travis' brain dump

So, you want record that iLO key that you forgot to write down previously, right?

No problem.

• Venture to https://support.hpe.com/hpesc/public/home and search for “HP Lights-Out Configuration Utility” and download the latest version.
• Once downloaded & installed, you can find it under C:\Program Files (x86)\Hewlett Packard Enterprise\HP Lights-Out Configuration Utility.
• Open your choice of text editors and paste the following into the file:
  <RIBCL VERSION=”2.0″>
  <LOGIN USER_LOGIN=”adminname” PASSWORD=”password”>
  <RIB_INFO MODE=”read”>
  <GET_ALL_LICENSES/>
  </RIB_INFO>
  </LOGIN>
  </RIBCL>
• You can choose to edit the admin name & password here or pass it on the command line (which I will outline shortly). Save the file as ‘getlicenses.xml’ and close the file.
• From a command prompt, navigate to the installation folder for the HPLOCU and execute the following:
  • .\HPQLOCFG.exe -s ip.of.ilo.srv -l .\logoutput.txt -f .\getlicenses.xml -u Administrator -p AdminPassword
• You should receive an output similar to this:
  

Skype for Business Front End Server
Event ID 32042 – LS User Services – Invalid incoming HTTPS Certificate

I ran into this issue recently when someone thought it’d be cute to have the intermediate and root certs for a domain sitting in the same container (Trusted Root Certification Authorities). There’s a reason we have different containers folks. 🙂

Needless to say I was not amused after wasting an hour or so trying to figure out just why this error kept popping up in my event logs and the FE services wouldn’t come up. The worst part? I’d looked at the certificate objects and because these two certs looked almost identical in name, I missed them entirely during my search. 

So after doing a little digging around, I was pointed back towards a problem with a chain. There were a few examples of some Powershell to accomplish what I needed, but I liked this one the best. It allowed for me to see the list of my offenders easily. 

Get-ChildItem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} |fl FriendlyName,Subject,Issuer

Once run, any certificate listed is going to be a cert you need to take a look at. You’ll most likely either move these certificates to the Intermediate or Personal containers. Just be careful where you move stuff so you don’t create new problems for yourself. 

Hopefully you can save yourself some time by having this handy. 

Ever needed to migrate a non-AD integrated Windows DNS Server to another instance of Windows? I found myself in the situation to do so this weekend so I figured I’d share the process for reference. 

From the source server: 

1. Create a folder for storing the migration files. (ex. c:\temp\dnsgmig)
2. From an elevated command prompt, execute the following commands:
   1. ‘reg export “HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Parameters” c:\temp\dnsmig\dns-params.reg
      
   2. ‘reg export “HKEY_LOCAL_MACHINE\System\CurrentVersion\DNS Server” c:\temp\dnsmig\dns-version.reg
3. Modify dns-params.reg and change “PreviousLocalHostname” to the fqdn of your new DNS server. If you using the same name, skip this step. 
4. Copy the folder c:\windows\system32\dns to c:\temp\dnsmig\

Copy the source folder (c:\temp\dnsmig) to the destination server. (example will use the same folder name)

1. From an elevated command prompt, execute the following command: 
   1. Stop-Service DNS
2. Click to import your two registry files, dns-params.reg and dns-version.reg. You’ll be prompted each time to confirm you want to import the information. Click ‘Yes’. 
3. Copy all of the files from c:\temp\dnsmig\dns to c:\windows\system32\dns
4. From an elevated command prompt, execute the following command:
   1. Start-Service DNS

You should now be up and running.