Veeam 11 Error When Editing Backup Job After Upgrade to ESXi Host

After upgrading the ESXi 7.0 host (Update 3), I was receiving the following error in Veeam Backup and Replication 11  (11.0.1.1261) when trying to edit an existing Backup Job:

Host with id ‘a-b-c-d-e’ was not found

The solution was to modify the Veeam database for a guest VM to point to the correct host ID.

  1. Using Microsoft SQL Server Management Studio, navigate to the dbo.BObjects table
    Databases -> VeeamBackup -> Tables -> dbo.BObjects
  2. Right click and Edit Top 200 Rows
  3. Locate the id from the error message in the host_id column
  4. Replace it with the correct host_id (with dashes).  Note – you can get a list of all host IDs by using PowerShell in a Veeam B&R console session with the command Get-VBRServer.  If needed you can also crosscheck the guest VM by matching the object_id column in the database with the Vmid of the VM on the host.
Posted in Uncategorized | Leave a comment

Unable to delete Time Machine Shared Folder in OMV 5

In OpenMediaVault the button may be greyed out if the Shared Folder is still Referenced. References can include file shares but also plugins.  In this case there was a Shared Folder that had been used for Time Machine and after removing the SMB share and verifying plugins, the Delete button was still greyed out.

First you can try to verify what is referencing the shared folder in this OMV file.
/etc/openmediavault/config.xml

Find the shared folder in question and note the UUID. Then search for that UUID in the same file.

In this case I had an afp section with data between the tags <afp> and </afp>. It had the the UUID stored as <sharedfolderref>UUID</sharedfolderref>.

The afp section was used by the the old netatalk plugin that was in OMV 4 but is no longer part of OMV 5 (the system had been upgraded).  However it was not possible to uninstall the plugin since it didn’t appear in the list of available packages.

Alternatively the plugin can be uninstalled via command line. Close the config.xml file then run the console command:

sudo dpkg -P openmediavault-netatalk

Once uninstalled, you can go back to the config.xml file and verify that the afp section was removed automatically.

Refresh the OMV control panel -> Access Rights Management -> Shared Folders. The folder in question should no longer be Referenced and the delete button no longer grayed out.

Posted in Uncategorized | Leave a comment

Set a Quota for Time Machine with SMB on OMV 5.6

This details an OpenMediaVault configuration where an SMB share was created and Time Machine support was enabled for it.  There was a need to limit the size of the Time Machine backups so that it does not consume all available space, and to do that you use the filesystem quotas:

  1. In OpenMediaVault navigate to Storage->File Systems
  2. Select the device that has the Time Machine shared folder
  3. Click the Quota button at the top. 
  4. Note – without any quotas set, Used Capacity for users will show zero even if data is already there.
  5. Set a quota value for the user associated with Time Machine.
  6. Click the grey save button
  7. Click the blue save button
  8. Apply changes
  9. If you click the Quota button again, you can verify that Used Capacity is populating for that user (if data is already in the shared folder).
Posted in Uncategorized | Leave a comment

pfSense IKEv2 VPN for Windows 10 and iOS Devices

This is an out of the box workaround if having trouble connecting to a pfSense IKEv2 VPN with iOS and Windows 10 devices after following the pfSense recipe:
https://docs.netgate.com/pfsense/en/latest/recipes/ipsec-mobile-ikev2-eap-mschapv2.html

When iOS clients (version 15) tried to connect, the device error was “An unexpected error occurred.”  In the pfSense logs there were errors similar to:

[IKE] <con-mobile|112> no acceptable proposal found
[IKE] <con-mobile|112> failed to establish CHILD_SA, keeping IKE_SA
[CHD] <con-mobile|112> CHILD_SA con-mobile{71} state change: CREATED => DESTROYING

The following change may work for you:

  • Phase 2 configuration -> Encryption Algorithms -> AES – change to Auto

When Windows 10 clients tried to connect, the device error was “Policy match error”. In the pfSense logs there were errors similar to:
[CFG] <con-mobile|122> no acceptable ENCRYPTION_ALGORITHM found
[IKE] <con-mobile|127> no acceptable proposal found

The following changes may work for you:

  • Phase 1 configuration -> create a new Encryption Algorithm -> Algorithm AES -> Key length 256 bits -> Hash SHA1 -> DH Group 2 (1024 bit)
  • Phase 2 configuration -> Hash Algorithms -> add SHA1

Note: the pfSense recipe indicates a PFS key group is not supported with a manual VPN configuration in iOS, however setting it to 14 (2048 bit) per the recipe did not cause any issues in iOS15.

Try the connection again to verify if it is successful.

Long term you may want to consider modifying the Windows 10 VPN configuration due to security issues:
https://docs.microsoft.com/en-us/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections

You can modify an existing VPN configuration using the PowerShell cmdlet Set-VpnConnectionIPsecConfiguration:
https://docs.microsoft.com/en-us/powershell/module/vpnclient/set-vpnconnectionipsecconfiguration?view=windowsserver2022-ps

For example, perform these steps to force Windows 10 to use a more secure method by avoiding SHA1 and DH Group 2.  Replace EXAMPLE with the name of the VPN connection you created.

  1. Similar to iOS clients, in pfSense set Phase 2 configuration -> Encryption Algorithms -> AES – change to Auto
  2. Modifying the existing VPN connection using PowerShell:
    Set-VpnConnectionIPsecConfiguration -ConnectionName "EXAMPLE" -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -DHGroup Group14 -PfsGroup PFS2048
  3. When asked to change the Cryptography Settings, choose Yes to continue.
  4. Try to connect to the VPN
Posted in Uncategorized | Leave a comment

Autologon User at Startup in Windows Server

This simple method has worked for me in Windows Server versions 2012 R2 through 2022. Create a new .reg file with the contents below, adjusting the USERNAME, PASSWORD strings as appropriate.  Then run it to add to the registry

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"DefaultUserName"="USERNAME"
"DefaultPassword"="PASSWORD"
"AutoAdminLogon"="1"

If it is a domain joined machine, then add this line and modify the DOMAIN string.

"DefaultDomainName"="DOMAIN"

Sourced from:
https://community.spiceworks.com/topic/1911274-autologin-autologon-sysinternals-with-windows-10-issue#entry-6360895

More information on this method:
https://docs.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon

Posted in Uncategorized | Leave a comment

Change Autodesk Licensing Mode (Post Install)

We recently changed the licensing type for Autodesk 2021 Products (AutoCAD, Inventor, Plant 3D, 3ds Max, etc.) from a license server to individual users. This is the method I used, based on the Autodesk website, by using the product key, product version and the Licensing Installer Helper tool:

https://knowledge.autodesk.com/support/autocad/troubleshooting/caas/sfdcarticles/sfdcarticles/Use-Installer-Helper.html

  1. Go to the directory:
    %CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\Current\helper
  2. Run the command:
    AdskLicensingInstHelper.exe list
  3. Make note of def_prod_key and def_prod_ver for each product you want to change
  4. Run the change command. In this example I was changing it from Network to User licensing but Standalone is also available.
    AdskLicensingInstHelper.exe change –pk (place value of def_prod_key here) –pv (place value of def_prod_ver here) –lm USER
  5. Test by launching the product

Note: for Inventor, I had to modify the licensing for the feature_id INVNTOR and also INVPROSA

Posted in Uncategorized | Leave a comment

Disable Lock Screen Windows Server 2022 Remote Desktop Session Host

I had a Windows Server 2022 RDSH terminal server that was moved to a new domain and would persistently lock the screen on idle for all users including administrators and require them to log in again.

Most guides reference the below Group Policy options, but none of these applied:
Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Session Time Limits

What I found was a setting that had been applied by a GPO in the previous domain and it retained the value when the server was joined to the new domain (which did not have the same GPO).

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon: Machine inactivity limit

Setting it to zero seconds prevented the issue from reoccuring.

Posted in Uncategorized | Leave a comment

Move Google Chrome Session From One Computer to Another

These are the quick and dirty steps I used to perform a complete migration of Chrome from one system to another. It will transfer bookmarks, open tabs and all history. In my experience Settings had to be reconfigured and Chrome Extensions reinstalled.

Based on the guide provided at the below site:
https://workconsultants.com/blog/move-google-chrome-profiles-to-a-new-computer

  1. Install Chrome on both machines
  2. Close Chrome on both machines. Check task manager for any chrome.exe processes that may not have shutdown properly.
  3. Export this registry key on source machine:
    [HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs]
  4. On destination machine, rename the same registry key to: PreferenceMACs-bak using Registry Editor.
  5. On source machine, copy/zip the User Data folder:
    C:\Users\Grant.Kniefel\AppData\Local\Google\Chrome\User Data
  6. On destination machine, rename the same folder to: User Data-bak
  7. Copy/extract the User Data folder from source machine to destination machine at the same location
  8. On the destination computer, import the registry key that was exported from the source machine.
  9. Test Chrome on the destination machine
Posted in Uncategorized | Leave a comment

pFsense Goes Unresponsive (no GUI or internet)

Running version 2.6.0.  After about 3 weeks of boot time, pFsense would lose connectivity. Requests to the internet would fail and the pfSense GUI web interface was unreachable. The console displayed a repeated error swap_pager_getswapspace(x): failed.  The dmesg log contained a list of errors for several services that were terminated (dhcpd, dnsmaasq, mpd5, nginx, php) with error message: pid xxxxx (service), jid x, uid y, was killed: out of swap space. In some cases you can use the top -o res -a command to sort by memory usage and find that bzip2 is consuming all resources.

The solution was to disable log compression under Status->System Logs-> Settings -> Log Compression -> then change to None.

Posted in Uncategorized | Leave a comment

Secure Wipe on OMV

I wanted to use the command line to Secure Wipe a hard drive in OpenMediaVault. I used the built in shred command, details are available at the link below:
https://manpages.debian.org/stretch/coreutils/shred.1.en.html

For example, I like to use the following combination (based on the device number found under Storage->Disks in the GUI):

 shred -vfz /dev/sdX

Verbose, force permissions and a final write of zeros (total 4 passes). This is in contrast to the OMW default, which is a single pass:
https://openmediavault.readthedocs.io/en/6.x/administration/storage/disks.html

shred -v -n 1 /dev/sdX
Posted in Uncategorized | Leave a comment