When you install a Windows 2012 R2 server, if you login as Administrator and try to run any Modern UI Apps (such as Internet Explorer) you’ll get this error message: “This app can’t be opened using the Built-in Administrator account please sign in with a different account and try again.” or “This app can’t be activated by the Built-in Administrator”.

You can either create a new user account in the Control Panel and then login as that user.

Or alternatively modify Windows security policy:

1. Press the Windows key + R to bring up the Run box, and then type secpol.msc. Press Enter.
2. On the Local Security Policy window, navigate to Security Settings –> Local Policies –> Security Options.

   

3. On the right panel, double-click on the option “User Account Control: Admin Approval mode for the Built-in Administrators Account” and enable it.

   

4. Click on Apply and exit Local Security Policy.
5. Press the Windows key + R to bring up the Run box, and then type regedit. Press Enter.
6. On the Registry Editor window, navigate toHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI. On the right side, double-click on default and change the value to “0×00000001(1)”. Click OK.

   

7. Restart your computer. Now you should be able to run Modern UI Apps using the Built-in Administrator account.
8. You will also need to enable downloads in Internet Explorer if you wish to download anything, please see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/210/0/enable-downloads-in-windows-2012-r2

You may encounter a situation where one of the DNS server's in the environment starts showing an issue where the zones are not loaded on the DNS console and you see Event ID 4000 and 4007 logged in the DNS event logs:

Event ID 4000:

The DNS server was unable to open Active Directory. This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly and reload the zone. The event data is the error code.

Event ID 4007:

The DNS server was unable to open zone <zone> in the Active Directory from the application directory partition <partition name>. This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly and reload the zone. The event data is the error code.

Also when you try to open the DNS console you get a pop-up giving Access Denied.

You notice that the DNS Server service is up and running.

When you try to perform any operation on the AD-integrated zones using DNSCMD, you receive the Access Denied error message.

Rebooting the server causes it to take a long time (up to 30 minutes or more) configuring the environment.

Cause

This happens when that particular DC/DNS server has lost its Secure channel with itself or PDC.

This can also happen in a single DC environment where that DC/DNS server holds all the FSMO roles and is pointing to itself as Primary DNS server.

Resolution

1. Run the following command with elevated rights:

   net stop kdc
   klist purge
   netdom resetpwd /server:127.0.0.1 /userd:domain.com\administrator /passwordd:*
   net start kdc

   It will prompt for the password of the Domain Admin account that you used, enter that.

2. Once the command executes, restart the Active Directory Services service.

DNS zones should load now.

Now reboot the server

Please note: If you are advised you are running an open DNS resolver you must take action as your VPS is most likely being used in attacks against other networks. Please read below for an explanation and instructions on resolving the problem.

An "open DNS resolver" is a DNS server that's willing to resolve recursive DNS lookups for anyone on the internet. It's much like an open SMTP relay, in that the simple lack of authentication allows malicious 3rd parties to propagate their payloads using your unsecured equipment. With open SMTP relays, the problem is that they forward spam. With open DNS resolvers, the problem is that they allow a denial of service attack known as a DNS Amplification Attack.

The way this attack works is pretty simple - because your server will resolve recursive DNS queries from anyone, an attacker can cause it to participate in a DDoS by sending your server a recursive DNS query that will return a large amount of data, much larger than the original DNS request packet. By spoofing (faking) their IP address, they'll direct this extra traffic to their victim's computers instead of their own, and of course, they'll make as many requests as fast as they can to your server, and any other open DNS resolvers they can find. In this manner, someone with a relatively small pipe can "amplify" a denial of service attack by using all the bandwidth on their pipe to direct a much larger volume of traffic at their victims.

ArsTechnica did a decent article on the recent DNS Amplification DDoS attack against Spamhaus, and is worth a quick read to get the basics (and a good visual of the amplification).

The simplest way to protect your system from being abused like this is to limit the addresses your server will perform recursive lookups for to your local subnets. (The specifics of which depend on which DNS server you're using, of course).

BIND

For example, if I were using BIND 9, and wanted to simply prevent DNS recursion from outside addresses, I would use the following code in my config:

options {
    directory "/var/named/master";
    allow-recursion { 127.0.0.1; 10.0.0.0/8; 192.168.0.0/16; 172.16.0.0/12; };

That line of code tells my BIND server to only process recursive DNS requests for the local loopback address (which I guess I could/should set to the local loopback block, the whole /8) and the 3 Private IPv4 address spaces.

Windows Server 2012

OPTION 1

Block external DNS requests with a firewall, such as the built in Windows firewall (use this method if you are running a domain controller and are NOT using the DNS server as an actual name server for public domains)

To my surprise, Windows DNS does not allow you to restrict the addresses to which recursive DNS requests are honored, so this actually the recommended method by Microsoft.

• Select the DNS (TCP Incoming) rule, go to the Remote IP address section and add:
  • 127.0.0.1
  • Any public IP addresses assigned to your VPS e.g. 203.143.X.X
  • Any internal IP addresses assigned to your VPS (if you are using an internal network) e.g. 10.1.X.X
• Now go to the DNS (UDP Incoming) rule and do the same.

OPTION 2

Disable Recursion (use this method if your DNS server is used as a name server for a public domain)

Disabling recursion is good when your DNS server is a public facing DNS server, only providing DNS information for zones it actually hosts (is authoritative for). If your system is a Domain Controller then you must make sure you have another DNS server specified in the network settings other than 127.0.0.1 or it will not be able to resolve any other domains, or use option 1 above. If your server is NOT a domain controller then this is the easiest option as it prevents your DNS server from providing any information other than about the zones it hosts.

• 
  1. Open DNS Manager.
  2. In the console tree, right-click the applicable DNS server, then click Properties.
  3. Click the Advanced tab.
  4. In Server options, select the Disable recursion check box, and then click OK.
     • Since we have a multi-forest environment, and use conditional forwarders for that to work, I'm not going to check that box. Might be something for you to consider as well.

If you want to make your local computer believe that your website is hosted on your new VPS before you modify the actual DNS, this can easily be done by modifying your hosts file.

Windows

• Click the 'Start' button in Windows on your LOCAL computer
• Type in: notepad
• Right click on the link to notepad that appears, and choose 'Run as Administrator'
• When notepad opens go to File -> Open
• Browse to c:\windows\system32\drivers\etc
• Open the file 'hosts' in notepad
• Add a lines to the bottom:

x.x.x.x www.yourdomain.com
x.x.x.x yourdomain.com

• Where x.x.x.x is your VPSBlocks VPS IP address and yourdomain.com is the domain you use to access your website.
• Save the file.
• Close all instances of your browser.
• Reopen your browser and browse to www.yourdomain.com and what you see will be served from your new VPS.

Once you have completed any testing always modify your hosts file again and remove the lines you added.

MAC

You need to edit the file at /private/etc/hosts

If you aren't sure how to do this follow these instructions:

1. Open Terminal

2. Type: sudo nano /private/etc/hosts

3. Enter your administrator password when prompted

4. Edit the file in the same format as for Windows above e.g.
x.x.x.x domain.com
x.x.x.x www.domain.com

5. Press Ctrl-o to save the file

6. Press Enter to confirm saving the file

7. Close all instances of your browser.

8. Reopen your browser and browse to www.yourdomain.com and what you see will be served from your new VPS.

Once you have completed any testing always modify your hosts file again and remove the lines you added.

By default Windows 2012 R2 doesn't allow downloading of files through Internet Explorer. To change this you need to modify the security settings.

In Server 2012 you’re not able to download a file :

Your current security settings do not allow this file to be downloaded

Solution:

Click on Custom level

Select the “Enable” file download option

If you login to your remote desktop server and click on the signal strength icon (only available in full screen mode), it will tell you if it's using UDP.

WINDOWS 2008 R2 / WINDOWS 2012 R2

Create a registry value forcing RDP to use TCP instead of UDP/TCP. This appears to work very well improving the connectivity substantially. This should be done on the server itself and a reboot will be required to activate it.

Source: https://getadmx.com/?Category=Windows_10_2016&Policy=Microsoft.Policies.TerminalServer::TS_SELECT_TRANSPORT

Open regedit.

Browse to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services

• Create a Value of type: REG_DWORD
• Give it the name: SelectTransport
• Give it a value of: 1

Restart your computer.

This will set your RDP to use TCP only and in most cases fixes occasional freezing issues. Note that the other settings available are:

• Value: 0 (Use both UDP and TCP)
• Value: 2 (Use either UDP or TCP)

WINDOWS 2016 - WINDOWS 2019

Source: https://social.technet.microsoft.com/Forums/en-US/92830c17-7d02-4f47-bf5a-9319f1fb67c9/remote-desktop-sessions-freeze-with-1809?forum=winRDc

Open regedit.

Browse to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

• Create a Value of type: REG_DWORD
• Give it the name: SelectTransport
• Give it a value of: 1

Restart your computer or the Remote Desktop Service.

This will set your RDP to use TCP only and in most cases fixes occasional freezing issues. Note that the other settings available are:

• Value: 0 (Use both UDP and TCP)
• Value: 2 (Use either UDP or TCP)

GROUP POLICY (ALL WINDOWS VERSIONS)

Another location to set this is in group policy at: Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connection -> Select RDP transport protocols

Again you need to set the value to 1 (Use only TCP).

To fix this issue you can do two things:

1. Install the latest updates on the server. This of course cannot be done if you cannot access the server, and will require a reboot to complete any update installation.

2. Modify a setting on your local computer which will allow the oracle based encryption.

Allowing Oracle Based Encryption

First you need to open an elevated command prompt. To do that click on the 'Windows Start' button and type: cmd

Then right click on the 'Command Prompt' option that will appear

The left click on 'Run as administrator'

You will be prompted with a security message asking are you sure. Click 'Yes'.

You will now see a regular command prompt window. You need to paste in the following command and press enter to execute it:

reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /f /v AllowEncryptionOracle /t REG_DWORD /d 2

It will say: The operation completed successfully.

You will now be able to connect via RDP with no issues.

It is highly recommended that you do update your server with the latest updates, and if you wish you can then revert the setting to allow Oracle Encryption by opening an elevated command prompt and using the following command:

reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /f /v AllowEncryptionOracle /t REG_DWORD /d 1

1. First launch Remote Desktop, for help see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/40/0/how-do-i-use-remote-desktop-rdp
2. Click the 'Start' button and type: services.msc (then hit enter)
3. The services window will appear, find the 'Windows Audio' service and double click on it. Change the Startup Type from Manual to Automatic. Click OK.
4. Now click the Play button to start the service right away.
5. Try playing something in your VPS, chances are it will function now. If not move to the next step.

If the audio device is missing you will need to enable it for RDP:

1. Type gpedit.msc in search box, and press Enter.
2. Find Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection
3. Double click Allow audio and video playback redirection on right panel.
4. Set the policy to enable or not configured.
5. Restart the Remote Desktop Configuration service, followed by the Remote Desktop Services service.
6. Reconnect via RDP and it should now detect audio.

Enabling Sound/Audio over Remote Desktop Windows is not the tough process. Know all the steps today!

1. First launch Remote Desktop, for help see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/40/0/how-do-i-use-remote-desktop-rdp
2. Click to 'Show Options' if it is not already.
3. Click the Local Resources tab.
4. Under “Remote audio”, Click "Settings"
5. Ensure Remote Audio Playback is set to "Play on this computer"
6. Login to the server which needs audio enabled.
7. If you hear the windows startup sound upon login, skip to “Making sure Audio is configured correctly for all applications.”

If you didn’t hear the windows startup sound:

1. On the VPS launch tscc.msc (Start-> Run-> tsconfig.msc) on the remote computer.
2. Open the Connections folder in the left sidebar.
3. Right-click RDP-Tcp, select Properties
4. Click “Client Settings” tab
5. UNCHECK the “Audio mapping” checkbox.  Note that all checkboxes under this section are below a blurb that states “Disable the following:”, thus anything checked here is disabled.  Audio is disabled by default.
6. Click OK, and close tsconfig.  A warning may be generated which says this change will not take effect for any currently-connected RDP sessions.  Click out of that.
7. Log out.
8. Log back in.

You may hear the windows startup sound at this point, even still, proceed to the next section.

Making sure Audio is configured correctly for all applications:

1. On the VPS open the sound control panel (Start-> (Settings->) Control Panel-> Sounds and Audio Devices)
2. Click the Audio tab.
3. Select “Microsoft RDP Audio Driver” for the default playback device, if not already specified.
4. Check the “Use only default devices” checkbox at the bottom of the dialog.
5. Click the Voice tab.
6. Select “Microsoft RDP Audio Driver” for the default playback device, if not already specified.
7. Click OK.

Due to the way most operating systems work, IPv6 is preferred before IPv4 when available - however the world isn't fully IPv6 ready even though many sites are supporting it - eg google has IPv6 - but It's not in Australia - so it's SLOW accessing it via an IPV6 from a VPS in Australia (and we wouldn't be surprised if the IPv6 international trunks are substantially smaller than IPv4).

You can use this Microsoft support article to prefer v4 over v6 (it lays the blame at mis-configured routers - not the case here - It's just that we're ahead of most of the rest of the world) or you can disable IPv6 on hosts which don't need/want it.

For linux variants there is an article here on how to disable IPv6: http://activemq.apache.org/multicast-watch-out-for-ipv6-vs-ipv4-support-on-your-operating-system-or-distribution-or-network.html

Interestingly, the latency between Melbourne to Sydney over ipv6 is also high - something which VPSBlocks or our DC have no control over (yet).

Disabling in Windows 2008

Download the fix onto your VPS and install it: http://go.microsoft.com/?linkid=9728870

Disabling in Windows 2012

Right click on the powershell icon and choose 'Run as Administrator', then paste in this command:

New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters -Name DisabledComponents -PropertyType DWord -Value 0xffffffff

You may need to restart afterwards.

Disabling in CentOS 5.3

Disable IPV6 support on your Linux machine by adding a line at the end of /etc/modprobe.conf by doing the following:

• SSH into your VPS (we recommend using Putty)
• Type: pico /etc/modprobe.conf
• Go to the end of the file and enter this line:
• alias net-pf-10 off # disable IPV6
• Save the file and exit pico.
• Restart the VPS

Disabling in CentOS 5.4+

• Edit /etc/sysconfig/network and set "NETWORKING_IPV6" to "no"  
• For 5.4 and later, replace in /etc/modprobe.conf

   alias ipv6 off

with:

   options ipv6 disable=1
 

Disabling in CentOS 6 or 5.4+

Add the following to /etc/sysctl.conf:

net.ipv6.conf.all.disable_ipv6 = 1

Alternative Method where modprobe.d is installed

touch /etc/modprobe.d/disable-ipv6.conf

echo "install ipv6 /bin/true" >> /etc/modprobe.d/disable-ipv6.conf 

Run /sbin/chkconfig ip6tables off to disable the IPv6 firewall

Reboot the system

Disabling in Linux (Debian)

Append the following to /etc/gai.conf

precedence ::ffff:0:0/96  100

Firstly, for sound to work via RDP you need to ensure it's not disabled in group policy, and that sound redirection is turned on. To do this see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/154/0/enabling-soundaudio-over-remote-desktop-windows-2008-r2

By default the sound quality over RDP can be quite poor.

To fix this:

• On your local computer open the remote desktop connection window (but do not connect)
• Enter in your IP address, then click 'Show Options'
• Choose 'Save As' and save the .rdp file to your desktop
• Close the remote desktop connection window
• Now right click on the file you just saved and choose 'Open With' and select Notepad
• Add the following line to the top of the file in notepad:
• audioqualitymode:i:1
• Save the file
• Now open the .rdp file with Remote Desktop
• Connect to the server and your audio should be improved.

You can change the quality modes by setting:

Dynamic Audio Compression
audioqualitymode:i:0

Medium Audio Compression
audioqualitymode:i:1

No Audio Compression (not recommended as it requires high bandwidth)
audioqualitymode:i:2

To use remote desktop:

• Click on the 'Start' menu or 'Windows' icon
• In the search/cmd box enter: mstsc.exe
• This will bring up the Remote Desktop Connection application
• Enter the IP address of your VPS
• Click 'Connect'
• Enter your username: Administrator
• Password: your password

Your IP Address and password are both found in the setup email that was sent to you immediately after your new VPS was provisioned.

You will now be able to access your VPS as though it was a desktop machine in front of you.

If you are using Windows XP Home version and do not have Remote Desktop installed, you will need to download it, see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/94/0/windows-xp-remote-desktop-connection-rdp-software

If you are using a Mac you can grab the Remote Desktop connection client here: https://itunes.apple.com/au/app/microsoft-remote-desktop-10/id1295203466?mt=12

This article will address how to prevent your VPS from being used in a DDOS attack. This affects all versions of Windows DNS (2003/2008/2012).

1. Your DNS Server is used for your VPS to resolve external domains

If you have installed the DNS server on your Windows VPS that has forwarders turned on, you must configure the Windows Firewall to stop outside users from using your DNS server.

All you need to do is modify the DNS TCP/UDP Incoming firewall rules on the Scope tab, and add any IPs you want to be able to access the DNS server:

Important: If you are joining other servers to a Windows Active Directory domain, you will need to make sure that you are adding the other server’s IP addresses to the “Remote IP Address” section. 

You can verify that the DNS server is open to being used in an attack by using the "nslookup" command.

On your own computer (not on the VPS) open a command prompt and type:

• nslookup
• yahoo.com 203.143.X.X

(where 203.143.X.X is the IP address of your VPS).

If it is secure it will look like this:

C:\Windows\system32>nslookup
Default Server:  BigPond.BigPondAddress:  10.0.0.138
> yahoo.com 203.143.82.2
Server:  [203.143.82.2]
Address:  203.143.82.2

DNS request timed out.   
timeout was 2 seconds.

DNS request timed out.   
timeout was 2 seconds.

DNS request timed out.   
timeout was 2 seconds.

2. Your DNS Server is being used as a name server for a specific domain

In this case you MUST turn off DNS forwarding, and cannot use the DNS server to resolve external domains. It can only provide information on the domains that it hosts to the public.

To turn off forwarding:

1. Go to the properties of the DNS server and click on the 'Advanced' tab
2. Make sure 'Disable recursion' is checked
3. In the network properties for the VPS make sure you are specifying other DNS servers (not 127.0.0.1) e.g. 8.8.8.8

To install the URL Rewrite Module 2.0 for IIS 7 / 7.5:

• Download it at: http://www.iis.net/download/urlrewrite
• You can either use the Web Platform Installer, or download the MSI install files directly.
• Once it is installed you can use your web.config to specify rewrite rules.

We recommend downloading the samples available at www.iis.net here: http://download.microsoft.com/download/3/9/E/39E30671-7AD2-4902-B56B-C300D862595E/RewriteExtensibility.msi

In Windows if you have an internal network adapter, and an external network adapter and make the server a domain controller, it will automatically make both NICs part of the domain profile (which allows everything in the firewall restrictions).

To stop this what we recommend is you make keep your internal network adapter as your domain profile, and make your external network adapter (the one that connects to the internet) a member of the public profile.

To do this go to the Windows Advanced Firewall and create a rule which blocks UDP on port 389 for the external subnet range (e.g. 203.143.x.x) both incoming and outgoing. This will prevent Windows from being able to resolve the NIC to a domain and therefore mark it as public.

If you send the username as simply: User

Your local system will essentially send it as: LocalDomain\User

This will fail to authenticate properly unless the RDP server is a member of LocalDomain.

To get around this, all you need to do is specify your user as: .\User

This ensures any domain is not sent as part of the authentication.

When your server restarts you can configure auto logon so the system will automatically login as a user. You can then add items to the startup for that user, which would mean after a server restart programs can be automatically launched.

• Click Start Run and enter: control userpasswords2
• Clear the checkbox for Users must enter a user name and password to use this computer and click OK. 
• If this checkbox is missing (your computer is part of a domain), you need to open an elevated command prompt and type:
  • reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d "1" /f
  • reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultDomainName /t REG_SZ /d %USERDOMAIN% /f
• Enter the user name and password that will be used for Automatic Logon and click OK

When the computer starts up the account you specified will be logged in automatically. 

You can then setup any application you like to start on user logon.

1. In Explorer open: C:\Users\<YourUserName>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
   (note replace '<YourUserName>' with the username you are logging in with)

2. Open the location that contains the item you want to create a shortcut to.

3. Right-click the item, and then click Create Shortcut. The new shortcut appears in the same location as the original item.

4. Drag the shortcut into the Startup folder you opened in step 1.

If your MySQL database has been corrupted or you don't have access to it any longer, you may get this error when you try to access MySQL server on Windows.

Solution:

1. Stop MySQL service (from services.msc)

2. Create a text file in C:\ called “init.txt”. Paste the following code and save it.

GRANT ALL PRIVILEGES ON mysql.* TO root@localhost IDENTIFIED BY 'YourPassword!' WITH GRANT OPTION;
GRANT ALL PRIVILEGES ON mysql.* TO root@127.0.0.1 IDENTIFIED BY 'YourPassword!' WITH GRANT OPTION;

3. Open command prompt (cmd)

4. Go to MySQL bin directory on cmd.

Example: C:\Program Files\MySQL\MySQL Server 5.1\bin

5. Start MySQL service on cmd.

mysqld --init-file=C:\\init.txt

6. Close cmd and kill “mysqld.exe” from task manager.

7. Start MySQL service.

Now you should be able to connect MySQL via root user.

Mail Enable offers a free version of their Mail Server which is fantastic for most small businesses.

Note: If you intend to install MailEnable on your server you should NOT install the Microsoft SMTP Server unless you run it on a separate port.

• Go to http://www.mailenable.com/ and download the Standard Edition to your VPS
• Run the installation file and follow any instructions
• Once installed, click on the 'MailEnable Administrator' which should be on the desktop (if not find it in the Start menu)
• Expand 'Post Offices' -> POSTOFFICENAME
• Click on 'Create Mailbox'
• Add your mailboxes
• Expand 'Servers' -> 'localhost' -> 'Connectors'
• Right click on the 'SMTP' connector and choose 'Properties'
• We recommend visiting each tab and reading each setting. If you intend to send mail out from the server you will need to 'Enable Mail Relay' on the 'Relay' tab, and add your server IP and 127.0.0.1 to the 'Privileged IPs' list. To support local IPV6 addresses we also recommend adding the following to the Privileged IP list (not adding this may result in emails sent from IIS being rejected):

0000:0000:0000:0000:0000:0000:0000:0001

This results in: 'Windows updates failed to install, rolling back changes' message that often does not complete.

First you need to stop your VPS (use the poweroff if it has been more than an hour rolling back changes).

Then you need to mount the Windows DVD media, this is found in the portal DVD library, see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/33/0/mount-a-dvd

Then you need to turn on the system, and view the console immediately, so you can hit the button to boot from the DVD.

Once there select your language and click next. Then on the following screen do NOT click 'Install Windows'. There is an option to Repair a windows installation in text on the bottom of the screen.

From there choose Troubleshooting and command prompt.

Fix #1: Delete cleanup.xml and pending.xml

Deleting the cleanup.xml and pending.xml files from the WinSxS folder.

1. Type these commands and press Enter:

   del D:\Windows\WinSxS\cleanup.xml
   del D:\Windows\WinSxS\pending.xml

   D:\ is the letter where the windows installation is. This is usually where it resides after booting from the DVD.

2. Type exit to quit Command Prompt
3. Restart the computer

See if it now boots. If not try the second method (we have had more success using the second method). 

 

Fix #2: Use DISM

If deleting pending.xml and cleanup.xml doesn’t work, use the DISM command:

1. Boot from the installation media and access Command Prompt (after you select Repair your computer > Troubleshoot > Advanced options > Command Prompt)
2. Type the DISM command:

   dism /image:D:\ /cleanup-image /revertpendingactions

3. Press Enter

 

 

To open a port in Windows 2012 and Windows 2008

• On the Start menu, click Run, type WF.msc, and then click OK.
• In the Windows Firewall with Advanced Security, in the left pane, right-click Inbound Rules, and then click New Rule in the action pane (upper right corner).
• In the Rule Type dialog box, select Port, and then click Next.
• In the Protocol and Ports dialog box, select TCP. Select Specific local ports, and then type the port number you wish to open. Click Next.
• In the Action dialog box, select Allow the connection, and then click Next.
• In the Profile dialog box, select all profiles. Then click Next.
• In the Name dialog box give the rule a name. Then click Finish.

On your Local Computer

• Click on the Start button and open Control Panel then open “Devices and Printers”
• Right click on the network printer that needs to be redirected and choose “Printer Properties”
• Click on the Ports tab and put a check next to “Enable printer pooling” and next to the “LPT1:” in the list then click the OK button to finish.
  
• Click on the Start button and open Remote Desktop Connection then click on the “Local Resources” tab.
  
• Click on the “More…” button at the bottom then put a check next to the Ports item then click the OK button.
  
• Make sure to go back to the General tab and click on save before clicking on the Connect button.
• Once connected download and install the needed print driver but do not create the printer itself yet.

On the RDP Server

• Inside the Remote Desktop connected computer you first need to install the drivers for the printer you are trying to connect, you should be able to download them and install them from the manufacturers website.
• Once the drivers have been installed, click on the Start button and open Control Panel then open “Devices and Printer”
• Click on the Add Printer button at the top then click on the “The printer that I want isn’t listed” link at the bottom of the window that opens.
  
• Click on the radio selection next to “Add a local printer or network printer with manual settings” then click on the next button.
  
• Click on the list “Use an existing port” and choose “TS001:” which usually corresponds to the LPT1: port redirection, but it may take some trial and error going through this list later to figure out which one it is.
• Search through the list of drivers to pick the one associated with the one being connected then click on the Next button.
• If requested, choose to “Replace the current driver” and click on the Next button.
• Change the name as needed and click on the Next button.
• Choose “Do not share this printer” and click on the Next button.
• Test the printer by clicking on “Print a test page” then click the Finish button.

If the printer does not print then open the printer properties on the Remote Desktop connected computer and change the port to TS002: on the Ports tab, click Apply then click “Print a test page” on the General tab to test again. Repeat down the list until the correct port is found.

To upload or download files through remote desktop you need to share a local drive.

To do this start the remote desktop program:

• Click on the 'Start' menu or 'Windows' icon
• In the search/cmd box enter: mstsc.exe

When the window comes up fill out the VPS address, then click on 'Options' (don't click Connect just yet)

Click on the 'Local Resources' tab

Click on the 'More' button under 'Local devices and resources'

There you can select which local drives you want to share with your remote desktop session.

Once you've done that, click 'Connect' to connect to your VPS.

Once you've logged into your VPS, on the VPS open 'My Computer' or 'File Explorer'. Under 'Computer' you'll see your local hard drives and you'll now also see a networked hard drive which leads to your local computer's drive. You can simply copy and paste or drag/drop files across between your local computer and the VPS.

When you remote desktop into a Windows server the clipboard by default should be shared between your local computer and your remote session.

If it's not working, the first thing to do is ensure it is turned on, to do this open a new remote desktop connection window, before connecting click on 'Show Options' , click on the 'Local Resources' tab and ensure 'Clipboard' is checked. Then connect and hopefully you will have a working clipboard.

If this doesn't work, the likelihood is that the rdpclip process has hung on the VPS. To fix this, connect via your RDP session to the VPS, go to the task manager (right click on the taskbar and select 'Task Manager'), then select the 'Processes' tab. Find the process called 'rdpclip.exe'. Select it and choose 'End Process'. Once it disappears, go to 'File' and 'New Task', and enter: rdpclip

This will create a new rdpclip process which will immediately fix the clipboard issue.

Portal Login Explained

If you login to the portal website using your email address and account level password you can administer all your VPSs, change account details, place new orders etc.

If you login to the portal website using your VPS username and VPS password you will only have access to manage a single VPS, no mention of VPSBlocks is made, and no ability to modify your account or order services.

How your Exchange licenses

If you have an existing VPS and would like or have remote desktop licenses, you can adjust the quantity through the portal.

1. Login to the https://portal.controlmyvps.com.au using your email address and password

2. Click on the 'Account' tab

3. Click on 'Manage Services' on the left hand side

3. Select the product 'Remote Desktop License'

4. Click on 'Upgrade/Downgrade'

5. Set your quantity you require.

6. Our staff will login and modify your licensing within your VPS. You MUST make sure that your administrator password is stored correctly in our system so we can access your VPS to adjust the licensing, see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/105/0/how-do-i-change-my-stored-vps-password

To install search engine friendly URLs in IIS:

• Install URL Rewrite 2.0 (see http://www.vpsblocks.com.au/support/Knowledgebase/Article/View/54/8/installing-url-rewrite-module-2-iis-75)
• Open the file in your kayako installation at \__swift\config\config.php
• Change the line define('SWIFT_BASENAME', 'index.php?'); to define('SWIFT_BASENAME', '');
• Modify the web.config file where you have installed kayako, and add the rewrite rules in the system.Webserver tag e.g.:
  
      <system.webServer>
          <rewrite>
              <rules>
                  <rule name="General Redirect (exclude Admin, Staff, static assets)" stopProcessing="false">
                      <match url="^(.*)$" ignoreCase="true" />
                      <conditions logicalGrouping="MatchAll">
                          <add input="{R:1}" pattern="^(admin|api|console|favicon\.ico|robots\.txt|sitemap\.xml|index\.php|tiny_mce_gzip\.php|cron|staff|rss|setup|visitor|winapp|wallboard|__swift)" negate="true" />
                          <add input="{R:1}" pattern="\.(jpg|jpeg|png|gif|js|css|htm|html)$" negate="true" />
                          <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
                          <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
                      </conditions>
                      <action type="Rewrite" url="index.php?/{R:1}" appendQueryString="false" />
                  </rule>
                  <rule name="Redirect for Staff, Admin, etc" stopProcessing="false">
                      <match url="^([a-zA-Z0-9]*)/(.*)$" ignoreCase="true" />
                      <conditions logicalGrouping="MatchAll">
                          <add input="{R:1}" pattern="^(favicon\.ico|robots\.txt|sitemap\.xml|index\.php|tiny_mce_gzip\.php|__swift)" negate="true" />
                          <add input="{R:1}" pattern="\.(jpg|jpeg|png|gif|js|css|htm|html)$" negate="true" />
                          <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
                          <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
                      </conditions>
                      <action type="Rewrite" url="{R:1}/index.php?/{R:2}" appendQueryString="false" />
                  </rule>
              </rules>
          </rewrite>
      </system.webServer>

If you require a snapshot to be taken of a server that is also a domain controller please contact support and we can switch the checkpoint time from production to standard. This will mean snapshots can take longer to work, and may be slower while they exist, but will provide the same level of protection as a production checkpoint.

1. Login to https://portal.controlmyvps.com.au/Cloud.aspx using your email address and password.

2. Click on 'Licensing' on the left hand menu

3. Click 'Add Licenses'

4. Select the license you wish to add and click 'Order Now'

5. Ensure you fill out the required quantity and the specify correctly the VPS name you wish to associate the license with.

6. Complete the checkout process.

7. Support will install the licenses for you.

Portal Login Explained

If you login to the portal website using your email address and account level password you can administer all your VPSs, change account details, place new orders etc.

If you login to the portal website using your VPS username and VPS password you will only have access to manage a single VPS, no mention of VPSBlocks is made, and no ability to modify your account or order services.

How your Exchange licenses

If you have an existing VPS and have Exchange installed, it's important to keep your licensing up to date in our system. Any time you add or remove a mailbox you must report your usage within the portal.

1. Login to the https://portal.controlmyvps.com.au using your email address and password

2. Click on the 'Account' tab

3. Click on 'Manage Services' on the left hand side

3. Select the product 'Microsoft Exchange SAL'

4. Click on 'Upgrade/Downgrade'

5. Set your quantity based on the number of mailboxes you have in your Exchange Server. This MUST be kept up to date as Microsoft occasionally audits licenses.

Fix Internet Explorer Certificate 'Continue to this website' not working

This occurs when a site you are visiting has under a 1024 bit encryption method. By default internet explorer will not allow you to visit the site at all, and clicking 'Continue to this website' will just reload the prompt page. This often happens when connecting to devices or to self signed certificates with a 512 bit encryption.

To fix this you need to add a registry key:

Open Regedit.exe

Browse to:

HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDLLCreateCertificateChainEngine\Config\

Create a new DWORD (32 bit) value:

DWORD (32 bit) : MinRsaPubKeyBitLength
value : 512 (decimal)

Open a new Internet Explorer browser window and you will now be able to click 'Continue to this website' and it will work.

If you would like to connect to your Windows 2003/2008/2012 server from an older version of Windows XP and remote desktop cannot be found when you follow this article: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/40/0/how-do-i-use-remote-desktop-rdp

Then you may need to install the remote desktop connection software first. To do this simply download it at: https://www.microsoft.com/en-us/download/details.aspx?id=22465 

Run the installer and follow the instructions.

Port forwarding can be useful to map incoming ports to other open ports on your machine. The following example you have an SSL connection initiated on port '12345', but handled by a service listening on port 443. To do this, the following command is entered on the command line:

netsh interface portproxy add v4tov4 listenport=12345 listenaddress=192.168.1.1 connectport=443 connectaddress=192.168.1.1

Port 12345 is mapped to port 443 on the same machine. To have the traffic transferred to another machine, change the ip address for the connect address to the desired ip address.

In Windows if you want to press ctrl-alt-delete you actually need to press:

ctrl + alt + end

This will perform a ctrl-alt-delete on the VPS (instead of your local machine)

By default our Windows VPSs are provisioned with paging disabled. This is primarily due to the extra IO this creates by clients ordering servers with a small amount of RAM and creating large page files to compensate.

However, some programs such as Exchange require a page file to operate properly.

To enable paging you need to:

1. Login to your VPS through RDP

2. Go to Start and run 'Regedit'

3. Find the key at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

4. You should see a value in there called 'PagingFIles'. Delete it.

5. Go to the control panel -> Advanced System Settings

6. On the advanced tab under Virtual Memory click 'Change'

7. Set the button 'Automatically manage paging file size for all drives'

8. Click OK

9. You will need to reboot for this to take effect.

If you are embedding true type fonts in your webpages, you must add a mime type to IIS to enable support of Firefox.

By default IIS has EOT and TTF files in the mime type list, you should also add WOFF.

To do this:

• Open IIS
• Click on your website
• Click on 'Mime Types'
• Click 'Add'
• Enter the mime type extension: WOFF
• Enter the mime type: application/octet-stream
• Click 'OK'

If your Windows installation is using a lot of disk space for the system, you can easily clean it up and free disk space by removing outdated updates. By default Windows keeps a store of all updates downloaded. Over time this can use a lot of disk space.

Removing the updates means it's not possible to uninstall updates, but it does free a lot of disk space.

Windows 2012 R2 and Higher

To do this open a powershell window and type the command:

Dism.exe /online /cleanup-image /StartComponentCleanup /resetbase

This may take a few hours depending on how many outdated updates your system has stored.

net stop wuauserv
net stop bits
del c:\windows\SoftwareDistribution /q /s
net start wuauserv
net start bits

For full information see: https://blogs.technet.microsoft.com/askpfeplat/2015/02/09/how-to-reduce-the-size-of-the-winsxs-directory-and-free-up-disk-space-on-windows-server-2012-r2-and-windows-8-1-or-do-we-even-need-to/

Windows 2008 R2

1. Download and install this hotfix on your system: https://www.microsoft.com/en-us/download/details.aspx?id=42739

2. Download the powershell script available here: https://gallery.technet.microsoft.com/scriptcenter/CleanMgrexeKB2852386-83d7a1ae to c:\

3. Open a cmd prompt and type: powershell -ExecutionPolicy ByPass
This will allow your powershell to run the script you just downloaded
Then run the script by typing: c:\cleanup-disk.ps1

Log into your server using remote desktop.

2. Click on start > administrative tools > windows firewall with advanced security.

3. On the left side of the firewall window click on the inbound rules option.

4. On the right side of the screen click on New Rule.

5. Click on the custom radio button and then click next.

6. Make sure the All programs radio is selected then click next.

7. On the protocol and ports options leave everything at its defaults and click next.

8. On the scope screen you will see two boxes the top one is for local IP addresses and the bottom is for remote IP addresses. In this scenario we are trying to block an outside (remote) IP from accessing anything on the server so we will need to add the IP address to this section only as it will not be a local IP address.

9. Click on the radio that says "these IP addresses " in the remote section as shown below:

10. Click on the Add button.

11. In the next window we will be adding a single IP address to the rule, you can also add an entire range at this point if you wish.

12. Click ok, click next.

13. Make sure you select the Block the connection radio on the next screen and then click next.

14. Leave all of the options on the next screen checked this will be sure to block the IP no matter the connection they are trying to use. Click next.

15. Name the rule on the next screen something you can remember in case you wish to remove or edit it in the future. Click finish and thats it.

If you click on the Start button and type: resource monitor it should come up as an option. Alternatively in the Run box type: perfmon /res

This will open your resource monitor.

Click on the 'Network' tab

Then click on the white square box to the left of a service that is using a lot of bytes (note that VPSBlocks only tracks Bytes Sent so look in the 'Send (B/sec)' column.

You can also click on 'System' which usually gives you a good idea of what hosts you are connected to.

Using this information you can determine what is using your bandwidth, you can stop the associated service, or block IPs/Addresses in your firewall.

Server 2012/2008 R2 unlike their predecessors, comes with the multiple remote desktop session restriction enabled. If you are only connecting to a server for remote administration purposes that can get a bit annoying, especially if you have a generic administrative account that multiple techs are using, and you keep kicking each other off the server.

Just as with earlier versions of Windows server you CAN have two RDP (remote desktop) sessions at any one time, the restriction is one logon for one account. Thankfully you can disable the restriction and there are a number of ways to do so.

Server 2012 and 2008 R2: Enable Multiple RDP sessions via the registry

1. Start > in the search/run box type: regedit

In regedit navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server

To Generate a Certificate Signing Request (CSR) — Microsoft IIS 7

1. From Start, select Administrative Tools, and then select Internet Information Services (IIS) Manager (IIS must be installed through Server Manager - Install Roles and Features).
2. In the Connections panel on the left, click the server name for which you want to generate the CSR.
3. In the middle panel, double-click Server Certificates.
4. In the Actions panel on the right, click Create Certificate Request....
5. Enter the following Certificate Properties, and then click Next:

   NOTE: The following characters are not accepted when entering information: < > ~ ! @ # $ % ^ * / \ ( ) ? &

   • Common Name — The fully-qualified domain name (FQDN) — or URL — for which you plan to use your certificate (the area of your site you want customers to connect to using SSL).
     • An SSL certificate issued for www.domain.com is not valid for secure.domain.com. If you want your SSL to cover secure.domain.com, make sure the common name submitted in the CSR is secure.domain.com.
     • If you are requesting a wildcard certificate, add an asterisk (*) on the left side of the Common Name (e.g.,*.domain.com or *.secure.domain.com).
   • Organization — The name in which your business is legally registered. The organization must be the legal registrant of the domain name in the certificate request.

     NOTE: If you are enrolling as an individual, enter the certificate requester's name in the Organization field, and the acronym DBA in the Organizational Unit field (Doing Business As)

   • Organizational Unit — Use this field to differentiate between divisions within an organization (such as "Engineering" or "Human Resources").
   • City/Locality — The full name of the city in which your organization is registered/located. Do not abbreviate.
   • State/Province — The full name of state or province where your organization is located. Do not abbreviate.
   • Country — The two-letter International Organization for Standardization- (ISO-) format country code for the country in which your organization is legally registered.
6. For Cryptographic service provider, select Microsoft RSA SChannel Cryptographic Provider .
7. For Bit length, select 2048 or higher, and then click Next.
8. Click …, enter the location and file name for your CSR, and then click Finish.

Once you have been supplied with a certificate from your provider or from us, see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/143/0/purchase-an-ssl-certificate

Then you need to install it.

Installing the certificate

Then, to install the primary SSL certificate, you must complete the pending request, and then bind the certificate to your website.

To Install an SSL Certificate in Microsoft IIS 7

1. Click Start, mouse-over Administrative Tools, and then click Internet Services Manager.
2. In the Internet Information Services (IIS) Manager window, select your server.
3. Scroll to the bottom, and then double-click Server Certificates.
4. From the Actions panel on the right, click Complete Certificate Request....
5. To locate your certificate file, click ....
6. In the Open window, select *.* as your file name extension, select your certificate (it might be saved as a .txt, .cer, or .crt), and then click Open.
7. In the Complete Certificate Request window, enter a Friendly name for the certificate file, and then click OK.

NOTE: For Wildcard SSL certificates make sure your Friendly Name to matches your Common Name (i.e. *.domain.com).

1. In the Internet Information Services (IIS) Manager window, select the name of the server where you installed the certificate.
2. Click + beside Sites, select the site to secure with the SSL certificate.
3. In the Actions panel on the right, click Bindings....
4. Click Add....
5. In the Add Site Binding window:
   • For Type, select https.
   • For IP address, select All Unassigned, or the IP address of the site.
   • For Port, type 443.
   • For SSL Certificate, select the SSL certificate you just installed, and then click OK.
6. Close the Site Bindings window.
7. Close the Internet Information Services (IIS) Manager window. Your SSL certificate installation is complete.

To Install an Intermediate Certificate in Microsoft IIS 7

1. Click Start, and then click Run....
2. Type mmc, and then click OK. The Microsoft Management Console (Console) window opens.
3. In the Console1 window, click the File menu, and then select Add/Remove Snap-in.
4. In the Add or Remove Snap-in window, select Certificates, and then click Add.
5. In the Certificates snap-in window, select Computer Account, and then click Next.
6. In the Select Computer window, select Local Computer, and then click Finish.
7. In the Add or Remove Snap-in window, click OK.
8. In the Console1 window, click + to expand the folder.
9. Right-click Intermediate Certification Authorities, mouse-over All Tasks, and then click Import.
10. In the Certificate Import Wizard window, click Next.
11. Click Browse to find the intermediate certificate file.
12. In the Open window, change the file extension filter to PKCS #7 Certificates (*.spc;*.p7b), select the *_iis_intermediates.p7bfile, and then click Open.
    

    NOTE: Do not install your Leaf Certificate in this area. Doing so removes your certificate from the list, and you must reinstall to correct the problem.

13. In the Certificate Import Wizard window, click Next.
14. Select Place all certificates in the following store, and then click Browse.
15. In the Select Certificate Store window, select Intermediate Certification Authorities, and then click OK.
16. In the Certificate Import Wizard window, click Next.
17. Click Finish.
18. Click OK.
19. Close the Console 1 window, and then click No to remove the console settings.

To turn off Internet Explorer Enhanced Security Configuration (IE ESC):

• Click 'Start' -> 'Administrative Tools' -> 'Server Manager'
• On the left hand pane click 'Server Manager (SERVERNAME)'
• On the right hand pane in the 'Security Information' section you will see the option 'Configure IE ESC' - click on it.
• You can then turn off IE ESC for Administrators or Users.

To get around this issue on Windows you need to modify the NIC metric for the NIC that is connected to the private network.

First go to the properties of the new NIC and then highlight 'Internet Protocol Version 4 (TCP/IPv4)' from the list and click on 'Properties'

Now click on the 'Advanced' button

Now uncheck 'Automatic Metric' and enter a value of 700 then click 'OK'

This will ensure that the second gateway the DHCP server has added does not override the primary gateway and you will be able to create outgoing connections without any issues.

This is not required on Linux operating systems.

Secondly, if you are using SQL Management Studio or anything else that does reverse DNS lookups when connecting to an IP, you may find that connecting to the local internal IP is slow (as there are no reverse DNS entries for local IPs). To get around this you can add an entry in the hosts file so that the local IP resolves to something. Generally adding "192.168.x.x localhost" to your hosts file will fix it (replace x.x with the local IP octets). The hosts file is found at c:\windows\system32\drivers\etc\hosts and can be edited with notepad when run as administrator.

If you have a SATA backup drive and have been taking Windows backups to it, then need to restore your system drive, you need to follow the instructions located at this article:

http://www.techrepublic.com/blog/data-center/how-to-restore-a-system-image-in-windows-server-2012/

Through the self service portal (https://portal.controlmyvps.com.au) you can mount the Windows 2012 DVD and then access the console to perform the restore.

First navigate to the 'Server Manager'. Start --> Right-Click Computer --> Manage.

Once in the 'Server Manager' Expand Configuration --> Local Users and Groups>Users.

Right-Click 'Users' then select 'New User...'

Make sure to fill the user name and create a strong alpha numeric password. (For the best security practices always include one number and one letter with a mix of capital and lower cases.)

You may also check 'User cannot change password' to ensure the password is not changed.

Check 'Password never expires' to prevent being locked out of the server.

Now that the user has been created you want to make them a part of the 'Remote Desktop Users' group.

Right-Click the new user and select 'properties'.

Select the 'Member Of' tab then click 'add'.

Click 'Advanced'.

Click 'Find Now'.

Scroll down the list of users and select the 'Remote Desktop Users' group.

You should now see the 'Remote Desktop Users' group in the 'Member Of tab'.

Click 'OK'.

To configure SMTP e-mail for a Web application

1. Click 'Start' -> 'Administrative Tools' -> 'Server Manager'
2. Click on 'Features'
3. Click on 'Add Features'
4. Double-click SMTP Server.
5. Click 'Add Required Role Services'
6. Click 'Next' twice then click 'Install'.
7. After installation go to 'Start' -> 'Administrative Tools' -> 'Internet Information Services (IIS) 6.0 Manager'
8. Double click on your COMPUTERNAME
9. Right click on 'SMTP Virtual Server' and go to Properties
10. Click the 'Access' tab
11. Click 'Relay'
12. Add 127.0.0.1 and any IPs assigned to this machine that you want to be able to send emails through from scripts on your server.

If you are using a Mac you can grab the Remote Desktop connection client here: https://itunes.apple.com/au/app/microsoft-remote-desktop-10/id1295203466?mt=12

If you are trying to connect to a Windows 2012 R2 server through remote desktop from a Mac, you need to ensure you are using the latest version of Microsoft Remote Desktop Client. This should allow you to connect and bypass any certificate error caused by the self-signed remote desktop certificates used by Windows.

If however, you cannot do this, you can still connect via your older version of Remote Desktop Client for Mac by requesting support to make a group policy change, or making it yourself through the web based console, see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/28/0/how-can-i-get-console-access-to-my-vps

The group policy change needs to be:

Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security

The key is called: Require use of specific security layer for remote (RDP) connections

It needs to be enabled and the security method set to RDP.

Once this is done, restart the "Remote Desktop Services" service and you will be able to connect.

If you are having trouble making a connection to your VPS with remote desktop, and it starts to make a connection then fails, the reason is likely that you are out of RAM on your VPS.

This is common on 1 block Windows plans, as 1GB of RAM does not allow many programs to run before the operating system has memory issues.

To regain access you should use the console access in the portal, see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/28/0/how-can-i-get-console-access-to-my-vps

Or stop and start your VPS in the portal, see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/34/0/how-do-i-stop--start--restart-my-vps

You should then consider upgrading RAM, see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/86/0/how-to-upgrade-your-memory--ram

When we provision Windows servers we also provision with no paging enabled. Enabling paging can help alleviate this issue, although upgrading RAM is still your best option. See: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/189/0/how-to-enable-the-page-file-on-windows

If you are receiving this message when trying to login, you can generally login if you keep trying. However, there are a few ways around this:

1. Limit the IPs that can connect to remote desktop in the Windows Firewall to stop hackers from being able to attempt to login.

2. Make sure that Network Authentication Only is set in the remote desktop settings. This may reduce hacker attempts at accessing your RDP server.

3. Change the maximum outstanding connections limit. This is done in the registry at:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\MaxOutstandingConnections

You will need to go to regedit.exe and browse to:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\

Then create a DWORD value called: MaxOutstandingConnections

Give it a Decimal value of 3000

When you connect via RDP and your local computer is a member of a domain, it will automatically pass that domain as part of the administrator username. As the VPS will not be part of the same domain as your local computer it will fail.

To bypass this, you need to adjust the setting in the Remote Desktop client:

• Open the Remote Desktop Client (mstsc.exe)
• Click on 'Show Options'
• Set the username so it is simply: administrator (not xxxx\administrator)
• Click Connect

Please note that when prompted you may have to type the password rather than cut and paste it.

All Windows systems automatically come pre-loaded with an activation key. Activation will occur automatically within 30 days of your VPS being provisioned, so there's no need to do it manually. If you do wish to do it manually, hit the 'Activate Now' button in the System Manager, it will prompt you to enter a new product key, leave this blank and hit 'Next'. This will then activate successfully.

This can take up quite a few GBs of data, however, these files can be safely and easily removed using powershell.

If you have a service pack installed, you can remove the old files from storage by opening powershell and typing the command:

dism /online /cleanup-image /SPSuperseded

Once that is complete, you can then cleanup any old files from newer updates by typing:

dism /online /cleanup-image /StartComponentCleanup

On Windows 2012 R2 or greater you should run this command to remove all superseded files for all components:

dism /online /cleanup-image /StartComponentCleanup /ResetBase

Then type the following commands:

net stop wuauserv
net stop bits
del c:\windows\SoftwareDistribution /q /s
net start wuauserv
net start bits

To install .NET 3.5 you need to do the following

1. Mount the Windows 2012 R2 DVD, see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/33/0/mount-a-dvd

2. Open a powershell window and type: Install-WindowsFeature -name Net-Framework-Core -source D:\sources\sxs\

Note: the above line assumes that the install DVD is mounted at D:

1. Click start

2. Type msconfig

3. Go under the "Boot" tab

4. Click "Advanced options" button

5. Uncheck "Maximum memory"

6. Reboot the server.

 

 

At the command prompt, run the following commands:

c:
cd Windows\System32
ren Utilman.exe Utilman.exe.old
copy cmd.exe Utilman.exe

• Close the command prompt, remove DVD/ISO and then reboot the system.
• The server should now boot and present the logon screen (or send the ctrl-alt-del button to see the login screen).
• Press the accessibility icon in the lower left corner.

At the prompt you can change the password, by typing the following command:

net user administrator Password123

This will set the password for the Administrator user to be Password123 (case sensitive).

Now repeat the DVD/ISO boot steps and open command prompt above and run the following to set it back:

c:
cd Windows\System32
del Utilman.exe
ren Utilman.exe.old Utilman.exe

Reboot the system and you can now login using the password you set.

If you are running Outlook on your VPS and trying to connect to an Exchange server and the connection is failing. The problem may be a result of a bug outlined here: http://support.microsoft.com/kb/2794253

The easiest solution is to simply disable IPV6 on your VPS. You can do this by going to the network properties on your VPS, right clicking on the network adapter and selecting properties, then unchecking ipv6. This will immediately stop ipv6 from working and all new domain resolution lookups will return ipv4 addresses.

You can also disable it through powershell, however, it requires a restart afterwards, see: https://www.vpsblocks.com.au/support/Knowledgebase/Article/View/79/0/solving-slowness-accessing-some-sites-through-your-vps

Sometimes you receive an error when you try to install roles/features. This can occur for many reasons, but primarily it occurs due to lack of available memory, and Windows cannot complete an installation properly.

When this happens, this can cause component store corruption. To fix this, open a powershell window and type:

dism /online /cleanup-image /restorehealth

Restart your server afterwards.

To extend a partition in Windows 2003 you need to use the command utility DISKPART.

Firstly, note you can ONLY extend the last volume on a disk.

Open a command prompt and type: diskpart

Type: list volume

Find the last volume on the disk (e.g. Volume 1)

Type: select volume 1

Type: extend

This will extend the selected volume with any remaining/free space on the partition.

One cannot RDP into the VPS unless another person logs off.

Previously it was possible to login via RDP even if there were two people currently logged in, RDP used to ask if you would like to disconnect or force disconnect.

One can still login via direct console with no issues  but not via RDP without having another person logged off.

Fix:

To increase the maximum number of simultaneous connections by using the Local Group Policy Editor:

1. Log on to the RDP server by using a user account that is a member of the local Administrators group.
2. Click Start, type gpedit.msc in the Search box, and then press ENTER.
3. Navigate to the following path: \Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.
4. Double-click Limit number of connections.
5. In the RD Maximum Connections allowed box type a number that is greater than or equal to the maximum number of simultaneous connections for the RD Session Host server (or 999999 for unlimited), and then click OK.

When clicking on a hyperlink in Outlook, this warning appears. Your organization's policies are preventing us from completing this action for you.

To resolve this issue please install the hotfix (designed for Windows 10), available here:
https://support.microsoft.com/en-gb/help/310049/hyperlinks-are-not-working-in-outlook
Hotfix name: MicrosoftEasyFix50388.msi

To get the hotfix to run on Windows server 2019 use the compatibility troubleshooter (otherwise it doesn't run for 2019).

Ensure you are logged in as administrator. Once run it works fine for all users (HKEY Class registry update with missing html classes).

Select the Standard Deployment option

Deployment scenario is session NOT VDI.

Select the Domain Controller for all services, RD Connection Broker, RD Web Access, and RD Session Host.

Select as a session host. Once you have confirmed and selected Restart. RDS will then start to install.

There you have it ….. The Domain Controller now has the Connection Broker, Web Access and Session Host roles.

Now set Deployment Properties in the Deployment Overview click 'Tasks' -> Edit Deployment Properties and ensure the licensing it set to per user.

Click on RD Licensing to install licensing. Do NOT install gateway that is for web farms. You then need to add the server to the collection (click tasks -> create collection).

If you cannot add the server to the collection make sure there are no GPO policies at:

• Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Security
• Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing

Then run gpupdate

Once your collection is created open the licensing and register and license.

If there are issues:

1. Remove all registry settings at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services and HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server and HKLM\SYSTEM\CurrentControlSet\services\TermService

2. Set all group policy settings to unconfigured Computer Configuration\Policies\Administrative Templates\Windows Components\Terminal Services or Remote Desktop Services

Go to Server Manager Select Add roles and Features, then select Remote Desktop Services Installation.

Select the Standard Deployment option

Deployment scenario is session NOT VDI.

Select the Domain Controller for all services, RD Connection Broker, RD Web Access, and RD Session Host.

Select as a session host. Once you have confirmed and selected Restart. RDS will then start to install.

There you have it ….. The Domain Controller now has the Connection Broker, Web Access and Session Host roles.

Now set Deployment Properties in the Deployment Overview click 'Tasks' -> Edit Deployment Properties and ensure the licensing it set to per user.

Click on RD Licensing to install licensing. Do NOT install gateway that is for web farms.

Add the server by clicking the right arrow and click 'Next'. Then click 'Add' to complete.

You then need to create a collection and add the server. To do that click on 'Collections' on the left hand panel.

Then click on 'Tasks' (in the Collections window) and choose 'Create Session Collection'

Enter any name you like e.g. Collection and click Next

Click the right arrow to add the server to the collection and click Next (it may already be added in which case just hit Next)

Domain Users will automatically be added, just click Next.

UNCHECK Enable user profile disks (very important) and click Next.

Click Create.

It may show an Invalid Operation error, this can be ignored.

Now click 'Tasks' on the Collections window again and choose 'Edit Deployment Properties'

Select 'Do not use an RD gateway server'

Check it is in Per user mode for licensing.

Now go to the RD Licensing Manager

If there is a yellow warning icon on the server, click 'Review' if required and 'Add to group' where recommended, then restart the Remote Desktop Licensing service.

Then refresh in the RD Licensing Manager and it should show a green tick.

Double click on the server, then right click on it and choose Manage Licenses. If it says the details are corrupt you need to go to the properties and enter the 'Required Information' fields

Then right click and choose 'Manage Licenses'

Select 'Rebuild the license server' -> this server is being redeployed

Confirm deletion and hit Next

Have VPSBlocks staff install licenses using SPLA as per normal.

Once complete check the RD Licensing Diagnoser.

!!!! If all settings are correct but running RD Licensing Diagnoser still shows the error about inability to connect to Licensing server, please run as below in PowerShell Administrator elevated window:

1. Open an elevated Windows PowerShell prompt
2. Type the following command on the PS prompt and press Enter:
   
   $obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting
   $obj.ChangeMode(4)
   $obj.SetSpecifiedLicenseServerList("localhost")
   
   
3. If you need to run the following command to verify the settings that are configured using above mentioned steps:
   
   $obj.GetSpecifiedLicenseServerList()
   
   You should see the server name in the output.

NOTE ON UPGRADES FROM PREVIOUS OPERATING SYSTEMS: You then will likely need to redeploy the license server in the license manager. You will need to go to properties and fill out the ownership details (just name and company) otherwise it will say it's corrupt.

If you cannot add the server to the collection make sure there are no GPO policies at:

• Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Security
• Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing

Then run gpupdate

Once your collection is created open the licensing and register and license.

!! THE LAST RESORT BEFORE REINSTALLATION !!

1. Remove all registry settings at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services and HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server and HKLM\SYSTEM\CurrentControlSet\services\TermService

2. Set all group policy settings to unconfigured Computer Configuration\Policies\Administrative Templates\Windows Components\Terminal Services or Remote Desktop Services

Once this is done it's important to restart the server, as the existing connections will not be affected by the change, and will continue to consume bandwidth.

To fix this (if you're sure the program is legitimate and virus free), you can modify the security by right clicking on the executable file (.exe), and choosing 'Unblock' in 'Security' which is beneath 'Attributes' if the program is being blocked from starting normally.

"The trust relationship between this workstation and the primary domain failed"

You will need to re-authenticate and update any tokens on the workstation. This is easily done by logging into the workstation as the local administrator (./Administrator) and then running:

Reset-ComputerMachinePassword -Server domaincontroller -Credential Administrator

Re-enter the administrator password when prompted.

If the command 'Test-ComputerSecureChannel' is coming back false you could run

Test-ComputerSecureChannel -Repair -Credential administrator

To fix it from the client end (e.g. the desktop system that runs Outlook)

You need to create the registry key "ExcludeHttpsRootDomain" as a DWORD give it a value of 1. See below for the location.

[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\AutoDiscover\]
"ExcludeHttpsRootDomain"=dword:00000001

Then make sure you close all of Outlook products.

Then go to Control Panel -> Mail (Microsoft Outlook) (32-bit)
Add an account
Put in the details (do not use the manual setup)
If it prompts for a user/pass make sure you edit it and put the email address as the user and the correct pass

It should now succeed with autodiscover and add the mail account without issue.