All posts by Website Admin

Replicated Folder Offline in DFSR

We recently had an issue with and Active Directory DFSR – The replicated folder has been offline for too long at Site error for a Windows Server Standard 2016 single Domain Controller environment.

Event ID 4012 – DFSR – The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain. This server has been disconnected from other partners for 149 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter (###). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder until this error is corrected.

To resume replication of this folder, use the DFS Management snap-in to remove this server from the replication group, and then add it back to the group. This causes the server to perform an initial synchronization task, which replaces the stale data with fresh data from other members of the replication group. .

Summary


Consider the following scenario:

You want to force the non-authoritative synchronization of SYSVOL on a domain controller. In the File Replication Service (FRS), this was controlled through the D2 and D4 data values for the Burflags registry values, but these values do not exist for the Distributed File System Replication (DFSR) service. You cannot use the DFS Management snap-in (Dfsmgmt.msc) or the Dfsradmin.exe command-line tool to achieve this. Unlike custom DFSR replicated folders, SYSVOL is intentionally protected from any editing through its management interfaces to prevent accidents.

How to perform a non-authoritative synchronization of DFSR-replicated SYSVOL (like “D2” for FRS)

  1. In the ADSIEDIT.MSC tool modify the following distinguished name (DN) value and attribute on each of the domain controllers that you want to make non-authoritative:CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<the server name>,OU=Domain Controllers,DC=<domain>msDFSR-Enabled=FALSE
  2. Force Active Directory replication throughout the domain.
  3. Run the following command from an elevated command prompt on the same servers that you set as non-authoritative:DFSRDIAG POLLAD
  4. You will see Event ID 4114 in the DFSR event log indicating SYSVOL is no longer being replicated.
  5. On the same DN from Step 1, set:msDFSR-Enabled=TRUE
  6. Force Active Directory replication throughout the domain.
  7. Run the following command from an elevated command prompt on the same servers that you set as non-authoritative:DFSRDIAG POLLAD
  8. You will see Event ID 4614 and 4604 in the DFSR event log indicating SYSVOL has been initialized. That domain controller has now done a “D2” of SYSVOL.

More Information


If setting the authoritative flag on one DC, you must non-authoritatively synchronizeall other DCs in the domain. Otherwise you will see conflicts on DCs, originating from any DCs where you did not set auth/non-auth and restarted the DFSR service.For example, if all logon scripts were accidentally deleted and a manual copy of them was placed back on the PDC Emulator role holder, making that server authoritative and all other servers non-authoritative would guarantee success and prevent conflicts.

If making any DC authoritative, the PDC Emulator as authoritative is preferable, since its SYSVOL contents are usually most up to date.

The use of the authoritative flag is only necessary if you need to force synchronization of all DCs. If only repairing one DC, simply make it non-authoritative and do not touch other servers.

This article is designed with a 2-DC environment in mind, for simplicity of description. If you had more than one affected DC, expand the steps to includeALL of those as well. It also assumes you have the ability to restore data that was deleted, overwritten, damaged, etc. previously if this is a disaster recovery scenario on all DCs in the domain.

Have any questions?

Call us at: 856-745-9990 or visit: https://southjerseytechies.net/

South Jersey Techies, LLC is a full Managed Web and Technology Services Company providing IT Services, Website Design Services, Server Support, Network Consulting, Internet Phones, Cloud Solutions Provider and much more. Contact for More Information.

To read this article in its entirety click here.

RingCentral Mobile Users Without A Digital Line

Ring Central allows your employees to communicate anywhere, anytime on any device. In the past, Ring Central has not been enforcing licenses for employees that are using the system on mobile devices without a digital line. That is about to change. 

 

RingCentral Mobile Users FAQ

 

Why are you now charging for Mobile Users without a digital line?
Mobile Users without a digital line can make and receive calls and have access to many of the same capabilities as users with digital lines. These include RingCentral Glip, RingCentral Meetings, integrations and more. With this advanced functionality, these users have begun using the product the same way they would a digital line.

Consequently, Mobile Users using the system without a digital line will now be considered part of the total licensed users and will be charged based on their account’s current cost per digital line.

Will I be charged for using the Mobile App?
No. Mobile Users with a digital line are not affected, and can continue to use the Mobile App for no additional charge. This change only affects Mobile Only Users without a digital line.

When does this take effect?
Please refer to the email notification for the timing of this change for your account.

What will be the cost?
The cost for each Mobile User without a digital line will be the same as users who have a digital line. If you want to add digital lines for your Mobile Users at no additional cost (excluding taxes and fees), please contact your RingCentral account manager.

What are the benefits to Mobile Users of adding a digital line?
By adding a digital line, the Mobile User will get full access to RingCentral’s softphone (inbound and outbound) and the ability to use a desk phone if needed. If you are interested, please contact your account manager by calling  800-591-7973.

How do I know which Mobile Users without a digital line will be billed at any given time?
System administrators can log into their RingCentral account and see this information under the billing tab. See more details here. If a mobile user without a digital line is inactive or is only used for internal company calls, within a given month, there will be no charge.

 

KB4090913: Windows 10 Device Fix

We have had a number of users that were unable to use their keyboard or mouse on their Windows 10 computer. Microsoft released an update that addresses the issue yesterday.

Addresses an issue in which some USB devices and onboard devices, such as a built-in laptop camera, keyboard, or mouse, stop working. This may occur when the Windows Update servicing stack incorrectly skips installing the newer version of some critical drivers in the cumulative update and uninstalls the currently active drivers during maintenance.

Known issues in this update


Symptom

Workaround

Windows Update History reports that KB4054517 failed to install because of error 0x80070643.

Even though the update was successfully installed, Windows Update incorrectly reports that the update failed to install. Select Check for Updates to verify that there are no additional updates available. You can also type About your PC in the search box on the taskbar to verify that your device is using the expected OS build. Microsoft is working on a resolution and will provide an update in an upcoming release.

Because of an issue that affects some versions of antivirus software, this fix applies only to computers on which the antivirus ISV updated the ALLOW REGKEY.

Contact your antivirus manufacturer to verify that their software is compatible and that they have set the following REGKEY on the computer: Key=”HKEY_LOCAL_MACHINE”Subkey=”SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat” Value Name=”cadca5fe-87d3-4b96-b7fb-a231484277cc” Type=”REG_DWORD” Data=”0x00000000″

After installing this update, some devices may fail to start, and return INACCESSIBLE_BOOT_DEVICE. This issue occurs when the windows update servicing stack incorrectly skips installing the newer version of some critical drivers in the cumulative update and uninstalls the currently active drivers during maintenance.

Microsoft is working on a resolution and will provide an update in an upcoming release. Workaround steps are available in KB4075150.

Because of an AD FS server issue that causes the WID AD FS database to become unusable after a restart, the AD FS service may fail to start.

There is no way to undo the database corruption. To return your AD FS server to a functional state, you must restore it from a backup.

How to get this update


This update will be downloaded and installed automatically from Windows Update. To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

File information

For a list of the files that are provided in this update, download the file information for cumulative update 4090913.

Have any questions?

Call us at: 856-745-9990 or visit: https://southjerseytechies.net/

South Jersey Techies, LLC is a full Managed Web and Technology Services Company providing IT Services, Website Design Services, Server Support, Network Consulting, Internet Phones, Cloud Solutions Provider and much more. Contact for More Information.

To read this article in its entirety click here.

Outlook issues in the June 2017 security updates

The problems stems from June 2017 security updates. Microsoft is investigating the issues and will update this page when a fix is available. In the meantime, please use the workarounds suggested for each issue. They have categorized it in seven scenarios.

Issue#1: Error when opening an attachment is an email, contact, or task formatted as Rich Text.

This issue affects Outlook 2007 and Outlook 2010.

When you open an attachment in an email, contact, or task formatted as Rich Text you get the following error:outlook-2010-2007-this-program-used-to-create-is-outlook-not-installed

You may also see:

STATUS: WORKAROUND

  • Forward the email to yourself and then open the attachments from the forwarded email.
  • Change the email format to HTML, or Text format.
  • Save the attachments to your computer, using one of the following methods, then open them from the saved location: Drag and drop the attachments to your desktop.
    Go to File > Save Attachments.
    Copy and paste the attachment to your computer.

Issue#2: Opening Mail Attachment warning when opening an attachment that includes consecutive periods

This issue affects Outlook 2007, Outlook 2010, Outlook 2013, and Outlook 2016.

When opening an attachment that includes consecutive periods (…), or an exclamation point (!), the files are blocked and you receive an Opening Mail Attachment warning.

Or if an email message includes an attached email message, and the attached email message’s subject line ends with an unsafe file name extension as listed in the Blocked attachments in Outlook, the email attachment will be blocked for recipients.

STATUS: WORKAROUND

If you get the Opening Mail Attachment warning, and you’re sure the attachment was sent from a trusted source, proceed to Open or Save the attachment.

If the file is blocked because of a potentially unsafe file extension, ask the sender to save the email message to their computer and rename its subject line so that it does not end with an unsafe file name extension. Then, attach it to the email message and resend.

Issue#3: Error when setting ShowLevel1Attach to allow Outlook to display Level 1 attachments

This issue affects Outlook 2013 and Outlook 2016.

If you set ShowLevel1Attach to allow Outlook to display Level 1 attachments, you may see the error: “One or more objects in this file have been disabled due to your policy settings”.

WARNING: Typically, Level 1 attachments are blocked. If you have enabled this policy, users can see Level 1 attachments in Outlook. If you use any of the workarounds to open the files, please make sure they are safe to open. See: Information for administrators about e-mail security settings in Outlook 2007.

If you set ShowLevel1Attach to allow Outlook to display Level 1 attachments, and you send an email with an attachment you may see this message: “This item contains attachments that are potentially unsafe.  Recipients using Microsoft Outlook may not be able to open these attachments.”

STATUS: WORKAROUND

  • Change the email format to HTML, or Text format.
  • Save the attachments to your computer, using one of the following methods, then open them from the saved location:
    • Drag and drop the attachments to your desktop.
    • Go to File > Save Attachments.
    • Copy and paste the attachment to your computer.

Issue#4: VBScript does not run or you receive malicious code warning when using a custom form for Outlook

This issue affects Outlook 2007, Outlook 2010, Outlook 2013, and Outlook 2016.

When you use a custom form that you have created for Outlook, you see the following two symptoms:

  • VBScript does not run.
  • You get a malicious code warning: 

STATUS: INVESTIGATING

We’re investigating this issue and will update this page when a fix is available.

Issue#5: “Something went wrong….” or “Search results may be incomplete” error when searching in Outlook

This issue affects all Outlook versions on Windows 7, Windows 8, Windows 10.

When searching in Outlook, you get this error: “Something went wrong and your search couldn’t be completed.”, or “Search results may be incomplete because items are still being indexed“.

And you’ll see this Event Log warning:

STATUS: WORKAROUND

Until the Windows Update fix release on 6/27, you can set a registry key that will cause Outlook to stop using the local Windows Search service. When this registry key is set, Outlook will use its own built-in search engine. The built-in search will display the message below to indicate it is not using the Windows Search service.

Disable Windows Desktop Search Service for Outlook:

NOTE: The following steps show you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Please make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, see this article.

  • Open Registry Editor.
  • Go to: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search
  • PreventIndexingOutlook
  • Set DWORD: 1

Detailed Instructions:

  1. Click Start, click Run, type regedit in the Open box, and then click OK.
  2. Locate and then click the following subkey in the registry:
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
  3. On the Edit menu, point to New, and then click New Key and name the key Windows Search.
  4. Click on the new key Windows Search.
  5. On the Edit menu, point to New, and then click DWORD Value.
  6. Type PreventIndexingOutlook for the name of the DWORD, and then press Enter.
  7. Right-click PreventIndexingOutlook, and then click Modify.
  8. In the Value data box, type 1 to enable the registry entry, and then click OK.
  9. Note to disable the PreventIndexingOutlook setting, type 0 (zero), and then click OK.
  10. Exit Registry Editor, and then restart Outlook.

Issue#6: iCloud fails to load properly in Outlook 2007

iCloud fails to load properly in Outlook 2007.

When accessing Calendar, Contacts, or Tasks in Outlook 2007, you get the following error:

The set of folders cannot be opened. MAPI was unable to load the information service C:\PROGRA~2\COMMON~1\Apple\Internet Services\APLZOD.dll. Be sure the service is correctly installed and configured.”

STATUS: WORKAROUND

The loading of unregistered MAPI services has been disabled by default to make Outlook more secure.

WARNING: This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. Microsoft does not recommend this workaround but is providing this information so that you can choose to implement this workaround at your own discretion. Use this workaround at your own risk.

If you have trusted applications that depend on being loaded in this manner, you can re-enable those applications by setting the following registry key:

REG_DWORD HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security\AllowUnregisteredMapiServices

You can use the following registry subkey to apply the registry setting as a domain policy:

HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Security\AllowUnregisteredMapiServices

Value 0 (default): Block loading of unregistered MAPI services. This is the recommended setting to avoid unexpected execution of unknown code.

Value 1: Enable loading of unregistered MAPI services.

IMPORTANT: The following steps show you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Please make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, see this article.

To make these registry changes, follow these steps:

  1. Click Start, click Run, type regedit in the Open box, and then click OK.
  2. Locate and then click the following subkey in the registry:HKCU\Software\Microsoft\Office\12.0\Outlook\Security\
  3. On the Edit menu, point to New, and then click DWORD Value.
  4. Type AllowUnregisteredMapiServices for the name of the DWORD, and then press Enter.
  5. Right-click AllowUnregisteredMapiServices, and then click Modify.
  6. In the Value data box, type 1 to enable the registry entry, and then click OK.

    NOTE: To disable the AllowUnregisteredMapiServices setting, type 0 (zero), and then click OK.

  7. Exit Registry Editor, and then restart the computer.

Vulnerability information (applies to all versions)

MAPI does not validate that a provider’s DLL that it is requested to load is registered correctly in MapiSVC.inf or even that it comes from the local machine. This can be exploited by creating a file together with an OLE object in such a way to cause MAPI to load a DLL from a network share when the OLE object is activated. This can allow arbitrary code execution to occur.

Issue#7: When printing a specific iframe or frame in a web page, the print output may be blank, or text is printed with a 404

This issue affects all Outlook versions on Windows 7, Windows 8, Windows 10.

When you print a specific iframe or frame in a web page, the print output may be blank, or text is printed that resembles the following:

NOTE: A frame is a part of a web page or browser window that displays content independent of its container. A frame can load content independently.

This problem has also been observed in both Internet Explorer 11, and in applications that host the IE Web Browser Control.

STATUS: INVESTIGATING

There is currently no workaround for this issue. However, if you print the entire web page, it will print correctly. We’re investigating this issue and will update this page when a fix is available.

Option: Uninstall Recent Microsoft Update

It is not recommended to uninstall the update as it applies to some other issues but if none of the workarounds help then you have this option until a new fix is releases.

For Outlook 2010:

  1. Go to the Control Panel – Programs and features and select view installed updates on the left.
  2. Search or look for KB3203467 and highlight it and uninstall it.

For Outlook 2007:

  1. Go to the Control Panel – Programs and features and select view installed updates on the left.
  2. Search or look for KB3191898 and highlight it and uninstall it.

Have any questions?

Call us at: 856-745-9990 or visit: https://southjerseytechies.net/

South Jersey Techies, LLC is a full Managed Web and Technology Services Company providing IT Services, Website Design Services, Server Support, Network Consulting, Internet Phones, Cloud Solutions Provider and much more. Contact for More Information.

To read this article in its entirety click here.

What you need to know about the WannaCry Ransomware

What has happened?

On May 12, 2017 a new variant of the Ransom.CryptXXX ransomware family (detected as Ransom.Wannacry) began spreading widely, impacting a large number of organizations, particularly in Europe.

What is the WannaCry ransomware?

WannaCry encrypts data files and asks users to pay a US$300 ransom in bitcoins. The ransom note indicates that the payment amount will be doubled after three days. If payment is not made after seven days, the encrypted files will be deleted.

Figure 1. Ransom demand screen displayed by the WannaCry Trojan

It also drops a file named !Please Read Me!.txt which contains the ransom note.

Figure 2. Ransom demand note from WannaCry Trojan

It propagates to other computers by exploiting a known SMB remote code execution vulnerability (MS17-010) in Microsoft Windows computers.

Are you protected against this threat?

South Jersey Techies, LLC recommends and offers Symantec Endpoint Protection to its clients. Symantec Endpoint Protection customers are protected against WannaCry using a combination of technologies: Antivirus, SONAR protection, Network-based protection.

All South Jersey Techies Managed IT Services client computers have the latest Windows security updates installed, in particular MS17-010, to prevent spreading. If your business / organization is not on our Managed IT Services plan please check or contact us to ensure that you have the latest updates installed.

Who is impacted?

A number of organizations globally have been affected, the majority of which are in Europe.

Is this a targeted attack?

No, this is not believed to be a targeted attack at this time. Ransomware campaigns are typically indiscriminate.

Can I recover the encrypted files?

Decryption is not available at this time but companies are investigating. South Jersey Techies, LLC does not recommend paying the ransom. Encrypted files should be restored from back-ups where possible. South Jersey Techies offers a number of backup solutions including Carbonite Online Backup and cloud storage solutions. If you are unsure about your computer / server backups, please check or contact us to discuss the best solution for your business.

What are best practices for protecting against ransomware?

  • New ransomware variants appear on a regular basis. Always keep your security software up to date to protect yourself against them.
  • Keep your operating system and other software updated. Software updates will frequently include patches for newly discovered security vulnerabilities that could be exploited by ransomware attackers.
  • Email is one of the main infection methods. Be wary of unexpected emails especially if they contain links and/or attachments.
  • Be extremely wary of any Microsoft Office email attachment that advises you to enable macros to view its content. Unless you are absolutely sure that this is a genuine email from a trusted source, do not enable macros and instead immediately delete the email.
  • Backing up important data is the single most effective way of combating ransomware infection. Attackers have leverage over their victims by encrypting valuable files and leaving them inaccessible. If the victim has backup copies, they can restore their files once the infection has been cleaned up. However organizations should ensure that back-ups are appropriately protected or stored off-line so that attackers can’t delete them.
  • Using cloud services could help mitigate ransomware infection, since many retain previous versions of files, allowing you to “roll back” to the unencrypted form.

Have additional questions?

Feel free to call us at contact us or (856) 745-9990 with any questions you may have.

New Website Design – Camden County Partnership for Children

The Website Design team of South Jersey Techies has been constantly working on developing great looking websites using the latest web technologies. The most website developed by the our team is a non profit that provides support services to children in the community, Camden County Partnership for Children.

Camden County Partnership for Children is a non-profit agency funded by the state of NJ to arrange a variety of treatment and support services to children in the community. They coordinate services, resources and supports to children and young adults with the most complex needs that include: behavioral/emotional, intellectual/developmental and substance use. Camden County Partnership for Children works with child-family teams (CFT) to develop individualized service plans (ISP).

 

Have questions?

Our Web Design team is here to help
Call us at: 856-745-9990 or visit: https://southjerseytechies.net

South Jersey Techies, LLC is a full Managed Web and IT Services Company located in Marlton, NJ providing IT Services, Managed IT Services, Website Design Services, Server Support, IT Consulting, VoIP Phones, Cloud Solutions Provider and much more. Contact Us Today.

CALL US NOW!