Exchange 2010 SP3: Event ID 1053 Exchange ActiveSync doesn't have sufficient permissions to create the "CN" container under Active Directory use "Active Directory operation failed on dc.domain.local. This error is not retrial. Additional information: Access is denied".

You are experiencing problems with certain users connecting a mobile device to the Exchange Server using ActiveSync, after checking all of the usual things such as Mobile Device associations from the ECP, and if ActiveSync is enabled for the users. After checking the event logs on one of the Exchange Client Access Servers (CAS) under the Application Log the event "Event ID 1053 Exchange ActiveSync doesn't have sufficient permissions to create the "CN" container under Active Directory use "Active Directory operation failed on dc.domain.local. This error is not retrial. Additional information: Access is denied". is present stating the user you cannot connect to Exchange.

There is a Microsoft known-issue fix for this but although this fix is similar doing exactly what this document stated did not fix the issue for me http://support.microsoft.com/kb/2579075

The first step was to look at the Security Permissions on one of the effected users objects. I always enable the Advanced Features view from the Active Directory Users and Computers MMC.

Then do a search for the user object and open the Properties, click on the Security tab and click on the Exchange Servers security principal. When I first did this only "Read Exchange Information" and "Read Exchange Personal Information" was Allowed in the entire list.

To test this was causing my issue I gave the Exchange Servers principal Full Control over the object. Although I do not normally like to grant explicit Full Control to anything I was hesitant but since it's the Exchange Servers security principal I could not see any reason why not to.

SCCM 2012 "This task sequence cannot be run because the program files for "PACKAGE ID" cannot be located on a distribution point." and Task Sequence Error "0x8000FFFF"

When you try to run a Task Sequence in SCCM 2012 it fails with "This task sequence cannot be run because the program files for "PACKAGE ID" cannot be located on a distribution point.". In this case for me this was because I had recreated by boot images and the Task Sequences were still pointing to the old ones "AG10005" which no longer existed. 

To test I created a new Task Sequence and configured it to use the newly generated boot images, when I did this it resolved the original issue and the Task Sequence started. I was then faced with a Task Sequence Error  "with error code (0x8000FFFF)".

After some research this related to the "Partition Disk 0" stage of the Task Sequence, I edited the Task Sequence and removed the predefined configuration done by the Task Sequence template I then used the star button to configure the volume to be labelled "DISK" and to use 100% of the available space.

The second part of this could have been caused because the device I am testing with is a Thin Provisioned VMware VMDK. 

SCCM/WDS PXE Boot Fails with "The details below show the information relating to the PXE boot request for this computer. Please provide these details to your Windows Deployment Services Administrator so that this request can be approved" and "Pending Request ID: x Please wait. SMS is looking for policy PXE Boot Aborted"

When you try to PXE Boot a new (unknown) computer you get "The details below show the information relating to the PXE boot request for this computer. Please provide these details to your Windows Deployment Services Administrator so that this request can be approved.", this is followed on by another error "Pending Request ID: x Please wait. SMS is looking for policy PXE Boot Aborted".

I checked in the SMSPXE.log file and it appears the issue was caused by the new computer being unknown by SCCM. It states "device is not in the database.".

From the Configuration Manager console browse to the All Unknown Computers collection from Assets and Compliance\Overview\Devices\All Unknown Computers highlight the Unknown Computer object which is x64 in this instance and use the Add Selected Items button and click Add Selected Items to Existing Device Collection.

From the Select Collection window choose a collection that has Task Sequences advertised/deployed to it and drop the unknown computer into there.

Try the PXE Boot again and it should have resolved the issue.

SCCM 2012 PXE Boot "PXE-E32 PXE Timeout" Windows Deployment Services (WDS) "The Windows Deployment Server service terminated with the following service-specific error: This shared resource does not exist"

After installing SCCM 2012 SP1 CU5 PXE boot is no longer working, when you attempt to boot a client you receive the following "PXE-E32 PXE Timeout" error. On investigation it is because the Windows Deployment Services (WDS) service is not running on the Distribution Point (DP), when you try to manually start this you get the following error  "The Windows Deployment Server service terminated with the following service-specific error: This shared resource does not exist".

The first step is to disabled PXE on the Distribution Point this can be done from the Properties pane of the Distribution Point by unticking the Enable PXE support for clients from the PXE tab.

This process will attempt to remove WDS from the server to ensure that it is completely removed use the following PowerShell command;

Uninstall-WindowsFeature WDS -Restart

When the server starts now try to reconfigure the Distribution Point for WDS, you do this by simply ticking the Enable PXE Support for Clients option. 

To confirm that WDS has been reinstalled and configured using the following PowerShell command;

Get-WindowsFeature *wds*

At this point I tried to start the Windows Deployment Services service again and it still failed, I then began to think this could be related to the RemoteInstall folder that is provisioned as part of SCCM/MDT.

When I checked the RemoteInstall folder it was configured as Not Shared, which did not seem right as this was where clients were directed to download boot images from.

My next step was to use the following command from an Administrative Command Prompt;

WDSUTIL /Initialize-Server /Reminst:"C:\RemoteInstall"

After this command completed successfully it restored the share configuration on the RemoteInstall folder. Now the Windows Deployment Server service started correctly.

This then allowed me to start the WDS service and clients could PXE boot.

Windows Server 2008 R2 to 2012 R2 Printer Migration using Printer Manager and Group Policy

The first thing you must have in place is a new Windows Server 2012 R2 server with the Printer and Document Services server roles installed. When you have installed this role it requires a rebooted before the Printer Manager option appears under Tools from Server Manager. Open Printer Manager and right click on Printer Manager and select Migration Printers...

Select Export Printers Queues and Printer Drivers to a File, click Next.

If you are backing up the configuration of  your old print server use the Browse button to select this server here and click Next.

On the review page also click Next.

Set a local path as a destination for the exported files containing the old servers printer configuration, click Next.

Click Finish when the export completes.

Now return to Printer Management and right click and choose Migrate Printers... again, now choose Import Printer Queues and Printer Drivers from a File, click Next.

Point to the configuration file that was generated in the previous steps.

As this server is going to host the printer ensure This Print Server is selected and click Next.

In the Import Mode field configure it to Overwrite Existing Printers and for List in the Directory to Don't List Any Printers, click Next to continue.

Now create a new GPO and expand User Configuration\Policies\Windows Settings\Deployed Printers, right click on the white space and select Printer.

Use the Browse button to point to the new printer server, with attached printers, use the Add button to move them across.

Now in the same GPO you can use Group Policy Preferences to delete the old printers, expand User Configuration\Control Panel Settings\Printers and right click and choose New. From there under Actions select Delete and enter the Share Path of the old print server/printers.

Perform a GPO update on a client and you will notice the old mapping have been removed and the printers have been re-mapped from the new print servers.

Migrating and Seizing Active Directory Flexible Single Master Operation (FSMO) Roles with PowerShell in WIndows Server 2012 R2

I know that there another hundred blogs with this information on them, I have posted it here so that I do not need to scramble about looking for the correct syntax the next time I need to do this.

Move-ADDirectoryServerOperationMasterRole -Identity "NewDCName" -OperationMasterRole SchemaMaster,RIDMaster,InfrastructureMaster,DomainNamingMaster,PDCEmulator

Move-ADDirectoryServerOperationMasterRole -Identity "NewDCName" -OperationMasterRole SchemaMaster,RIDMaster,InfrastructureMaster,DomainNamingMaster,PDCEmulator -Force

Netdom query fsmo

SCCM 2012 Task Sequence Fails 0x80070490 "Unable to find a Windows system root at X:\. Element not found. (Error 80080490); Source: Windows"

An SCCM Task Sequence fails mid-deployment with 0x80070490 on reviewing the SMSTS.log file, the location of this log files depends so please consult the following blog;

http://sccmguy.com/2011/03/29/where-is-the-smsts-log-located/

In my SMSTS.log file it was specifying the error "Unable to find a Windows system root at X:\. Element not found. (Error 80080490); Source: Windows)". After a bit of further research it turns out this is related to the Windows WIM file index.

My Task Sequence was configured to use 1-1 so I used the following command;

Dism /Get-WinInfo /WimFile:D:\PathtoWim.wim

This printed the images indexes in the current WIM file. You will notice from the screen shot that 1-1 was reporting a description of "undefined". This made sense, so I though I would check within the Configuration Manager console.

Browse to Software Library\Overview\Operating Systems\Operating Systems Images and right click on the image that is being deployed via the Task Sequence select Properties.

From the Properties window click on the Images tab and select 1-1  you will notice that most of the properties are actually blank. 

 If you do the same again and choose 2-2 the fields are now populated.

 Now that I had determined the cause of the issue the next step was to edit the Task Sequence, browse to Software Library\Overview\Operating Systems\Task Sequences and right click on the Task Sequence and select Edit. Click on the step within the Task Sequence that installs the operating system and ensure the Image drop down is set to 2-2 when I first checked mine was obviously set to 1-1.

Configuring Citrix StoreFront (XenDesktop 7.x) to use HTTPS, and Configuring Citrix Receiver with "Provisioning File"

If you try and configure Citrix Receiver manually when your Citrix StoreFront is still configured to use HTTP and not HTTPS you will receive the following error "Please enter a secure server address that begins with HTTPS".

You must first configure IIS with a certificate. Open IIS, double click Server Certificates from the host name list. Then click on New Domain Certificate, in this example I am using a wildcard certificate and as this is only internal none of the other details are required.

In an Active Directory domain it will auto detect the Certificate Authority servers, also give the certificate a Friendly Name click Next and you will receive a certificate.

The next step is to configure the site bindings expand Sites and click Default Web Site from there click on Bindings and create a new HTTP Binding using the SSL certificate you just installed. The friendly name of the certificate will appear here.

You now need to reconfigure Citrix to use HTTPS, open the Citrix StoreFront and click Server Group click on the Change Base URL link and append an s onto the existing URL so that it reads HTTPS.

Now if you look throughout the StoreFront the status will have changed to StoreFront using HTTPS.

You should now be able to configured Citrix Receiver.

Although you can do this manually as outlined above, there is also a way to export the configuration for a particular site. This lets you make it available to users so that when Citrix Receiver is installed on their computers all they have to do is double click the link. You export the Provisioning File from the Citrix StoreFront\Stores window.