XBOX game pass for PC

I recently picked up XBox game pass for PC. It was (is if your reading this soon after posting!) $1 for the first month and $5/month after that currently…. although i fully expect that the price will substantially increase if it manages to take off.

I subscribed to Xbox game pass purely to play “the outer worlds” without having to wait for 6 months for it to turn up on steam. While it is available via the epic games store – full price simply doesn’t compare to $1 (even though the outer worlds is worth every cent of its full price tag)

So – keep in mind that Xbox game pass is in Beta (which is watered down somewhat by the fact that “beta” is increasingly used as a long term excuse for a shit product)

  • The library of games is OK – but not great. For $1 or the reverting price of $5 month it is pretty good. I played “dead cells” for example because it was available via the pass – and discovered how absolutely fucking brilliant that game is. Overall though, there would maybe only be 5-6 games that im truly interested in on the current list… clearly very much based on personal preferences.
  • The speed and responsiveness of the client is just terrible. Clicking a game results in a 10-15 second wait for the main information screen to show, downloads of games are excruciatingly slow – be ready to leave your PC on overnight in order to download a couple of your games. Once your in game, all is good….
  • The app regularly “black screens” (which appears to be a common issue). This is sometimes resolved by restarting the client and sometimes by restarting the PC.
  • The app regularly doesn’t automatically log in
  • The app, if shutdown 1/2 way through a download will commonly “lose” all knowledge about that app, and you’ll need to go back into the store and re-select “install”. So don’t bother queuing up 4 or 5 installs unless you plan on leaving your PC on overnight.
  • Because it downloads everything as “WindowsApps”, most people will have to change their default windows app install location to their larger drive. This ofcourse sets the default for all windows apps – not just the games – this is just poor design. The config/save files etc can also be difficult to find due to the whacky folder structure – but to be fair, steam suffers from this a little as well – as there are no industry standards for this.
  • And perhaps the biggest downside, the app has been shoe-horned in as a way to get people onto the latest versions of Windows 10. While this isn’t an issue for me, i imagine it will be for some people – but more to the point, its that the thinking around the app/storefront seems to be “let leverage this to force Win 10 upgrades and windows apps usage” as opposed to “lets make a genuinely good game storefront/platform to challenge steams dominance and encourage crossplay between Xbox and PC”

 

To sum up – ill be keeping my Xbox game pass (for PC) for at least a few months – primarily because it represents good value for money right now. Given where Microsoft seem to have their focus, i wouldn’t be surprised if this goes the same way as the ultra-successful “games for Windows live” – but i would also be happy to be wrong!

Exchange migration and AdminSDProp

I recently did a piece of work for a client – moving from Exchange 2010 to 2016. Nothing too exciting…. but they did have an interesting issue.

Once migrating some of test mailboxes, inheritance in AD had to be enabled for a few admin accounts before they could connect via outlook and activesync – to be expected (yes yes, i know admin accounts shouldn’t have mailboxes, but we all know that some clients still do this – and thats not the focus of this post)

What was interesting, was that on further investigation – every account has AdminCount set to “1” and had inheritance disabled – not something to handle manually..

On further investigation, it was found that via some group nesting, all users were members of print operators.

Groups with AdminCount=1 can be located utilising the powershell

Get-ADGroup -LDAPFilter “(admincount=1)”

The client did not want to immediately reverse this due to potential client impacts – and while i disagreed – excluding a group from AdminSDHolder was not something i had looked into before – so i was interested.

A short amount of googling later – and reading a long list of articles, we decided to exclude “print operators” from AdminSDHolder. Two of the better articles (for reference) around this were:

https://social.technet.microsoft.com/wiki/contents/articles/22331.adminsdholder-protected-groups-and-security-descriptor-propagator.aspx

https://social.technet.microsoft.com/Forums/windows/en-US/ddd8d964-6c8b-42b0-b170-2cacaa283d1c/adminsdholder-remove-groups-server-operators-print-operators-backup-operators?forum=winserverDS

The condensed version of the overall solution is:

  • In order to exclude a group from AdminSDHolder, you can utilise ADSIEdit to modify  the property dsHeuristic under “CN=Directory Services,CN=Windows NT,CN=Services,CN=Configuration,DC=YourDomain,DC=com”
  • The value can be calculated depending what groups you wish to exclude, the 2nd linked technet social post above has a really nice explanation
  • in my case, i needed to it to “0000000001000004” (without the quotes)
  • Once this is done, clear the AdminCount property from the appropriate group (in my case, this was “print operators” + another group within the long-line of nesting this client had)
  • Re-run the powershell – “Get-ADGroup -LDAPFilter “(admincount=1)” to verify the groups no longer show up
  • Once this is done, we need to remove the “adminCount” from each of the affected user accounts and enable inheritance – to do that, you can run the below script

 

$users = Get-ADUser -ldapfilter “(objectclass=user)” -searchbase “<DN of path you wish to use for your search base>”
#$users = Get-ADUser -Identity <username> ‘ Use this for testing on a single user first

#Get domain values
$domain = Get-ADDomain
$domainPdc = $domain.PDCEmulator
$domainDn = $domain.DistinguishedName

#HashTable to be used for the reset
$replaceAttributeHashTable = New-Object HashTable
$replaceAttributeHashTable.Add(“AdminCount”,0)

$isProtected = $false ## allows inheritance
$preserveInheritance = $true ## preserve inheritance rules

ForEach($user in $users)
{
# Binding the users to DS
$ou = [ADSI](“LDAP://” + $user)
$sec = $ou.psbase.objectSecurity

Set-ADUser -identity $user -clear adminCount

if ($sec.get_AreAccessRulesProtected())
{
#Changes AdminCount back to &lt;not set&gt;
Get-ADuser $user.DistinguishedName -Properties “admincount” | Set-ADUser -Remove $replaceAttributeHashTable -Server $domainPdc
#Change security and commit
$sec.SetAccessRuleProtection($isProtected, $preserveInheritance)
$ou.psbase.commitchanges()
}
}

 

References:

https://social.technet.microsoft.com/wiki/contents/articles/22331.adminsdholder-protected-groups-and-security-descriptor-propagator.aspx

https://sdbrett.com/BrettsITBlog/2016/12/discover-clear-admincount-powershell/

https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee361593(v=msdn.10)?redirectedfrom=MSDN

https://blogs.msdn.microsoft.com/muaddib/2013/12/30/how-to-modify-security-inheritance-on-active-directory-objects-using-powershell/

https://blogs.technet.microsoft.com/chadcox/2018/01/08/adposh-find-and-fix-adminsdholder-orphans-admincount/

http://www.selfadsi.org/extended-ad/ad-permissions-adminsdholder.htm

https://social.technet.microsoft.com/Forums/windows/en-US/ddd8d964-6c8b-42b0-b170-2cacaa283d1c/adminsdholder-remove-groups-server-operators-print-operators-backup-operators?forum=winserverDS

 

VMWare guest server CPU and memory issues

Got a call from a client who was having issues with the SQL instance on their SCCM server – and investigation showed that the SQL service was crashing due to various memory errors (event log and SQL logs) – but the descriptions weren’t overly helpful.

The SQL exception.log shows errors such as

09/12/19 12:23:58 spid 125 Exception 0xc0000005 EXCEPTION_ACCESS_VIOLATION writing address 000001E1F29E3390 at 0x000001E1F29E3390

 

After a bit of investigation, i noticed that the “system” task in task manager was constantly utilising between 20-40% CPU. The “system” task has no associated command line in task manager, so tracking it down required the use of the ever-helpful sysinternal tools – in this case, process explorer.

Once opening process explorer, you can go to the properties of the “system” process and view all its threads – and most importantly, sort by CPU usage.

In this case, i could see that Vmmemctl.sys was using the vast majority of the CPU time within this process.

A quick google lead me to this https://kb.vmware.com/s/article/2138677

While i wasn’t getting blue screens, i was definitely getting memory errors – so this lined up.

Checking the installed programs, i could then see that VMWare tools 10.2.5 was installed, but so was 9.1.

Removed VMWare tools 9.1 from the server and the CPU use immediately dropped – and the memory issues, at least so far, are not longer occurring.

Surprisingly, this didn’t seem to require a reboot after the VMWare tools 9.1 uninstall.

I guess the moral of this story (post) is – keeping your VMWare tools version up to date is wise….. but don’t forget to uninstall old versions as well.

SCCM 1906 release

SCCM 1906 released! – https://docs.microsoft.com/en-us/sccm/core/plan-design/changes/whats-new-in-version-1906

If you want it right now – you can opt-in via the fast ring script – https://go.microsoft.com/fwlink/?linkid=2099733

Another belting release from the SCCM team – while some releases have different focuses over time – generally releases have tended to have something which makes day-to-day admin life a bit easier for someone…. and sometimes, big things, such as passive site servers, that just structurally make the product substantially better.

Anyway – out of this release comes a couple of items that i think are particularly of note to me (other may be interested in different parts – depending on your setup):

  • Site maintenance UI is friendlier
  • Use your distribution point as an in-network cache server for Delivery Optimization
  • Support for Windows Virtual Desktop
  • OneTrace – a preview of a tool which could be dubbed the next-gen of CMTrace…
  • Improvements to co-management auto-enrollment
  • Retry the install of pre-approved applications
  • Task sequence debugger – not there yet – but great that its being thought about – can see this being exceedingly handy as this matures
  • The Disable BitLocker task sequence step has a new restart counter
  • Additional options for WSUS maintenance – these are brilliant. Hopefully this release will also fix bug id 4808740 – i haven’t been able to test this as yet.
  • New Windows 10, version 1903 and later product category – this enables admins everywhere to further reduce the number of updates stored by WSUS – which leads to improvements with server and client performance
  • Role-based access for folders – finally!
  • Administration service support for security nodes – this is potentially a big change – keen to test this out in a bigger environment
  • Collections tab in devices node – gradually chipping away at right click tools functionality
  • Multiselect and delete packages – finally!

 

 

 

 

Microsoft NCSI – prompt for proxy authentication

NCSI has been around for a long time now.

 

It can be disabled by using the policy at Computer Configuration\Computer Configuration\Administrative Templates\System\Internet Communication Management \ Turn off Windows Network Connectivity Status active tests

however, disabling it has impacts on technologies such as direct access.

Recently a client was getting prompted for auth form their proxy, for all connections, wired, wireless and 4G.

Msftncsi.com had been added as un-authenticated location for proxy access, but it was still occurring on Windows 10 1809.

Googling this found a few sites talking about proxy issues, disabling NCSI or re-directing this. I did not want to disable or re-direct, and the proxy issues didnt seem to fit our situation.

I ended up going down the wireshark path and discovered that www.msftconnecttest.com is now the DNS name used for NCSI resolution.

Added this to the list of sites which do no required auth – and all is good with the world again.

MYOB – finding the current library root for server edition

MYOB – other small business owners may be familiar with this software…. its not good software and its expensive…. but it is one of the options out there for small business.

Anyway – upgrade MYOB server edition

When performing this upgrade, it automatically resets the Library location back to the default – which is not helpful…. and there is no way in the GUI to determine the library location (that i can see)

So – in order to ascertain your library location prior to upgrade, check the following registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MYOB\HuxleyServer\LibraryRoot (assuming an x64 server, remove the “wow6432Node” if you are somehow still running a 32 bit server OS in 2019)

HP CM1312 – using the network scanner with Windows 10

I still have an older MFP – the HP CM1312nfi

The printer is detected and installs fine on Windows 10, the scanner however is not detected.

The Microsoft support articles are junk… “Windows will automatically find your devices” – with no assistance on what to do if Windows doesn’t find your device.

The HP site links to the positively ancient product install here – https://support.hp.com/us-en/drivers/selfservice/hp-color-laserjet-cm1312-multifunction-printer-series/3558902/model/3558903 

No great surprise – this installer fails to detect the printer, let alone the scanner.

The “HP Smart” Windows 10 app also doesn’t detect the scanner.

To get this scanner working

  1. Download the product driver install package here https://support.hp.com/us-en/drivers/selfservice/hp-color-laserjet-cm1312-multifunction-printer-series/3558902/model/3558903
  2. Extract the installer to a directory using 7zip
  3. Locate hppasc11.inf within the extraction directory – right click | install
  4. Give it a few seconds – all done.

I suspect HP would you prefer you purchased a newer model…. but its a printer/scanner that still works…. they just haven’t made it easy.

Draytek – central AP management – not so great

I grabbed a couple of Draytek Vigor AP902 access points to work in conjunction with my Draytek Vigor 2925 router and Draytek Vigor 910c access point.

I dont mind the Draytek gear in general – for a home setup it is sufficient… however i did find i needed better wireless range thought that 3 AP’s with roaming would be a good fit…. and Drayteks central management swayed me towards getting an all-draytek solution. (as if you can manage 3 AP’s centrally, why wouldn’t you?!)

In short – it was/is a disappointment. The central AP management interface, accessed via the vigor 2925 is quite basic and there is no feedback indicating if applying a configuration to AP’s has been successful or not (for example).

The biggest issue however is that my PSK was applied incorrectly to all access points – this became apparent when all devices lost connectivity, despite the PSK being “the same”

When logging in directly to one of the access points to troubleshoot, i found the PSK in clear text, missing the last 5 characters. This was both good and bad…. bad as it was displayed in clear text, but good as it made the issue very clear.

From there, i simply updated the PSK on each individual AP, each with a 2.4 and 5.0GHz SSID, so 6 updates – and all was OK. Then disabled central management on the 2925.

If someone else is thinking of going for an all draytek solution for the same reasons…. my impression at the moment is – don’t do it.

I’ve emailed draytek support – and will update this post with their reply.

 

*** Update 07/01/2019 ***

I got a reply from Australian Draytek support – initially i got told “it works fine” – when i replied asking if a WPA2 key with certain characters in it, it does look like that a WPA2 key with “&” in it cannot be managed via the Vigor 2925 central management

Active Directory 2019 and Exchange 2019 – what’s new

The short answer is – not much.

Exchange 2019 was released a few weeks back, but was effectively un-usable, as Exchange 2019 requires Windows Server 2019…. and Windows server 2019 got pulled from release (like Windows 10 1809) due to some issues.

Windows Server 2019 was re-released a few days ago, which allowed nerds everywhere (including me) to put Server 2019 and Exchange 2019 into a test environment.

The most striking thing that is immediately noticeable is that everything looks the same…. The install process, the GUI, the management, all looks the same as it did in 2016. To me, this is a good thing – while Microsoft of the past seemed to believe that moving functions between areas was good – some consistency is nice to have too.

 

Active Directory

First appearances indicate there is nothing new in AD 2019, the installation process and management is exactly the same as 2016.

While installing, there is not even an option to set the forest and domain functional level to “2019” – only 2016.

A quick look at the schema version indicates it has increased and quick google finds this article

https://blogs.technet.microsoft.com/389thoughts/2018/08/21/whats-new-in-active-directory-2019-nothing/

So, while there is something new in the schema, its an incredibly small update….. and there are no new features or functionality of any type to focus on.

 

Exchange 2019

Exchange 2019 is a bit the same as AD, everything appears to be the same as Exchange 2016, from the install process to the management interface.

A google comes up with this

Should you upgrade to Exchange Server 2019?

So there are some changes and feature updates – but these updates may not have an impact/matter to your organization.

 

I found these two releases interesting overall as

  • AD is the core of many enterprise networks
  • Exchange is a core business application

To see a new release of both of these products with very minimal improvements I think demonstrates where all Microsoft’s development effort is going (which, to be fair, we already knew)

 

Always on VPN – technical follow up

As a follow up to my article a few days ago on Always on VPN vs DA – http://www.hayesjupe.com/always-on-vpn-and-da-a-comparison/ – an employee of mine was having a test with some spare time today and came up with the following findings.

  • Configured and tested the VPN server using L2TP/IPSec + PSK, User/Pass using MS-CHAP-V2
  • Attempted to export the VPN profile using the Microsoft script MakeProfile.ps1 (https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#bkmk_fullscript)
    • Doesn’t work if you’re using Folder Redirection, as it tries to write to C:\User\UserID\Desktop instead of using %desktop%
    • Adjusted the script to just write to C:\Temp and it works fine
  • Ran the generated VPN_Profile.ps1 and it comes back with “A general error occurred that is not covered by a more specific error code”. After doing some troubleshooting and googling, worked out that the MakeProfile.ps1 has “<AlwaysOn>true</AlwaysOn>” in it, when it actually needs to be “<AlwaysOn>True</AlwaysOn>” (upper-case T). Thanks Microsoft.
  • Finally got it imported. Attempted to connect and received an error that the destination address didn’t exist.
    • Checked the XML, the “Servers” item was populated correctly
    • Checked the VPN connection in Windows, the “Server” item wasn’t populated. Awesome.
  • Populated the Server field manually, tried to connect, failed.
    • The export also didn’t bring across the PSK
    • Populated the PSK, works.

To sum up:

  • Microsoft’s MakeProfile.ps1 is helpful, but isn’t even remotely reliable for exporting all of the settings
  • No idea why the server isn’t be populated. It’s in the XML, it just doesn’t populate it
  • There doesn’t seem to be a way of using PSK instead of certs – the XML doesn’t seem to have any options for specifying a PSK (that I’ve been able to find)

 

So let me revise my earlier “its very much a v1 product” to “its very much a v0.1 product”