Unable to send email from SBS 2008 Task Scheduler when Event Viewer Audit Failure, error 2147746321

I wanted an SBS 2008 server (which is essentially Windows Server 2008) to email me if there was a login failure recorded. So if someone types the wrong password, or more importantly, starts trying to guess a password, I'll get a notification.

The Event Viewer should let you attach a task to a particular event id, in this case Audit Failure Event ID 4625. Find one in the event viewer (using Filter Current Log > keywords > Audit Failure) then right-click and Attach Task.

Except no matter how many combinations of user/SYSTEM account, Run whether user is logged in or not, highest privileges and then messing with the from field and the smtp server (including a second receive connector on a different port), localhost vs ip vs 127.0.0.1 ... it just wouldn't send an email. I couldn't even see in the Transport Roles verbose logging what was happening. The only hint was in the Task properties under history which showed error 2147746321. That didn't Google to anything that fixed the problem.

So I gave up on that plan.

And decided to attach a script instead, dead simple, ran first time. So open notepad and paste this script in

Set objMail = CreateObject("CDO.Message")
Set objConf = CreateObject("CDO.Configuration")
Set objFlds = objConf.Fields
objFlds.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
objFlds.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "SERVER1"
objFlds.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
objFlds.Update
objMail.Configuration = objConf
objMail.From = "administrator@acmecleaning.co.uk"
objMail.To = "support@redleg"
objMail.Subject = "Security audit failure (Acme Cleaning)"
objMail.TextBody = "Please check the security log on SERVER1 at Acme Cleaning."
objMail.Send
Set objFlds = Nothing
Set objConf = Nothing
Set objMail = Nothing

Save the file as "security-warning.vbs" into somewhere handy like c:\users\administrator and change the task action from send email to run a program, point it at that script.

Oh and you'll need to update the script with your server, from email address and to email address.

Note that the sending port is the default 25 in this example which doesn't allow internal smtp by default. You might want to create another Receive Connector in Exchange Management Console > Server Config > Hub Transport using another port, eg 25025 and allow anonymous internal email via that instead.

Did someone say Mouse !?

Contrary to rumours, I'd just like to confirm I fixed the iMac to capture VHS video, not the cat. I did get help, a lot of help.

DrayTek Vigor 2820 ADSL monitoring with SNMP, whats the line speed OID

One client with a DrayTek Vigor 2820n internet router has a problem with the ADSL upload speed slowing down to around 40-50% of normal on occasion. It has a big impact because there are staff out in the field needing to VPN in to the office to update the main database.

To keep an eye on performance we added SNMP monitoring to the Centrastage console for that client, with an alert to trigger if it fell below 80%. The upload line speed is typically just under 1.2Mbps with the Annex M fast upload option we have on that line. It seems to fluctuate 5-10% in normal operation anyway - possibly some dodgy wiring or just being quite a way from the exchange.

The key element of SNMP monitoring is knowing what object identifier (OID) to monitor. We used snmpwalk to dump them all out to CSV. Then matched the known line speed values to the relevant OIDs:
 .1.3.6.1.2.1.2.2.1.5.4  --- ADSL download line speed
 .1.3.6.1.2.1.10.94.1.1.5.1.2.4  --- ADSL upload line speed

DrayTek have a list of some useful Vigor router OIDs

Have you got any other useful parameters or OIDs to monitor on a DrayTek router ?

MODx Evolution 'Access Denied' to directory in assets\files

Moved a MODX Evo website to a new server, which went pretty smoothly with the standard instructions. However any user trying to access one of the directories under assets/files where all the reports etc are stored constantly got an Access Denied error.

This occurred when going into Elements >  Manage Files

If you're looking closely, you can see the directory 'Test' in this image has been truncated to 'est'. Interesting.

Tracked the fault down to an extra slash in the File Manager path. Go into Tools > Configuration > File Manager and look at the first field, titled File Manager path, see pic.

I had to remove the slash between the [(base_path)] and assets, so the entry should read [(base_path)]assets/files

HTH

MODX Evo server move causes error about unspecified timezone in PHP

Having just moved a MODX Evolution based website from the old server to a 1and1 VPS, we started getting errors about not specifying a timezone in PHP. Tried several suggestions around updating htaccess but no luck.

Adding this line to the index.php did the trick.

ini_set("date.timezone", "Europe/London");

Apparently its because the default PHP setting on the 1&1 VPS is to use Fast CGI

Exporting / copying results from Exchange 2007 Message Tracking troubleshooting assistant

I was trying to track down some specific invoice emails that had allegedly been sent a couple of weeks earlier. Its easy enough to fire up the Message Tracking troubleshooting assistant from the Exchange 2007 Management Console, just look in the Toolbox section. Its a bit like the old Message Tracking Center in Exchange System Manager from the 2003 version.

You specify your message criteria and date range and it shows you all the matching email records. However you really need to get it into Excel to start filtering and sorting the data usefully, especially when it returns 100s of matching emails. However there isn't an obvious copy or export option.

The trick is to click Go Back and look at the shell command that was generated, at the bottom. You can see in this screenshot the equivalent shell command is


get-messagetrackinglog -EventID "SEND" -MessageSubject "invoice" -Start "16/11/2014 07:58:00" -End "28/11/2014 21:08:00"

Copy that line, then start Exchange Management Shell and paste the command (You need to click the shell icon top left then choose the Edit submenu). Before you hit enter to run the command, paste the following to the end of the line: 
| export-csv c:\windows\temp\results.csv
(the | is the Shifted backslash symbol just by Z on the UK keyboard, its the pipe command) 

That will create an Excel friendly report in the Windows\Temp directory

Uninstall Exchange Server 2010 SP3 Rollup 8 requires msexchange.msi

Having been caught with an SBS 2011 server that had the Exchange Server 2010 Service Pack 3 Rollup 8 loaded, just before Microsoft withdrew that update. Apparently it caused connection problems with Outlook clients, although we had no reported issues.

Before you start make sure you've downloaded Exchange 2010 Service Pack 3 and run it, so that its unpacked in a handy directory.

Going into Control Panel > Programs > View Installed Updates, you should see Exchange 2010 SP3 Rollup 7 and Rollup 8.

Select and uninstall Rollup 8. It takes a while to complete but will prompt for the location of msexchange.msi. This is actually the original  SP3 installer, not anything to do with RU7 which is what you'd expect. So when it prompts, browse to the SP3 directory mentioned above, where you already unpacked the files, and choose that msi file.

The RU8 will uninstall and appear to leave RU7 on the updates list, however in reality your Exchange server is now all the way back at SP3 with no Rollups at all.

Reinstall Exchange 2010 SP3 RU7 to bring it back up to date - and wait for MS to reissue RU8.

Bad week for faulty updates!

Offline Files error - 0x80070718 Not enough quota is available to process this command

I was copying files from an old PC to a Win7 64 bit laptop for a client with an SBS2011 server. The laptop was at home, offline, when it started warning about not being able to copy any more files - to be fair there were 20GB of photos involved.

Those laptops are setup to use Offline Files, so the Documents folder is available away from the office. Sounds an easy one, the SBS2011 server has a 2GB file quota for users by default. I checked it was turned off ok, then connected via VPN, tried another copy, still no luck. Double-checked that setting, turned it on and off, again no luck. Had to be something else - not as obvious unfortunately.

Tracked it down to a local limit on the laptop - the offline files disk usage limit was too low. Look in Control Panel > Sync Center > Offline Files > Manage Offline Files > Disk Usage > Change Limits

A more useful error message would have saved a bit of time there.

Intel NUC / Ubuntu 14.04 Rise Vision info display needs to turn off as soon as power button pressed

We've got an Intel NUC, one of the DN2820FYK kits - except its really a DN2830 - we use with the Rise Vision platform to run an information display in a reception area. Very nice bit of kit, boots in no time with Ubuntu 14.04 and a Kingston V300 SSD.

(As an aside, we did test with a Raspberry Pi, but it was just too slow. We've got 4 dynamic elements on the screen plus time, date, logo, weather and unfortunately the Pi just kept getting stuck with 100% cpu)

However we need it to shutdown right away if staff press the power button, not prompt with the confirmation dialog. Thanks to maketecheasier we found the following terminal command to sort that:

gsettings set com.canonical.indicator.session suppress-logout-restart-shutdown true

Press the NUC power button and it will be down in under 5s !

iPad Kindle 'Tap to Retry' unable to download books and descriptions - caused by Norton ConnectSafe

On a home broadband connection one simple way to keep the kids away from dodgy websites - pornographic or security - is to use Norton ConnectSafe. Its a free service and just requires a small change in setup on your internet router. Essentially you use their DNS server settings so if a computer tries to connect to a website with suspicious content, you get redirected to Norton's safe page.

Just had reports in the past couple of weeks of a Kindle device failing to download books and descriptions and reporting that the WiFi wasn't working properly. Then the iPad Kindle app stopped downloading books, just reporting 'Tap to Retry'.

Both worked ok on the WiFi shared off my mobile phone, so it had to be the home broadband setup that was at fault.

The fix was to update the router with the latest DNS server settings from Norton ConnectSafe. So the old settings were 198.153.192.50 and 198.153.194.50.

The latest DNS servers that Norton recommend to use are:
     199.85.126.20
     199.85.127.20

As soon as this was updated and the Kindle/iPad network connections renewed (or device rebooted) then they started downloading again. Success!

Just to note there are additional DNS server changes, depending upon what level of filtering you require ...
     199.85.126.10  (was 198.153.192.40)
     199.85.127.10  (was 198.153.194.40)
     199.85.126.30  (was 198.153.192.60)
     199.85.127.30  (was 198.153.194.60)

More details and instructions can be found on the Norton ConnectSafe Configure Router page.