{Stott.Asia}

A little script I wrote to standardize a bunch of manually created Windows Firewall rules on hosts, with a variety of Display Names. Also added the ability to configure specific parameters, and insert Remote Site / Address to the newly renamed / created rule:

# Set up the variables
$Port = "9000"
$DisplayName = "ServiceName Inbound - $Port"
$Description = "Allow inbound traffic from whitelisted IPs on $Port"
$Whitelist = @("10.0.0.1", "8.8.8.8") 

# Pull a list of all firewall rules
$Rules=(New-object -ComObject HNetCfg.FWPolicy2).rules

# Filter down to the ones that contain LocalPorts=$Port
$RuleFound = $Rules | Where-Object {$_.LocalPorts -eq $Port}

# Pull the name of the rule(s) from the array
if ($RuleFound -eq $null)
        {
        # There is no rule matching, so we need to create one
        New-NetFirewallRule -Direction Inbound -LocalPort $Port -Protocol TCP -RemoteAddress $Whitelist -Action Allow -Profile Domain -DisplayName "$DisplayName" -Description "$Description" 
        }

else
    {
    foreach ($rule in $RuleFound)
        {
        $RuleName = $Rule.Name
        # There was a matching rule, let's amend & rename both the rule Name & DisplayName
        Set-NetFirewallRule -DisplayName "$RuleName" -Direction Inbound -LocalPort $Port -Protocol TCP -RemoteAddress $Whitelist -Action Allow -Profile Domain -Description "$Description" -NewDisplayName "$Displayname" 
        }
    }

We encountered a problem on the Ignition Wizard install of two Avaya IP Office ACCS Contact Centres, whereby after rebooting we could no longer see the Desktop after login, only receiving a black screen. Ctrl-Alt-Delete worked and we could run Task Manager OK, but not spawn Explorer. This happened to two separate 2012 R2 servers, at the same point in the installation process.

When you attempted to RDP to the servers and logon with the Domain admin account there are some errors raised in the Windows Application logs. In particular Event ID 18214

The machine-default access security descriptor for the COM Server application C:\Windows\System32\rdpclip.exe with APPID Unavailable is invalid. It contains Access Control Entries with permissions that are invalid. The requested action was therefore not performed. This security permission can be corrected using the Component Services administrative tool

This error message led me to start looking into DCOM permissions on the server. Below is where I found the modified permission, and the steps to fix it without explorer.exe:

• CTRL+ALT+END to invoke Taskmanager
• File > Run New Task
• Browse to: C:\Windows\System32\dcomcnfg.exe & execute
• Expand ‘Component Services’
• Expand ‘Computers’
• Right-Click ‘My Computer’ & select ‘Properties’
• Select ‘COM Security’ tab
• Under ‘Access Permissions’, select ‘Edit Default’
• Change ‘SYSTEM’ object to remove ‘Remote Access’. Hit “OK”
• 

• From task manager, Start > Run > shutdown /r
• Server reboots & GUI is restored

Went to administer WSUS today, and my MMC window prompted this:

Strange. Started investigating and found the following

• Server was up and connecting via RDP / RPC
• IIS was up
• Windows Internal Database & WSUS Service both up
• Server connecting via telnet on port 8530
• Local admin of the WSUS console via MMC failed with the same error message

Found errors in the event log:

Ran a “wsutil checkhealth”:

Which led me to this error:

So I went off to C:\Program Files\Update Services\WebServices\ClientWebService\ to edit the web.config file. Had to take ownership of the file to enable me to make a change, and added the required flag at the appropriate level:

<serviceHostingEnvironment aspNetCompatibilityEnabled=”true”  multipleSiteBindingsEnabled=”true”/>

Restarted the server and everything started working again

Mucking around with some forum software, and have made a forum available at http://forum.stott.asia

You need to register to post, which will probably put most people off posting – The alternative is a forum full of Indonesian viagra spam, which the internet already has enough of.

You can post threads and request assistance with anything you come across here, or any other server issues which you would like to discuss.