Windows 2012 – miqrogroove

Server Crippled by Updates Again

February update cycle again sent my server into a reboot loop, shutting down all services until I could diagnose the problem on site.

Following the same steps as in my previous post, I switched the boot choice to Safe Mode, and observed another boot failure. This time instead of getting into the weeds of troubleshooting the update system with a second Safe Mode boot, I decided to let the server go back to the normal boot mode, because some other websites have reported this as a good solution.

In this case, the failed Safe Mode boot followed by no other action did successfully restore the server.

After reviewing the Event Viewer logs, I could only find a repeated Event ID 1074, “TrustedInstaller.exe has initiated the restart”. KB2992611 and KB890830 both installed successfully before the loop, then KB4502496, KB2822241, and KB4537814 installed after the loop.

My current recommendation is to disable automatic updates for Windows servers and only perform update checks while on site. Also, run the update check twice in a row. The servicing stack update from December didn’t show up until after recovering from the reboot loop and then checking again for more updates.

Reboot Loop After KB4525246 Update

Several other sites confirmed recent server failures after running Windows Updates. Here are the basic steps I used to recover.

Attach a keyboard and enter BIOS setup. Make sure Quick Boot is disabled.

Press F8 while restarting the server to open the Advanced Boot Options menu.

I tried Safe Mode, but did not see a successful boot there.

Next I tried Repair Your Computer, which brought me to the “Choose an option” screen.

Select Troubleshoot, then select Command Prompt. Follow the instructions to log in as one of the administrators.

Windows 2012 Can’t Ping NVR Host

I just resolved a long-term problem where one specific Windows 2012 server was unable to ping one specific device on the same LAN.

There were no relevant resources or similar-looking cases on the web. Everything else on this LAN worked normally. The server could ping all other clients, and the clients could ping the server and the NVR. I just could not get the server to ping the NVR for the life of me.

I suspected at one point that this was a routing issue due to my desire for strong security policies around IOT devices. This turned out not to be the case as I could find nothing wrong with the router or any routing tables.

At last, I decided this problem was so specific that it could be a bug in the NVR itself. In this case, the only thing special about the Windows server from the NVR’s perspective was that the server was providing both DHCP and DNS to the NVR. I tried disabling each service, and found exactly what I was looking for.

The NVR will not respond to pings from its DNS server.

I don’t know why this is broken and don’t really care to investigate any further. The workarounds are either:

Create a DHCP reservation with its own option to specify a 3rd-party DNS server, OR
Disable the NVR’s DHCP client and set a static address with an alternative DNS server address value.

In my case, the NVR does not need to use the local DNS server, so this is an easy fix. So long as my server’s IP address is not used in the NVR DNS configuration, everything works normally and the server can ping the NVR.

High Resource Use by Start Screen

While diagnosing what I thought was a Windows Update failure, I discovered unrelated massive resource consumption and file scanning activity apparently tied to the Start screen in Windows 2012.

Symptoms:

10 to 20% constant CPU usage by Windows Explorer.

Rapid file scanning or Shared Folder usage in the case of folder redirection.

Triggers:

Resource consumption begins immediately after opening the Start screen and performing a keyboard search.

Closing the Start screen does not help.

Workarounds:

Sign out the current user. This action will shut down Windows Explorer, preventing the unwanted symptoms until triggered again by a user.

Cookies Not Working in IE10

I’ve finally fixed a crippling bug in Internet Explorer 10 that was preventing me from using any website that required cookie support.

This problem seemed to plague my Windows 2012 server from day one. I’m not yet sure what was special about this configuration. No matter how many settings I changed, every website I visited told me that I had cookies completely disabled.

I used these steps right before the browser started working correctly:

Step 1 – Find the “Delete Browsing History” dialog box.

Continue reading Cookies Not Working in IE10

Folder Redirection Broken After GPO Changes

I am learning quite a bit about the Windows 2012 environment thanks to a recent server migration. The biggest lesson so far deals with Folder Redirection, and the effects of repeated adjustments to the GPO settings.

Under certain circumstances, folder redirection seems to get “stuck” showing either an old folder path or none at all when the user goes looking for their documents. The Group Policy Results tool seems to confirm that the Folder Redirection settings are not being applied at all for the user/computer profile that is stuck. Frustratingly, I couldn’t find any problem with my Group Policy configuration.

No amount of logging off and on, adjusting permissions, or messing with Group Policy seems to have any effect.

In the end, I was able to clear up the problem by running this command:

gpupdate /Target:User /Force /Logoff

The key here is the Force option, which successfully resets the folder redirection policy for that user profile, and perhaps all the profiles on that particular computer. Problem solved! Windows 8.1, Windows 2012, and possibly other versions are affected.

Windows VPN Requires NTLMv1

LAN Manager authentication level set to Send NTLMv2 response onlyrefuse LM — Solution Screenshot

I’ve stumbled upon a seemingly undocumented authentication error in the Windows VPN system.

Error 691: Access was denied because the username and/or password was invalid on the domain.

This can be caused simply by elevating the VPN server’s LM authentication level to 5, which refuses the NTLM protocol. According to KB823659 requiring NTLMv2 should not break Windows XP connections unless older systems are involved. However, this configuration does cause client and server authentication errors.

Continue reading Windows VPN Requires NTLMv1