The Comms Room

mossy

00:00

"Cats of Google+" and "The Hunger Games"

moving on

MDMarra

lists.centos.org/pipermail/centos-announce/2013-March/…

ewwhite

00:40

I don't want to have to debug more EL6.4 issues. But the timing is right. Need to test the new XFS.

mossy

01:07

@MDMarra A lot of hot blogger moms on g+

jscott

Uhh...

mossy

lol

jscott

You're a young dude, aren't there any cougar bars in your town?

ewwhite

01:31

Tap that!

ewwhite

01:46

@mdmarra shame that you're missing some billable work

mossy

Sweet. Someone sent back a quality recommendation on linkedin!

MDMarra

02:09

@ewwhite ?

I have a phone, you know

Speaking of billable.

ewwhite

How do I clear Windows 2003 installer cache?

MDMarra

What's the problem?

ewwhite

it's what happens when you leave a customer to manage their own TS.

want to look?

MDMarra

If you clear the installer cache, you won't be able to upgrade or uninstall anything

Sure. I'll look

ewwhite

k. I won't touch it.

it's just such a messed up setup.

I had no clue

MDMarra

02:14

yeah that's where it keeps the uninstall stubs and all that

when you're in add/remove programs and click uninstall, it uninstalls by running {blah-blah-blah-guid-thing-0000-1111-2222}.msi /X from the installer cache behind the scenes

ewwhite

k

MDMarra

@ewwhite what's the actual problem with this place?

ewwhite

you'll see.

MDMarra

oh god

are you going to send admin credentials as well?

ewwhite

There's a terminal server that's a domain controller

4

jscott

02:18

TS DS. So hot!

ewwhite

I was called in to install Exchange last year

so I did... added some dc's...

Adrian

howdy howdy

ewwhite

can't get functional level to 2008 R2 yet...

MDMarra

@ewwhite ok send me admin creds and the server name and I'll take a look

ewwhite

@MDMarra I need to demote the terminal server obviously.

MDMarra

02:20

yeah

is this in production now?

or are they off

ewwhite

Yes.

I've been tasked with P2Ving the old terminal server

MDMarra

so nothing I do can cause a reboot now

ewwhite

Oh, this setup is in production

but this is a downtime period

MDMarra

ok

so you just need this to not be a DC?

or is other stuff broke too

ewwhite

yes, which I can do.

but I want to see what can be purged before I p2v

MDMarra

02:22

you're going to demote before P2V right?

ewwhite

yes.

MDMarra

ok

so you just want to be P2Ving the least amount of stuff possible then and you want me to take a look and see what can be axed?

ewwhite

yes... but I'll also need a plan to get this setup in order.

I gave them a newer TS to use...

assuming they'd move everyone to it

they didn't

so there are users on the new TS... and users on the old...

the people on the old are relying on crusty PST's

MDMarra

ok

ewwhite

files are strewn all about.

MDMarra

02:25

send me admin creds and server names and I'll take a look.

ewwhite

10.1.1.5 is the term server

dc1 and dc2 are 2008 DC's

MDMarra

what's the FQDN of the AD?

ewwhite

generalproduceinc.com , duh

:)

MDMarra

split horizon

classy

ewwhite

Whoever set up AD initially left the netbios name at... GENERALPRODUCEI

MDMarra

02:28

haha

jscott

Well, it's not like they had a choice to add the "NC" on the end.

MDMarra

i get NXDOMAIN for DC1.generalproduceinc.com

ewwhite

nice.

ping it

MDMarra

nope

no go

also can't get to 10.1.1.5

VPN is connected no prob though

ewwhite

fix your mac!

MDMarra

02:31

it works just fine!

ewwhite

I don't know what you're saying.

MDMarra

My Mac works fine

However, I can't get to anything on the other side of this VPN tunnel

ewwhite

reconnect.

MDMarra

Already tried

ewwhite

what IP do you have?

MDMarra

02:36

utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
inet 10.1.1.226 --> 10.1.1.226 netmask 0xffffffff

ewwhite

can't see you

I see me!

MDMarra

If there a 1 tunnel per user restriction or anything?

ewwhite

nope

oh, maybe.... let's see.

use mdmarra

MDMarra

the same, uh, password isn't working for mdmarra

oh wait

is that the second email you sent me

ewwhite

no...

MDMarra

02:39

nope

ewwhite

hold on

k. try now

MDMarra

Marks-MacBook-Pro:~ mark$ nslookup dc1.generalproduceinc.com
Server: 75.75.75.75
Address: 75.75.75.75#53

** server can't find dc1.generalproduceinc.com: NXDOMAIN

so, it doesn't look like this VPN connection is not pushing the resolvers on the other side of the tunnel to me

ewwhite

it is.

dscacheutil

and reboot that crap

...

MDMarra

nope

nothing

ewwhite

try again

Mac newbie...

MDMarra

02:50

is this a split tunnel?

looks like it

ewwhite

yes

it is.

MDMarra

and it looks like the internal interface of the asa is the same as my router at home

that's problematic, right?

ewwhite

there you go!

MDMarra

wait i might be reading this wrong

ewwhite

man, it's all about 192.168.1.0/24... there will never be overlap if you do that.

MDMarra

02:52

Internet:
Destination Gateway Flags Refs Use Netif Expire
default 192.168.1.1 UGSc 89 0 en1
default utun0 UCSI 0 0 utun0
10.1.1/24 10.1.1.226 UGSc 1 11 utun0
10.1.1.226 10.1.1.226 UH 4 9 utun0
10.1.2/24 10.1.1.226 UGSc 0 0 utun0
10.1.3/24 10.1.1.226 UGSc 0 0 utun0

I'm reading that wrong, I think

Everything on the other side of the tunnel is 10.1.1/24. My home network is 192.168.1.0/24

So no overlap, I'm just bad at networking

ewwhite

open your system prefs... look at the tunnel

under advanced config, you'll see the resolvers

MDMarra

yeah i see it

ewwhite

can you ping the DNS resolver?

MDMarra

no

ewwhite

netstat -rn

MDMarra

02:55

There are routes over utun0

ewwhite

odd.

MDMarra

two defaults though?

ewwhite

which client are you using?

MDMarra

default 192.168.1.1 UGSc 102 0 en1
default utun0 UCSI 0 0 utun0

the built-in OS X cisco ipsec client

ewwhite

yes, that is normal

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            172.16.4.1         UGSc           25        0     en0
default            utun0              UCSI            0        0   utun0
10.1.1/24          10.1.1.227         UGSc            3       18   utun0
10.1.1.227         10.1.1.227         UH              5       33   utun0
10.1.2/24          10.1.1.227         UGSc            0        0   utun0
10.1.3/24          10.1.1.227         UGSc            0        0   utun0

MDMarra

02:58

how do you preserve the formatting in chat?

ewwhite

"Fixed Font"

MDMarra

what's the markdown for that though

ewwhite

The "Fixed Font" button

MDMarra

there's a fixed font button?!

Marks-MacBook-Pro:~ mark$ netstat -rn
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.1.1        UGSc          102        0     en1
default            utun0              UCSI            0        0   utun0
10.1.1/24          10.1.1.226         UGSc            1       11   utun0
10.1.1.226         10.1.1.226         UH              4        6   utun0
10.1.2/24          10.1.1.226         UGSc            0        0   utun0

woah, I never noticed that

jscott

It only appears once there's multiple lines in the input box. Dat UX.

ewwhite

03:01

Time's-a-wastin'

MDMarra

Fix the ASA!

ewwhite

Nothing wrong with it.

MDMarra

sigh

ewwhite

this happens sometimes on Mac systems

MDMarra

So what's the fix?

ewwhite

03:04

dunno. The VPN works for me.

which group name is in use?

"clientvpn"?

MDMarra

yep

i copied and pasted what you sent me

ewwhite

and ping 10.1.1.1 ?

MDMarra

timeout

ewwhite

set your service order

the gear icon in the network config

drag this connection up to the top

MDMarra

didn't help

You sure this isn't an ACL?

ewwhite

03:09

yep

what IP do you have?

MDMarra

Marks-MacBook-Pro:~ mark$ ifconfig utun0
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1280
	inet 10.1.1.226 --> 10.1.1.226 netmask 0xffffffff

ewwhite

start pinging 10.1.1.1

MDMarra

ok

timing out

ewwhite

yeah, weirdo mac.

is VMware or Parallels running

MDMarra

No

Also, any other tunnel works fine

ewwhite

03:16

I'd delete and recreate the VPN

MDMarra

ok

actually

I already did that

but I'll do it again

for a third time

nope, still nothing

ewwhite

could be a NAT issue

looking at logs

MDMarra

ok

ewwhite

yeah, no idea what the issue is here. unless it's an asymmetric routing issue...

which is a possibility here

MDMarra

Yeah no clue. I don't have any crazy setup at home or anything. The only thing I use this laptop for besides web browsing is side work for you mostly haha

And I just tried with Valley and Davalan and both connect fine

ewwhite

03:28

it's their load balancer... packets are being returned over a different connection

MDMarra

oh

awesome

...........this server...........

ewwhite

are you in?

MDMarra

I just got disconnected from that server with the domain admin account

Was that you?

ewwhite

oh, go back in

MDMarra

oh my god

this server

hahaha

ewwhite

03:32

what's the problem?

MDMarra

all those shares

ewwhite

imagine a non-tech guy who figured out how to use a feature... then went to town with it.

MDMarra

oh and it's a print server

ewwhite

sure

MDMarra

ok, so besides telling you how fucked up it is (which you already know)

what exactly is it that you're wanting me to do here?

ewwhite

03:34

I need to see if it is safe to demote it from DC

then see if there's anything nice that can be cleared out before I P2V it.

the client's complaint is that it's been turning itself off every so often...

MDMarra

OFF?

ewwhite

I think I solved that.

faulty PDU

MDMarra

yeah

ok im going to poke around dc1

ewwhite

I threw dc1 up last year to get Exchange running... mainly because Kroger no longer accepts unencrypted mail streams

MDMarra

so there are 4 DCs

ewwhite

03:38

haha

MDMarra

Both TSes are DCs

ewwhite

make everything a DC!

MDMarra

yep

ewwhite

(I made dc1 and ts1)

MDMarra

dc1 has all the roles though

ewwhite

03:39

I did that... but never got around to demoting

termserv2 isn't really a terminal server

I think it just has a fax card in it

it was intended to replace the first terminal server

but now both of those systems are old... 2003 and 2005

(the years that they were deployed)

MDMarra

ok so it's definitely safe to demote the TSes unless something is using them for DNS

ewwhite

nothing I know of

MDMarra

Also, this TS only has 1 DNS server listed

I'd pop DC2 in there for good measure too

ewwhite

yep

see the shares...

what is the fix?

dedicated file server...

MDMarra

yeah

and there's no reason to have all of them as shares. Just make \\server\shares and have them be subfolders

ewwhite

03:43

do you think you could sort out the profiles and the file shares?

MDMarra

sure

ewwhite

share - singular...

MDMarra

cleaned up about 1/2 a GB on C:\

give you a little more breathing room there

ewwhite

spec out what you think it'll need in terms of time to get them onto a real fileserver...

MDMarra

sure

ewwhite

03:45

and I'll get it approved.

MDMarra

I'm looking through the data now to see if it's scriptable

ewwhite

nothing is uniform...

and there's a lot of waste

MDMarra

it's only like 50GB of stuff

Even if most of it's crap, it's not a ton

ewwhite

Look at E drive

and user profiles on C

MDMarra

yeah, I was talking about moving the user profiles on C as 50GB

ewwhite

03:47

problem is that those are profiles mainly comprised of PST files.

and they already have exchange.

MDMarra

oh

so will this include exporting/importing those?

or are they being skipped?

ewwhite

these were people who the local person NEVER MOVED to the new TS1

2008 RDS servers use Exchange online mode by default

and the profiles wouldn't be compatible anyway, right?

MDMarra

I don't set up roaming profiles though

Folder Redirection is different

Roaming Profiles roam everything not just data. So things like desktop wallpaper, app-specific settings, etc.

ewwhite

but you don't want to have to enable XP mode

MDMarra

I've never seen a real need for it

It's not the end of the world for XP style profiles. In clients like some of the one's we've done in the past where it's a rip it out and replace it migration, I prefer not to

But if there is going to be coexistence, then it makes sense

ewwhite

03:50

this shit needs to just be ripped out

MDMarra

oh ok

ewwhite

no coexistence.

MDMarra

so similar to what we did at valley but a little messier?

ewwhite

other than I was asked to P2V...

but the reasoning is faulty

but think about the time needed to handle profiles, users, file server... and a printer GPO

MDMarra

what do they use these shares for?

ewwhite

03:52

departments, users, crap

just a produce company

MDMarra

are they mapped manually to workstations or something?

ewwhite

they'll need some minimal security

MDMarra

Or is this all thin client

ewwhite

Axel terminals,

thin client

and PC

they go out and buy PC's, then force the users to open RDP sessions

so no PC is actually joined to the domain

oh, and look at the OU's

MDMarra

so what the heck do they have all of these shares for?

ewwhite

03:54

what are the share names?

MDMarra

where do they access them from?

Share name   Resource                        Remark

-------------------------------------------------------------------------------
ADMIN$       C:\WINDOWS                      Remote Admin
print$       C:\WINDOWS\system32\spool\drivers
                                             Printer Drivers
IPC$                                         Remote IPC
E$           E:\                             Default share
C$           C:\                             Default share
Acct Docs    E:\Acct Docs
aps bu       E:\aps bu

If they all just remote to this terminal server anyway, what's the point of all of those shares

ewwhite

two terminal servers

MDMarra

is the other one like this?

ewwhite

and the scan folders are destinations...

for the copier's scans

MDMarra

so the copiers will have to be reconfigured

ewwhite

03:56

and the printers all appear to be shared

it's stupid to define them all on a terminal server anyway

there may be a case for per-location printer targeting here

three locations

MDMarra

sure

location as in sites with separate IP subnets?

ewwhite

yep

MDMarra

cool

ewwhite

10.1.1, 10.1.2, 10.1.3

but if you ever wondered what happens when there's no IT...

look at the naming conventions

MDMarra

Is there stuff on the other terminal server that needs to be migrated as well?

ewwhite

03:58

go take a look...

ts1

MDMarra

yeah

ewwhite

what's over there?

MDMarra

what's general-ts2

is that the new one? or is there a third one

ewwhite

man, I don't even know

general-ts2 is the non terminal server with a fax card in it

MDMarra

aka the 4th DC

:)

what the hell is Keller?

There's a share for it on every server

ewwhite

04:04

can never have too many domain controllers

Keller is for their trucking business.

MDMarra

ok

so there are user profiles on both term servers, a ton of shares, and printers on both

ewwhite

and it should be consolidated, right?

MDMarra

They need:

And OU structure
GPO
Central File/Print Server deployed via GPO
File Migration skipping PSTs
Demotion of the two extra DCs

Sound right?

ewwhite

I can handle the dcpromos

MDMarra

yeah

ewwhite

04:07

I need to do that tonight

but the rest, yes

MDMarra

as long as nothing is using them for DNS, you should be good. They aren't FSMO holders

ewwhite

I'd add that they should probably delete any inactive users

MDMarra

yeah, I can whip up a query for anyone that hasn't logged in for X days

that'll cut down on data needing to be migrated

ewwhite

Lots of maternity leave at produce places...

it's weird... but you'll find users who've been gone for months.

MDMarra

Well, I can get a list that you can give to them for review

ewwhite

04:11

not looking for itemized... just a estimate of a block of hours

to get approved.

e.g. 12 hours.

MDMarra

Ok, so I'd say 12-18 hours. Probably closer to 12, but there's some fucked up stuff here so I'm expecting at least a surprise or two

Is that too wide of a window?

ewwhite

just make it 15 hours.

MDMarra

sure

ewwhite

so can I dcpromo and p2v this crap?

MDMarra

yeah do it up

add DC2 to as the secondary resolver too

demote general-ts2 too while you're at it and raise the DFL and FFL to 2008 R2 so that I can do stuff like enable the AD Recycle Bin and use 2008 Namespaces for the file server

ewwhite

04:17

so this whole thing is doable?

MDMarra

anything is doable

but yeah, it's a mess but I think it can be sorted out

The only thing is that I dont know what these shares are

so I don't know what will break when the path moves

ewwhite

you don't know where they go, you mean?

MDMarra

i mean, there's program files\Keller shared

i don't know who is actually using those shares and where the paths might be hardcoded

if there's a way to get lists of who should be mapped to what shares, I can just whip up a GPO that maps based on group membership and then it's simple, just time consuming

ewwhite

ugh... painful

MDMarra

or you can just tell them where the new shares are and they can map manually

ewwhite

04:20

these people are like Valley... an overworked dude trying to hold things together

oddly enough, the guy there taught me how to take photos

MDMarra

the problem is just that I don't think I can make it seamless unless i know exactly where each and every share is mapped and by who

and there are dozens of shares

ewwhite

he specializes in photographing teenage models

2

MDMarra

ಠ_ಠ

ewwhite

What?!?

I wasn't kidding.

MDMarra

But yeah, tell them 15 hours. Get me a new terminal/file server there, and tell the creepy teen guy to stop making shares

@ewwhite not clicking that

ewwhite

04:23

It's work safe.

well, I wouldn't click on Jenna...

MDMarra

ಠ_ಠ

Jacob

lulz

MDMarra

@ewwhite so, what can we do to dial down these shares or get them sorted?

ewwhite

@MDMarra gotta find out what connects to them

MDMarra

Ok

So, bill the other outstanding projects. Then let's clean up this mess :)

ewwhite

04:28

you need a new terminal server?

is ts1 fucked up, too?

yeah, it probably is

MDMarra

If you'd like to start totally fresh, we can do that

Is there any way to make the VPN work me on this?

I'd hate to have to rdp to this old box to jump to the new stuff

ewwhite

I'd have to set a persistence rule on the load balancer

MDMarra

sounds do-able :)

ewwhite

try it now

MDMarra

no :(

ewwhite

04:41

again

MDMarra

same

ewwhite

works for me!

I added an ipsec-esp rule... maybe that'll work

MDMarra

negative

ewwhite

oh well

Transcript for