Issue with WSUS after running June 2016 Patch

Problem: I normally patch WSUS server at the end. I ran a quarterly patch on WSUS server itself. Couple of hours after patching I found out that clients were not reporting to WSUS console. I have a GP to let the clients contact WSUS every hour.

On the windowsupdate.log on the client machines. The following warning was registered.
#Warning: Failed to find update with error code 8024008.
-Windows Update client failed to detect with error 0x80244008

WSUS server event viewer:

Event ID : 1310
Event Code : 3007
Event Message ; A compilation error has occurred.
Application Virtual Path  /ClientWebService
Error  BC31007: Unable to open module file 'C:\Windows\Microsoft\Framework64\v4.0.3031a\Temporary ASP.Net Files..............

Scouring the web, not close but got some clue that there might be permission issues.

Solution : Granted Full Access Rights to C:\Windows\Temp folder to the group IIS_IUSRS.

Lo and Behold, no new error 1310 reported in WSUS event viewer and clients started reporting to the WSUS console.

I am not sure whether the new .Net updates /patches changed something but the above solution worked.

vLAG from Brocade VCS LC to Cisco 6509

Just for configuration testing, I am creating single 10G FC vLAG from Brocade VDX to Cisco 6509. It is straight forwarded.

BrocadeSW:

interface port-channel 9
switchport
switchport mode trunk
switchport trunk allowed vlan all
no shutdown

Interface TenGigabitEthernet 5/0/48
channel-group 9 mode active type standard
no fabric isl
no fabirc trunk
no shutdown
lacp timeout long



on Cisco 6509

interface port-channel 9
switchport
switchport mode trunk
switchport trunl allowed vlan all

interface TenGigabitEthernet 8/4
channel-group 9 mode active type standard
switchport nonegotiate
no shutdown


Make sure port-channel 9 is up  and line protocol is up

show port-channel 10

Also make sure interface is up and line protocol is up.


show port-channel detail. Sync status should be 1 to show the link is functional.

Brocade VDX switch : Unable to ping to gateway (mgmt-vrf)

 VDX 6740, running NOS 5.0.0, I am trying to get firmware upgrade... I see in "Upgrade Guide":

You must configure the gateway and default route that is pointing to the management interface within the mgmt-vrf and address-family unicast context.

Here is my configuration on management interface:

=========================================

interface Management 1/0
no tcp burstrate
ip icmp echo-reply
no ip address dhcp
ip address 10.0.8.55/23
ipv6 icmpv6 echo-reply
no ipv6 address autoconfig
no ipv6 address dhcp
vrf forwarding mgmt-vrf

Config for the VRF

=========================================

rbridge-id 1
 vrf mgmt-vrf
  address-family ipv4 unicast
   ip route 0.0.0.0/0 10.0.8.1

I can ping to the address that was assigned to the interface:

=========================================
VDX6740# ping 10.0.8.55 vrf mgmt-vrf
Type Control-c to abort
PING 10.0.8.55 (10.0.8.55): 56 data bytes
64 bytes from 10.0.8.55: icmp_seq=0 ttl=64 time=0.169 ms
64 bytes from 10.0.8.55: icmp_seq=1 ttl=64 time=0.124 ms

....

But i cannot ping to the Gateway address 10.0.8.1

This is the show interface management, it looks fine?

=====================================
VDX6740# show interface Management
interface Management 1/0
ip address "static 10.0.8.55/23"
ip gateway-address 10.0.8.1
ipv6 ipv6-address [ ]
ipv6 ipv6-gateways [ ]
line-speed configured Auto

So now I can't reach to my FTP server via gateway, any suggestion or troubleshoot tips?

Answer:

Starting in version 5.0, enforced separation of the management and data plane was instituted. As a default ping will try to source from the default-vrf. Appending the vrf mgmt.-vrf is needed to source the pings in the management plane.

Brocade VDX : upgrading to new NOS, one of the partition does not get updated.

When upgrading to new NOS one of the partition does not get updated. Following is the only option to get the new NOS on both the partitions.

Requirement: you will have to contact Brocade Tech support to ship you a Brocade USB stick containing basic NOS.

1) Brocade USB stick containing basic unit operating system (in the safe)
2) Requires NFS mountable directory to access the new NOS.
3) Have console port access
After power cycle, hit ESC until you get here
Hit ESC to stop autoboot: 0
1) Start system.
2) Recover password.
3) Enter command shell.
Option? 3
Boot PROM password has not been set.
=> [This is the u-boot prompt]
These environment variables should be set at U-boot
printenv and check for these variables - ipaddr, netmask, gatewayip, serverip. If not set, then assign.
setenv ipaddr <IP address that you want to assign to this device>
setenv netmask <What is the subnet mask used in the lab where the switch is located?>
setenv gatewayip <xx.yy.zz.ww>
setenv serverip <tftp/ftp server ip used>
If these are changed
saveenv

Insert the USB, these are the steps are done at the U-boot prompt:
> usb reset 1
> ext2ls usb 0:1
> makesinrec 0x1000000; ext2load usb 0:1 2000000 tftpboot/castorXX/uImage;ext2load usb 0:1 3000000 tftpboot/castorXX/ramdisk.image;ext2load usb 0:1 4000000 tftpboot/castorXX/silkworm_bd131.dtb; bootm 2000000 3000000 4000000

When this finishes the unit should reboot and come up to a shell prompt. At that prompt enter the following information (management interface address, netmask and gateway).
ifconfig eth0 x.x.x.x netmask x.x.x.x up
route add default gw x.x.x.x

The NOS firmware is loaded using the following steps:

mount -o tcp,nolock <server>:<path>/nos5.0.1d /load
cd /load
./install release
sync
sync
reboot –f

After this finishes the switch should be fully functional with NOS 5.0.1d on both partitions.

Brocade VDX Fun ; SFP breakouts

Shortly I will be deploying bunch of Brocade VDX switches in Logical Chassis Mode to replace the existing Cisco 3750's.

I have a 40 GBPS QSFP+ breakout module.

To configure breakouts:

config t
hardware
connector 4/49
shut
exit
hardware
connector 4/49/1
sfp breakout

I later changed my mind and issued no sfp breakout command. The 40GB port went dead would not respond.

Here is what need to be done after issuing no spf breakout

Login to the LC primary switch
Go to the RBridge where you want to convert back the port
shutdown all the ISL ports that are connected to the LC
verify that all other switches show offline
run Copy default-config startup-config
reboot

Exchange Server 2013 /PrepareAd for Cumultive update installation fails.

Today I was trying to update my Exchange Server 2013 CU4 (SP1) to CU10.

Following pre-installation tasks were done:

1. Stop Symantec Client protection service
2.Uncheck Check for Publisher's Certificate revocation & Check for server certificate revocation on IE
3.Run c:\>%windir%\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update
   c:\>echo %errorlevel%

(The above steps are suggested to speed up the installation)
4. Run setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms (requires Enterprise Admins and Schema Admins permissions, and must be performed in the same AD Site as the Schema Master on a server with the RSAT-ADDS-Tools feature installed – the Schema Master itself would meet these requirements)


5. Run setup.exe /PrepareAD /IAcceptExchangeServerLicenseTerms
As I went to do PrepareAD, it failed with the following error:

he following error was generated when “$error.Clear(); 
install-AdministrativeGroup -DomainController $RoleDomainController

” was run: “Active Directory operation failed on Servername.domain.com. The object

‘CN=Folder Hierarchies,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),

CN=Administrative Groups,CN=Exchange Organization,CN=Microsoft Exchange,

CN=Services,CN=Configuration,DC=Domain,DC=Com’ already exists.”

Scouring the websites, I found the solution posted at Exchange Weblog

CN=Configuration,CN=Services,CN=Microsoft Exchange,CN=Your Exchange Organization,

CN=Administrative Groups,CN=Administrative group,CN=Exchange Administrative Group

(FYDIBOHF23SPDLT),CN=Folder Hierarchies

 

There are multiple methods to fix this issue , Here is the recommended method

by Recreating Public Folders containers.

Use ADSI Edit or a similar tool to locate and expand Exchange Administrative Group (FYDIBOHF23SPDLT).

The Public Folders object can be found at:

CN=Configuration,CN=Services,CN=Microsoft Exchange,CN=Organization,CN=Administrative Groups,

CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Folder Hierarchies

1. Right-click the Folder Hierarchies object, click New, and then click Object.
2. In the Select a class list, select msExchPFTree, and then click Next.
3. In the Value box, type Public Folders, and then click Next.
4. Click More Attributes.
5. In the Select a class list, select msExchPFTreeType, and then click Next.
6. In the Edit Attribute box, type 1, click Set, click OK, and then click Finish

https://blogs.technet.microsoft.com/manjubn/2013/09/02/1-exchange-server-2013-preparead-or-cumultive-update-installation-fails/

https://blogs.technet.microsoft.com/manjubn/2013/09/02/1-exchange-server-2013-preparead-or-cumultive-update-installation-fails/

After creating the new object, /PrepareAD completed successfully.

SlipStream Adobe Reader with Powershell to be deployed using SCCM or psexec

Deploying Adobe quarterly patch and the security update is pain specially when you have environment with no internet connection.

Note: You need to remove the older version of Adobe Reader in order be able to installed the slipstream version of Abode Reader.

Here is how I slipstream quarterly update with security patches

You can download the script from the TechNet Gallery.

To slipstream you need to download the following files from Adobe.
1. Base Installer ( eg. AdbeRdr11000_en_US.exe)
2. Quarterly Update
3. Security Patch

Ftp download link
ftp.adobe.com/pub/adobe/reader/win/11.x/11.0.06/en_US/AdbeRdr11006_en_US.exe

Apply the installer and patches in the following order:
Base Installer -> Quarterly Patch -> Security Patch
11.0.0->11.0.14 -> 10.1.15

Follow the steps to use the Power Shell Script:
1. Downloaded the necessary file(s) to a folder somewhere (should be a local drive or mapped network drive). I’ve downloaded AdbeRdr11006_en_US.exe to C:\Downloads. I’ll refer to this location as the Download folder in this post.
2. Create a folder called AIP. I’ve created it at C:\AIP and will refer to it as the TargetFolder.
3. Download the script from TechNet Gallery and extract it C:\Scripts.
4. Open an elevated PowerShell console, browse to C:\Scripts and run the following command:

.\New-AdobeReaderAIP.ps1 -FileName "AdbeRdr11006_en_US.exe" -DownloadFolder "C:\Download" -TargetFolder "C:\AIP"




5. The script will now start to slipstream Adobe Reader.







Copy the entire AIP folder to the destination computer and run the AcroReader.msi to install.

You can deploy remotely using psexec:

devices.txt contains the host names where you want to deploy it.

psexec @C:\adobe\devices.txt -h -u domain\username -p "password" -c xcopy /y /s "c:\AIP" c:\temp\update

psexec @C:\adobe\devices.txt -h -u domain\username  -p "password" msiexec.exe /i c:\temp\update\AcroRead.msi  /quiet /qn /norestart /l+ c:\temp\update-logs\log.txt