The error was: Error code: MapiExceptionADNotFound: Unable to mount database.
To be more specific, the wizard created the database on AD but couldn’t mount it. After doing some troubleshooting I found out that Exchange was writing to one Domain Controller and reading from another, therefore, it wasn’t an Exchange issue, just needed to wait (or force) replication between DCs.

Forced replication between the DCs on Active Directory Sites and Services and the database mounted instantly. Another thing that you can do is sit back and wait for it to replicate.

I hope this helps you! If it does, please leave a comment.

Date: Tuesday, 28 February 2012Topic: Cloud

User: IT Pro

Location: Park Plaza, Plaza 3-6 Room, Boar Lane City Square, Leeds, LS1 5NS

Synopsis

The aim of this camp is to provide a practical introduction to Hyper-V, for
people new to server virtualisation or those experienced in other server
virtualisation technologies.

The exact content of each camp is driven by you, the delegate. However, we
will follow some broad topics around virtualisation such as:

•     •  Virtual networks in Hyper-V
•     •  A first look at System Center Virtual Machine Manager 2012
•     •  Installing Hyper-V
•     •  Hyper-V licensing and licensing virtual machines
•     •  Microsoft support for virtualisation

Source: http://uktechdays.cloudapp.net/it-pro-camps.aspx

It looked like a DNS issue, as it is the most common cause for failed ADMT agent operations.
The error was ERR3: 7075 (“ERR3:7075 Failed to change domain affiliation”), which drove me to this KB – http://support.microsoft.com/kb/929493
But that was not the solution, as the problem was caused by a specific setting on the Server 2008 Domain Controller policies.

1. The solution: Log on to a Windows Server 2008-based domain controller.

2. Click Start, click Run, type gpmc.msc, and then click OK.

3. In the Group Policy Management console, expand Forest: DomainName, expand DomainName, expand Domain Controllers, right-click Default Domain Controllers Policy, and then click Edit.

4. In the Group Policy Management Editor console, expand Computer Configuration, expand Policies, expand Administrative Templates, expand System, click Net Logon, and then double-click Allow cryptography algorithms compatible with Windows NT 4.0.

5. In the Properties dialog box, click the Enabled option, and then click OK.

Source: http://support.microsoft.com/kb/942564

Happy Migration!

Now that we have a complete inventory and rationalized our applications with MAP and Centrix WorkSpace iQ, we are left with a list of application that will be delivered to the Windows 7 users. The next step is to assess the compatibility of those applications on Windows 7 and on the platform that will deliver the application. There are a few different options here. The first decision to make is “32 or 64 bit” version of Windows 7, this decision will imply changes on the application compatibility results. The recommended platform is 64 bit, and it is recommended to companies without a complex application stack and even more important, no legacy applications.

The second decision is on how to deliver the applications. Will it be installed directly to the physical machine through a MSI? Will it be virtualized with App-V and delivered via streaming? Will it be installed on a Remote Desktop pool and the application will be delivered through presentation virtualization? This is also important, as standards for compatibility for App-V and Servers are different from the OS.

Some of the new security features introduced in Windows Vista and Windows 7 may cause the lack of compatibility. Common issues are Session Zero Isolation, 16 bit components, legacy drivers, hardcoded paths, and application that require to run as administrator. There are different ways to test for application compatibility. Microsoft has a very nice tool called ACT – Application Compatibility Toolkit that will help you run applications on a Standard User Mode (non-admin). It will flag all the issues that are preventing the application to run correctly to help you fix the issues. It will also provide a list of potential fixes and will work with Shims.

But the process with ACT can be very lengthy and painful as the amount of information provided is low the tasks are very manual. An alternative is to use AppTitude by App-DNA (now part of Citrix). App-Titude allows you to import applications and it will run code and behaviour analysis based on the application’s MSI. It will run compatibility analysis and give you results for Windows 7, 64 bit, App-V, XenApp, Server 2008, Server 2008 R2. It will also help you choosing the best option to deploy that application, physical, virtual or hosted on a server. All the results are displayed on a RAG status and in case it is amber or red it will give you remediation guidelines, suggest shims and even propose auto fixes with MSTs. App-Titude will also automate packaging for App-V to help you accelerate the deployment. The greatest advantage of this tool is that you can send all the application that come out as Green straight to UAT and focus your packaging team on the applications that require remediation. It will also tell you how complex it is to fix a specific app so you can easily manage your internal resources or take the decision to use an external packager for that.

Internet Explorer compatibility is also something worth looking at. Some websites where coded a long time ago and might have components that will not run on Internet Explorer 8 or 9. AppTitude can handle analysis of web applications. Another way to solve web application issues is Browsium, a nice piece of software that integrates legacy browser tabs on your current Internet Explorer version, so you can run web application in IE6 mode inside IE9.

There are other methods to solve compatibility issues. For very small companies or departments, you can use Med-V, but you will still need to manage the Windows XP running under Windows 7 and it will also be out of support soon.

Dealing with applications is the lengthiest process on the path to Windows 7 and that is the main reason why you should at it sooner rather than later on the migration journey. The next step is to consider how to deliver Windows 7 to the end user.

Resources:
ACT – Application Compatibility Toolkit

AppTitude by App-DNA

Browsium

Med-V

The Springboard Series

For this just enter these two commands to an elevated (right click on CMD.EXE, run as administrator):

netsh wlan set hostednetwork mode=allow ssid=YOURFRIENDLYSSID key=SOMEPASSWORD

netsh wlan start hostednetwork

At this point, if Internet Connection Sharing (ICS) is setup, anyone can connect to your SoftAP (if they know the PWD of course) and the traffic will be sent through whatever adapter you want. You can actually bridge it across an entirely different adapter… or the same on a different Wifi LAN.

A GUI to set this up can be downloaded for free here: http://www.connectify.me/

You should start with a hardware and software inventory. I recommend using MAP, the Microsoft Assessment and Planning Toolkit. MAP is an agentless application that will take an inventory of machines on your network and tell you what hardware they have. It will also tell you what software is installed on the machines. It will go even further and tell you if the machines are ready to run Windows 7 and Office 2010, based on a few pre-defined factors. Make sure you take out DVD Drive as a requirement (this is a default value), as you will probably use something like WDS and/or MDT to deploy Windows 7. MAP can do much more; check the resources at the end of this article.

MAP will provide the inventory, but it is still hard to understand how the applications are being used. Having an application installed does not mean that the users actually use it. Furthermore, do they use the application when they are at the office or when they work from home? How many concurrent users do you have for an application? Those answers can seriously affect the price you will pay for your licences. To tackle this problem I recommend Centrix WorkSpace iQ. It will monitor application usage on workstation with the agent installed. It can also help you understand how laptops are used. I had a client to run the laptop analysis in 700 laptops and after 3 months we found out that only 96 of them where ever taken away from the docking station, which means that potentially 604 of them can be replaced by a desktop on the next hardware refresh cycle.

Once you understand your hardware and software current state you will need to rationalize the software that is used on your company. It is a great time to remove old versions and retire legacy software. On average each retired application can save up to 3000 dollars during a migration. Choose carefully with software will be delivered on your new Windows platform and work to solve potential application compatibility issues.

Make a list of the hardware that needs to be replaced and find a solution for it, If you have the budget get new machines. If you are tight in budget but have a decent licence agreement give Windows ThinPC a try.

Resources:

Microsoft Assessment and Planning Toolkit

Centrix WorkSpace iQ

AGPM is a tool that will increase the control you will have over your group policies. This toll will help you avoid issues like the one descibed at “Group Policy Management – Steve and Nick’s Tale”.

The key components in Microsoft Advanced Group Policy Management are:

Change Control

AGMP provides a secure archive for controlling changes to GPOs. In order to change a GPO, an administrator has to “check out” the GPO from the voult. When the changes are complete, the GPO gets “checked in” to the vault. Differences between archived versions and live versions are reviewed on the reports tab. When a GPO is ready for deployment it can be transferred to the live environment. The main advantage of this process os that a group policy can be “rolled back” to an archived version.

Offline editing

Group Policy is the centerpiece of security and configuration management on Active Directory®-based networks, and, as such, configuration changes can affect a large number of computers. Offline editing enables you to configure and test changes without impacting live operations, and to deploy those changes with the knowledge that they can be quickly reverted if there are unexpected consequences.

Role-based delegation

Group Policy provides a rich delegation model, allowing administration tasks to be delegated to regional or task-oriented administrators. This is a significant advantage over scripting and utility products. However, the native delegation model allows Group Policy administrators to approve their own changes.

Microsoft Advanced Group Policy Management improves on this by providing an optional workflow process that includes rolebased delegation, review, and approval before deployment to a live environment. At the same time, it preserves the granular delegation inherent in native Group Policy.

GPMC integration

Group Policy Management Console (GPMC) is the central management interface for Group Policy. Microsoft Advanced Group Policy Management provides smooth integration within GPMC.

If you want to learn more about AGPM go to the Microsoft Springboard Website, where you can find documentation, videos, guides, etc.

Group Policy is extremely powerful, and as Uncle Ben told Peter Parker (a.k.a. Spiderman) – ‘With great power comes great responsibility’. The reason I am bringing that up is that is that IT departments overlook the importance of controlling access to Group Policy management. Group Policies are live, as soon as you edit a setting it is already in place. Giving control of group policy to people without the right skills can be very dangerous and can cost the company productivity and financial loss.

As a real life example, I had the opportunity to work with an Education company related to the military services. One of their IT helpdesk people, I will call him Steve, was trying to “open” the internet connection to one of the directors of the business. The Director who was on a resort for a week with his family, wanted to get some work done, and was struggling to connect to the internet. Steve who is a self-tough IT professional uses the tools he feels can address the issue quickly and helps the Director who seemed really happy over the phone. Feeling great because he was able to help a high profile person on the company, Steve goes away to his 2 days off, as planned in advance.

Next morning Steve’s boss Nick can’t access the internet and starts troubleshooting, but it seems that his proxy settings are not being correctly assign and it isn’t long until other users started calling helpdesk about not being able to access the internet. Nick talks to his team and no one knows what might have caused the issue. Steve was away. That is the point when I was called in.

Trying to gather information on symptoms, we identified that the issue was only affecting manages and directors, therefore, very likely to be a proxy setting issue. Trying to get more information I went to the proxy settings on Internet Explorer on Nick’s computer and found that the settings were blank. Nick was surprised that I could even get to the proxy settings as this was a protected menu on IE. This information was enough to find the cause of the issue. Someone, at some point, change a group policy containing a few settings. Looking at the recent changes I could identify which policy was changed the previous day, but not who did it and which settings where affected. The policy name didn’t help much as it was named “Directors and Managers”.

I focused on restoring internet connectivity by specifying the proxy settings, which took over 40 minutes for Nick to find out what is was due to the lack of documentation. I also restricted access to the connections tab on IE.

With the problem resolved and people back to work just after lunch, I had a meeting with Nick. The first question was “What happened?” The answer was easy; someone changed the group policy settings that affect the managers and director. I restored internet connectivity and secured the menu, but can’t guarantee that other settings are on the state that they should be. Than Nick asked, “What can be done to prevent that from happening again?” An my answer was; don’t give more rights to user than they really need, and more specific for this case, make sure that only people who know what they are doing have permissions to manage group policy. You can also use Microsoft Advanced Group Policy Management, part of MDOP, one of the benefits you have because you have Software Assurance on your Windows Licences.

Two days later I get a call from Nick telling me that Steve did it to help a director and he had no clue what he was doing, but then again, he was never trained by the company to do his job properly.

In short, be careful when assigning permissions for IT admin staff, helpdesk, etc. Always give them the minimum rights they need to be able to perform the tasks they are supposed to do. Many companies give “Domain Admin” rights to a lot of people just because it is easier, and that can cause a lot of issues.

Keep it classy IT pros.

Resources:
2008 Group Policy Planning and Deployment Guide
Advanced Group Policy Management Overview

TechDays Online UK 2011 was a very interesting event. I had the pleasure to present 2 sessions, the first about Windows 7 as the best desktop experience and Why Internet Explorer is awesome for the Enterprise. All the recordings for TechDays are available at the TechNet UK Team Blog.

I managed to re-encode my sessions so they can be uploaded to youtube. Enjoy and leave your feedback.

Find the link for the presentations on slideshare on this other post: http://davidnudelman.com/2011/techdaysuk/

In this case he was using the Checkpoint SecureClient and it damaged the IPv6 configuration of his machine.

Instead of fixing it and leaving the problem behind he did the right thing, created a tool that integrates with the windows troubleshooting engine to fix the problem and shared it on codeplex.

His name is Ricardo Polo and he deserves al the credit!

Download the IPv6 reset tool on codeplex.