I try to keep an eye out for new KB articles for specific products I deal with day to day (http://almostdailytech.com/2009/08/27/microsoft-product-rss-feeds/ ). Initially reading the headline is my RSS feed of ” Windows fails to start with error Missing or Corrupt ntoskrnl.exe when keys are pressed during startup”  had my attention thanks to a few key words such as “ntoskrnl.exe”, “missing” and “corrupt”. On further reading the cause (hitting buttons during startup apparently) and the solution which is just absolutely brilliant (just stop doing that stupid), this has officially become my favorite KB article of all time. I’d like to meet the engineer that wrote this KB and shake his hand.

http://support.microsoft.com/kb/2022960

A useful little trick when installing/administrating something that has a potential to eat up storage (think file server, logs for a database) is the fear that the drive will fill up in space without you noticing and you’ll have to add new space immediately. What if this process of adding new space requires downtime or has to be approved? What do you do if you missed the drive space filling up over time and now the system is offline? The answer is a dummy file. I create a semi large dummy file that can be deleted in a pinch if the drive filled up to get everything up and running again on my file server. Think of it as some quick breathing room until you can get the situation under control.

fsutil file createnew dummy.file 10737418240

You can run this at the command line to create your blank large empty file. The last parameter is in bytes, that example is for a 10 GB file.

Just try to gather all some useful info and put it all in one place.

That includes the quorum and MSDTC resource.

http://almostdailytech.com/2009/05/27/changing-the-quorum-disk-in-a-cluster/

How to move Exchange Database (this is similar for moving system path files as well)
http://support.microsoft.com/kb/821915

Moving MS Search

http://almostdailytech.com/2009/06/18/moving-the-ms-search-the-easy-way-and-the-hard-way/

General Cluster

http://msmvps.com/blogs/clusterhelp/archive/2005/08/05/moving-a-cluster-to-a-new-san-original-posted-jul-22-2005.aspx

Borrowing this from another blog which everyone should totally read , http://www.markwilson.co.uk/blog/index.php

Now that MS supports some things to be virtualized but not all aspects, it can be quite confusing depending on your configuration what is supported or not. A simple web form will show you the way.

http://www.windowsservercatalog.com/svvp.aspx?svvppage=svvpwizard.htm

So easy to use, easy to understand and it will show specifically what feature is and is not supported. What is supported is a mystery no more!

Original Post

http://blogs.technet.com/mattmcspirit/archive/2009/07/03/the-svvp-wizard.aspx

Most adminsitrators RDP into their servers daily and every now and then install updates and then reboot a server. The terminal server session closes and you move on. Life is good. Later you go back to RDP into the box and you get nothing. When you finally make it over to the console you notice that the box is still up and the logs show no reboot, what just happened happened?

1.) You didn’t use the /console or /admin switch. This provides you with console level access which is where you should reboot a box from. Since you are not at the console level you have to ask other process if it’s ok to shutdown. They can say no but your RDP session is already closed and you think it’s rebooted.This blog post goes into more detail.

http://blogs.technet.com/askperf/archive/2008/03/18/hotfix-installs-remote-desktop-and-the-reboot-that-wasn-t.aspx

2.) You did us the /console or /admin switch and it still didn’t work, you can never win can you?

Solution: Try applying this update.

http://support.microsoft.com/default.aspx?scid=kb;en-us;971310&sd=rss&spid=3198

Hope this helps. You could also use shutdown.exe /r/f to force it but you could lose data.

Awesome post from the Windows Performance team on how to determine which service is running on which port.

Step 1.) Run netstat -ano

• -a: listing of all connections and listening ports
• -n: display address and port numbers in numerical form
• -o: display the owning PID associated with each connection

Step 2.) Run tasklist.exe

Step 3.) Match up the PID

http://blogs.technet.com/askperf/archive/2008/08/26/what-port-is-that-service-using.aspx

Similar to the RPC dynamic port allowcation, FRS works in the same way. FRS is used in AD replication as well as file replication pre 2003 R2. Once again, putting in firewall rules can be difficult with this random port usage. This registry key can restrict it to a specific port making firewall configuration much easier.

http://support.microsoft.com/kb/319553/

I’ve stumbled apon a very cool tool for determing the health of Windows systems. It is called PAL (Performance Analysis of Logs). It is free as in beer too!!! Basically if you give it a performance log with all the coutners, it will give you a detailed report (HTML, or XML) of what is going on with your system with key areas highlighted in Red where it has having problems. The best part is you are able to see the Performance Counters that are important for on each system. They have several pre-built counters and the levels (think MOM/SCOM but without proactive monitoring), for Exchange 2003/07, Active Directory, IIS, SQL Server 2000/05 and a few others.

http://www.codeplex.com/PAL

There are few easy things you can do to help prevent DDOS attacks to your Windows 2000/20003 Server. These include to change the TCP/IP keep alive time as well as the retransmission of SYN-ACK to prevent a SYN flood.

http://support.microsoft.com/kb/324270