The request contains no certificate template information

If you want to secure Exchange 2010 with SSL you can have your own Enterprise CA issue a certificate.

However when you try to issue it with the CA MMC, you may receive this error message:


Certificate Request Processor
The request contains no certificate template information. 0x80094801 (-2146875391)

The trick is to use the certreq command-line tool instead. Here is a example of the syntax:

certreq -submit -attrib "CertificateTemplate: WebServer" WebServerCertReq.txt

where WebServerCertReq.txt is the name of the request file from your Exchange certificate.

Thanks to David Rawling and his excellent "Deliberations from Dave" blog. Here is a link to his original post: http://pdconsec.net/certificates-the-request-contains-no-certificate-template.aspx

To generate a CSR from openssl on Linux use this command line:

openssl req -new -newkey rsa:2048 -nodes -out csr_request.csr -keyout privatekey.key -subj "/C=CA/ST=QC/L=MONTREAL/O=domain.com/OU=HEAD OFFICE/CN=host.domain.com"

where:

csr_request.csr: the name of the CSR file generated
privatekey.key: the name of the private key file generated
/C= : country code
/ST : state or province code
/L= : city
/O= : Organisation
/OU= : Organisational Unit
/CN= : The URL you use to access the web server

Search Server 2010 vs SQL Server Express 2012

If you install the free "Microsoft Search Server 2010 Express" using the free "SQL Server 2012 Express"  as the back-end database, MSSSE 2010 still thinks that the database size limit is 4 GB even though it really is 10 GB with this release of SQL Server Express.

The trick is to add an undocumented registry key on the MSSSE server and set it to 10 GB:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office Server\14.0\Search\Global\MaxSearchDBSizeMB of type REG_DWORD and set the value to 10240 (decimal).

MSSSE will now be aware that the database limit is 10 GB.

Thanks to Trevor Seward (MCC) of the TechNet forums for pointing me in the right direction !

Link to the forum thread where you can see the offending SharePoint code: http://social.technet.microsoft.com/Forums/en/sharepoint2010setup/thread/870dde9a-ea60-4133-82fd-f6d25385f035

How to delete or modify an Adtran softphone license

The Adtran softphone does not delete the license file from a computer when it is uninstalled.


The license is in the file "%systemdrive%\ProgramData\ADTRAN\IP SoftPhone\config.cps"


To delete the license simply delete the file. To change the license edit the file with Notepad in administrative mode. Voilà !

Reset a Cisco Router to Factory Default

If you have console access:

router#configure terminal
router(config)#config-register 0x2102
router(config)#end

Erase the current start-up configuration on the router with the write erase command.

Reload the router with the reload command. When prompted to save the configuration, DO NOT save.

Cannot mount an Exchange 2010 database after a dirty shutdown

After a power outage, our Exchange 2010 server could not mount the mailbox database with an error about corrupt or missing log files.


I found the solution on the excellent blog of Mike Pfeiffer.


Here is the link: http://www.mikepfeiffer.net/2010/04/getting-an-exchange-database-into-a-clean-shutdown-state-using-eseutil/


In short I used "eseutil /r /l /d /a" to replay the logs into the database and "eseutil /mh" to make sure that it was in a "Clean Shutdown" state. After that I was able to mount the database again from the EMC.


After the repair, my backup software, ArcServe v.15 could not backup the Exchange mailbox database. It failed with the "AE9708 Check integrity failed. Check the Exchange server status." error message.


However, the "new-MailboxRepairRequest" PowerShell cmdlet did not detect any corruption on the database.


Solution: https://support.ca.com/irj/portal/solndtls?aparNo=RI36088&os=WINDOWS&actionID=3


Disable integrity check !

SonicWall CFS blocks SEPM 12 LiveUpdate

Hi,

Just to share that on my SonicWall TZ200, enabling the Content Filter Service blocks the LiveUpdate from the SEPM 12 server.

The easy solution is to add an exception for the server IP address in the CFS configuration page on the firewall.

HP Proliant server - Multiple Logical Drive Creation with single R5 array

I got a new HP ProLiant DL160 G6 server to replace my aging ML150 G2 file server. It is equipped with the Smart Array P212 controller and 4x 1 TB SAS drives. The OS is Windows Server 2008 R2.


I had to create 2 logical drives (LUNs) from the usable 3 TB RAID 5 array because the disk where Windows is installed must be a MBR disk, which is limited to 2 TB. By having 2 LUNs (100 GB for the OS and the rest for storage) Windows sees them as separate disks, so you can configure the bigger volume as a GPT disk, bypassing the 2 TB limit.


When you press F8 at boot time to access the P212 setup program, you do not have the option to create logical drives inside your RAID array. To enable this function, you must boot on the provided "Easy Set-Up" CD, and access the ACU there.


After that you install the OS on the smaller volume. When Windows is installed, you can convert the second logical drive as a GPT disk, with full access to the disk space.

Thanks to gregersenj from HP ITRC forums for pointing me in the right direction !

See his post at http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1420815

GPO to disable password protection of Microsoft Office files

We do not want our employees to password-protect Microsoft Office files in case they forget the password or they leave the company. If you use AD, there is a GPO to disable this feature in Office.

First you must download the "Administrative templates" for the version of Office you use. Here are some links:

Office 2003: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=ba8bc720-edc2-479b-b115-5abb70b3f490

Office 2007: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=92d8519a-e143-4aee-8f7a-e4bbaeba13e7

Office 2010 beta: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=c3436a99-5c80-48ce-83e8-481f9c3d2288

Extract the files to a temporary folder.

Launch "Active Directory Users and Computers" (aka ADUC) and right-click the domain or OU you want to add the policy to. Select Properties and go to the "Group Policy" tab. You can then edit an existing policy or create a new one.

Once inside your GPO, right-click "Administrative templates" and select "Add/Remove Templates...". Click Add and browse to the temporary folder where you extracted your templates. The name of the template you need to load varies with the version of Office. For Office 2007 the file you need is "office12.adm". Click Close.

Back in your GPO, you will see settings that were not listed before. Browse to "Microsoft Office System 2007", Security Settings and the policy you need to enable is the third last.

At the next policy refresh (you can force a refresh on a client computer by typing "gpupdate" at a command prompt), the "read-only password" option in the "Save as..." dialog box of Word and Excel will be grayed out !

BTW if someone sets an edit password on a document, don't worry. Open the file as read-only and copy and paste the content in a new document.

How to make a Windows 7 "universal disk"

From the ISO file of Windows 7 Ultimate, any language, x86 or x64, you can make a "universal disk" that will prompt you to select which version to install (Home, Pro, etc.).

Use the excellent ei.cfg Removal Utility to edit your ISO file.

From the site: "The resulting ISO images are bit-for-bit identical with those posted on MSDN or TechNet, and their SHA-1 hashes should match the official hashes posted by Microsoft. This tool works by toggling the deletion bit in the UDF file table, eliminating the need for unpacking and rebuilding the ISO."

USB multifunction printer on a W2K3 TS

First, I know that you should not install unsigned third-party printer drivers on a TS, but sometimes you just have to...

A remote user have at home a "Brother MFC-8500 USB" multifunction printer. This is the name of the driver on his XP computer. I wanted to install the driver on our W2K3 TS to enable him to print at home. I went to the Brother web site and downloaded the "Add printer wizard" XP driver for this machine, since there was no W2K3 driver available.

Alas, when I added this driver to the Terminal Server, the name was "Brother MFC8500". So when the remote user logged in I had the infamous Event 1111 on the server's event log:

"Driver Brother MFC-8500 USB required for printer Brother MFC-8500 USB is unknown. Contact the administrator to install the driver before you log in again."

The thing is that the driver's names must match exactly for W2K3 to "see" that it is the good driver and load it.

Since it was only a name issue and I knew that the binaries were OK, I opened the OEMMF01A.INF from the extracted driver files and I seached for the "Brother MFC8500" string. I edited it to read "Brother MFC-8500 USB" and I ran the "Add Printer Driver Wizard" again. As expected the name was in the list and it installed OK.