Microsoft Exchange ECP in English

This is quick one, just in case you're administering Microsoft Exchange 2013 without mailbox in that organization, and you want to open the ECP interface in English (default language is something else than English), at the end of the url add "?mkt=EN-us".

For example: if the URL of the ECP is https://exchange.server.local/ecp, URL for opening ECP on English will look like this: https://exchange.server.local/ecp?mkt=EN-us .
 

Microsoft Exchange excessive log growth on database

In this case, in Microsoft Exchange 2010 organization, there was excessive log files generation for one database. Number of logs generated for the database was 10 times higher than usual daily rate for that database. Besides monitor tools that were monitoring the parameters of the Exchange server and reported this excessive log growth for the database, backup administrators has also noticed that time needed for the backup of this database has also grown.
So, question was why there is excessive log growth for this database ?
For answering this question I've installed ExMon (Exchange Server User Monitor) on server that was having this database mounted.
For downloading Microsoft Exchange Server User Monitor for Microsoft Exchange Server 2000,2003,2007 and 2010 use this link
For downloading Microsoft Exchange Server User Monitor for Microsoft Exchange Server 2013 and 2016 use this link

Running Exchange Server User Monitor has reported a user that has "monopolized" store.exe process cpu usage to 50% and generated huge amount of log data. Disabling this user has normalized logs generated files for the affected database. And the reason for this huge amount of logs generated files for the database was a faulty activesync device registered by this user. Enabling this AD user and disabling activesync access for this user, has also stabilized affected database logs generation.

For more info about ExMon follow this link.

Refreshing ExMon might crash the console and prevent ExMon from running again with following error "Unknown StartTrace error (183)", because the previously started trace is still running. In order to resolve the issue, check the status of running traces and search for "Exchange Event Trace" with "logman query -ets" :

Stop the trace with "logman stop "Exchange Event Trace" -ets ", and ExMon should start successfully.

For more about debugging Microsoft Exchange excessive database logging please check https://blogs.technet.microsoft.com/exchange/2013/04/18/troubleshooting-rapid-growth-in-databases-and-transaction-log-files-in-exchange-server-2007-and-2010/ .
 

Network shares might become inaccessible after installation of KB3161949

In this case, access to internal network shares for external users was granted over Cisco ASA as a published solution. After installation of KB3161949 on Window Server 2012 R2, that was hosting those network shares, the network shares become inaccessible to these external users. The error message that external users were experiencing by the Cisco ASA portal was "Error contacting host":

Even though the description of this KB is "MS16-077 Description of the security update for WPAD: June 14, 2016", there is a change by this KB affecting the network shares access.
The first change listed in the KB article is hardening the NETBIOS communication outside of the local subnet, affecting the SMB over NETBIOS to stop working outside of the local subnet (in my case Cisco ASA for publishing network share access was relying on).
Resolving the issue for these external users, and enabling access to internal shares same way as before installation of this KB, was either by uninstalling the KB or enabling the following key in registry:

SUBKEY: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
Value Name: AllowNBToInternet
Type: Dword
Value: 1

After creation of AllowNBToInternet and setting the value to 1, and rebooting the server, external users were able to connect to network shares again, hosted on Windows Server 2012 R2 and published by Cisco ASA.
 

Event ID 4769 Audit failure with Failure Code 0xC

In this case there was a two way forest trust between two forests. Forest 1 was containing single domain1, Forest 2 was containing several domain trees. Also, there was a external trust between Domain 1 and domain B.

Users from both forest we're able to login successfully on workstations that were also members in both forests. But, when users from domain B were trying to access resources (file share \\server1.domain1.local\fileshare) in Domain1, there was a credential prompt requesting for valid username and password. On domain controllers in Domain1 Audit failure was logged with following details:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Task Category: Kerberos Service Ticket Operations
Level:         Information
Keywords:      Audit Failure

Description:
A Kerberos service ticket was requested.

Account Information:
 Account Name:  user@domainB.local
 Account Domain:  domainB.local
 Logon GUID:  {00000000-0000-0000-0000-000000000000}

Service Information:
 Service Name:  cifs/server1.domain1.local
 Service ID:  NULL SID

Network Information:
 Client Address:  ::ffff:a.b.c.d
 Client Port:  49783

Additional Information:
 Ticket Options:  0x40810000
 Ticket Encryption Type: 0xffffffff
 Failure Code:  0xc
 Transited Services: -

From https://technet.microsoft.com/en-us/library/bb463166.aspx Failure code 0xC is KDC_ERR_POLICY.

I have successfully resolved this issue by enabling name suffix Domainb using Trust properties, Name Suffix Routing tab in Forest 1. After enabling Domainb in Name suffix routing tab, users from DomainB were successfully accessing resources in Domain1 using Kerberos without any credential prompt.
 

Free ebook : Windows 10 IT Pro Essentials: Top 10 Tools

This book is for all IT Pros. Even experienced IT Pros might find some interesting topics and some new ways for achieving their daily tasks.

Grab a copy of free eBook: Windows 10 IT Pro Essentials: Top 10 Tools .