Author: Ayesh De Silva

In Place Upgrade ADFS Server 2012 to 2019

Ayesh De Silva

Recently, I had the opportunity to upgrade ADFS server runs on 2012. I was able to upgrade 2012 server to 2019 via Windows in-place upgrade without reconfiguring or rebuilding entire server. This a very brife write up on how to do this.

**It is best to backup or take a proper snapshot of the server before any changes. In my case vmware snapshot was the option.

**First, insert 2019 ISO to the 2012 server and bring up PS shell as a admin and then browse to the ISO folder( in my case it was d:\support\adfs). You will be able to see two PS script one for export and another for import. We are gonna use the export, run( Make sure that you have created appropriate folder first to export the data)

export-federationconfiguration.ps1 -path c:\adfs_backup

Once the export done make sure to take a screenshot or note down all the adfs server name and stuff show end of the script. This is important, since you gonna need to install adfs after the upgrade.

**Then I copied that contetnt from adfs_backup folder to my desktop, just incase things goes south 🙂

***Then Export the certificate with the private key to safe location. Usually server woudn’t purge any certs during the in place upgrade but its better to be safe.

***Then go ahead and do the upgrade of 2012 to 2019. Once done, re-install adfs role on the server using the same name and properties showen end of the script run from the first step and do the basic config.

***Once ADFS done, brows to the ISO d:\support\adfs import the federation data that was exported from the old ADFS run via PS Shell

import-federationconfiguration.ps1 -path  c:\adfs_backup

***Make sure al the certs properly inplace using certmanger via MMC

***Bring PS Shell and run,

$FormatEnumerationLimit=-1
Get-ADFSProperties

Set-ADFSProperties –ExtendedProtectionTokenCheck None

Set-AdfsProperties -WIASupportedUserAgents ((Get-ADFSProperties | Select -ExpandProperty WIASupportedUserAgents) + "Chrome" + "Mozilla/5.0")

***Then finally test out the ADFS!

Please find great write up here,

https://ezcloudinfo.com/2017/02/20/easy-migration-steps-from-adfs-2-0-to-4-0/

https://www.ibm.com/docs/en/security-verify?topic=directory-configuring-adfs-windows-integrated-authentication

https://help.hcltechsw.com/domino/10.0.1/admin/secu_enabling_iwa_adfs30.html

Advertisement

Cert will not show in IIS after import

Ayesh De Silva

Some hosting providers will not provide a traditional SSL cert. This is especially true if you decide to use wild card SSL on your internal IIS server, while it is an issue to your web server hosting provider. In many cases a cert will be provided as a .cer and key file.

But IIS will not take .cer since it will be missing a private key. In this case easy solution is to convert .cer and key file to.pfx.

This site explain in detail how to do that https://www.sslmarket.com/ssl/how-to-create-an-pfx-file

But if you need a quick solution, you can easily use this online tool to perform that task and generate the pfx and install it on your IIS.

https://www.sslshopper.com/ssl-converter.html

Image Capture Wizard Fails With Error Code (0x00004005)

Ayesh De Silva

This is a solution to resolved image capture error from SCCM while capturing standard image. I was able to successfully resolved error code while I was trying to capture Win 10 latest update image. Basically issues caused my APPX package on Windows store. Only solution is to get rid appx associated profile, so SCCM wouldn’t have to do some extra work which bound to fail :). My case my image was on VM which allowed me to take lots of snapshots which saved me tones of time. Hope this will help some of you.

All the credits goes to here. I had to do some changes in my process while I was doing this.

1.  Run the Powershell command  ‘Get-AppxPackage | Remove-AppxPackage’

2. Configure your registry settings for SysPrep.

  1. Open regedit and look for:
  2. HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus\CleanupState\ 
    Set to value: 2 ( My case this wasn’t there)
  3. HKEY_LOCAL_MACHINE\SYSTEM\Setup\Status\SysprepStatus\GeneralizationState\ 
    Set to value: 7 ( This was already set to 7)
  4. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SoftwareProtectionPlatform\SkipRearm 
    Set to value: 1 
  5. Then, run the command:msdtc -uninstall (wait a few seconds) 
    msdtc -install (wait a few seconds) ( My case I didn’t see anything happened but who knows ran it anyways)

3.  Next Steps to resolve appx,

  1. Run the Import-Module Appx PowerShell cmdlet
  2. Run Import-Module Dism
  3. Run Get-AppxPackage -AllUser | Where PublisherId -eq 8wekyb3d8bbwe | Format-List -Property PackageFullName,PackageUserInformation
  4. Run Get-AppxPackage -AllUser | Where PublisherId -eq 8wekyb3d8bbwe | Remove-AppXPackage
  5. On my VM I saw all my two accounts had the appx, so I created another local admin account and log in with that new account.
  6. After with the new account I have delete whatever account is tied to all of my Appx packages.
  7. Reboot the computer and login to your new admin account.
  8. Capture the image as your new admin account.

Also here is the place to see the error on capture process.

C:\Windows\System32\Sysprep\Panther

following files has the issues related to capture.

  • setupact.log
  • setuperr.log

Cisco ISR 4331 IOS and ROMMON Upgrade

Ayesh De Silva

Here is the steps to upgrade ISR 4331 GW. You will need to upgrade ROMMON upgrade first if you are going from older ver to new ver. This is specially true when you receive RMA from Cisco for trouble device. Once the upgrade done make sure to enable smart license (Most of the time I keep questioning ” Smartness” ) and get that activated.

ISR4331 – Cisco recommended IOS-XE release 16.12.05 & ROMMON version 16.12(2r).


Step 1: Copy both ROMMON and IOS images to the bootflash of ISR

copy tftp: bootflash:
copy ftp: bootflash:
copy scp bootflash:

Step 2: Verify MD5 Checksum for both the files.


verify /md5 bootflash:isr4300-universalk9.16.12.05.SPA.bin

verify /md5 bootflash:isr4200_4300_rommon_1612_2r_SPA.pkg

Step 3: Upgrade the ROMMON on the router with the following command

upgrade rom-monitor filename bootflash:isr4200_4300_rommon_1612_2r_SPA.pkg all

Note: Please wait until this process finishes and do not interrupt

Then reload the system to make sure it boots properly.

Step 4: Now set the new boot statement in order to be able to load the new code on the device using the following commands
conf t
no boot system
boot system flash bootflash:isr4300-universalk9.16.12.05.SPA.bin
end
Write

Step 5: Verify that the boot variable points to the new image using the following command.
show bootvar

Step 6: Now reload the device using the following command
reload

Filezilla Server Setup

Ayesh De Silva

It seem that new version of Filezilla Server tend to confuse many of us with introduction with complete new UI. This is a basic quick setup of Filezilla Server and some explanation for confusing steps.

***Download FIilezilla from https://filezilla-project.org/ and those who want older version of product here is the link https://download.filezilla-project.org/server/

****Once downloaded start the installer and go through process and make sure to setup admin password to access the server and if you prefer change the admin port number from default one during the installation.

****Next open Filezilla admin interface and click on server and configure

**** Click on server listener and setup listing IP to accept incoming FTP request, usually this is leave as 0.0.0.0 to listen to all address. Also you can define whether you want to you explicit TLS or not.

**** Next click on Users and add user and password. This will be the user / psw that you will be need when connecting from FTP client. Important line on here is virtul and Native path,

Virtual path is slimier to Linux directory and this will be the name directory show when client connect and you can /whatever the name you like. Native Path is where will be this file will be actually save, basically real directory path in computer where data will be saved. Note that Filezilla Server doesn’t support network path.

***Next Apply setting and done!. Server setup is complete.

Note that I didn’t go into detail to setup certs and all other setup. This is a quick and dirty FTP server 🙂

An error occurred while enrolling for a certificate.The certificate request could not be submitted to the certification authority.The RPC server is unavailable.

Ayesh De Silva

Recently I had upgraded Root cert server OS ver from 2012 to 2019 via in place upgrade. Yes, I know it is not the most ideal way but I had my reasons 🙂

After upgrade none of the help desk staff was was able to connect to root cert server via MMC or none of the PC was able to request certs. So everyone was in help desk wasn’t happy 😦 But user was able to request certs and domain admin was able to connect to cert MMC and issue them. Since the PC wasn’t able to request any certs and end up in breaking SCCM communication which was done via PKI. So error I was getting was this,

After many search one of the post from here save the day and it was issue with DCOM error caused by the in place upgrade, how? I have no idea 🙂 https://theitbros.com/the-rpc-server-is-unavailable-0x800706ba/

Solution was this in my case,

In the AD search for Certificate Service DCOM Access and add Domain computers/Users/domain controllers as members

Then go to root CA server and run in cmd in admin mode.

certutil -setreg SetupStatus -SETUP_DCOM_SECURITY_UPDATED_FLAG

net stop certsvc & net start certsvc

After this I was able to resolved my issue.

Error: ‘Invalid Argument provided. Java Server startup failure.’ when creating or refreshing a report using a JDBC

Ayesh De Silva

First make sure you have correct OJDBC or JDBC file.

Then copy that file to the java lib location, in my case D:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\java\lib

Then open CRConfig.xml and add the path location as shows below

https://userapps.support.sap.com/sap/support/knowledge/en/1527666

https://userapps.support.sap.com/sap/support/knowledge/en/1219417

SCCM Prerequisite check error when upgradeing – SQL Server Configuration for site upgrade failed

Ayesh De Silva

I had a opportunity to upgrade SCCM to new version from 2006 ver. As some of you may know that before SCCM upgrade there is a process to check whether current environment meet per-requisites. I new that my SQL environment and server environment meet standard after reviewing Microsoft documents. But my environment was keep failing per-requisites no matter which new version I choose. After several ours of browsing and reading through logs was able to locate the issue on SQL and pass through the obstacle and successfully upgrade the environment.

All I had to do is connect with SQL server and run two command. I’m no expert on SQL so I’m going simply put here two command that you need to run in your SQL server environment. I’ll also will put link here for great post related to SCCM upgrade.

ALTER DATABASE SCCM_DB_NAME SET ENABLE_BROKER WITH ROLLBACK IMMEDIATE;

ALTER DATABASE SCCM_DB_NAME SET HONOR_BROKER_PRIORITY ON

https://blog.ctglobalservices.com/uncategorized/mas/configmgr-prerequisite-check-error-when-upgradeing-to-1810-sql-server-configuration-for-site-upgrade-failed/

https://systemcenterdudes.com/step-by-step-sccm-2103-upgrade-guide/

This task sequence cannot be run because the program files for scopeid

Ayesh De Silva

There are many issues that can generate above mentioned error while imaging using SCCM. But the biggest hurdle is locating the scope ID. Because usually it gives you some giant number not that clear.

Easiest way to locate the scope ID is clicking on listed task list and reference tab which list all the task IDs. This issue was resolved by re distributing erred task ID related package.

How to setup Tor Bridge

Ayesh De Silva

I am not going to detail what is tor and all. Because if you already looking to setup Tor bridge, I assume that you already know about tor 😊. You can learn more about tor here anyways https://www.torproject.org/

In my setup I’ve used Lubuntu ( Focal distribution) (https://lubuntu.net/ ) light weight ubuntu base distro on spare old NUC box. This setup needs very little resources since Lubuntu design to run on your old hardware. Also, system can run 24/7 with very little power consumption.

First you need to get install latest tor. Because Debain LTS ver does not always give you the latest stable tor. if your tor bridge not safe, your intended user will not be safe either.

***** Enable package manager

# apt install apt-transport-https

***** Next go the to /etc/apt/sources.list or a new file in /etc/apt/sources.list.d/ add below entries,

   deb     https://deb.torproject.org/torproject.org <DISTRIBUTION> main

   deb-src https://deb.torproject.org/torproject.org <DISTRIBUTION> main

in my case it was little different because Focal dropped 32-bit support,

   deb     [arch=amd64] https://deb.torproject.org/torproject.org focal main

   deb-src [arch=amd64] https://deb.torproject.org/torproject.org focal main

***** You can fine your distro ver by running lsb_release -c in terminal.

***** Then add gpg Keys to sign packages

# wget -qO-  https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --import

# gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add –

***** Install Key rings

# apt update

# apt install tor deb.torproject.org-keyring

Get more info here https://support.torproject.org/apt/tor-deb-repo/

****** Install Tor and proxy packages

# apt-get  install tor

# apt-get install obfs4proxy

# apt-get update

***** Brows into /etc/tor/  and right click and edit as admin torrc file or open with terminal editor,

Comment out or add these lines if the do not exists,

BridgeRelay 1

ORPort TODO1 = In my case TODO1 replace with 9001

ServerTransportListenAddr obfs4 0.0.0.0:TODO2 = I changed TODO2 to 9002

ExtORPort auto

ContactInfo address@email.com = change out your address you want to be contact if the relay have issue

Nickname PickANickname = set a nickname whatever you like

ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy

Log notice file /var/log/tor/notices.log

****** Set NoNewPrivileges=no in these two files,

/lib/systemd/system/tor@default.service

/lib/systemd/system/tor@.service

After that run below in terminal,

# systemctl daemon-reload

# systemctl restart tor

***** Now you need to port forward above set ports, so that Tor can reach your bridge.

Find more info here , https://community.torproject.org/relay/setup/bridge/debian-ubuntu/