserPrincipalName, Manager, Manager_Name |sort AccountExpires
<# #This section should be used for troubleshooting purposes, it will attach all group members to mail
#Generating full list of Betsy_users group
$result_full = Get-QADGroupMember $AdGroupName -Indirect -ErrorAction Stop | where {$_.AccountIsDisabled -ne $true} |select Name, Samaccountname, Company, Email, Accountexpires, Passwordexpires, AccountIsDisabled, UserPrincipalName, @{Name=”Manager Name”;Expression={(Get-QAduser $_.Manager).DisplayName}}, @{Name=”Manager Email”;Expression={(Get-QAduser $_.Manager).Email}}
#Saving the list to the CSV, later it will be sent as attachemnt to managers to check the results
$result_full | Export-Csv -Encoding Unicode -Path $Attach -Delimiter “`t” -Force -notype
#>

#Sending warnings to managers about password expires
$Expiring = “Password”
ParseUsersByManager $resultp
#Sending warnings to managers about account expires
$Expiring = “Account”
ParseUsersByManager $resulta
Write-Host “——————————————————–`r`n”

And here is the short cmd file to run ps script. I had some troubles with script logging so decided just to forward all scripts output to log file.

cd C:\scripts
powershell .\AP.ps1 >> C:\scripts\AP\Log.txt

Search for files encrypted by Crypto Virus

Hey!

Today I will talk about crypto viruses. This is one of the ugliest virus types. Our company much suffers from them. Antiviruses just let them do their work until we get all files encrypted. It is not a big deal, since we have backups. But first we need to identify on what to restore.

You can find vocabularies of file extensions that crypto viruses used in the past. For now they go smarter and file extension for encrypted files is just 6 random letters.

For a long time I was searching for the script that can identify for me such encrypted files, but found nothing. So I decided to make my own script. Here are the requirements I had:

1. It should work quick. Users have network disks mapped, and storage there can be 20-30 TB of data, so search can take very long time
2. It should handle unicode symbols in files names
3. It should handle double file extensions, like document.doc.ba or some others
4. It should support long file names

As result I got Powershell script

You will need to change 4 first strings to your data. №1 is the path where you want to do a search for encrypted files. №2 is to save temporary file. №3 is your file with scan results №4 is how many days ago do you think virus encrypted the files

$PathToCheck = “\\server\folder”                                          #where to search for encrypted files

$LogFilePath = “C:\Installation\group_scan.txt”              #temporary file which fill collect all file names from specified sourse

$ResultsOutput = “C:\Installation\res.txt”                          #File with results of scanning

$EncryptedFilesAge = “3”                                                          #Search only for files created less then X days ago

$EncryptedFilesAge =”/MAXAGE:” + $EncryptedFilesAge

$params = New-Object System.Collections.Arraylist

$params.AddRange(@(“/L”,”*.*”,”/S”,”/NJH”,”/BYTES”,”/FP”,”/NC”,”/NDL”,”/TS”,”/XJ”,”/R:0″,”/NP”,”/W:0″,”/NJH”,”/NJS”,”/NS”,”$EncryptedFilesAge”,”/MT:128″,”/UNILOG:$LogFilePath”)) #Parameters for Robocopy execution

write-host @(Get-Date)

& robocopy $PathToCheck NULL $params #execute robocopy, just logging, nothing will be copied/removed/moved/renamed

write-host @(Get-Date)

(Select-String -Path $LogFilePath -Pattern “[.]+([a-zA-Z]{6})+$” -Encoding Default | select “Line”).Line |  Format-Table -Wrap -HideTableHeaders | Out-File $ResultsOutput -Encoding Default #Filter file names by “.” + 6 random letters + end of string

write-host @(Get-Date)

Script is using robocopy to handle long file names, unicode symbols and processing speed. Unfortunately last 2 options appeared only for robocopy for windows 2012R2 (maybe 2012 also). So script is designed to work on windows 2012R2.

Script does full scan of 1.82TB of data during 12minutes

But if you know that virus encrypted files just few days ago (parameter #4) then same amount of data it scans less then 1 minute!!!

Here are some improvements that can be done:

1. Add support of multiple sources
2. Send results by mail
3. Handle exceptions
4. Add some logic to display only root folders that need to be restored, but not all the files
5. Improve file mask to search only for file with duplicate extensions, like document.docx.asdjkl
6. Add possibility for script user to add mask by himself, cause extension and principles on how crypto virus works might be changed

If you have any questions pls reach me on iurii.iashchenko@gmail.com

#CryptoVirus #Crypto Virus #6 random characters extension #powershell #robocopy #windows 2012

Long File Names and AccessEnum

Hi guys! (I can hardly believe any girls reading us)

Today I want to talk you about handling of long file names in windows. Those of you who have windows 10 or windows 2016 can safely ignore this article, these 2 windows do not have any troubles with long file names.

As you might know maximum file length in windows is 260 symbols. However in many cases users create rather longer names using network disks or whatever they do)

Recently I got a task to scan 20Tb of users data and find out where everyone or domain users groups have full permissions. I found a perfect free program that fit to my needs, it is AccessEnum from sysinternals. When I started to scan disks it appeared that some files or folders displayed as “???”. I checked them in windows and it appeared that their path length overcome 260 symbols. Peoples are lazy, so I did not want to write any custom scripts to get my job done and started to look for workarounds. At this time I found an article about Windows API. I’ve been working as IT engineer for 10+ years but never heard about this. If you are too bored with Windows API article I can tell you in short that Windows can handle path by 32767 characters it depends just how to ask it.

Here comes magic combination \\?\

For some reasons search engines do not give any results when you try to search for \\?\ combination, but it is  there.

So when you type \\?\C:\temp application will have no problems to handle long file names. For UNC path you can use \\?\UNC\ preffix.

When I tried to use \\?\ preffix for AccessEnum application it no longer had any troubles with long file names

Please consider that not all windows applications might undersdand \\?\ suffixes, but it always worth to give it a try!

#Long File Names # AccessEnum #Windows API #\\?\ #\\?\UNC\

Windows Time Problem

Hi there! Sorry for all my typos and style, I’m trying to write briefly and do not check anything since do not have time for that. But technically it is all written right and it is all real life experience where I spent many hours to fix the problem. And give it to you for free 🙂

Recently I got one server where was not possible to start windows time service.  Error message was:

The Windows Time service terminated with the following error:

The system cannot find the file specified.

Windows time service depends on three files located at C:\Windows\System32

W32time.dll

W32tm.exe

W32topl.dll

When I checked them, on the server, all of them were in place and they were original.

So I decided to re-register windows time service:

On the elevated command prompt:

W32tm /unregister

W32tm /unregister

W32tm /register

I know that I mentioned /unregister twice; it is because sometimes it cannot unregister at the first time.

But when I tried to register I got exactly the same error

The following error occurred: The system cannot find the path specified. (0x80070003)

Later on, I tried to check which files it is trying to find with a procmon filtering by w32tm.exe process name. I got no information from there.

So I decided to copy whole registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\ including sub keys from another working machine. In general, it is exactly the same on any windows version.

Now I started to get an error message

The time service encountered an error and was forced to shut down. The error was: 0x80070005: Access is denied.

 

Then I configured logging for Windows Time Service, since it was not clear for me where it comes from

Since windows time service executable is “C:\Windows\system32\svchost.exe -k LocalService” it was not possible to check its activity in procmon.

From elevated command prompt run:

w32tm /debug /enable /file:c:\windows\temp\w32time.log /size:10000000 /entries:0-116

 

Error message from the log file was:

151991 12:30:27.1064599s – ———- Log File Opened —————–

151991 12:30:27.1064599s – CurSpc:15625100ns  BaseSpc:15625000ns  SyncToCmos:No

151991 12:30:27.1064599s – PerfFreq:3579545c/s

151991 12:30:27.1064599s – Logging error: The time service encountered an error while refreshing its configuration in the registry and cannot start. The error was: Access is denied. (0x80070005)

151991 12:30:27.1064599s – Failed in initialization, w/o restart service151991 12:30:27.1064599s – Service shutdown initiated with exit code: -2147024891.

151991 12:30:27.1064599s – Exiting ServiceShutdown

151991 12:30:27.1064599s – ———- Log File Closed —————–

 

Based on this error description I found the article from MS.

In general, it is about giving permissions for account NT Service\W32Time to different sub keys of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\

I never could imagine there is such account exists!

But when I granted permissions for NT Service\W32Time to whole key and its subkeys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\

I was able to start service successfully

During investigation I also disabled this key, dunno if this is important or not:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\VMICTimeProvider]

“Enabled”=dword:00000001

For those of you who do not have an empty windows machine where to copy registry settings from I publish them here

#0x80070003, #0x80070005, #w32time, #debug, #register

---

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\Config]

“FrequencyCorrectRate”=dword:00000004

“PollAdjustFactor”=dword:00000005

“LargePhaseOffset”=dword:02faf080

“SpikeWatchPeriod”=dword:00000384

“LocalClockDispersion”=dword:0000000a

“HoldPeriod”=dword:00000005

“PhaseCorrectRate”=dword:00000001

“UpdateInterval”=dword:00057e40

“EventLogFlags”=dword:00000002

“AnnounceFlags”=dword:0000000a

“TimeJumpAuditOffset”=dword:00007080

“MinPollInterval”=dword:0000000a

“MaxPollInterval”=dword:0000000f

“MaxNegPhaseCorrection”=dword:0000d2f0

“MaxPosPhaseCorrection”=dword:0000d2f0

“MaxAllowedPhaseOffset”=dword:00000001

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\Parameters]

“ServiceDll”=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\

00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\

77,00,33,00,32,00,74,00,69,00,6d,00,65,00,2e,00,64,00,6c,00,6c,00,00,00

“ServiceMain”=”SvchostEntry_W32Time”

“ServiceDllUnloadOnStop”=dword:00000001

“Type”=”NTP”

“NtpServer”=”time.windows.com,0x9”

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\Security]

“Security”=hex:01,00,04,80,84,00,00,00,90,00,00,00,00,00,00,00,14,00,00,00,02,\

00,70,00,05,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,05,12,00,\

00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,\

00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,00,14,00,\

8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,9d,01,02,00,01,\

01,00,00,00,00,00,05,13,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,\

00,00,00,00,00,05,12,00,00,00

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\NtpClient]

“DllName”=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\

74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,\

00,33,00,32,00,74,00,69,00,6d,00,65,00,2e,00,64,00,6c,00,6c,00,00,00

“Enabled”=dword:00000001

“InputProvider”=dword:00000001

“AllowNonstandardModeCombinations”=dword:00000001

“CrossSiteSyncFlags”=dword:00000002

“ResolvePeerBackoffMinutes”=dword:0000000f

“ResolvePeerBackoffMaxTimes”=dword:00000007

“CompatibilityFlags”=dword:80000000

“EventLogFlags”=dword:00000001

“LargeSampleSkew”=dword:00000003

“SpecialPollInterval”=dword:00093a80

“SpecialPollTimeRemaining”=hex(7):74,00,69,00,6d,00,65,00,2e,00,77,00,69,00,6e,\

00,64,00,6f,00,77,00,73,00,2e,00,63,00,6f,00,6d,00,2c,00,30,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\NtpServer]

“DllName”=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\

74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,\

00,33,00,32,00,74,00,69,00,6d,00,65,00,2e,00,64,00,6c,00,6c,00,00,00

“Enabled”=dword:00000000

“InputProvider”=dword:00000000

“AllowNonstandardModeCombinations”=dword:00000001

“EventLogFlags”=dword:00000000

“ChainEntryTimeout”=dword:00000010

“ChainMaxEntries”=dword:00000080

“ChainMaxHostEntries”=dword:00000004

“ChainDisable”=dword:00000000

“ChainLoggingRate”=dword:0000001e

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\VMICTimeProvider]

“Enabled”=dword:00000001

“InputProvider”=dword:00000001

“DllName”=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,76,\

00,6d,00,69,00,63,00,74,00,69,00,6d,00,65,00,70,00,72,00,6f,00,76,00,69,00,\

64,00,65,00,72,00,2e,00,64,00,6c,00,6c,00,00,00

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\VMICTimeProvider\Parameters]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\VMICTimeProvider\Parameters\IPC]

“UniqueId”=”f3932585-19e8-40cc-922f-673073cbc0d7”

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TriggerInfo]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TriggerInfo\0]

“Type”=dword:00000003

“Action”=dword:00000001

“GUID”=hex:ba,0a,e2,1c,51,98,21,44,94,30,1d,de,b7,66,e8,09

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TriggerInfo\1]

“Type”=dword:00000003

“Action”=dword:00000002

“GUID”=hex:6e,51,af,dd,c2,58,66,48,95,74,c3,b6,15,d4,2e,a1

Ipswitch WS_FTP ftp logs export

Hi everybody, hope you enjoy reading our blog! This time I will write about Ipswitch WS_FTP ftp server and how did we extract logs from it.

One of our customer has very old ws_ftp setup (ver 7.1) and they decided to perform migration to another FTP server solution. As I told before, it is very old setup with 200+ users, who are not documented. Ftp is extensively used, so customer decided to analyze logs for last year and maybe clean some of the users and inform others about future changes in FTP setup. There are 2 ways to get a logs:

• From PostgreSQL database
• From log viewer built into WS_FTP

Unfortunately, the password from PostgreSQL was unknown so the only possible way for us was to use log viewer. The only export format for log viewer is xml. It is not user-friendly and does not allow regular user to make any filtering. In addition exported xml was about 4.5Gb. So not possible to open with excel. Ms Access with some stupid errors, even when I split file to parts

So I decided to export data to MS SQL Server table and convert it to flat format from xml. Here is an example on how xml looked

<?xml version=”1.0″ encoding=”utf-8″ ?>
<log>
<entry>
<log_time>20150311-12:45:02</log_time>
<description><![CDATA[Timeout session:  605,109375 secs inactivity, Login state]]></description>
<service>S1</service>
<sessionid>16278752</sessionid>
<type>0</type>    <severity>1</severity>
<user>user1</user>
<host>ftps.srv.com</host>
<lstnconnaddr>12.28.27.13:990</lstnconnaddr>
<cliconnaddr>39.16.77.36:36738</cliconnaddr>
<cmd>timeout</cmd>
<params><![CDATA[MLSD ]]>
<sguid>B4CFC212-7C36-438F-EEA7-188BD3EACAA3</sguid>
</entry>
</log>

Therefore, I made an empty database and a table inside

---

create table ftplog (

[log_time] nvarchar (17),

[description] nvarchar (100),

[user] nvarchar (30),

[host] nvarchar (20),

[lstnconnaddr] nvarchar (30),

[cliconnaddr] nvarchar (30),

[cmd] nvarchar (30))

GO

---

The length of the fields can be different, especially for “description”, however I used max values to cover every possible case

I also made a query to import a data from xml file to table so it is written as table, but not xml

---

use FTPdatabase

GO

DECLARE @messagebody XML

 

SELECT @messagebody = BulkColumn

FROM OPENROWSET(BULK ‘C:\year.xml’, SINGLE_CLOB) AS X –change to your path

 

INSERT INTO [ftplog]

select  a.value(N'(./log_time)[1]’, N’nvarchar (17)’) as [log_time],

a.value(N'(./description[1])’, N’nvarchar (30)’)) as [description],

a.value(N'(./user[1])’, N’nvarchar (30)’) as [user],

a.value(N'(./host[1])’, N’nvarchar (30)’) as [host],

a.value(N'(./lstnconnaddr[1])’, N’nvarchar(30)’) as [lstnconnaddr],

a.value(N'(./cliconnaddr[1])’, N’nvarchar (30)’) as [cliconnaddr],

a.value(N'(./cmd[1])’, N’nvarchar (30)’) as [command]

from @messagebody.nodes(‘/log/entry’) as r(a);

---

This query is designed for this specific xml structure, so for different xml it need to be changed. As you can see I skip some unnecessary fields from xml, like sessionid, host, sguid and so on.

After the first run, I got an error message that it cannot read some symbols, sure, it cannot! FTP was installed on Swedish, and I had different settings on my laptop, so I had to change language for non Unicode programs to be Swedish and restart laptop. By the way, before laptop I was trying to import data to SQL Server installed on virtual machine, which is used quite a lot by different people. Query was running for years, so I decided to use my laptop with SSD and 12gigs of RAM.

On the small files import query was running fine, but when I started it against xml with data for the last year it gave me an error message

Msg 9420, Level 16, State 1, Line 5

XML parsing: line 42131402, character 49, illegal xml character

 

It is not possible to view 4Gb file in notepad. First I tried to use powershell, but it took whole memory and was running for years. Therefore I made a vbs script to read a line with specific number

---

Set objFSO=CreateObject(“Scripting.FileSystemObject”)

‘ Put your path to xml here

filename = “C:\Desktop\FTP\year.xml”

 

Set fso = CreateObject(“Scripting.FileSystemObject”)

Set f = fso.OpenTextFile(filename)

 

for k = 1 to 42131400   ‘ In my case error happened on line 42131400 and I was not sure how vbs count the ‘strings so I did output for 2 strings prior to 42131402

strline = f.ReadLine

Next

 

wscript.echo “String with number: ” & k & “has value” & “strline”

strline = f.ReadLine

wscript.echo “String with number: ” & k+1 & “has value” & “strline”

strline = f.ReadLine

wscript.echo “String with number: ” & k+2 & “has value” & “strline”

 

f.Close

---

Unfortunately, even with this tool I was not able to identify the problem. I was able to read a string, but not to identify what is wrong with it. Here is what I got reading the string. Yeah, there are some Unicode symbols, but anyway it should be possible to read them. Here is example of string output from script:

<description><![CDATA[Unknown command : ŸÔŸÝ]]></description>

After googling a bit I found out that it might be a problem with unreadable Unicode table characters (1-32). So I made another vbs script to remove such characters from my source file.

---

Set objFSO=CreateObject(“Scripting.FileSystemObject”)

‘ How to write file

outFile=”C:\FTP\fixed1.xml”   ‘ Keep results in this file

Set objFile = objFSO.OpenTextFile(outFile,2)

filename = “C:\Desktop\FTP\year.xml” ‘ Source file

 

Set fso = CreateObject(“Scripting.FileSystemObject”)

Set f = fso.OpenTextFile(filename)

i = 0

Do Until f.AtEndOfStream

 

strline = f.ReadLine ‘ Read each string of the source file

for j=1 to 32              ‘ Change 32 to be 31, so you do not loose spaces

strline=Replace(strline,Chr(j),””) ‘Remove unreadable characters

Next

objFile.WriteLine strLine  ‘ Write fixed string to output file

i = i+1

Loop

wscript.echo “Number of strings is: ” & i

f.Close

objFile.Close

---

After cleaning a file I got error message from SQL

Msg 9421, Level 16, State 1, Line 5

XML parsing: line 1, character 13, illegal name character

 

Using the first vbs script I red first 3 lines and they looked exactly fine

<?xmlversion=”1.0″encoding=”utf-8″?>

<log>

<entry>

However, after bit more research I discovered that the first string is missing spaces (unreadable character with code 32 that was removed by vbs script. I was not worried about spaces anywhere so just added them to the first string

<?xml version=”1.0″ encoding=”utf-8″ ?>

 

I tried running SQL import batch again and it still was not working with error message

Msg 9420, Level 16, State 1, Line 5

XML parsing: line 1461998912, character 29, illegal xml character

Did not feel comfortable with reading strings with vbs script and spending so much time on that, so I did some research and it appeared that there are quite a lot of nice tools who can read huge text files.

One of them is EmEditor was fit for my needs with fully functional 30 days trial. So now I was able to open and browse huge xml file using nice GUI interface!!!

During file opening got an error message that some characters cannot be converted using the specified encoding.

Wow, this tool saved hours for me and I was able to identify problematic symbol, it appeared to be �

Using EmEditor I replaced this symbol with nothing and saved changes

 

Finally, I was able to run SQL import query and after 30 minutes I got a table containing 6+ million records ready for queries and sorting!

For customer I exported same xml file to MS Access database table. Compressed it consumed just 60Mb

Hope you enjoyed this long story. I do not think that someone will need to reproduce all of my steps, but some of them might be useful for different purpose. Looking forward for your feedbacks and do not forget to follow our blog. Promise, soon it will update more often and it will be a lot of interesting content!

Insufficient system resources exist to complete the requested service!

Hi everybody!  Here is some more information about different issues we are facing each day!

Trying to copy huge (70Gb) database backup from one disk to another I got an error message that insufficient system resources exist to complete the requested service.

The first, I was thinking about was to use robocopy command prompt tool, which is optimized to work with file operations

Despite all retries, it was not able to copy a file. Server is an old windows 2003 virtual machine on vmware with 6GB of RAM used as database server for some old applications. I am sure that server restart would fix this problem for some time, but server is in use and I had to think some other workarounds. I tried to copy smaller files, like 8GB and it worked fine.

I downloaded and installed 7-zip archiver on server, and started it to add file to archive. Compression usually takes a lot of time, so I set compression level to “Store” (no compression) and in the “Split” to volumes I choose 8Gb parts.

After operation completed I copied all 9 files to destination without any issues, opened first of them and extracted complete file.

Windows 2012R2 RDS CAL reporting script

Hi, long time we were keeping silent, but not it is a time for some news.

Here i found a script for reporting of per user RDP CAL licenses usage, however my license server was windows 2012r2, so original script was not working. So I changed it to work and also added section to send results by mail, here you go:

# Filename of the export
$filename = “RDS-CAL-Report.csv”
# Import RDS PowerShell Module
import-module remotedesktopservices

# Open RDS Location
Set-Location -path rds:

# Remove previous reports (Optional)
remove-item RDS:\LicenseServer\IssuedLicenses\PerUserLicenseReports\* -Recurse

# Create new RDS report
Invoke-WmiMethod -Class Win32_TSLicenseReport -Name GenerateReportEx

# Name is automatically generated
$NewReportName = Get-ChildItem RDS:\LicenseServer\IssuedLicenses\PerUserLicenseReports -name

# Get issued licenses
$IssuedLicenseCount = get-item RDS:\LicenseServer\IssuedLicenses\PerUserLicenseReports\$NewReportName\Win8\IssuedCount
# Count issued licenses
$IssuedLicenseCountValue = $IssuedLicenseCount.CurrentValue

# Get installed licenses
$InstalledLicenseCount = get-item RDS:\LicenseServer\IssuedLicenses\PerUserLicenseReports\$NewReportName\Win8\InstalledCount
# Count installed licenses
$InstalledLicenseCountValue = $InstalledLicenseCount.CurrentValue

# Installed – Issued
$Available = $InstalledLicenseCount.CurrentValue – $IssuedLicenseCount.CurrentValue
# Show percentage available
$AvailablePercent = ($Available /$InstalledLicenseCount.CurrentValue)*100
$AvailablePercent = “{0:N0}” -f $AvailablePercent

# Display info

Write-host “Installed: $InstalledLicenseCountValue”
Write-host “Issued: $IssuedLicenseCountValue”
Write-host “Available: $Available [ $AvailablePercent % ]”

# Add the information into an Array

[System.Collections.ArrayList]$collection = New-Object System.Collections.ArrayList($null)
$obj = @{
Installed = $InstalledLicenseCountValue
Available = $Available
AvailablePercent = $AvailablePercent
Issued = $IssuedLicenseCountValue
Date = get-date
}

# Exit RDS location
set-location c:

# Create PSO Object with the data
$collection.Add((New-Object PSObject -Property $obj));

# Export Data into a file
$collection | export-csv $filename -NoTypeInformation -Encoding UTF8

#send mail

#Modify to your SMTP server
$smtpServer = “123.12.57.20”

#Modify to your path where report generated
$file = “C:\script\RDS-CAL-Report.csv”
$att = new-object Net.Mail.Attachment($file)
$msg = new-object Net.Mail.MailMessage
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$msg.From = “server_reports@microsoft.com”

#Modify recipients

$msg.To.Add(“user1@ms.com”)
$msg.To.Add(“user2@ms.com”)
$msg.CC.Add(“user3@ms.com”)
$msg.Subject = “server licenses usage reporting”
$msg.Body = “Monthly license reporting, refer your question to me”
$msg.Attachments.Add($att)
$smtp.Send($msg)
$att.Dispose()