Failure to Mount ISO on Windows Server 2016 and 2019

Problem

You have an ISO on a share in your network. You have mapped a drive to the share because, well, that's the right way to do it. And the users are happy about it, the service operations people can get to their stuff easily and the Admins have a share with all of the daily use tools.

Now, that library just happens to have a bunch of ISO files. You want to use one of them to install software, modify boot/install disks, etc. The easy button since Win 8 is the right click and Mount command. East peasy lemon squeezy. You get what looks like a CD Drive and you can browse the files.

Replication

Now, try that on a server with at least minimal security. Not happening.

1. The right click Mount option is there. so the default application is Windows Explorer or File Explorer depending on your version.
2. If you directly address the file as in \\file-01\share\mygreat.iso it will work
3. If you map a drive "net use z: \\file-01\share" and try z:\mygreat.iso it will NOT work. It will tell you there is a problem.
4. Yes, if you move it to a C Drive folder, or some other direct location it will work, but when you have a LIBRARY of iso files, that's not an option.

Supposition

This has to do with Administrative rights and UAC. Somehow the mapped drives (EVEN THOUGH THEY ARE MAPPED IN GROUP POLICY FOR ALL USERS) do not get mapped when you go to mount the ISO.

Before you suggest it. I'm already logged in as a domain admin.

This is a large issue. Many people are having this problem. And for those of you that are NOT having the problem. Good for you. Now lock your computers down so you don't get hacked, OK?

NetApp OnCommand Performance Manager

Installing

Installing OCPM is an easy OFV File install, but sometimes, you get a MonitorLoop error. What I found was that the OVF file had reservations for CPU and memory. Reduce those to Zero (0) and you should startup fine.
The next problem will be installing the VMWare tools. On my instance of 6.5U3, the OVF file came in with an OS Type of Other/Other and the VMware tools install can't find a disk for Other. Shut it down, go into Edit Settings and the VP Options tab. Epand General and you'll find the OS Choices. I was able to successfully install using "Centos 4/5 or higher x64". Set the VM Options to that, save, and power it back up.
You should now beable to open the console, select VMRC, Manage, Install VMWare tools. You will see the console update automatically that it is installing the tools. Eventually, it will bring you to the start of the setup questions. Location.
It's Whack-A-Mole from here.

CDBurnerXP command line problems ERROR 800402A0

An error (800402A0) occurred while executing the command

This is generally caused by an error in one of your paths. Try different options and see what the results are.

Simplify the folder option from this:
"C:\Program Files\CDBurnerXP\cdbxpcmd.exe" --burn-data -folder[\backup]:"D:\DiskBackup" -iso:"d:\datadisk.iso"

To this.
"C:\Program Files\CDBurnerXP\cdbxpcmd.exe" --burn-data -folder:"D:\DiskBackup\" -iso:"d:\datadisk.iso"

Use quotes around your paths.

vCenter VCSA Certificate Locations via SSH

HTTPS Strict Transport Security error

If you get the dreaded HTTPS Strict Transport Security error when going to vCenter and you CAN NOT get the certificate in order to install it. Because if you get the error, you don't get the screen that let's you download it. Catch-22.

Where it lives

Here is where it lives:
/etc/vmware/vmware-vmafd

Just putty or Secure CRT (MY ABSOLUTE FAVORITE) into the vCenter appliance, cd to the directory and cat the files. Then copy them, paste them to a notepad++file and save them with a .crt extension.

Import into Certificate Manager

Click start, and type certificate manager, run it.
The ca.crt file you should import and store in local computer in the trusted root certification authorities folder. The Machine-ssl.crt file just use local machine and let it figure it out.

DONE! 

No more red banner, no more HSTS error.

Now I'm leaving that took about 3 hours to figure out.

Dell R640 Servers

Using these as ESXi Hosts

There are a number of things that you want to do if this is a true enterprise environment. You want to manage them as a group. that can be difficult especially in an offline environment.

Dell has lots of services for internet connected servers, but who really wants their credit card processing server touching the internet.

iDrac 9 info

https://www.dell.com/support/manuals/lt/en/ltbsdt1/poweredge-r940/idrac_3.00.00.00_ug/configuring-services-using-web-interface?guid=guid-7bb3e8b1-89f2-4ef5-94ab-146958142354&lang=en-us

VMware Enhanced Authentication not working

If you have accepted the certificates already, you next need to go to:

https://vmware-plugin:8094

and accept the certificate and all should be well. You may have to reload Firefox, but I didn't have to.

Also, if you are using Enterprise signed certificates, You will want to make sure that Firefox will recognize the Enterprise Certificate chain. If you push out your certs via Group Policy, look at the link below to get it working.

https://support.umbrella.com/hc/en-us/articles/115000669728-Configuring-Firefox-to-use-the-Windows-Certificate-Store

I’ve copied Tom’s Article in below to make sure that post doesn’t go away.

Configuring Firefox to use the Windows Certificate Store

Tom Allen

·         2 months ago

·         Updated

Follow

Deploying the Cisco Umbrella Root CA can be difficult for Firefox users, because there is no built-in way to centrally manage Firefox. This article describes how Firefox can be configured to trust certificates in the Windows certificate store. This makes certificate management via group policy much easier in the long run.
The following guidance is provided 'as is' and cannot be directly supported by Umbrella beyond what is outlined below.

Use the Windows certificate store
As of FF49, a new option has been included which allows Firefox to trust Root authorities in the windows certificate store.  This means that certificates can be deployed via group policy as normal and Firefox will trust the same Root authorities that Internet Explorer trusts.  For more details see here:
https://bugzilla.mozilla.org/show_bug.cgi?id=1265113
Unfortunately, Mozilla have decided not to turn this feature on by default, so this method still requires some other configuration. To enable this setting the security.enterprise_roots.enabled must be set to true.  For more details see here:
https://bugzilla.mozilla.org/show_bug.cgi?id=1314010
To enable this feature on a single computer:

·         In Firefox, type 'about:config' in the address bar

·         If prompted, accept any warnings

·         Right-click to create a new boolean value, and enter 'security.enterprise_roots.enabled' as the Name

·         Set the value to 'true'

To enable this feature on multiple computers you will need to use another method (see below) to lock the preferences in Firefox. The benefit is that once enabled you can easily manage certificates using group policy in future.

Locking Firefox preferences
You can use a preferences file to configure the security.enterprise_roots.enabled setting. To do so use the attached files:

·         The 'umbrella.cfg' file must be placed in the root of the Firefox directory. For example:
C:\Program Files\Mozilla Firefox\umbrella.cfg

·         The 'local-settings.js' file must be placed in the \defaults\pref sub-directory. For example:
C:\Program Files\Mozilla Firefox\defaults\pref\local-settings.js

The contents of local-settings.js should be as follows:

 pref("general.config.obscure_value", 0);

 pref("general.config.filename", "umbrella.cfg");

The contents of the umbrella.cfg file should be as follows:

 //

 lockPref("security.enterprise_roots.enabled", true);

NOTE:  If creating the above files manually, they must be ANSI encoded.

Distributing Firefox preferences files via Group Policy
Group policy can be used to distribute the above files.  Note, this process requires that Firefox is installed to the default location on the client computers.

1.    Add the files 'umbrella.cfg' and and 'local-settings.js' to a network share.  Ensure that the share has read permissions for 'Domain Computers'

2.    Create/Edit a group policy in Group Policy Management

3.    Edit the settings in 'Computer Configuration > Preferences > Windows Settings > Files'

4.    Right-click and select 'New File'

5.    Point the 'Source File' to umbrella.cfg on the Network Share

6.    Point the 'Destination' file to be C:\Program Files\Mozilla Firefox\umbrella.cfg and 'Apply'

7.    Repeat the above step to copy the same file to C:\Program Files (x86)\Mozilla Firefox\umbrella.cfg

8.    Repeat these steps to copy 'local-settings.js' to C:\Program Files\Mozilla Firefox\defaults\pref\local-settings.js

9.    Repeat these steps to copy 'local-settings.js' to C:\Program Files (x86)\Mozilla Firefox\defaults\pref\local-settings.js

Distributing Firefox preferences with the Firefox installer
These files can also be copied by script to the correct location during installation, if you are performing a scripted Firefox installation.  Details on performing a scripted installation of Firefox are here:
https://wiki.mozilla.org/Installer:Command_Line_Arguments
The full offline installer for Firefox is required for a scripted installation.  This is available here:
https://www.mozilla.org/en-US/firefox/all/

(Optional) Distributing Firefox settings with CCK2
CCK2 is another popular method to create locked firefox configurations.  CCK2 is a Firefox add-on with a GUI which allows you to set many different Firefox preferences:
https://mike.kaply.com/cck2/
CCK2 will produce AutoConfig settings which can be extracted into the Firefox installation directory.
Optionally, CCK2 can also export these settings as a Firefox extension that can be distributed to users.

VMware Horizon ADAM Database edits

Making changes to the ADAM Database

There are many reasons why you want to make changes to the ADAM Databse. It is the underlying database that holds the info on Pools, VDI Machines, etc. And this Database FREQUENTLY gets corrupted. I'm not sure why, I'm a big VMware Horizon fan, but man does it get messed up easily.

So to get into it there is a standard procedure that I grabbed from VMware's KB2012377 https://kb.vmware.com/s/article/2012377

Windows Server 2008 / 2012

To connect to the View ADAM database:

1. Log in to one of the View Connection Servers as Domain Administrator.
2. Click Start > Administrative Tools > ADSI Edit.
3. In the console window, right-click ADSI Edit and click Connect to.
4. In the Name field type:
   
   View ADAM Database
    
5. Select Select or type a Distinguished Name or Naming Context.
6. In the field below Select or type a Distinguished Name or Naming Context, type:
   
   dc=vdi,dc=vmware,dc=int
    
7. Select Select or type a domain or server.
8. In the field below Select or type a domain or server, type:
   
   localhost:389
    
9. Click OK.
10. Click View ADAM Database [localhost:389] to expand.
11. Click DC=vdi,dc=vmware,dc=int to expand.

Note: If you are unable to connect using dc=vdi,dc=vmware,dc=int, try using dc=vdi;dc=vmware;dc=int.

Once in there, you have a number of common tasks that you can do.

Server 2019 - .Net 3.5 install failure

When spinning up a 2019 Server you may get a .Net 3.5 Error.

The following feature couldn't be installed:
.NET Framework 3.5 (includes .NET 2.0 and 3.0)

For .NET Framework 3.5, sometimes it will not install with the GUI and a message will be displayed.

 or 

To install it via PowerShell:

DISM /Online /NoRestart /Enable-Feature /FeatureName:NetFx3ServerFeatures /Source:D:\sources\sxs

DISM /Online /NoRestart /Enable-Feature /FeatureName:NetFx3 /Source:D:\sources\sxs

You may get an error after the first command, but the second command will fix that. D: is your DVD Drive, change that if it’s mounted elsewhere.