Windows 8 – A Geeks World

How to solve EVENT ID 1202 SceCli 0x57 Parameter is incorrect

Customer is repeatedly getting this Event ID on all Servers and Clients, especially on the Domain Controllers being logged every 5 minute.

Warning	1/26/2018 3:08:15 PM	SceCli	1202	None

Log Name:      Application
Source:        SceCli
Date:          1/26/2018 3:08:15 PM
Event ID:      1202
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      SERVERNAME
Description:
Security policies were propagated with warning. 0x57 : The parameter is incorrect.

Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="SceCli" />
    <EventID Qualifiers="32768">1202</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-01-26T14:08:15.607182700Z" />
    <EventRecordID>147038</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SERVERNAME</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x57 : The parameter is incorrect.

Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".</Data>
  </EventData>
</Event>

Warning 1/26/2018 3:08:15 PM SceCli 1202 None

Log Name: Application

Source: SceCli

Date: 1/26/2018 3:08:15 PM

Event ID: 1202

Task Category: None

Level: Warning

Keywords: Classic

User: N/A

Computer: SERVERNAME

Description:

Security policies were propagated with warning. 0x57 : The parameter is incorrect.

Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".

Event Xml:

<Channel>Application</Channel>

<Computer>SERVERNAME</Computer>

</System>

<Data>0x57 : The parameter is incorrect.

Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".</Data>

</EventData>

</Event>

Searching for that Error gives thousands of results, most less helpful.The way I solved this problem was like this.

On one of the servers having the problem, run RSOP.MSC
Resultant Set of Policies showed a Warning on the Computer policies. Selecting properties there showed the same error as in our Event Log.
Browsing the Tree showed that there were a problem in the Password Policy section, from the Default Domain Policy.
Which were also visible in GPMC (Group Policy Management Console)
By modifying the Default Domain Policy and fixing the bad entries (no clue how they got there). The Error message (and problem) is now gone.

Enable driver verifier for all none-microsoft drivers with powershell

I’ve been doing some debugging for a customer, who has multiple industrial Client PC’s who are rebooting regularly. And to get more information in the memory dumps I had a need to configure the system to do a complete memory dump but also to enable extra verification of all drivers in the system to find the cause of the bluescreens.

Window has a built in tool called “Verifier” where you can enable extra checks on calls done by specific drivers. You generally don’t want to enable it on all drivers as that will slow down the system notable. And truthfully, the number of times it’s a Microsoft device driver who’s causing the issue is so small, because they check and stress test their drivers so much better than all the other vendors. Thus, it’s always better to enable the extra checks for all drivers, except the ones from Microsoft to start with.

As I didn’t want to run around to all the Client PC’s and configure verifier, I’ve made a small powershell script that reads the name of all none-microsoft drivers from the system and enabled verification for just those drivers. Which can then be execute in any number of ways.

It’s using both the Get-VMIObject and Get-WindowsDrivers to get a complete list of thirdparty drivers in the system. And it will also configure the system for a Complete Memory Dump.

# Get all Drivers in system and Enable Driver Verifier 

$driverquery = driverquery /si /FO CSV | ConvertFrom-CSV | where {$_.Manufacturer -notLike "*Microsoft*" -and $_.Manufacturer -notlike "*standard system devices*" -and $_.Manufacturer -notlike "(Standard*" -and $_.Manufacturer -notlike "Generic *"}
$inffiles = $driverquery | Select-Object -Property InfName | Where-Object { $_.InfName -like "*.inf" } 
$Sys =  foreach ($inffile in $inffiles) { 
      Select-String -Path $env:SystemRoot\inf\$($inffile.InfName) -Pattern ServiceBinary | select-string -Pattern \.SYS 
    } 
$drivers1 = $Sys.Line -replace ".*\\" | select -Unique | Sort-Object


$WindRivers = Get-WindowsDriver -Online 
$Sys =  foreach ($inffile in $WindRivers.Driver) { 
      Select-String -Path $env:SystemRoot\inf\$($inffile) -Pattern ServiceBinary | select-string -Pattern \.SYS 
    } 
$drivers2 = ($Sys.Line -replace ".*\\" | select -Unique)

[array]$alldrivers = $null
$alldrivers = ($drivers1 + $drivers2) | Sort-Object | Select-Object -Unique
# $alldrivers

& verifier /reset
& verifier /standard /driver $alldrivers /bootmode resetonbootfail

$regkeypath="HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl"
 #Write Debugging Info
 Set-ItemProperty -Path $regkeypath -Name "CrashDumpEnabled" -Value 1
 Set-ItemProperty -Path $regkeypath -Name "AutoReboot" -Value 1
 Set-ItemProperty -Path $regkeypath -Name "LogEvent" -Value 1
 Set-ItemProperty -Path $regkeypath -Name "Overwrite" -Value 1
 
Write-Output "Please reboot $ENV:COMPUTERNAME"

# Get all Drivers in system and Enable Driver Verifier

$driverquery = driverquery /si /FO CSV | ConvertFrom-CSV | where {$_.Manufacturer -notLike "*Microsoft*" -and $_.Manufacturer -notlike "*standard system devices*" -and $_.Manufacturer -notlike "(Standard*" -and $_.Manufacturer -notlike "Generic *"}

$inffiles = $driverquery | Select-Object -Property InfName | Where-Object { $_.InfName -like "*.inf" }

$Sys = foreach ($inffile in $inffiles) {

Select-String -Path $env:SystemRoot\inf\$($inffile.InfName) -Pattern ServiceBinary | select-string -Pattern \.SYS

}

$drivers1 = $Sys.Line -replace ".*\\" | select -Unique | Sort-Object

$WindRivers = Get-WindowsDriver -Online

$Sys = foreach ($inffile in $WindRivers.Driver) {

Select-String -Path $env:SystemRoot\inf\$($inffile) -Pattern ServiceBinary | select-string -Pattern \.SYS

}

$drivers2 = ($Sys.Line -replace ".*\\" | select -Unique)

[array]$alldrivers = $null

$alldrivers = ($drivers1 + $drivers2) | Sort-Object | Select-Object -Unique

# $alldrivers

& verifier /reset

& verifier /standard /driver $alldrivers /bootmode resetonbootfail

$regkeypath="HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl"

#Write Debugging Info

Set-ItemProperty -Path $regkeypath -Name "CrashDumpEnabled" -Value 1

Set-ItemProperty -Path $regkeypath -Name "AutoReboot" -Value 1

Set-ItemProperty -Path $regkeypath -Name "LogEvent" -Value 1

Set-ItemProperty -Path $regkeypath -Name "Overwrite" -Value 1

Write-Output "Please reboot $ENV:COMPUTERNAME"

Just to be safe, I’ve added /bootmode resetonbootfail so it will reset the verifier settings in case the system is bluescreening during boot due to verifier notificing a bad driver in the boot process.

Reboot the PC, get a big cold Coke and wait for the bluescreen to happen.

Working with Virtual NIC’s in Windows

At times when I’m for example at a customer and need to connect my Laptop to different VLAN’s it’s really nice to add new virtual Network Cards (vNIC’s) on the fly, and be connected to multiple networks at the same time.

By transforming the Network Cards in your computer, into a virtual switch, and then add Virtual Network Cards connected to that switch, it’s possible to do a bit of network magic.

Here is a part of the script that I run each time I reinstall my PC’s to create the vNIC’s that I need and use the most. The script is also installing the software I need and doing some other minor changes (always a work in progress).

Pre-Requisits: Hyper-V Role installed

# Create a Switch for Ethernet Network 
Get-NetAdapter -Name "Ethernet" | New-VMSwitch -Name "Uplink Switch" -Verbose -AllowManagementOS:$false -MinimumBandwidthMode Weight -ComputerName $ENV:COMPUTERNAME
Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "External LAN" -verbose -ComputerName $ENV:COMPUTERNAME
Set-VMnetworkAdapter -ManagementOS -Name "External LAN" -MinimumBandwidthWeight 20 -verbose -ComputerName $ENV:COMPUTERNAME 

# Create a Switch for WiFi Network 
Get-NetAdapter -Name "Wi-Fi" | New-VMSwitch -Name "Uplink Switch WiFi" -Verbose -AllowManagementOS:$false -MinimumBandwidthMode Weight -ComputerName $ENV:COMPUTERNAME
Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch WiFi" -Name "External WLAN" -verbose -ComputerName $ENV:COMPUTERNAME
Set-VMnetworkAdapter -ManagementOS -Name "External WLAN" -MinimumBandwidthWeight 20 -verbose -ComputerName $ENV:COMPUTERNAME

# Add a vNIC for VLAN11 on Physical Network Card
Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "VLAN11" -Verbose -ComputerName $ENV:COMPUTERNAME
Set-VMNetworkAdapterVlan -ManagementOS -Access -VlanId 11 -VMNetworkAdapterName "VLAN11" -Verbose -ComputerName $ENV:COMPUTERNAME
Set-VMnetworkAdapter -ManagementOS -Name "VLAN11" -MinimumBandwidthWeight 10 -verbose -ComputerName $ENV:COMPUTERNAME

# Add a vNIC for VLAN800 on Physical Network Card
Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "VLAN800" -Verbose -ComputerName $ENV:COMPUTERNAME
Set-VMNetworkAdapterVlan -ManagementOS -Access -VlanId 800 -VMNetworkAdapterName "VLAN800" -Verbose -ComputerName $ENV:COMPUTERNAME
Set-VMnetworkAdapter -ManagementOS -Name "VLAN800" -MinimumBandwidthWeight 10 -verbose -ComputerName $ENV:COMPUTERNAME

# Create a Switch for Ethernet Network

Get-NetAdapter -Name "Ethernet" | New-VMSwitch -Name "Uplink Switch" -Verbose -AllowManagementOS:$false -MinimumBandwidthMode Weight -ComputerName $ENV:COMPUTERNAME

Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "External LAN" -verbose -ComputerName $ENV:COMPUTERNAME

Set-VMnetworkAdapter -ManagementOS -Name "External LAN" -MinimumBandwidthWeight 20 -verbose -ComputerName $ENV:COMPUTERNAME

# Create a Switch for WiFi Network

Get-NetAdapter -Name "Wi-Fi" | New-VMSwitch -Name "Uplink Switch WiFi" -Verbose -AllowManagementOS:$false -MinimumBandwidthMode Weight -ComputerName $ENV:COMPUTERNAME

Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch WiFi" -Name "External WLAN" -verbose -ComputerName $ENV:COMPUTERNAME

Set-VMnetworkAdapter -ManagementOS -Name "External WLAN" -MinimumBandwidthWeight 20 -verbose -ComputerName $ENV:COMPUTERNAME

# Add a vNIC for VLAN11 on Physical Network Card

Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "VLAN11" -Verbose -ComputerName $ENV:COMPUTERNAME

Set-VMNetworkAdapterVlan -ManagementOS -Access -VlanId 11 -VMNetworkAdapterName "VLAN11" -Verbose -ComputerName $ENV:COMPUTERNAME

Set-VMnetworkAdapter -ManagementOS -Name "VLAN11" -MinimumBandwidthWeight 10 -verbose -ComputerName $ENV:COMPUTERNAME

# Add a vNIC for VLAN800 on Physical Network Card

Add-VMNetworkAdapter -ManagementOS -SwitchName "Uplink Switch" -Name "VLAN800" -Verbose -ComputerName $ENV:COMPUTERNAME

Set-VMNetworkAdapterVlan -ManagementOS -Access -VlanId 800 -VMNetworkAdapterName "VLAN800" -Verbose -ComputerName $ENV:COMPUTERNAME

Set-VMnetworkAdapter -ManagementOS -Name "VLAN800" -MinimumBandwidthWeight 10 -verbose -ComputerName $ENV:COMPUTERNAME

Thanks to my friend and colleague Mikael Nyström who showed me this a few years ago.

MSTSC and RDCMAN Crashing?

For the last 3 days we have had issues connecting with RDP through our Remote Desktop Gateway. I’ve used both RDCMAN (Remote Desktop Connection Manager) and plain MSTSC where it’s crashing. It’s been happening quite regularly with the latest build (10041) of Windows 10 but also with a Windows 8.1 client.

In my case it’s sometimes been possible to connect to some of the servers but not others. And I’ve at times been able to stay connected for shorter periods (5-30 sec) before the client crashed.

I did a quick usermode debug of the crashing application and found out that in both cases it’s a DLL file for MSTSC that’s causing the problem and it’s related to UDP Traffic.

Disabling UDP in the Remote Desktop Gateway seems to solve the problem short term. I’ll have to look into it more in depth later on, but for now I’m at least able to keep on working.

Bugcheck: DRIVER_POWER_STATE_FAILURE (9f)

I experienced a Bluescreen of Death (BSOD) on my Windows 8 Laptop (HP EliteBook 8560w) this morning when it resumed from Hibernate.
I quickly launched WinDBG and opened the crashdump.

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\030613-18798-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*E:\Temp\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 9200 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9200.16496.amd64fre.win8_gdr.130108-1504
Machine Name:
Kernel base = 0xfffff801`32483000 PsLoadedModuleList = 0xfffff801`3274ca80
Debug session time: Wed Mar  6 07:16:24.267 2013 (GMT+1)
System Uptime: 3 days 23:01:10.653
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800dfae880, fffff80133f0db30, fffff9801b7f6d80}

*** WARNING: Unable to verify timestamp for e1c63x64.sys
*** ERROR: Module load completed but symbols could not be loaded for e1c63x64.sys
Probably caused by : e1c63x64.sys

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa800dfae880, Physical Device Object of the stack
Arg3: fffff80133f0db30, Functional Device Object of the stack
Arg4: fffff9801b7f6d80, The blocked IRP

Debugging Details:
------------------

DRVPOWERSTATE_SUBCODE:  3

IRP_ADDRESS:  fffff9801b7f6d80

DEVICE_OBJECT: fffffa8011e01050

DRIVER_OBJECT: fffffa800f7fa5f0

IMAGE_NAME:  e1c63x64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  50258df2

MODULE_NAME: e1c63x64

FAULTING_MODULE: fffff88004a00000 e1c63x64

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0x9F

PROCESS_NAME:  SynTPEnh.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80132612422 to fffff801324fd040

STACK_TEXT:  
fffff801`33f0daf8 fffff801`32612422 : 00000000`0000009f 00000000`00000003 fffffa80`0dfae880 fffff801`33f0db30 : nt!KeBugCheckEx
fffff801`33f0db00 fffff801`32612455 : fffffa80`20a1e170 fffffa80`11f0ec70 fffff801`33f0dc89 fffff801`325287d6 : nt!PopIrpWatchdogBugcheck+0xe2
fffff801`33f0db60 fffff801`32529ae4 : fffffa80`11f0ec70 fffffa80`11f0eb00 fffff801`33f0de68 fffff880`02ef4180 : nt!PopIrpWatchdog+0x32
fffff801`33f0dbb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiProcessExpiredTimerList+0x214

STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0x9F_VRF_IMAGE_e1c63x64.sys

BUCKET_ID:  X64_0x9F_VRF_IMAGE_e1c63x64.sys

Followup: MachineOwner
---------

100

101

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64

Loading Dump File [C:\Windows\Minidump\030613-18798-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*E:\Temp\Symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 7 Kernel Version 9200 MP (8 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 9200.16496.amd64fre.win8_gdr.130108-1504

Machine Name:

Kernel base = 0xfffff801`32483000 PsLoadedModuleList = 0xfffff801`3274ca80

Debug session time: Wed Mar 6 07:16:24.267 2013 (GMT+1)

System Uptime: 3 days 23:01:10.653

Loading Kernel Symbols

...............................................................

................................................................

....................................................

Loading User Symbols

Loading unloaded module list

..................................................

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800dfae880, fffff80133f0db30, fffff9801b7f6d80}

*** WARNING: Unable to verify timestamp for e1c63x64.sys

*** ERROR: Module load completed but symbols could not be loaded for e1c63x64.sys

Probably caused by : e1c63x64.sys

Followup: MachineOwner

---------

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)

A driver is causing an inconsistent power state.

Arguments:

Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time

Arg2: fffffa800dfae880, Physical Device Object of the stack

Arg3: fffff80133f0db30, Functional Device Object of the stack

Arg4: fffff9801b7f6d80, The blocked IRP

Debugging Details:

------------------

DRVPOWERSTATE_SUBCODE: 3

IRP_ADDRESS: fffff9801b7f6d80

DEVICE_OBJECT: fffffa8011e01050

DRIVER_OBJECT: fffffa800f7fa5f0

IMAGE_NAME: e1c63x64.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 50258df2

MODULE_NAME: e1c63x64

FAULTING_MODULE: fffff88004a00000 e1c63x64

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR: 0x9F

PROCESS_NAME: SynTPEnh.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff80132612422 to fffff801324fd040

STACK_TEXT:

fffff801`33f0daf8 fffff801`32612422 : 00000000`0000009f 00000000`00000003 fffffa80`0dfae880 fffff801`33f0db30 : nt!KeBugCheckEx

fffff801`33f0db00 fffff801`32612455 : fffffa80`20a1e170 fffffa80`11f0ec70 fffff801`33f0dc89 fffff801`325287d6 : nt!PopIrpWatchdogBugcheck+0xe2

fffff801`33f0db60 fffff801`32529ae4 : fffffa80`11f0ec70 fffffa80`11f0eb00 fffff801`33f0de68 fffff880`02ef4180 : nt!PopIrpWatchdog+0x32

fffff801`33f0dbb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiProcessExpiredTimerList+0x214

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0x9F_VRF_IMAGE_e1c63x64.sys

BUCKET_ID: X64_0x9F_VRF_IMAGE_e1c63x64.sys

Followup: MachineOwner

---------

WinDBG managed to find the driver that caused this problem by itself this time. But IF WinDBG had not been able to show me the faulty driver, the next step would have been to use the Bugcheck info (0x0000009f) to dig further into this;

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa800dfae880, Physical Device Object of the stack
Arg3: fffff80133f0db30, Functional Device Object of the stack
Arg4: fffff9801b7f6d80, The blocked IRP

DRIVER_POWER_STATE_FAILURE (9f)

A driver is causing an inconsistent power state.

Arguments:

Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time

Arg2: fffffa800dfae880, Physical Device Object of the stack

Arg3: fffff80133f0db30, Functional Device Object of the stack

Arg4: fffff9801b7f6d80, The blocked IRP

The last argument is the interesting one, and which we should look into further with the !irp command.

0: kd> !irp fffff9801b7f6d80
Irp is active with 6 stacks 4 is current (= 0xfffff9801b7f6f28)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  Pending has been returned
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0 10 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [ 16, 2]   0 e1 fffffa800dfae880 00000000 fffff80132aca430-fffff9801b7f6ee0 Success Error Cancel pending
	       \Driver\pci	nt!IovpInternalCompletionTrap
			Args: 00041100 00000001 00000001 00000002
 [ 16, 2]   0 e1 fffffa800f5a2040 00000000 fffff880014b54c0-fffffa8011e011a0 Success Error Cancel pending
	       \DRIVER\VERIFIER_FILTER	ndis!ndisSetDevicePowerOnComplete
			Args: 00041100 00000001 00000001 00000002
>[ 16, 2]   0 e1 fffffa8011e01050 00000000 fffff80132aca430-fffff9801b7f6f70 Success Error Cancel pending
	      Unable to load image \SystemRoot\system32\DRIVERS\e1c63x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for e1c63x64.sys
*** ERROR: Module load completed but symbols could not be loaded for e1c63x64.sys
 \Driver\e1cexpress	nt!IovpInternalCompletionTrap
			Args: 00041100 00000001 00000001 00000002
 [ 16, 2]   0 e1 fffffa8012162040 00000000 fffff8013259d6a0-fffffa8020a1e170 Success Error Cancel pending
	       \DRIVER\VERIFIER_FILTER	nt!PopRequestCompletion
			Args: 00041100 00000001 00000001 00000002
 [  0, 0]   0  0 00000000 00000000 00000000-fffffa8020a1e170    

			Args: 00000000 00000000 00000000 00000000

0: kd> !irp fffff9801b7f6d80

Irp is active with 6 stacks 4 is current (= 0xfffff9801b7f6f28)

No Mdl: No System Buffer: Thread 00000000: Irp stack trace. Pending has been returned

cmd flg cl Device File Completion-Context

[ 0, 0] 0 10 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[ 16, 2] 0 e1 fffffa800dfae880 00000000 fffff80132aca430-fffff9801b7f6ee0 Success Error Cancel pending

\Driver\pci nt!IovpInternalCompletionTrap

Args: 00041100 00000001 00000001 00000002

[ 16, 2] 0 e1 fffffa800f5a2040 00000000 fffff880014b54c0-fffffa8011e011a0 Success Error Cancel pending

\DRIVER\VERIFIER_FILTER ndis!ndisSetDevicePowerOnComplete

Args: 00041100 00000001 00000001 00000002

>[ 16, 2] 0 e1 fffffa8011e01050 00000000 fffff80132aca430-fffff9801b7f6f70 Success Error Cancel pending

Unable to load image \SystemRoot\system32\DRIVERS\e1c63x64.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for e1c63x64.sys

*** ERROR: Module load completed but symbols could not be loaded for e1c63x64.sys

\Driver\e1cexpress nt!IovpInternalCompletionTrap

Args: 00041100 00000001 00000001 00000002

[ 16, 2] 0 e1 fffffa8012162040 00000000 fffff8013259d6a0-fffffa8020a1e170 Success Error Cancel pending

\DRIVER\VERIFIER_FILTER nt!PopRequestCompletion

Args: 00041100 00000001 00000001 00000002

[ 0, 0] 0 0 00000000 00000000 00000000-fffffa8020a1e170

Args: 00000000 00000000 00000000 00000000

It will show something similar to this. And it’s the e1c63x64.sys driver that were active at the time of the bluescreen. Same info as !analyze -v managed to figure out by itself.

Hmm, so what driver is that?

0: kd> lmv m e1c63x64
start             end                 module name
fffff880`04a00000 fffff880`04a70000   e1c63x64 T (no symbols)           
    Loaded symbol image file: e1c63x64.sys
    Image path: \SystemRoot\system32\DRIVERS\e1c63x64.sys
    Image name: e1c63x64.sys
    Timestamp:        Sat Aug 11 00:40:50 2012 (50258DF2)
    CheckSum:         0007E11B
    ImageSize:        00070000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

0: kd> lmv m e1c63x64

start end module name

fffff880`04a00000 fffff880`04a70000 e1c63x64 T (no symbols)

Loaded symbol image file: e1c63x64.sys

Image path: \SystemRoot\system32\DRIVERS\e1c63x64.sys

Image name: e1c63x64.sys

Timestamp: Sat Aug 11 00:40:50 2012 (50258DF2)

CheckSum: 0007E11B

ImageSize: 00070000

Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

Too bad that it were unable to provide more detailed information. But some oldschool properties of the \SystemRoot\system32\DRIVERS\e1c63x64.sys file gave this;

And a quick search on Intel’s Support sites showed that there was a newer version available for my NIC;
Intel(R) 82579LM Gigabit Network Connection here.

Driver updated, and hopefully no more bluescreens due to this driver bug.

Computer account issues with vm snapshots

If you are often jumping back and forth between snapshots in your virtualized environment, you have probably had problems with computers that are unable to establish a secure connection with the domain. Basically, you have to rejoin the computer to the domain or reset password for the computer account, after restoring a snapshot. And you may question yourself, why this happens sometimes but not always?

You may see this in the eventlog

The session setup from the computer DomainMember failed to authenticate.
 The name of the account referenced in the security database is DomainMember$. 
 The following error occurred: Access is denied.

The session setup from the computer DomainMember failed to authenticate.

The name of the account referenced in the security database is DomainMember$.

The following error occurred: Access is denied.

The short explanation is, the password for the computers domain account does not match the one in AD, and have to be reset by either resetting the password or rejoining the domain.

The solution is to either create a script that resets the computer account, OR which is nicer but not always applicable in all environments, is to make sure the passwords always match!

There is a Local Security setting, which you can set on those computers that you need to restore (it’s a per computer setting so you don’t have to apply it to all of your computers). I usually do this in my Lab and Demo environments, so I can restore individual snapshots without worrying about this.

Just “Enable” the policy:

Domain member: Disable machine account password changes

Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days.

Default: Disabled.

Domain member: Disable machine account password changes

Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days.

Default: Disabled.

That will prevent those computers from changing their password in AD, so it will always match no matter which snapshot you jump back and forth to.
Though, the password changes for the computer account is a security precaution, disabling them could make it possible for a malicious user to get hold of the computer password and use it to Authenticate to the domain to read information.

The long(er) explanation:
A computer account is like a User Account, except for a few things. Like that a computer account password never expires, So even if you define that your users have to set a new password every 30 days, your computer accounts could use the same password for ever.

A Windows computer (client or server) will do a client side initiated password change according to the policy.

Domain member: Maximum machine account password age 
This security setting determines how often a domain member will attempt to change its computer account password. 
Default: 30 days.

Domain member: Maximum machine account password age

This security setting determines how often a domain member will attempt to change its computer account password.

Default: 30 days.

This means, that the client will by default initiate a password change every 30 day, when it has contact with the Domain. If the password change is successful, it will store the previous password as “OldVal” (Old Value) and the new Password as “CurrVal” (Current Value) in the registry at HKLM\SECURITY\Policy\Secrets\$machine.ACC.
If the client does not have contact with the Domain but the password is older than 30 days, it’s going to check (by default) every 15 minute if there is a Secure Channel to a DC and if it can initiate a password change.

When a client is booting, it will try to logon to the domain with the current password, if that fails, it will try with the previous password as a fail safe, in case the new password has not replicated to the other DC’s yet.

The reason a computer can join a domain with a pre-staged account where you as a user does not have the “Domain Join” permissions, is that the computer will simply logon with username: computername and password: computername$ (small letters with a $ at the end), and when the client has joined the domain, it will initiate a password reset and set a secure password.

And as stated above, the cool thing is that these policy settings are per computer. So you can use the 30 days default for all of your domain, except for a few computers that’s being used in testing or for application packaging where you regularly restore your snapshots.

The 30 day password change, is also the reason it’s so common to search the AD for inactive computer accounts by looking at the last password change. If the client has not changed password in the last ~90 days, it’s probably not in use anymore and the computer account can be deleted or inactivated.

There is a great article on this subject “Machine Account Password Process” written by the Microsoft “Directory Services Team” if you want even more in-depth information on Computer Account Passwords.

Can’t access a computer remotely without password?

I got a question the other day, “how can i access a computer remotely without a password?”

The reason that it’s by default is not possible to access a computer remotely with an account that does not have a password is because there is a new security policy/feature which states:

Accounts: Limit local account use of blank passwords to console logon only

This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard.

Default: Enabled.

Accounts: Limit local account use of blank passwords to console logon only

This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard.

Default: Enabled.

You can change that behavior by modifying the “Local Security Policy” here:

Just a thought. One could argue that it’s actually safer to have no password on the Local Admin account and leave this policy Enabled. Than have a weak password on the Admin account.

Because if there is no password, no malicious person or software could ever remotely access the computer as a local admin. While if you have a weak password, it would be possible for someone to brute force (try all possible combinations until you get in) the password.

Howto get NAP with Server and Domain Isolation to play together

If you are trying to get NAP (Network Access Protection) and SDI (Server & Domain Isolation) to play nice, you might not get the results you are expecting. I’m going to explain howto get NAP with Server and Domain Isolation to play together

There are plenty of Blogs and Guides out there, explaining how to get either NAP or Server and/or Domain Isolation to work. And that’s basically no problem so I won’t cover that here today.
But I’ve so far not found anyone who’s tried to combine both technologies.

Background

First of all, some background for my environment. I’m working on a project where we want to implement NAP to get the health check, but also Server and Domain Isolation to make sure that only trusted clients and users can talk to the systems they have access to. There was no doubt that we would use Certificates to validate the client health state.

Two Windows Server 2008 R2 Servers with HRA/NAP Roles and the Stand-Alone CA Role were installed for redundancy. Clients are getting the Health Certificates and all is good. The SA (Security Associations) policy on the servers and clients is configured to “Require Inbound and Request Outbound Authentication”, with a requirement for a Health Certificate from the organizations CA Servers. So far, so good.

The clients can now access the server when they have a valid health state, and are unable to access the server if they don’t. Yay! NAP works.

And the nice thing is that since the HRA only serves Domain Joined clients. As the servers won’t talk to any client without a Health Certificate, and only Domain Joined client can get one, we have also got “Domain Isolation”. Ok, two out of three check boxes done.

Now, try to use Server Isolation and configure a Firewall Rule to only allow ClientA to talk to connect to ServerX via RDP. That does not work. Well, it does work to create the rule, but it will never allow the traffic.
The reason is that when you use a NAP Certificate to authenticate the connection, there is no mapping to the computer account. Which makes it impossible to use a Computer Based rule.

Notice “No Authentication”.

Okay, so if you use the check box “Enable certificate to account mapping”?

Sorry, that doesn’t work either. When you use the Health Certificate feature, no certificate mapping is done in the Windows Firewall. This has been verified in the Windows source code.

This blog post does state that it should be possible to use that check box and then use a Policy “Access this computer from the network” where you can specify which computers are able to access the server over the network. But it’s still “All or nothing”. You can’t specify that ClientA should be able to access the SQL Server but nothing else.

Solution for NAP with Server and Domain Isolation

Luckily, there is a kind of workaround. To be honest, it’s not that common that you want to restrict so only ClientA, ClientB and ClientC can access the SQL Service on ServerX. I would dare to say its more common that you want to restrict which Users can access the service. Right?

I want to control so UserD, UserE and userF can access the RDP (Remote Desktop) Service, from any Health Domain Joined Client. It doesn’t really matter which client they connect from as long as it’s healthy and domain joined. Or I could control which clients they are able to logon to.

So by using a “Secondary Authentication” option, where we Authenticate the User, like this.
Still the same options for the Computer Authentication. Just add a Secondary Authentication on the SA for User (Kerberos v5). It’s then possible to restrict which users are able to connect to a specific service.

In your firewall RDP Rule, configure it to Require a secure connection, and specify which users should be able to access the service. Now try to connect with two different users via RDP. You should see how the rule is applied and works.

I decided to create a Firewall Rule for RDP that only allowed “TestUser” to connect to the service.
In the screenshot below, the upper RDP is started with the TestUser Account, while the bottom RDP Client is started with “Runas Domain\Administrator” which according to the rule, should not be allowed to connect. And as you see, it’s not able to connect, which is expected.

Summary

To get NAP to work with Server Isolation, you have to enable “Second Authentication” for the User with Kerberos Authentication, so there is Authentication done when the connection is established. Which in turn makes it possible to create Firewall Rules that can be applied to User Object, unfortunately not to computer objects.

How to launch programs from the Windows Logon screen

It does happen from time to time, that I want to start some troubleshooting tools before a user logs on to the system. For example Sysinternals Process Monitor or xperf / wpr etc.

There are several ways to do it, as with most things with IT. You can either logon with another user, start the tools and then use Fast User Switching.
Or enable Boot Logging to get the full boot sequence + logon for a user.
Or use Psexec from a remote system, etc etc
Another way to do it, is to execute any tool of your choice from the Windows logon (winlogon) screen. The nice side effect is that you will be executing the tool as System, with full permissions.

I recently had to troubleshoot a “Password Reset” solution, which launches a browser from the Logon screen and it were unable to connect to the web-service. If you ran it from within windows as a normal user account, or system account, it worked. So I had to troubleshoot the problem as it was happening.

Logon as a local administrator
Make a copy of %windir%\system32\utilman.exe
Take ownership of %windir%\system32\utilman.exe
Grant yourself full control permission on the file.
Replace utilman.exe with cmd.exe (or any other tool of your choise, though CMD is good as you can execute other tools from that one).
At the windows logon screen press the “Accessibility icon” in the bottom left corner.
Wahoo, you now have a command prompt with System Access

This works on Vista, Windows 7 and Windows 8.

List computer certificates that will expire with Powershell

Just a small simple script that will list all Computer Cerificates that will expire in 90 days, to give you a heads up and time to renew them.

To list computer certificates that will expire in 90 days:

# Show computer certificates that will expire in 90 days 
get-childitem cert:LocalMachine\My -recurse | where-object {$_.NotAfter -gt (get-date)} | select Subject,FriendlyName,Thumbprint,@{Name="Expires in (Days)";Expression={($_.NotAfter).subtract([DateTime]::Now).days}} | where "Expires in (Days)" -lt 90 | Sort "Expires in (Days)"

# Show computer certificates that will expire in 90 days

get-childitem cert:LocalMachine\My -recurse | where-object {$_.NotAfter -gt (get-date)} | select Subject,FriendlyName,Thumbprint,@{Name="Expires in (Days)";Expression={($_.NotAfter).subtract([DateTime]::Now).days}} | where "Expires in (Days)" -lt 90 | Sort "Expires in (Days)"

Just change “-lt 90” to some other value to adjust the expiry period.