VMware Converter - SQL_CANTOPEN Error

While working with the VMware vCenter Converter Standalone Client (in my case version 5.0) I kept getting the following error while trying to convert machines:

A general system error occurred: SQL_CANTOPEN: unable to open database file

After some research I find this error message has been around for awhile and also happens with previous versions of the Converter.  Some say network errors can cause it.

In my case it was the CrashPlan backup client that was causing it.  Forcing CrashPlan to sleep during my conversions corrected my issues.  I also read that for some disabling antivirus software corrected it for them.

So basically anything that could be locking files on the computer your running the VMware Converter software on is where you should look and not the machine being converted.  It was driving me crazy and I thought it was the target VSphere Server that was the issue.

Windows 7 - Preparing your computer for first use

After using Symantec System Recovery 2011 (aka Symantec Backup Exec System Recovery) to restore an image backup of a physical Windows 7 machine to a virtual machine using the "Restore Anywhere" option, I was left with a machine that was stuck on the message: "Setup is preparing your computer for first use"

The "Restore Anywhere" option is a way of saying I am restoring to disimiliar hardware.  Also, I tried the restore to VMware VSphere 5 and VMware Workstation 7 and I had the same results.

Below are some steps that helped me resolve this.

While you see the message "Setup is preparing your computer for first use" you can press Shift F10 on the keyboard and you will see a command prompt.
Type in taskmgr.exe and you will get the Windows Task Manager
Look for a process called windeploy.exe and kill it (End Task)
Then you are taken to the Windows Logon screen where you can login normally.

Then follow these steps:

1. Within Windows, Click Start - Run, type 'regedit.exe' and press Enter.
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\Setup
3. Within HKEY_LOCAL_MACHINE\SYSTEM\Setup you will need to change the following values:

Here is an example of what the registry values could look like
"SetupType"=dword:00000000
 "SystemSetupInProgress"=dword:00000002
 "SetupPhase"=dword:00000004
 "CmdLine"="C:\OOB\Windeploy.exe"
 "OOBEInProgress"=dword:00000001

This is what the values needed to be changed to:
"SetupType"=dword:00000000
 "SystemSetupInProgress"=dword:00000000
 "SetupPhase"=dword:00000000
 "CmdLine"="" (This field should be Blank )
 "OOBEInProgress"=dword:00000000
 
Now click START and run MSCONFIG.EXE

On the General tab you may see it set for Selective Startup, and on the Boot tab you will see a reference to a Windows installation that is in "Recovery".



This is where it is confusing, but on the General tab, under Selective Startup, check the box that says "Use original boot configuration", and you will see it immediately uncheck the "Selective Startup" and check the "Normal Startup".  Also if you now look at the Boot tab you will see another bootable installation.

Now reboot, and you'll likely get a nasty message from the Boot Manager that says it cannot boot.  So you boot from your Windows 7 CD and choose the Repair Option.  It will detect the issue, correct it, and reboot.

And now finally you should have a working Windows 7 machine again.
 

Lock Out

I want to tell a story of a customer that called me yesterday.  I'm sharing this story in hopes that these steps can be of help to someone else in the future.  Their Active Directory domain administrator password was changed somehow and there was no way to login to the primary server (Domain Controller).  This customer is in another state, and I mention this only to point out that my only access to them was from remote across the Internet.

Since I had previously done work for them on their Web Server, I at least had a way to remote in to that server, but since the domain admin credentials were not working I had to authenticate using the Web Server's local admin credentials.  Once connected I used VNC to get to the primary server's console, and we tried various password combinations but could not login as Administrator.

I found a free tool called ADManager Plus, and once installed on their Web Server I was able to query Active Directory and get a list of User Names and could at least see the last time those Users had authenticated.  I knew from my previous work that some of the accounts that existed were disabled, but this tool did not show which ones were active versus disabled. 

ADManager Plus can be found here:
http://www.manageengine.com/products/free-windows-active-directory-tools/download.html

Since we could see at least one account in the list that I recognized as being used by their primary application vendor and knowing that account likely already had Admin privileges, my hope was to login with that account and then reset the Administrator password.  The application vendor was very helpful and gave me several password combinations to try, but unfortunately none of them worked.

The customer also contacted a local IT Vendor and once on site, they tried a procedure similar to the one found here:

HOW TO: Reset your Lost 2003 Active Directory Admin Password
http://www.geeksaresexy.net/2009/03/12/how-to-reset-your-lost-2003-active-directory-admin-password/

The above steps basically have you wrap a password reset tool into a service and it attempts to change the password as the server is booting up.  Unfortunately this didn't work either.  It has worked for many others, which is why I wanted to still reference it as an option.

After some research, I thought perhaps I could use the Net.exe commands in Windows to reset the password, but in order to try I would need some way to get to the primary server's command prompt.

So I downloaded PSEXEC to their Web Server.  PSEXEC is a utility now owned and maintained by Microsoft that allows you to execute remote commands to another machine on the network.

Download PSEXEC here:

http://technet.microsoft.com/en-us/sysinternals/bb897553

So let's say the Primary Server's name in this example is ALPHA.  I issued the following command from the Web Server's command prompt:

psexec \\ALPHA cmd

This allowed me to run cmd.exe (the command console) on the ALPHA server.  And now I could issue commands on the Primary Server.  This is also the step in which we were very lucky (or Blessed).  Typically in order for PSEXEC to do its magic it has to authenticate to the remote machine.  How is it I was able to issue this command when the Administrator account was inaccessible?  I can only assume that this server had previously authenticated before the Administrator password was changed and thus still had a valid security token.  I can't help but wonder that if we had rebooted this Web Server before now, if this step would have been impossible.

I tried using the Net.exe commands on the Primary Server but then realized that for some reason, Net.exe didn't exist on this server.  I'm not sure why since this is Server 2003 it should have been there.  After further reading, using the Net.exe commands might not have worked anyway since this is a Domain Controller.  I still wanted to mention this, as it could prove useful to someone in another scenario.

In the example below, the username whose password we are trying to reset is sunrise and the new password we want is Password2, and the /domain switch is supposed to indicate that we want to change it for the domain user called sunrise as opposed to a local user called sunrise.

net user sunrise Password2 /domain

More information about How to Use the Net User Command can be found here:  http://support.microsoft.com/kb/251394

I then came across some Active Directory commands such as:

dsquery - Query Acive Directory
dsadd - Add Users
dsmod - Modify Users

Please see How To Use the Directory Service Command-Line Tools to Manage Active Directory Objects in Windows Server 2003 here:
http://support.microsoft.com/kb/322684

I also found this site which gives some great examples on using these commands:
http://www.sadikhov.com/forum/index.php?/topic/84286-examples-for-dsadd-dsquery-dsget-dsmove-dsmod-dsrm/

In the end, we had success when I issued the following command:

dsmod user "CN=sunrise,CN=Users,DC=acme,DC=local" -pwd Password2

In the above example:
The username we wanted to change the password for is: sunrise
The Domain Name is: acme.local
The container that holds the username sunrise is: Users
The new password we want is: Password2

Once the sunrise password was changed, I logged into the Primary Server and then was able to change the Administrator password.

So to recap the successful steps:

Open a Remote Console on the Domain Controller
psexec \\ALPHA cmd 

Change the password of an account that already has Administrator Priviledges
dsmod user "CN=sunrise,CN=Users,DC=acme,DC=local" -pwd Password2

Malware hides all files and shortcuts

On several occasions we are called in to look at a computer that has been infected with malware or a virus.  And the malware has hidden every file (and shortcut) on the entire hard drive.  You notice this right away when you click on the START menu and nothing is there.  And when you open the C: drive in Windows Explorer, you also see nothing.

I wanted to document this fix for this for my own quick reference and hope it can be of help to others as well.

From a Command Prompt use this command:

attrib -r -h c:\*.* /s /d

This changes the attributes of each file to not be read-only or hidden and does this for all files and folders including subdirectories. 

Malware can also sometimes mess with file associations and leave you with inability to run EXE files or open documents or shortcuts.  I found this great website with a ready reference of fixes for these types of issues:

http://www.dougknox.com/xp/file_assoc.htm

Android Camera Phone to Picasa Web to Computer

I have been experimenting with Picasa Desktop and Picasa Web trying to figure out the best way to manage photos taken from my Android camera phone. 

Thanks to the Google+ app for Android it can automatically send photos you take on your phone to your Google+ account and then they are viewable in your Picasa Web account.  But the linkages are one-way and not bi-directional.

In the video below I demonstrate the various ways to get the photos from your phone to the computer as well as deleting them.

You may prefer to watch directly on YouTube

As a side note, this was also my first attempt at making a screen-capture video, so it's a little unpolished.

SSL not working on Windows Server 2003

We have a customer that physically moved their server from one location to another. This was a server that had not been rebooted in over 6 months.


After we moved it and brought it back up I began to realize the SSL on the web server was not working.  I first thought I had made a mistake in the firewall rules since it was a new firewall at a new site on a different ISP.  But later began to realize that it was the server itself.  


If you tried to connect to the page with http port 80 it worked, but if you go https port 443 you get absolutely nothing, no errors just does not display.  There were also no errors in the Windows Error Logs.  I did iisreset until I was blue in the face, but no change.  


Then I decided to replace the certificate with a self-signed certificate:

• In IIS, right-click on website (Default Web Site in my case) and choose Properties
• Go to the Directory Security tab and choose the Server Certificates button
• Choose the option to Replace the current certificate
• Then I choose my self-signed certificate

Then magically the website began to show the SSL page, albeit with a security warning because it is a self-signed certificate.  Then I replaced it again with the valid certificate issued by the Trusted Certificate Authority (GeoTrust in this case).  But then I was back to my original symptom of no page displayed at all.

Then I decided to delete the certificate altogether and re-import it (thankfully I had saved it in a folder when we first installed it), but that too didn't work.  Then it occurred to me, that if I deleted the public certificate, I may have also deleted or broke the private key chain.

After Googling I found this very helpful article:

http://blogs.iis.net/lprete/archive/2007/11/25/assign-a-private-key-to-a-new-certificate-after-you-use-the-certificates-snap-in-to-delete-the-original-certificate-in-internet-information-services.aspx

I followed the instructions, but the magical command line that made it work was rather unclear in their article since they did not give an example.

So let me clarify it here.  If you delete a certificate and then re-import it, you will need to repair the private key store to re-link it.

When you look at the certificate's Serial Number you will see it has spaces in it.  You have to include the spaces in your command line. 

Example: 

certutil -repairstore my "02 85 03"

Over the years I have dealt with SSL, I've had lots of errors and mistakes, but this was the first time I've encountered a situation that there was no errors, no clues, it just didn't work.  Hoping this might help someone else.

Windows 7 Accessing Mapped Network Drives

Today I ran into a situation on a Windows 7 install that I previously fought several months ago, but this time I vowed to document it so I can find the fix more quickly in the future.

Problem:  You have a Windows 7 PC connected to a domain.  The login scripts will map network drives for you.  Once logged in the user can see their mapped drive, H:\ for example.  But when you run a cmd prompt as an Administrator you cannot see drive H:\ or any drive that is mapped.

The reverse might also be true.  If the drive is mapped while under the context of Administrator, then the local user cannot see it.

Solution: Microsoft says this is by design, and maybe so, but it is still a pain-point.  The current user and the "run as local administrator" are considered two different contexts and each have a separate security token.  A workaround is to modify a registry key to allow both contexts to share the tokens.

• Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
• And if it does not exist create a new Key (DWord value) called EnableLinkedConnections with a value of 1
• Then reboot

Reference: http://support.microsoft.com/kb/937624