Matt Parkinson – Notebook

Lync 2010 – Active Directory Operation Failed – Insufficient Access Rights To Perform This Operation

So after a long break in posting due to busy work commitments I am finally back to write some more articles which I have saved up. This one goes back a while to when Microsoft Lync 2010 first came out however it is something that I have come across in a few environments when installing Lync especially in environments where I.T. staff are domain administrators to be able to support their users on a day to day basis.

When editing a domain administrator in the Lync control panel you may be faced with the error below once you press the commit button to save your changes.

Lync - Active Directory Operation Failed - Insufficient Access Rights

To fix this you need to make the following changes in active directory which can be a bit of a pain if you are making regular changes to any domain administrators as the permissions you are about to change will reset themselves after about 5 minutes.

1. Go to Start>Administrative Tools>Active Directory Users and Computers.
2. Browse to the organizational unit that holds the user account you are attempting to modify in Lync.
3. Right click the user and go to properties which will present the following dialog.
   
4. Press the advanced button where you will then be presented with another dialog box.
5. Tick the box marked “Include Inheritable Permissions” as shown below
   

   Active Directory Advance Security Dialog

6. Press ok to close all of the dialogs and try saving your changes again.

Please remember as I mentioned earlier this fix will only last for around 5 minutes as Active Directory will automatically re-apply the old permissions so if you need to make a number of changes you may want to keep the advanced security dialog open so you can easily re-apply the settings.

NAV 2009 / CRM 2011 Integration – Requested value ‘Customer_No’ was not found

While working on a recent integration between NAV 2009 and CRM 2011 for a client I came across the following error when trying to run the default “NAV Customer Card to Account” mapping.

Inner Exception: Requested value ‘Customer_No’ was not found.

This took me a long time to work out so I have documented the fix below however please make sure that you read the rest of this article to determine if your situation is exactly the same. The client’s NAV database I was trying to integrate was from NAV 2009 SP1 however support for the connector was not added until NAV 2009 R2 so the database was missing a few required tables. I had imported these which were tables 5151 & 5150, Codeunit 5151 & 5150 and XMLport 5151 & 5150 and I had enabled the connector from the marketing setup table. This populated everything correctly and enabled the web services which allowed me to start the integration and get to the point where this failure was occurring. After a little research I found that you could browse to the web service URL and view the pages that were being shared on the web service. I did this for an integration that worked using the test database in the same environment and also for my integration which was failing and I found the results shown in screenshots below.

Web Service from NAV Server that wasn't working

Web Service from working NAV server

You will see in the 2nd screenshot from the working NAV Server that there is the field “Customer_No” at the bottom. In the NAV server that wasn’t working and reporting the error that field isn’t present and that’s whats causing the problem. If you want to check this on your own server you can bring up a list of the web services by going to http://localhost:7047/DynamicsNAV/WS/Services on your NAV server. You should then see a list of the available web services and you want to look for the one ending “Page/Integration_Ship_to_Address”. If you copy the full url which should be something like “http://localhost:7047/DynamicsNAV/WS/Page/Integration_Ship_to_Address” and browse to it you will then see something similar to the screenshots above and you can check for the existence of “Customer_No” in the web service.

Now the explanation on how to check this and verify you have the same problem has been done let’s get on to actually fixing it:

1. Open Microsoft Dynamics NAV Classic with Microsoft SQL Server
2. Locate and open the demo database that is shipped with NAV 2009 R2. This should be in your installation media.
3. Once open go to Tools>Object Designer
4. Find page 300 “Ship-to Address” and go to File>Export. Save the file to your computer.
5. Close the demo database and open your own NAV database.
6. Go to Tools>Object Designer
7. Go to File>Import and find the file you saved when you exported the table.
8. Press ok to the dialogs and the table should now be imported/merged with your existing table.
9. Refresh the web service URL posted earlier and you should now also see “Customer_No” on the installation that was not previously working.
10. Re-run the integration map and it should no longer complain of the error.

Allow sender spoofing in Exchange 2007

Recently while working on a client’s exchange server I had the need to setup a user which could send from domains that were not being hosted on the server. The reason for this was due to a legacy application that was using the exchange server to send e-mails to mailing lists for an external company. On the first try I just attempted to authenticate using the domain credentials and send the e-mail however exchange will come back with the following error:

If the user and domain we were trying to send as existed on the exchange server we could simply add send as rights to allow us to send from the address. The problem here however is that the domain is on a remote server so we need to find a way to let us send as any address we want to. After some research over at Microsoft Technet it turns out there is a power shell command “Ms-Exch-SMTP-Accept-Any-Sender” which will allow a user to spoof their from address. To use this command you will need to open up the Exchange Management Shell and run the following command.

Get-ReceiveConnector “CONNECTOR” | Add-ADPermission -User “DOMAIN\USER” -ExtendedRights “Ms-Exch-SMTP-Accept-Any-Sender”

You will need to modify the “connector” and the “domain\user” parts to match up with your own configuration. As long as everything goes ok you can test spoofing the address again and this time it should go through. If you are not sure what the name of your connector is you can run “Get-ReceiveConnector” on it’s own to list the available ones.

Custom 404.ASP Page Displaying Code

When implementing a custom 404 ASP page for a client recently I found that the code of the page was displaying as text rather than the parsed code. Accessing the custom 404 page directly however worked without any problems and showed the correct error document.

In the end the problem turned out to be that you can’t specify the page’s “message type” as file if you are using a scripted page such as ASP as it won’t parse the code. If you specify the type as a url and put in the absolute path relative to the sites root however it will work correctly and parse the code. I have included a screenshot below to show the settings a little clearer.

Changing the Windows drive letter

Although it is not recommend there are some times when you may need to change the letter of your Windows drive from C: to another letter or it may have changed by itself to another letter and you need to change it back to C:. In my case after an automated Windows installation my Windows drive letter had come up as D: so I wanted to change it to C:. The reason this had happened was due to a USB disk being connected while the install was taking place so it had labeled that as C: instead. To change the drive letter please follow the steps below:

1. Go to start > run and type in “regedit” and press enter.
2. Expand the folders to HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
3. You should see something similar to the screen below. We are interested in the \DosDevices\ values.
   
4. If you are in the same scenario as myself and something is already using the C: drive you will need to select it from the list and press F2 to edit the value. You should change this to a drive letter that is not in use which in my case would be “I:”. If you do not have a device using C: you can skip to the next step.
5. You then need to find the value which has your current drive and edit that to be C:. So in my case I need to change “\DosDevices\D:” to “\DosDevices\C:”.
6. You should now restart your computer and the drive letters should change. You do not need to worry about the boot.ini configuration as this is controlled using the disk and partition numbers rather than the drive letters.

If you get an access denied message while trying to change these values it may be due to the permissions on the registry key. To change this you should right click the “MountedDevices” folder on the left hand pane and go to permissions. You then need to ensure that the “Administrators” group has full control of the folder. If you have modified these settings you should then close the registry editor and re-open it for the settings to take full effect.

DL120 and Adaptec 2405 Grub Loader Problems

Yesterday I was working on a new HP DL120 G6 with an Adaptec 2405 RAID controller and I had quite a serious problem with the Grub Boot Loader in that it would always ask me to select the option to boot as though a key had been pressed rather than automatically booting the default kernel. While this is not a problem if there was someone there to press enter when it rebooted as the server was in a datacentre it was not very easy.

Another key note on this is that as Grub started to load it was slow and while showing “Loading Grub Stage 2″ the Adaptec card would have a constant beep for around 10 seconds until Grub had loaded. This initially is strange as usually it loads so fast I never see the text on screen. The second thing was that after selecting the kernel to boot it would then start to beep constantly for about a minute while it perform the initial kernel loading which was also very slow.

I spent a few hours trying to fix this (which is why I am writing about it) changing all sorts of options in the BIOS and on the card itself to no luck. Eventually I went to the Adaptec site and started to read through the new firmware release notes and found that while there was not a specific fix related to the DL120 there were some other fixes related to HP and specifically the ML110 so it looks like Adaptec actively work with HP on problems.

Because of this I decided to download the latest firmware (which at this point is build 17911) and proceeded to flash the Adaptec BIOS. Upon this completing and rebooting the server the Grub Boot Loader started to work correctly and automatically boot the default kernel option.

Find Text Inside A File In Linux

Recently I had the need to find all files on a Linux system containing a particular string of text. To do this you can use the following command adjusting it for your specific needs. This command is very useful in cases where websites have been comrpomised to search for a common string that may have been replaced in all of the files on the website.

find ./ -type f -print0 | xargs -0 grep -l “text to search for”

The above command will search the current directory for the text “text to search for”. You can change the directory you want to search in by modifying the “./” to the full directory path.

Windows Server 2008 SMTP Logging Not Working

Yesterday I was trying to debug my SMTP service by using the built in IIS logging feature. I enabled logging the same way I always have done in 2003 by selecting the SMTP server properties however no logs were being generated. After a few different attempts I went back into the server manager and took a look at the IIS role and found that there was a “Health and Diagnostics” section in the role services of which one of the options was “ODBC Logging”. As soon as I installed this and restarted the SMTP service logging began to work. If you have a similar issue you can check that ODBC Logging is installed by following the instructions below:

1. Go to Start > Server Manager
2. Expand Roles
3. Scroll down in the right hand pane until you find Web Server (IIS)
4. Click “Add Role Services” from the right hand side
5. Scroll down and find “ODBC Logging” and tick the box if it is not already ticked and then click the “Install button”
6. Go to start > run and type in services.msc
7. Find the “Simple Mail Transfer Protocol (SMTP)” service and press restart
8. Browse to “C:\Windows\System32\LogFiles\SMTPSVC1″ and check the logs are now being created

Run Commands As System User

Sometimes there may be a need to run a command as the system user however as you may have noticed it is not possible to log directly into this account. To get around this you can use the following work around.

1. Go to Start>Run and type in CMD then press enter.
2. In the new command prompt box type “at 09:00 /interactive cmd.exe” and press enter replacing the 09:00 with the time a few minutes ahead of what it is now. This creates a scheduled task in the interactive mode to launch at the time specified.
3. Once you reached the time set you will see a new command prompt box open similar to the following
4. This command prompt is now running as the system user and you should be able to issue any commands you want. As you can see I have run “intl.cpl” which loads the language and regional settings for the system user. In my case this was to change the time format for a service which was being run as the system user.

Outlook crashing after Exchange 2010 Upgrade

Recently I performed an upgrade to Exchange 2010 from Exchange 2007 and found that upon opening Outlook on the users computers it would just crash straight away. It seems like a number of people have been noticing this problem after an upgrade and it seems to be related to the msExchQueryBaseDN attribute not being set in active directory. After setting this attribute for my users I was then able to open Outlook without any issues. To check if this is the problem in your case please follow the steps below:

1. Go to Start> Administrative Tools> ADSI Edit
2. Right click ADSI Edit in the left hand pane and go to connect to and use the following settings.
   
3. On the left hand pane you should now be able to expand the active directory tree which will look fairly similar to what you are used to seeing in active directory users and computers. You need to browse to where the user you want to change is stored.
4. Right click the user and go to properties which will open all of the attributes available.
5. Scroll down until you find the msExchQueryBaseDN attribute and most likley to the right of it there will be nothing set.
6. Double click this entry and in the new dialog box enter the distinguished name of where the user should be able to search for mail enabled objects in OWA. For example if you want the user to be able to find all mail enabled objects in your whole organisation enter “DC=domain,DC=local” replacing the values of domain and local of course.
7. Try to re-open Outlook and it should now open correctly.