Windows update Error 0x8007f004

Last week I had the need to bring in a Win 2003 server into my Win 2008 domain to support a legacy application that refuses to run on Win 2008 R2 server.
After building the server and adding it to the domain while applying the windows updates I got "Unable to apply the updates - Failed and Error 0x8007f004"
The primary reason for this is because administrators need to have permissions on the following policies
Local Policies > User Rights Assignment
1. Back up files and directories
2. Debug programs
3. Restore files and directories
4. Manage auditing and security log
5. Take ownership of files or other objects
In my case I updated permissions on group policy at domain level "Manage auditing and security log" for an issue I was having with SharePoint and mistakenly removed Administrator group and added "Domain admin" group.
Added back the Administrator group and the updates ran fine.

How to delete a user profile in Vista, Windows 7 and Windows 2008?

Apart from going to the Users folder and deleting the profile one must also go to the registry as shown below and delete the key corresponding to that user. In my case I needed to know a SID of a user after the user was disabled and deleted from AD. Looking at the profileImagePath one can cross check the user associated with the SID.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1659004503-1788223648-1417001333-500]
“ProfileImagePath”=”%SystemDrive%\Documents and Settings\User1”
“Sid”=hex:01,05,00,00,00,00,00,05,15,00,00,00,57,66,e2,62,a0,20,96,6a,75,b9,75,54,f4,01,00,00
“Flags”=dword:00000000
“State”=dword:00000100
“CentralProfile”=”"

Windows 7 random RDP disconnects.

The windows 7 client when RDP'ing into windows 2008 servers are randomly getting disconnected if the user min the RDP window even for like 20 seconds. It will try to reaquire the RDP session once the RDP screen is maximized. After a little bit of research below are the steps I took to remedy this issue.

Disable autotunning. Open an cmd windows with admin rights and issue the below command
netsh interface tcp set global autotuninglevel=disabled
You can check to see if this is disabled or not by running
netsh interface tcp show global
If you want to enable it back run the below command
netsh interface tcp set global autotuninglevel=normal

Change the MTU size from default value 1500 to 1300 following below steps
netsh interface ipv4 show interface
netsh interface ipv4 set subinterface "Local Area Connection" mtu=1300 store=persistent

There might be multiple other reasons as well you can try rolling back the NIC drivers, disabling the "Power Management" feature, depending on the network backbone try diff speed settings from AUTO to 100/Half, 100/Full. Looking at couple of other settings as well. Will first try them on the test servers and will post the results.

Find full distinguished LDAP name for an Active directory user

For an application I was setting up it required full distinguished LDAP name for an Active directory user to assign permissions. The way to find this is -
One. Running the command dsquery user -name ADUSERNAME where ADUSERNAME is the name of the user on the AD
Two. Running the command ldifde -f users.txt where all LDAP data from AD is dumped into the file named users.txt

Performance tuning Windows Server 2008 R2

Below 2 are articals that I came across today when I was researching performance issue on  SQL 2005, Windows 2008 R2 server. Good basic information to get your hands on....

http://blogs.technet.com/b/askperf/archive/2010/08/06/performance-tuning-windows-server-2008-r2-pt-1.aspx

http://blogs.technet.com/b/askperf/archive/2010/11/05/performance-tuning-windows-server-2008-r2-pt-2.aspx

What do you think?

Demote domain controller in 2008 Active Directory.

OS - Windows 2008 R2
AD - 2008
DC - GC, Second DC in the forest.

How to demote a DC in 2008 AD?

Go to Start --> Run --> Enter "dcpromo". This will start the installation wizard.

Select "Next"

In the next screen its asking if this is the last dc in the domain. In my case I need to just demote the existing backup dc for hardware refresh. Moving it to a new server...I did not select the option.

If you chose to remove the AD integrated DNS zones select the "Delete" option as shown.

This will prompt you for the Admin id/password as shown below

The wizard will present you the summery and off you go demoting your DC.

Command to get member's in a AD group

If you need to query for the member's present in a AD group is -

csvde -f report.txt -r (sAMAccountName=) -l member

Substitute the with the group you want eg SalesGroup and the report will be generated as report.txt.

csvde -f report.txt -r (sAMAccountName=SalesGroup) -l member