Author: Adam Fowler

Citrix Access Gateway and Changing Passwords

Posted on by Adam Fowler

Hi,
Recently we had two Citrix Access Gateways (CAG) installed, replacing our software based Citrix Secure Gateway (CSG). The CAG is a hardware appliance (here’s the install guide http://support.citrix.com/servlet/KbServlet/download/21072-102-665925/AG_HardwareInstallationGuide.pdf) while the CSG is a free software based solution that sits on a Windows box, but isn’t looked favourably upon anymore. Here’s a great article from Dan Brinkmann on that topic: http://blog.whatwoulddando.com/2011/10/12/citrix-secure-gateway-sigh/

We ran into an issue where some new users couldn’t log in to the gateway, getting the generic error “Try again or contact your help desk”. Everyone loves a generic error…

Anyway, we worked out that it didn’t like accounts where the password had expired, or set to change at next logon. After setting the option on the CAG to allow users to change their password, it looked like it was fixed. The user was prompted to change their password, but when they tried it bombed out again with the same generic error “Try again or contact your help desk”.

Restorting to Google at this stage, as I couldn’t find any logs or errors via the CAG web interface, I found that you need to set up your LDAP as a secure connection for this to actually work (over port 636 not 389). This also requires you to import your internal Root CA to the CAG.

Luckily Citrix doco had this covered, and here are the instructions:

http://support.citrix.com/article/CTX127316

That all worked! So, LDAP over port 389 insecurely will allow authentication only, but for password changes etc you’ll need to use port 636 and use a certificate.

SCCM 2012 Unknown Computers

Posted on by Adam Fowler

Hi,
While getting OSD (Operating System Deployment) working in SCCM 2012 I came across two little things.

First, I want to be able to specify the computer name as part of the deployment. Windows-noob has a great article on this, available here:
http://www.windows-noob.com/forums/index.php?/topic/5542-how-can-i-easily-prompt-for-a-computer-name-in-configuration-manager-2012/

It’s just specifying the variable OSDComputerName needs to be set for your Unknown Computers collection, which will work as long as you have your OSD task sequence advertised there too.

The second thing, which was more of an issue, was that my PC wasn’t detecting my PXE server after the first time, even though the OSD Task Sequence bombed out.

After reading this Microsoft TechNet thread: http://social.technet.microsoft.com/Forums/en-US/configmanagerosd/thread/b4c4ff5e-8e9b-41fd-a4ee-f21d7daccaaf/ I did a search for ‘Unknown’ in my devices, where 2 items popped up. In the properties I checked the MAC address, and sure enough one of the entries matched my PC.

In SCCM 2007 it didn’t quite work this way, generally if it bombed out there would be no record and you could continually PXE boot as many times as you liked. In 2012, as soon as you get to the list of available task sequences, the ‘Unknown Computer’ record is created.

A bit annoying, but there you have it.

SCCM 2012 Client Push Error 80041026

Posted on by Adam Fowler

Hi,
I’ve just been troubleshooting a PC that was failing when the SCCM 2012 client was being pushed to it, with the below error located on the client’s log file ccmsetup.log:

MSI: Setup failed due to unexpected circumstances
The error code is 80041026

After trying the install locally and still having it fail, I took the next logical step and googled it.

I found this blog, which had a similar issue but different error code:

http://www.madanmohan.com/2010/10/msi-setup-failed-due-to-unexpected.html

Luckily the fix was the same, due to something wrong with the WMI Repositry.

Following these instructions worked perfectly:

http://www.madanmohan.com/2010/10/rebuilding-wmi-repository.html

Due to being an XP client, the steps I ran were:

net stop winmgmt

Using Windows Explorer, rename the folder %windir%\System32\Wbem\Repository. (For example, %windir%\System32\Wbem\Repository_bad). %windir% represents the path to the Windows directory, which is typically C:\Windows.

net start winmgmt

rundll32 wbemupgd, UpgradeRepository

That was it, no reboot required. Retrying the install again was then successful.

Thanks Madan’s Blog!

Running Remote Control without the SCCM 2012 Console

Posted on by Adam Fowler

Hi,
Just a quick one here, I figure this blog should also be sharing solutions that others have found and worked, rather than just my own content.

So, I can confirm the following works:
http://ccmexec.com/2012/05/running-configuration-manager-2012-remote-control-standalone/

These instructions will let you run Remote Control from System Center Configuration Manager 2012 without needing any extra software installed. The logged on account still needs ‘Remote Tools Operator’ access from inside SCCM 2012, but they can fire this up to remotely connect after this.

Keep in mind that if you have a 64 bit OS, the path for the files will be “Program Files (x86)”. Also, this works on both 32 and 64 bit OSs, while the old 2007 required separate copies.

It should be a nice easy way to remove VNC or other less secure connection methods internally from your company.

I’ll also add that the 2012 version seems much more reliable than the 2007, especially with visual issues.

Have fun!

How To Enable Office 2013 KMS Host

Posted on by Adam Fowler

Hi,

Following on from my previous blog on “How to add your KMS keys for Windows 8 and Server 2012, here’s how you can enable a KMS Host (Key Management Service) for Office 2013.

Server End

First, you’ll need access to Microsoft VLSC (Volume Licensing Service Center) here: http://www.microsoft.com/Licensing/ Update: You can also download it from here http://www.microsoft.com/en-au/download/details.aspx?id=35584

From there, under the ‘Downloads and Keys’ section you’ll need to find ‘Office Professional Plus 2013 Key Management Service Host’ or Office Standard Key Management Service Host’ depending what you’re licensed for. It’s a 800kb ISO file.

Once downloaded and extracted/mounted, you’ll need to go to your already configured KMS Host which is running your Windows KMS Host activation. If you’ve already got Widnows 8/Server 2012 running then it could be easier, as there were some patches for the pre-release version of this tool, and that will possibly apply to this proper release.

On the KMS Host, open your command prompt and run the command ‘cscript kms_host.vbs’ (assuming you’ve navigated to the directory containing the extracted ISO). It’ll do it’s thing as per this screenshot:

 

Then, as long as you’ve been kind to the licensing Gods it will prompt you saying that the install was successful, and would you like to enter and activate your Office 2013 KMS key now? Yes please you’ll reply, realising you’re talking to your PC.

Enter your key including dashes (obtained from VLSC under the actual Office 2013 product download) and nervously wait, while it gives no indication anything is happening for 10 seconds or so. Eventually you’ll get another prompt saying the key has been successfully installed and activated. You will be able to see this from the Volume Activation Management Tool under the ‘Licensed’ area.

Client End

The Office 2013 client automatically installs using the client KMS. There are two keys remember, being the KMS Host and KMS Client. The KMS Host is obtained via VLSC and individual to your organisation, while the KMS Client key is standard worldwide, and the default for install. The KMS Client key is also referred to as the Generic Volume License Key (GVLK). More info including the publically available keys here: http://technet.microsoft.com/en-us/library/jj219430%28v=office.15%29.aspx

To force client activation, run the command ‘cscript ospp.vbs /act‘ from the C:\Program Files (x86)\Microsoft Office\Office15\ folder. More info on that here:

http://technet.microsoft.com/en-us/library/ee624350%28v=office.15%29.aspx

You’ll now probably get an error saying “The count reported by your Key Management Service (KMS) is insufficient.” with an error code 0xC004F038.

I believe you need 5 unique PCs to request a key before your KMS Host will start giving them out (reference for Office 2010 http://blogs.technet.com/b/odsupport/archive/2010/06/14/troubleshooting.aspx). I haven’t had a chance yet to test this, so please let me know if you find out more.

Update: As confirmed by this page, you need 5 unique PCs http://technet.microsoft.com/en-us/library/ee624358%28v=office.15%29.aspx