LumbGaps

Show Control Panel in Start Menu using Registry

2010-06-16T09:00:00.004Z

If you are using roaming profiles, or even better mandatory profiles, you can set the Control Panel to appear or not appear in the Start menu for all users by editing the following registry key in the NTUser hive:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel

1 = Show Link
0 = Hide

We use Appsense to set this key on logon for specific users on specific servers.

Ford Focus MK2 Space Saver Tyre

2010-04-26T13:50:00.002Z

A big deviation from my usual posts, but I'm looking for an owner of a Ford Focus MK2 who would like to swap a never used full size spare tyre for a space saver. I have a theory that there must be a lot of people wanting to swap space saver for full and not pay a lot of money!

The reason for the swap is that the full size shallows the boot a little, which in some circumstances is actually quite nice, but not when we are trying for fit in a pram and various other baby items! It is not worth the expense of buying the space saver spare, but if someone wants to swap then that is great.

I live in the Leeds area of UK, so please only respond if you live nearby or can travel.

If you are interested please post response or email me. Thanks!

Changing the Primary Domain DNS name of this computer to "" failed.

2010-03-16T13:39:00.015Z

We have been hitting an error when adding Windows 7 and Windows 2008 R2 machines to our Windows 2003 domain, specifically:

This issue does not affect older versions of Windows and does not appear to stop the computer from successfully joining the domain. I looked into the c:\windows\debug\netsetup.log and found the Windows 7/2008 R2 perform an additional number of steps at the end of the domain join, things that previous OS versions have not done and the following error is shown:

NetpLdapBin:ldap_bind failed Server:81: Server Down

I am yet to discover exactly what these additional steps do, but it was easy to spot the problem. Throughout the domain join the server contacts the domain controllers using the DC FQDNs. In this last section it attempts to contact the domain controllers using the netbios name, which fails as we do not apply domain suffixes to our servers and workstations using DHCP - we use the standard DNS devolution and setting to apply parent DNS names. If you do use DHCP to apply DNS suffixes you more than likely will not see this issue. If you don't you can work around the issue by adding a manual DNS suffix for your domain before your domain join and then remove it again afterwards (this is how we are working around it for now). Or you could just ignore it as I cannot find any negative side affects.

Microsoft have confirmed this as a bug in Windows 2008 R2 and Windows 7 but have not yet committed to a fix date as they see it as low priority (as it does not break anything). I have requested a KB number from MS, which I will post ASAP.

Your Out of Office settings cannot be displayed because the server is currently unavailable. Try again later.

2010-02-18T08:19:00.003Z

There are loads of blog entries about this error and numerous causes. It could be that autodiscovery is not working correctly, that the OOF URL is configured incorrectly, permissions are wrong on the CAS servers etc.... I'm not going to go into detail here as there are loads of blogs and articles about this.

Our situation was slightly different to anything I could find. OOF works just fine for our users, however as Exchange administrators we could not set other users OOF when using Outlook 2007, we got the error "...the server is unavailable...". We also found that we were unable to login to other users mailboxes using our Exchange admins accounts using OWA, which was the other way we used to set OOF for absent users. The only way we could still set OOF for end users was to use Outlook 2003, but this is no longer supported on our campus, so we needed another way. This prompted me to get to the bottom of this problem, so we as system admins could again easily set end users OOF.

The one thing that was obvious is that this was a problem that only happened when connecting via the CAS servers. We could login to mailboxes just fine using MAPI. Therefore there had to be something different about the way the CAS servers authenticate users against mailboxes. It is worth mentioning at this point that we had confirmed that our admin accounts were listed as having Full Mailbox Access to all mailboxes in ESM. We soon discovered that the server is unavailable error is a generic error and happens regardless of what error is actually returned by the server. Having tried the URL of the OOF within IE we saw that it was actually an access denied error that was being returned by the CAS server, not a service unavailable error. We were stumpted as our admin accounts had full access!

With some testing I noticed that some of our several thousand mailboxes did allow us to set OOF as admins, but the vast majority did not. The question was why. I then started playing with Full Access permissions and found that any change whatsoever to the Full Access permissions using ESM or the shell suddenly made OOF work for our admin accounts. This is where Microsoft came in as I was stumpted. It turned out that this is apparantly an expected issue that Microsoft have documented very poorly. It is a result of the split permissions model in Exchange 2007. When connecting to a mailbox using a CAS server (as OOF does in Outlook 2007), the CAS server reads the MSExchangesecurityDescriptor from AD. By default this is truncated and incomplete. To cut a long story short, Microsoft no longer support automatically inherited AD permissions to mailboxes, although you will see the permissions using ESM and they will work using MAPI connections. I find this utterly baffling, but it is what it is. In order to resolve this you need to make a change to the mailbox permissions using the shell or ESM. This causes Exchange to rewrite the MSExchangeSecurityDescriptor in AD and suddenly everything works. A couple of methods and further info:

add-mailboxPermission -identity -accessrights:fullaccess

get-mailbox -server Add-MailboxPermission -User -AccessRights FullAccess

http://technet.microsoft.com/en-us/library/aa996343(EXCHG.80).aspx

http://support.microsoft.com/kb/310866

MapiExceptionNotAuthorized in Exchange 2007

2009-08-28T13:28:00.003Z

I thought I would share with everyone an issue we had with mail delivery to Public Folders in Exchange 2007. We were receiving the following error:

#550 5.2.0 STOREDRV.Deliver: The Microsoft Exchange Information Store service reported an error. The following information should help identify the cause of this error: "MapiExceptionNotAuthorized....

This happened for some staff, but others could deliver messages just fine. Also external users i.e. Hotmail could deliver messages to the PFs without issue.

You would imagine then there must be a deny rule somewhere for a specific group of staff, or there was something wrong with the permissions on the PF. Numerous tests and checks proved this to not be the case.

Fortunately a pattern started to emerge with the people having the problem i.e. they were all in the same faculty and members of specific groups. Further testing proved that if a user was a member of a few groups their messages/emails would be denied to ALL PFs. However the groups were not mentioned anywhere in the PF permissions.

We even created new mail enabled PFs and gave everyone full control with no denies... still no luck. After a bit more thinking we figured that it must be that Exchange is having trouble reading the group membersip. We soon found that the OUs containing the problem groups of which the problem users were members, had inheritance switched off and hence had not picked up the new Exchange 2007 permissions when we installed EX2007. They still allowed the old Exchange Enterprise Servers group acccess which worked for EX2003, but no access was in place for the EX2007 Exchange Servers group. The OUs had also had read permissions removed for Pre-Windows 2000 (Everyone) and Authenticated Users. Therefore Exchange was denying the user access as it could not fully recurse the users ACLs. I guess this is secure by default in action, although it seems like a bit of an inefficient design to me.

I hope this saves someone a bit of time as it took us ages to get to the bottom of it.

Exchange 2007 Outlook Web Access Old Passwords

2009-08-05T08:09:00.003Z

Weird one yesterday. We had a customer who had fallen foul of a phishing email and entered their username and password in a web form. Surprise surprise their account was compromised and used for sending a huge amount of SPAM. As soon as we became aware of the problem the user changed their password. Because the spammer had already established a connection as this user the password change did not affect them and they carried on. No major surprises there. We had to lapse the account (disable) for the connection to be dropped (I wish Microsoft would provide a tool for checking/closing active OWA/IMAP sessions in Exchange). The surprise came when we found the user could continue to login to OWA/IMAP using their old password, although it could not be used for any other resources. With some investigation it seems that once a user has authenticated to a CAS server with a password, as long as the connection remains active (and for some time after) the old password can still be used to authenticate (open new connections) to OWA/IMAP. This is alarming in my opinion. The most alarming thing is that all connections can be closed and you can still login using the old password (although I don't know for how long).

This issue is per CAS server. We usually have two, so this issue would not be as obvious normally (as the server the user logged into using the old password is the only server that will allow logins to continue using the old password).

I am going to log a urgent call with Microsoft about this. For info we are using Exchange 2007 SP1 RU5 on one front end and Exchange 2007 RU5 on all backends. The other front end has recently been upgraded to RU7, but the issue remains.

Anyone else seeing this?

Support for Citrix Secure Gateway

2009-07-08T06:53:00.002Z

08/07/09

We currently run Citrix PS 4.0. Due to support running out at the end of this year we have been looking at upgrading to XenApp and have run into confusion over whether Citrix Secure Gateway is still supported or if we need to switch to using Access Gateways. It seems that the general confusion about support for SG is fairly widespread, perhaps because Citrix really want customers to start using Access Gateways. Anyway, we did not need all the benefits that AGs have over SGs so through our helpful support people we put the question to our Citrix account manager. It took a while to get an answer (the confusion does not seem to be limited to customers), but the good news is that Secure Gateway support is directly linked to support for XenApp. Therefore SG 3.1 will be supported as long as XenApp 5.0 is supported. The following Citrix article explains a little more:http://support.citrix.com/article/CTX110115
Although this article is 3 years old we are told by Citrix that it is still valid.

With this info we can get on with our XenApp upgrade!

Appsense - Internal Server Error

2009-07-01T14:38:00.003Z

01/07/09

I have been having fun trying to get Appsense 8.2 to work following the database being accidentally deleted by a colleague. Despite the Management configuration utility providing a facility to create a new database it refused to use its new database and kept trying to use old settings. I gave up and reinstalled.
The reinstall did not fix the initial problem I was seeing with loading the Management Console. Basically it reported that the server returned HTML instead of XML. When I went to the Management Server website directly it returned a 501 error, specifically related to custom HTML error pages using explicit paths. I opened all the web.config files (there are about six of them under the Appsense installation directly) and deleted the CustomErrors sections. All then worked.
I have no idea why and when this issue started. All I can imagine is that it is related to the installation of Windows 2008 SP2.

02/07/09

The very efficient chaps at Appsense spotted this blog entry and sent me the following link:

https://www.myappsense.com/content/knowledgebase/solutionDetails.aspx?sid=50120000000EW3dAAG

You will need a MyAppsense account to get to this, but as an Appsense customer you should have one. That will teach me for not checking the knowledge base articles before upgrading!

Anyway the issue is related to a Windows 2008 SP2 security change. The advice given in the article as the same as the way I fixed and problem. Importantly it does state that you should not change the %PROGRAMFILES%\AppSense\Environment Manager\Personalization Server% and PROGRAMFILES%\AppSense\Performance Manager\Central Statistics\Incoming web.config files (I better go and fix mine). It also states that the issue is fixed in v8 SP2, but I don't seem to be able to download that just yet.

Now onto why my upgraded v7 App Manager config causes my server to go totally nuts and stops a number of core services from starting and even entirely kills the network connection! I quess I'll be creating that from scratch :-).

Exchange 2007 IMAP RFC822.SIZE and Pine/Alpine

2009-04-07T07:21:00.003Z

A common problem with Exchange 2007 IMAP when used with Pine/Alpine is alerts indicating that a message has shrunk. What is happening here is that Pine is retrieving the RFC822.size from Exchange, downloading the message and comparing the real message size with the size Exchange 2007 provides. Sadly there often is a huge discrepency, sometimes by as much as a factor of two. Interestingly Pine only checks for size decreases in case of data loss during copy hence you only see this message appear on some emails, not all. If Pine checked for message decreases and increases you would see it for pretty much all emails.

Microsoft have so far explained that the size returned by Exchange prior to Exchange 2003 was based on the MIME message stored in the STM database. As the STM database no longer exists in Exchange 2007 the RFC822.size is calculated based on the MIME skeleton and the original MIME message size. This is done for performance reasons. I have asked Microsoft for clarification as to why the original MIME size of the message is vastly different to the regenerated MIME message and am waiting for clarification.

There is an Alpine code change that will supress this message (if you are happy to lose the safety check), or you can apply a change to Exchange on either a server or on individual mailboxes. The setting is nothing secret but documentation is very scarce. It is worth mentioning that making this change has a performance penalty as it forces Exchnage to regenerate each message as MIME and then send the size of the regenerated MIME message every time a message size is read.

For the server:

Set-ImapSettings -EnableExactRFC822Size:$true

For each user:

Set-CASMailbox "username" -ImapUseProtocolDefaults:$false -ImapEnableExactRFC822Size:$true

Although this solves this particular problem, sadly other issues persist with Pine and Exchange 2007 like Pine crashing when opening messages with Digital signatures and Pine not handling multipart messages correctly. It seems that although these issues only appear in Pine/Alpine (and perhaps Mutt), it appears to be Exchange that is failing to follow the RFC standards (and Pine is a stickler for standards!).

I'm sure we will get there soon!

Exchange 2007 SP1 RU5 - IMAP Error 4999

2009-02-26T14:57:00.002Z

Hi,

Like many other people we have been suffering from our Exchange 2007 SP1 RU5 IMAP service constantly falling over with the following error:

Watson report about to be sent to dw20.exe for process id: 6848, with parameters: E12, c-RTL-AMD64, 08.01.0336.000, M.E.Imap4, M.E.D.Common, M.E.D.G.OutboundCodePageDetector.AddText, System.ArgumentNullException, 3e79, 08.01.0336.000. ErrorReportingEnabled: False

The good news is that we have put a stop to this by isolating it to a specific user.

There are many records online about this being a known issue, which it seems is indeed the case and we have received the fix from Microsoft (which we intend to try on the 27/02) - KB960292. I will post how this goes. The problem relates to a null ID being presented during login that the IMAP service should ignore, but it fails instead.

Anyway, what I wanted to share is that we have isolated this issue to the Sea Monkey 1.1.14 client. All three installations we know of are causing this issue and we have worked around it temporarily by preventing the users from logging in using IMAP (they are using OWA temporarily instead).

Good luck if you are experiencing this problem.

Rob

Increasing Redirect to Voicemail Timeout on O2

2009-02-13T17:55:00.003Z

When I received by lovely new HTC Touch HD I found I kept missing calls as there was a slight delay between the caller calling and the phone starting to make a sound. I contacted O2 and they told me to run the following command :

**61*901*10*??#

?? is the delay you want in increments of 5 up to 30. I went for:

**61*901*10*25#

Works a treat.

I hope this saves someone a bit of time.

This is the home email address of this recipient. It cannot be removed

2009-01-07T08:54:00.002Z

It has been a while since I posted, but I came across a nuisance error this morning: "This is the home email address of this recipient. It cannot be removed". The address that could not be removed was not the primary address and what's more this was a mailbox, not a contact, so I could not just delete it without disrupting the user. I needed to remove the rogue address as it had been created in error and was a domain that was not managed by Exchange. Anyway, I launched ADSIEdit.msc, found the attribute TargetAddress (http://msdn.microsoft.com/en-us/library/aa487600(EXCHG.65).aspx) and cleared it. I could then go back to ADUC and remove the rogue address. After about 20 minutes mail started to be delivered to the mailbox once again.

Using the Safari Browser with the Citrix Web Interface 4.0

2008-06-13T09:19:00.003Z

Citrix provide a very helpful article at http://support.citrix.com/article/CTX104367 describing how to customise the Citrix Web Interface 4.0. to support the Mac client on Safari. This works well, but it is not the whole job as when the user logs off and back on again, they will find their client is set back to Java. It also does not present the user client installation prompts in the message centre until they are logged on.

It is fortunately very simple to complete the job. Follow the steps in the Citrix article and then do exactly the same for the following files in the auth folder as you did for the same named files in the site folder: include.cs, embed.cs, install.cs.

Works a treat. Obviously all changes should be tested in a dev environment first and don't forget to read Citrix's disclaimer on the webpage linked above.

Windows Live Mesh

2008-05-28T13:22:00.004Z

I recieved my invite to Live Mesh today and found it would not install and reported that I should check my network settings: "Installer encountered errors: Please verify your network settings and attempt to reinstall".

Well all was fine with my network settings. I tried setting my locale to US as suggested on some site and ensured that UAC was switched on. I then tried changing my auto proxy configuration script to a hard coded proxy (in IE connection settings) and Live Mesh then installed. So if anyone else sees this error and you are using an automatic configuration script for your proxy, that is why.

Hopefully Microsoft will fix this at some point.

SPSS and Appsense Environment Manager

2008-03-31T14:41:00.004Z

I am having trouble with SPSS 15 running on Citrix Presentation servers which also has Appsense Environment Manager running. Basically, Environment Manager kills the SPSS processor. I can reproduce this consistently and fix the problem by either disengaging the EM process, removing the EM DLLs or simply removing any applied EM policies.

I have had a call open with Appsense about this for a few weeks. The only suggestion they have made so far is to upgrade to the most recent version. I did this (7.2.227), but it made no difference.

Currently I am trying SPSS 16.0, but not having much luck as our license for SPSS 16.0 is not authorised for use on a terminal server......... Hopefully I will have a call from SPSS soon to establish how I can run this test.

Has anyone seen this issue?

I will keep this post updated, but it looks like we are going to have to switch of Environment Manager on our Citrix servers and live without the good things that it does.

SoftGrid 4.1 - Desktop Refresh Times Out - Error 10000005

2008-03-11T11:32:00.005Z

I've had issues with SoftGrid today with all Desktop Refreshes failing and no applications launching. Unfortunately this happened while I was rebuilding one of the VAS servers so I wasted a lot of time trying to trouble shoot issues that could have been caused by removing this server.......

The errors I was seeing in the sftlog.txt file when trying to launch applications were:

[03/11/2008 08:00:28.370 AMGR WRN] {hap=1:app=CorelDRAW X3 13.0.0.739:tid=4FC}The SoftGrid Client lost contact with a server and entered disconnected mode.
[03/11/2008 08:00:28.385 JGSW ERR] {hap=1:app=CorelDRAW X3 13.0.0.739:tid=148C:usr=srvrjh}The SoftGrid client could not connect to stream URL 'rtsp://appstreaming.leeds.ac.uk:554/cdrawtst/cdrawtst.sft' (FS status: 1600190A-00000120).
[03/11/2008 08:00:28.385 SWAP ERR] {hap=1:app=CorelDRAW X3 13.0.0.739:tid=148C:usr=srvrjh}The client was unable to connect to a SoftGrid server (rc 1600190A-00000120)
[03/11/2008 08:00:28.432 TRAY ERR] {tid=C88:usr=srvrjh}The SoftGrid Client could not launch CorelDRAW X3 13.0.0.739.

An unexpected error occurred. Please report the following error code to your System Administrator.

Error code: 41112E-1600190A-00000120
This turned out to be nothing to do with the VAS rebuild and was actually associated with the provider policy. It seems that SoftGrid does not use native Windows authentication but instead employs LDAP. In our architecture LDAP often causes issues. We have two domains, a forest root and a child. The child domain is first in the alphabet.

Anyway, we performed some AD upgrade work at the weekend and the one domain controller in the child domain that the VAS servers could contact was offline (in case we needed to revert back the domain). We accepted the fact that users in this domain would not be able to authenticate to the VAS servers during this period, as we have no softgrid users in that domain at present. However what we did not anticipate is that because a group of users from the child domain was defined in the provider policy, SoftGrid would time out trying to contact the domain and it would break all desktop refreshes and all applications (that were not 100% pre-cached).

Microsoft states the issues we were seeing are related database problems, but I would suggest that before you do anything with your databases that you check your provider policy and look for any groups that have not been properly resolved.

ISA 2006 Custom Login Page

2008-01-15T09:11:00.000Z

I have a couple of custom login pages on ISA 2006 to fit with company branding. This all works well with one problem. When a user enters an incorrect username or password, every now and again the user is dropped back to the default ISA login page. This does not break anything and the user can carry on to login ok, but it looks a bit daft and is very confusing for the end user. I may well be logging this with Microsoft, but I would rather not as it seems like an issue that Microsoft are going to want a lot of information on and because it is very intermittent it could take a lot of time (of which I don't have much). If anyone has found a work around/fix for this I would love to know. Please post to this blog entry. I'll keep it updated if I get anywhere with it.

Softgrid Documentation

2007-12-13T11:03:00.000Z

Are you looking for the Softgrid 4.1/4.2 Documentation/Softgrid Admin installation guide? Well it is well hidden and oddly not linked from the Softgrid home page and you will be hard pressed to find it on Google. Anyway, it is here: http://support.microsoft.com/kb/940163

I hope that helps save someone a bit of time hunting around.

Master Site Directory in Sharepoint 2007 Error

2007-11-16T08:44:00.000Z

I ran into an error when trying to assign a master site directory in MOSS 2007 Central Admin:

This not a valid site directory. Specify a URL to a site that is using the site directory template.

I checked that the URL was valid and that it was pointing to a Directory Site. I even created a new directory site and tried that with no luck.

I worked out that if I set the default public URL to be a simple name like site, instead of site.domain.co.uk, the master site directory page accepts the entry and it all works. However this is no good as we need a proper FQDN as the default public URL (and changing it back after setting the MSD breaks the MSD functionality).

I have a call open with Microsoft through ESCUK about this. This call has been dragging on for a long time and somehow Microsoft have not been able to reproduce the problem.

I'll keep this post updated as and when I hear something back from Microsoft. I would be very interested to hear if anyone else is seeing this problem so I can feed back to Microsoft. Thanks!

07/01/08

Microsoft have finally reproduced this problem and have acknowledged it as a 'possible bug', as such it has been escalated. No news as to a fix yet.

23/01/08

Today I had a call from a developer at Microsoft who has been looking through the code used by the Master Site Functionality and established that it first checks for the existance of the site in the configuration database. This is interesting because apparently if it does not find the exact URL in the config database it will reject it. This means that if you use a different default AAM to the URL you used when creating the web application that hosts your MSD, the lookup will fail. The only way I know of to fix this is to extend your web application and use the URL of your default AAM as the URL for your new IIS site and set this extended web app to use a different zone (i.e. Intranet). The default AAM URL will end up the default AAM for two different zones and will now appear in the configuration database (as it is added by Central Admin when you use it to extend the web app). This is not pretty and I don't advise you go ahead with it in the production environment without taking advice from Microsoft.

Fortunately our default AAM was also the URL that was used to create the original web application used to host the MSD. Therefore the work around above is not appropriate. Back to the drawing board......

Quick thought...... if using NetBios names fixes the problem, what could be happening differently for FQDNs. Perhaps a proxy issue. However I have made sure that our proxy is configured to be disabled for the application pool and service accounts. However each web application's web.config file by default sets the proxy to auto=true. The developer at Microsoft suggested changing this to false for the Central Administration web application. That did the trick! We now have a full functional master site directory. It was a very long time coming for a simple solution, but a good learning experience.

To make this change go to C:\Inetpub\wwwroot\wss\VirtualDirectories\****, where **** is the port number of your Central Admin site. If you are not sure which is the right virtual directory open IIS Admin, right click on the Central Admin site and choose Explore. Right click in the white space to the right and select properties to get the folder and path. Open the web.config and locate the following:

(system.net)
(defaultProxy)
(proxy autoDetect="true")
(/defaultProxy)
(/system.net)

Change to:

(system.net)
(defaultProxy)
(proxy autoDetect="false")
(/defaultProxy)
(/system.net)

You will also need to do this for any web applications that you want to create Site Collections from within a Site Directory page (and make use of the Master Site Directory feature). Hhowever if you do this you may want to use something more like below so that web parts like RSS readers can connect to external feeds.

This adds exceptions for *.domain.local.com and 198.168.*.*

I hope this saves someone a lot of time!

Sharepoint 2007 - Server Farm Configuration Not Complete

2007-11-15T14:48:00.000Z

Along with many others my MOSS 2007 Farm has been running for some time saying that it's configuration is not complete.

This was starting to get annoying so I decided to investigate. I deleted all the Administrator Tasks and ensured all the services were running where they should be. I even went to the extent of ensuring everything that could be configured was configured. The only thing remaining was to switch on farm features that I did not want, so I switched on Excel Calculation Services and started the service on one WFE server. The message went away! I was then able to stop the service and switch off the feature and the message did not come back.

Sharepoint 2007 - Problem with Profile synchronisation and My Sharepoint Sites

2007-11-13T09:48:00.002Z

We have another issue with Sharepoint 2007 in which one site collection and all of its subsites are not appearing in our My Sharepoint Sites list. I have run through all the basic tests and ensured that the right people are in the Site Members list and have even recreated the Site groups and added the members back in, but nothing works. More than this though, it seems that none of the profile synchonisation (a Sharepoint timer job) is being run against this site collection as any changes to users profiles from MySites/Profiles/directly on the SSP are not reflected in the people and groups pages on the problem site collection. For example if I delete my profile picture i.e.

This change is reflected everywhere but this site collection where it still attempts to reference it:

I used Quest Recovery Manager to restore this site collection so currently have an open call with them and depending on how things go will also open a call with Microsoft to see if they can offer a fix for this.

Any ideas or feedback greatly appreciated. As always I will update this post when I have a fix/workaround.

Office 2007 and Vista, persistent cookies do not work

2007-11-13T09:11:00.001Z

I have run into another issue with SharePoint 2007 which specifically only affects Office 2007 running on Windows Vista.

We have SharePoint setup using ISA 2006 for forms based authentication. This works perfectly for XP/2003 with Office 2003/2007 and Vista with Office 2003. However when we open a document from SharePoint 2007 using Office 2007 on Vista, we are prompted for a password. This is rather annoying. I have opened a call with Microsoft to see if I can get to the bottom of this.

There are numerous articles out there saying that this is to do with IE Protected mode, but we have this switched off for the Intranet zone (hence it works fine in Office 2003 on Vista).

Even more worrying than the simple inconvenience of the prompt is that fact that WebDAV caches the users' credentials. Imagine the scenario that you go to a public access machine and log onto SharePoint using ISA FBA. You then open a document and enter your credentials. You then finish working and log off Sharepoint and close the browser. You would think you were now logged off, but you are not as WebDAV is still caching your credentials. Whoops!

04/01/2008

Following my call being escalated by the good guys at ESK UK to Microsoft, it has now been escalated within Microsoft. I've just been on a call with a very helpful escalation engineer at Microsoft who has confirmed that this issue is related to Office 2007 on Vista trying to use WebDAV and WebDAV trying to authenticate using Windows Auth, rather than using the persistent cookies. As our server is connected via ISA using FBA, Windows auth falls back to basic auth and then WebDAV caches the credentials (until the webclient service is restarted or the user logs off).

The engineer has provided a useful workaround: install the Web Client update for Vista (http://support.microsoft.com/default.aspx?scid=kb;EN-US;907306) and then set all Office Apps to run in compatibility mode. This has a couple of drawbacks other than the work involved. Firstly it loses the enhanced ability that WebDav has to be able to browse up and down SharePoint web applications and secondly it does not resolve the password prompt you get when when you try to use Explorer view (I don't know of a way of telling Explorer to run in compatibility mode). Nevertheless we will use this workaround on the few Vista machines we have, but will certainly have to think twice before rolling Outlook Vista and Office 2007 to our 12,000 desktops.

The following registry keys can be set to tell Office Apps to run in XP SP2 compatibility mode. Remember you can really mess up your machine by changing the wrong registry settings so back it up and go careful:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers]
"winword.exe"="WINXPSP2"

SQL 2005 Reporting Services "The ReportServerVirtualDirectory element is missing"

2007-10-16T09:37:00.000Z

I had this issue after a clean install of IIS followed by Reporting Services. I configured reporting services using the config tool and ended up with green ticks against all sections. The reportserver url worked fine and reports were accessible, however when accessing http://servername/reports, I received the error "The ReportServerVirtualDirectory element is missing".

Following looking around I found the following article:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=741808&SiteID=1

This page provides the following fix which worked perfectly:

Open C:\Program Files\Microsoft SQL Server\MSSQL.2\Reporting Services\ReportManager\RSWebApplication.config using notepad or equivalent. Find the line and add "" so that it looks like:
"ReportServer"
Save the file and reload the page.

Citroen C4 Reliability

2007-10-13T11:07:00.001Z

This is a big step away from my usual postings, but I had to share my experience of owning a Citroen C4 VTR with the wider world.

When I purchased the car I had a six week honeymoon period when I enjoyed driving it and loved the way it looked, I even managed to overlook the rattles and squeaks. After six weeks the pain began. I have had the car for 22 months now and in that period it has been in the garage for warranty repairs 22 times! In total it has cost me over £200 in costs of insuring courtesy cars and an untold amount of hassle, not to mention the fact that I hardly see my car these days, have to drive around in basic small cars and am generally sick and tired of it.

Well I have had a case open with Citroen for some time and am hoping to get some compensation and get rid of my C4 (which I have now not seen for three weeks). I have tried two garages who have both not yet been able to fix the issues. Citroen so far have said 'we want to restore your confidence in the Citroen and will work with the dealer'. Well times are well beyond that now and I want and expect a lot more. I spoke to a friend of mine yesterday who has a lot of experience of managing auto repair centres and he described Citroen technical (the guys that are supposed to help the garages with difficult problems) as hopeless. Even more worrying a technician I spoke to in a garage described the experience as sometimes as helpful as phoning a snowman (it was a cold day).

I'll see what happens over the next couple of weeks and keep this blog updated.

In the mean time, if you are thinking of buying a C4, don't!!!! Go and buy a Ford Focus instead, it may look bland but at least you will get to see it and it won't rattle and break all the time (and it handles better). If not the Focus and you want something that looks good go for the Seat Leon.

15/12/07
The saga continues. I again was told that the issue was fixed (I've lost count of how many times I have been told this now) so I went to the garage (not very optimistically), sat in the car and reproduced the problem immediately. So another week without my car and another £15.50 lost on covering the insurance on the courtesy car. I logged another call with Citroen Customer services who called me back within 2 days and told me that they were very concerned, would contact the garage and that the next step would be to send a Citroen engineer to look at it. About time I would say, after all two dealers have now had 11 opportunities to fix it. Why don't we have a law like Lemons law in the US? Anyway, Citroen Technical have another couple of ideas which parts are ordered for. If this does not help I don't expect any progress until the New Year as the Citroen Regional Customer Services Manager is on leave.

19/12/07
I was promised a call from Citroen customer services today. No call.

20/12/07
Still no call and no contact from the garage.

21/12/07
I called the garage and spoke to one of the really helpful guys on the service desk who told me they believe the issue was with the BSI (I think that's what it was called), the thing that interfaces to the ECU and connects the cables. Anyway apparently Citroen don't think this is the problem and have not authorised its replacement, even though the garage has ordered the part and has it in stock. The Garage have told me that they are going to try swapping the cables round coming from the BSI from the OF to NS doors and see if the fault follows the cable to the other door. If it does then they know the problem is with the BSI. Unfortunately with the Christmas period the engineer at the garage is quite rightly on leave until the 2nd of January so nothing will happen until then. Kindly the garage have allowed me to hold onto the courtesy car which is now beginning to feel like my own car as I have had it for five weeks!

04/01/08 AM
Awaiting feedback from the garage and still no courtesy call from Citroen. I have now spent in excess of £120.00 on insuring courtesy cars.

04/01/08 PM
I called the garage. The BSI cables have been swapped round and the problem remained with the passenger side window. Now all relevant parts have been replaced except the entire door and the ECU. I'm writing to Citroen today and seeking legal advice as this is ridiculous. As it stands the problem has changed again in that it now works OK from the passenger side control but not from the driver side and the issue with freezing after going up and down just twice (which the garage introduced early December 07) is still evident. The garage, who continue to try very hard with this, have been told to expect a call from someone at Citroen in France. I have had to extend the courtesy car cover by yet another week. Between two garages Citroen has now had nearly 8 weeks to put this issue right. I wish there was some proper legal advice on what do to in these situations. The problem is not with the seller as the issue was not there at the time of sale, so the sale of good act as far as I see it does not apply. However there must be some rules about a suitable level of warranty repair!

09/01/08
I've not heard anything more from Citroen or the garage so have now written a letter to Citroen customer services asking for a formal response within seven days with an action plan. I have told Citroen that I will be contacting a solicitor in seven days if I do not have a response or their response is unsatisfactory.

10/01/08
Still nothing from Citroen. I had a call from the garage though who asked me to pop by, so I did. They had the car stripped back when I got to the garage and showed me what they had been doing. The garage told me they had been chasing Citroen technical all week and they were not returning their calls. The garage have been suggesting replacing the BSI for a few weeks now and had the part ordered in, however Citroen would not authorise them to replace the part (presumably because they did not want to pay for it). Well the garage decided to cut their losses, as like myself they have lost money on this problem due to Citroen being hopeless and not giving them suitable advice and having to spend a huge amount of time on the problem. The garage decided to fit the BSI and potentially take on the cost themselves. This has resolved the problem. The window still does not work perfectly due to an over-sensitive window switch on the driver's side, but I can live with that.

13/01/08
Window still working ok, fantastic! I took some chocolates into the garage to thank them for their great work and for going beyond the book. I am pursuing my case with Citroen and have not heard anything back yet. I am bitterly disappointed with Citroen and want to see some financial compensation for the way I have been treated and the hassle I have been put through. Seems like they may be busy though as the C4 seems to be full of electric problems from the stereo switching itself off after 2 minutes if then engine is not running (Citroen's response: go for a 2 hour drive and then try again; how ridiculous) to not being able to get into the car due to a failure in the locking electricals, all within the warranty period. I dread to think what will happen after the three year warranty. The car has to go!

14/01/08
I recieved a call from Citroen customer services regional service manager today who asked me to put together some rough costing of my expenses incurred as a result of warranty repairs. I calculated £280 if you don't take into account by time and £470 if you do.

17/01/08 AM
My Window still works but the new seal they have put on is not tight so there is a lot of wind noise on the motorway. Therefore it is going back into the garage again soon !!!

17/01/08 PM
Today I received a letter from Citroen sincerely apologising for the inconvenience and offering me a 12 month extension to my manufacturer's warranty. I think this is a big step in the right direction, although I'm not sure if it goes far enough to making up for my expenses. However this is not a perfect world and to be fair to Citroen it does show willing to help and that they acknowledge that the experience I have had is not acceptable. I'm inclined to accept the offer and keep the car for another year to take advantage of it. My colleagues are telling me to seek legal advice and push for more. I'm just not sure if I can be bothered.

22/01/08
Well it did not last long. I took the car for a long drive and it has four new problems. The seal on the passenger's window is knackered so it sounds like the Window is open all the time - very annoying on the motorway. The passenger door is no longer aligned with the car body, the internal light will not stay on and the car no longer knows that I have front fog lights! Booked back in for the 04/02/08.

31/03/08
I've not updated this for a while as I lost heart with it all. Since my last post the garage have (across three further visits) managed to fix all issues including cruise control failures, fog lights, wind noise, internal light and another safety recall. Now the car is working 100% I'm quickly getting rid of it. Because I don't want any responsibilty for future problems I have cut my losses and am trading it in. I'm getting myself a Fiat Bravo Dymanic 150T. Can't wait. Hopefully it will be as reliable as the last Fiat I had.

Sharepoint 2007 - Set MySite Locale (Regional settings) to UK (EN-GB)

2007-08-14T10:43:00.000Z

I spent much time recently investigating how to set regional settings (locale) on a MOSS 2007 Web Application level so that any new site collections inherit the appropriate regional settings (in my case EN-GB).

It is possible to set regional settings at site collection level and inherit down to all subsites, which works fine when you do not use self-service site creation, but not otherwise, especially for MySites. Back in May 2007 I opened a call with Microsoft about this (via the Education Support Centre http://www.escuk.net/) and recently received the news that Microsoft have identified this as a code change and the developers are considering the change. As it stands Microsoft may well need more persuasion in order to make this change, so if you are having this trouble please get in touch with me and we can build a case.

There are some work arounds to this if you are prepared to forefit Microsoft support for your Sharepoint implementation i.e.

1. Alter the Store procedure proc_CreateSite which performs the site creation process and accepts language and locale as parameters, to always use locale 2057 (English UK) for each portal (In the relevant _site database). Currently it will be set with no default, so will always use the 1033 locale (English US). If you were to do this, you could be asked to remove the setting from the settings from the store procedure and more importantly revert back any portals to before the changes were made.
2. Bulk update the webs table in the _site database for each Portal to have a locale of 2057 instead of 1033. This has the effect of changing all the sites to UK English.

Naturally I DO NOT recommend these changes due to supportability issues, but support from Microsoft may not be of concern in all implementations.

Another better workaround is to use feature stapling to provision a masterpage to new mysites by adding the regional settings to the featurereceiver (credit to Esben Kolind of Netcompany IT and Business Consulting for this suggestion):

mySiteWeb.RegionalSettings.LocaleId = 1030; //Danish
mySiteWeb.RegionalSettings.Time24 = true;
…
mySiteWeb.Update();

Microsoft have now developed a fix for this that has gone through testing, has been approved and is being rolled into a hotfix.

07/01/08
The initial fix released in October 07 broke the creation of MySites in my farm so was prompty uninstalled. A new version has now been released for pre-SP1. I'm awaiting Microsoft to send it to me. Microsoft plan to release a post-SP1 update in about eight weeks.

14/01/08
The second release of the fix works a treat and allows the administrator to set the locale in https://MySiteURL/_layouts/settings.aspx (the Personal Site Provider site) to whatever they want ie. UK and then this will be inherited to new My Sites.

08/02/08
A third release of the fix is now available for post SP1. Because this fix has not undergone full regression testing it is not available for general download. To obtain, contact Microsoft and quote KB942819.

MOSS 2007 Installation - Could not access the Search service configuration database

2007-05-30T10:49:00.000Z

I had some trouble configuring the Windows SharePoint Services Search Service during a MOSS 2007 installation. When starting the service I hit the following error message:

Could not access the Search service configuration database

In the Application Event log the following error was shown:

The filename or extension is too long. 0x800700ce

This problem is caused by the server names in use being too long. It is no good trying to change the name of the database server to be the Netbios name (rather than FQDN) within the Windows SharePoint Services Search Service configuration, you need to change the name of the server registered to perform the Search service.

Before doing this please ensure you take a full backup of your MOSS site collections (if you have any, in my case I didn't as it was a clean install):

stsadm.exe -o backup -url <http://hostname> -filename backup.dat
http://support.microsoft.com/default.aspx/kb/889236

After the backup perform the following steps to register your search (perhaps also WFE/Index) server using stsadm.exe to invoke the "renameserver" command option.

Open a command prompt window and navigate to the folder where stsadm.exe sits. Normally "C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\BIN".

Use the renameserver command as follows, replacing and with the new and old names of your server:

stsadm -o renameserver -newservername -oldservername

That should do it.

I am told that this command is safe to run as part of your configuration if necessary, although I would recommend you follow the setup procedure in the following site though to avoid it.
http://mindsharpblogs.com/bill/archive/2006/06/27/1153.aspx

Multiple Languages/Invalid Characters in RSOP of Windows 2003

2007-05-24T09:58:00.000Z

When you run RSOP on Windows 2003 SP1/SP2 and you have Group Policies that modify the Error Reporting settings, you may notice that under Computer Configuration\Administrative Templates\ there are a lot of random languages that appear to be related to Application Error Reporting.

This is caused by RSOP quering the applicable settings for Application Error Reporting in local ADMs. All local ADMs named AER_xxxx.adm in the %Systemroot%\INF folder are parsed to see if there is a match for the error reporting policy setting. If there are multiple AER_xxxx.adm files that match the error reporting policy, they are all displayed in the RSOP result. These ADM files are installed by .Net Framwork 2.0. as Microsoft have not released language specific versions of .Net 2.0.

This is not by design, but there is no current fix.

To workaround this issue you can either happily ignore it, or on the machine where RSOP mmc is being run (this does not need doing on all machines if you query them from a central server) have a look in the %Systemroot%\INF for any ADM files that begin with AER_xxxx.

If you find multipleAER_xxxx.adm files, then (after backing them up) remove all but the AER_1033.adm (English).

Run Rsop again.

VMWare Server: Virtual machine config file is invalid

2007-05-15T08:45:00.001Z

Have you experienced this error after a host lock up on VMWare Server? This can be caused by a number of things from duplicate/invalid entries in the config .vmdk file (compare it to others), missing files, corrupt disk volumes or corrupt memory files. In my case the problem was with corrupt memory files and the following steps resolved it:

Reboot the host server to remove any file locks
Delete the .vmem and .vmem.lck files in the faulty VM's working directory.

The virtual machine can then be powered back on.

Please approach this with caution on production VM servers as any transactions that are in memory and not committed to disk will be lost.

Automatically update and reboot Citrix Presentation Servers on a schedule

2007-05-09T20:19:00.001Z

When we originally set up our Citrix PS 4.0 farm we needed to establish an efficient method of patching our servers without any maintenance windows or visible downtime. This method of patching needed to tie in with our use of WSUS and not add any administrative overhead.

The answer seemed easy, we need a system that detects if there are any outstanding patches (those approved for installation on WSUS, or available from Microsoft Update depending on environment), if there are outstanding patches it then needs to stop subsequent TS/Citrix logins, wait for everyone to log off, download and install the patches and then reboot.

I was sure that there would be plenty of people who need a similar solution but having spent some time looking all I could find were scripted methods for installing patches, tools that rebooted servers when there were no remote logons (all of which I found inconsistent) and the obvious change logon /disable command. I needed a way of pulling this together so I wrote a number of batch files and VBScript (I can't claim credit for all the VBScipt as I downloaded it from http://www.wsus.info/).

We set WSUS setting via GPOs to check for updates every night and install between 04:00 and 06:00. Therefore, if we approve a WSUS update to a group the servers in that group will update that evening. The first step was to change this GPO for the Citrix PS servers so that the servers were set to only download the updates and not install (although you could set it to do nothing, the important thing is that the servers are set to look at the WSUS server for updates). the next step was to create a scheduled task to run my scripts, which I set to run every night.

Now to the scripts, the first of which determines if updates are available: if there are it calls a batch file, if not it quits and nothing happens until the scheduled task runs again the next night.

Set updateSession = CreateObject("Microsoft.Update.Session")
Set updateSearcher = updateSession.CreateupdateSearcher()
Set searchResult = _updateSearcher.Search("IsInstalled=0 and Type='Software'")
Set File = CreateObject("Scripting.FileSystemObject")

Set LogFile = File.OpenTextFile("R:\Temp\WSUSUpdates\CheckForUpdates.log", 8, True)
LogFile.WriteLine("***************************************************************")LogFile.WriteLine( "START TIME : " & now)LogFile.WriteLine( "Searching for updates..." & vbCRLF)
LogFile.WriteLine( "List of applicable items on the machine:")

For I = 0 To searchResult.Updates.Count-1
Set update = searchResult.Updates.Item(I)
LogFile.WriteLine( I + 1 & "> " & update.Title)
Next

If searchResult.Updates.Count = 0 Then
LogFile.WriteLine( "There are no updates waiting to be installed, quiting.")
WScript.Quit
Else
LogFile.WriteLine( "There are updates waiting to be installed.")
LogFile.WriteLine( "Stopping the IMA service to prevent logons.")
dim shell set shell=createobject("wscript.shell")
LogFile.WriteLine( "Checking for logged in users....")
shell.run "R:\Temp\WSUSUpdates\CheckLoggedInUsers.bat 350"
set shell=nothing
WScript.Quit
End If

You will notice that if patches are available the batch file CheckLoggedInUsers.bat is called. This batch file disables new logins and checks for users logged in remotely using the ICA protocol and if there remote users it loops round until they are not! It takes the parameter from the first VBScript "350" as the number of times to retry before giving up and quiting. You will need PS Tools from: http://www.microsoft.com/technet/sysinternals/Utilities/PsTools.mspx installed for this to work and sleep.exe from the Windows 2003 server resource kit tools: http://www.microsoft.com/downloads/details.aspx?FamilyID=9D467A69-57FF-4AE7-96EE-B18C4790CFFD&displaylang=en.

@echo off
If "%1"=="" GOTO Parameter
set E2=0
set E1=0
set E0=0
%systemdrive%
cd %systemdrive%\temp\wsusupdates\
date /t >>CheckLoggedInUsers.log
echo Stopping logons >>CheckLoggedInUsers.log
echo Stopping logons
change logon /disable
goto firstrun
:loop
echo Users logged on, checking retry limit
echo Users logged on, checking retry limit >>CheckLoggedInUsers.log
echo Incrementing retry count >>CheckLoggedInUsers.log
echo Incrementing retry count
:E0
if %E0%==9 goto E1
if %E0%==8 set E0=9
if %E0%==7 set E0=8
if %E0%==6 set E0=7
if %E0%==5 set E0=6
if %E0%==4 set E0=5
if %E0%==3 set E0=4
if %E0%==2 set E0=3
if %E0%==1 set E0=2
if %E0%==0 set E0=1
goto DONE
:E1
set E0=0
if %E1%==9 goto E2
if %E1%==8 set E1=9
if %E1%==7 set E1=8
if %E1%==6 set E1=7
if %E1%==5 set E1=6
if %E1%==4 set E1=5
if %E1%==3 set E1=4
if %E1%==2 set E1=3
if %E1%==1 set E1=2
if %E1%==0 set E1=1
goto DONE
:E2
set E1=0
if %E2%==9 set E2=0
if %E2%==8 set E2=9
if %E2%==7 set E2=8
if %E2%==6 set E2=7
if %E2%==5 set E2=6
if %E2%==4 set E2=5
if %E2%==3 set E2=4
if %E2%==2 set E2=3
if %E2%==1 set E2=2
if %E2%==0 set E2=1
goto DONE
:DONE
If "%E2%%E1%%E0%"=="%1" GOTO RetryLimit
echo Sleeping for 60 seconds >>CheckLoggedInUsers.log
echo Sleeping for 60 seconds
sleep.exe 600
:firstrun
echo Checking for ICA Sessions >>CheckLoggedInUsers.log
echo Checking for ICA Sessions
query session FIND "ica-tcp#" >nul
IF NOT errorlevel 1 GOTO loop
:update
Echo Performing an update >>CheckLoggedInUsers.log
Echo Performing an update
InstallWSUSUpdates.vbs
psshutdown /r /f
:RetryLimit
echo Retry limit exceeded, script exiting >>CheckLoggedInUsers.log
echo Retry limit exceeded, script exiting
GOTO end
:Parameter
echo No retry limit entered (enter three characters i.e. 003), script exiting >>CheckLoggedInUsers.log
echo No retry limit entered (enter three characters i.e. 003), script exiting
GOTO end
:end

We now have no logged in users, new users cannot login and there are patches waiting to be installed. The third of the scripts installs the patches:

Set updateSession = CreateObject("Microsoft.Update.Session")
Set updateSearcher = updateSession.CreateupdateSearcher()
Set searchResult = _
updateSearcher.Search("IsInstalled=0 and Type='Software'")
Set File = CreateObject("Scripting.FileSystemObject")
Set LogFile = File.OpenTextFile("R:\Temp\WSUSUpdates\InstallWSUSUpdates.log", 8, True)
LogFile.WriteLine("***************************************************************")
LogFile.WriteLine( "START TIME : " & now)
LogFile.WriteLine( "Searching for updates..." & vbCRLF)
LogFile.WriteLine( "List of applicable items on the machine:")
For I = 0 To searchResult.Updates.Count-1
Set update = searchResult.Updates.Item(I)
LogFile.WriteLine( I + 1 & "> " & update.Title)
Next
If searchResult.Updates.Count = 0 Then
LogFile.WriteLine( "There are no applicable updates.")
WScript.Quit
End If
LogFile.WriteLine( vbCRLF & "Creating collection of updates to download:")
Set updatesToDownload = CreateObject("Microsoft.Update.UpdateColl")
For I = 0 to searchResult.Updates.Count-1
Set update = searchResult.Updates.Item(I)
LogFile.WriteLine( I + 1 & "> adding: " & update.Title )
updatesToDownload.Add(update)
Next
LogFile.WriteLine( vbCRLF & "Downloading updates...")
Set downloader = updateSession.CreateUpdateDownloader()
downloader.Updates = updatesToDownload
downloader.Download()
LogFile.WriteLine( vbCRLF & "List of downloaded updates:")
For I = 0 To searchResult.Updates.Count-1
Set update = searchResult.Updates.Item(I)
If update.IsDownloaded Then
LogFile.WriteLine( I + 1 & "> " & update.Title )
End If
Next
Set updatesToInstall = CreateObject("Microsoft.Update.UpdateColl")
LogFile.WriteLine( vbCRLF & _
"Creating collection of downloaded updates to install:" )
For I = 0 To searchResult.Updates.Count-1
set update = searchResult.Updates.Item(I)
If update.IsDownloaded = true Then
LogFile.WriteLine( I + 1 & "> adding: " & update.Title )
updatesToInstall.Add(update)
End If
Next
logFile.WriteLine( "Installing updates...")
Set installer = updateSession.CreateUpdateInstaller()
installer.Updates = updatesToInstall
Set installationResult = installer.Install()
'Output results of install
LogFile.WriteLine( "Installation Result: " & installationResult.ResultCode )
LogFile.WriteLine( "Reboot Required: " & installationResult.RebootRequired & vbCRLF )
LogFile.WriteLine( "Listing of updates installed " & "and individual installation results:" )
For I = 0 to updatesToInstall.Count - 1
LogFile.WriteLine( I + 1 & "> " & updatesToInstall.Item(i).Title & ": " & installationResult.GetUpdateResult(i).ResultCode )
Next
'if installationResult.RebootRequired = -1 then
'LogFile.WriteLine( "reboot the server")
'strComputer = "."
'Dim refWMIService
'Set objWMIService = GetObject("winmgmts:" _
'& "{impersonationLevel=impersonate,(Shutdown)}!\\" & strComputer & "\root\cimv2")
'Set colOperatingSystems = objWMIService.ExecQuery ("Select * from Win32_OperatingSystem")
'For Each objOperatingSystem in colOperatingSystems
'ObjOperatingSystem.Reboot()
'Next
'end if
LogFile.WriteLine( "STOP TIME : " & now)
LogFile.WriteLine("***************************************************************")
LogFile.Close

You can comment back in the VBScript reboot command but I found using psshutdown /r /f within the calling batch file (script 2) much more dependable.

I also have a scheduled task to re-enable logins at bootup: change logon /enable

That is it. This has been running problem free for about six months and does not require any administrative overhead (any more than WSUS does anyway).

Suggestions and comments always welcome!