I setup a DFS to hold my RedirectedFolders last week, in order to add an additional safeguard against a failing harddrive.

Moments ago, all of my files disappeared from my redirected Desktop... and My Documents, and worst of all - My Pictures. :(

I just checked the C:\windows\debug folder for the DFS logs, and basically, there's only logs from when I set up the replication, and from 15 minutes ago when all my files started disappearing.

What happened and how can I fix it/prevent it.

FYI, the log entries look like this:

20140728 22:48:47.344  972 USNC  3040 UsnConsumer::TombstoneOrDelete ID record tombstoned from USN_RECORD:
+ USN_RECORD:
+ RecordLength:        88
+ MajorVersion:        2
+ MinorVersion:        0
+ FileRefNumber:       0x10000000022FC
+ ParentFileRefNumber: 0x10000000022E4
+ USN:                 0x210fb318
+ TimeStamp:           20140728 22:48:47.344 Eastern Standard Time
+ Reason:              Close File Delete
+ SourceInfo:          0x0
+ SecurityId:          0x0
+ FileAttributes:      0x20
+ FileNameLength:      24
+ FileNameOffset:      60
+ FileName:            IMG_0066.JPG
+ 
20140728 22:48:47.344  972 USNC  3034 UsnConsumer::TombstoneOrDelete LDB Updating ID Record:
+ fid                             0x10000000022FD
+ usn                             0x210fb370
+ uidVisible                      1
+ filtered                        0
+ journalWrapped                  0
+ slowRecoverCheck                0
+ pendingTombstone                0
+ internalUpdate                  0
+ dirtyShutdownMismatch           0
+ meetInstallUpdate               0
+ meetReanimated                  0
+ recUpdateTime                   20140721 02:44:04.460 GMT
+ present                         0
+ nameConflict                    0
+ attributes                      0x20
+ ghostedHeader                   0
+ data                            0
+ gvsn                            {1F5F298D-7CD3-4529-AE67-A9B15A148ADA}-v101735
+ uid                             {1F5F298D-7CD3-4529-AE67-A9B15A148ADA}-v74647
+ parent                          {1F5F298D-7CD3-4529-AE67-A9B15A148ADA}-v60188
+ fence                           Default (3)
+ clockDecrementedInDirtyShutdown 0
+ clock                           20140729 02:48:47.344 GMT (0x1cfaad79ea6a535)
+ createTime                      20121002 19:06:40.681 GMT
+ csId                            {2AF192A7-A0CA-4500-B576-80BED5CBD35E}
+ hash                            B3B8A883-CF8D934A-A330C4D4-D86FBE6C
+ similarity                      38172A10-20203F06-3213260D-35162120
+ name                            IMG_0068.JPG

IT Manager and CEO of Fringe Communications.

On my file server when I try to Optimize the tiered storage I get this:

PS C:\Windows\system32> Optimize-Volume -DriveLetter D -TierOptimize
Optimize-Volume : A general error occurred that is not covered by a more specific error code.
At line:1 char:1
+ Optimize-Volume -DriveLetter D -TierOptimize
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (MSFT_Volume (Ob...1-a83c-b33c...):ROOT/Microsoft/...age/MSFT_Volume) [Opt
   imize-Volume], CimException
    + FullyQualifiedErrorId : HRESULT 0x89000000,Optimize-Volume

Also, I'm seeing and Unknown status when I try to pin files:

PS C:\Windows\system32> Get-FileStorageTier -VolumeDriveLetter D | FT -AutoSize

FilePath                           DesiredStorageTierName      PlacementStatus State
--------                           ----------------------      --------------- -----
D:\Shares\Media\Movies\300\300.mkv DATA_Microsoft_SSD_Template Unknown         OK

Running both as Administrator

Hello,

Can some one help me how to trigger mail for file auditing if user deletes the data the mail should be initiated.

Thanks & Regards, Santosh Chowdary Vasireddy System Administrator Prolifcs DHFLVC Silicon Towers, 5th Floor, Survey #14, Kondapur, Hyderabad – 500 032. Work +91 40 3999 1999 Ex.1656 l Cell +91 9849277255 l santosh.vasireddy@prolifics.com A Global Provider of IBM, Microsoft and Testing Solutions Award Winner for Technical Excellence, BPM, SOA, Portal and Governance

Hi All:

I just finished installing WS2012R2E and getting all my clients connected, transferring them from my aging WHS V1

All seems to be working well but I'm scratching my head on the fact that the Storage Pool reports 3.63Tb of storage  (I have 2 x 2Tb drives) but the storage space reports 16Tb....  I tried changing the "Storage Space Size (Maximum)" to something closer to the actual storage pool capacity but no number seems acceptable to the field. 

I get it (sort of) that the storage space is different from the pool, but it seems to me that if the dashboard storage tab reports the storage space with a Capacity of 16Tb it does not give a clear picture of my storage situation. 

In addition to that quirk, the dashboard storage space window, hard drives tab reports 1Tb of used space but when I click into "Manage Storage Spaces"  that window reports that I'm using 2.16Tb of the 3.63Tb - ?!

I've tried searching this with no joy - maybe I just haven't stumbled across the right doc yet...   Can some one enlighten or point me to a detailed description of they way this is supposed to work?

Thanks!

Hi,

I have increased the capacity from IBM storage and it appear as unallocated space in disk manager but when I tried to extend the volume through disk part it's giving me error " you don't have 1 MB free disk space available to extend this volume" 

Disk Type: Dynamic

Partition Style: MBR

Capacity: 2813952 MB

Unallocated: 716802 MB

Reserved Space: 0 MB

Regards,

Hakim. B

Hakim.B Sr.System Administrator

Guys,

I have enable auditing in some of my shared folder from server 2008 R2, but only almost one day logs are present in all servers (security audit logs), Is their any option to increase its limit at-least 15 days or so, from were I can increase it ?

Hallo everybody,

I've configured DFSR replication between a Windows Server 2008 and a Windows Server 2012 to a static RPC port following this guide:  http://blogs.technet.com/b/askds/archive/2009/07/16/configuring-dfsr-to-a-static-port-the-rest-of-the-story.aspx
The servers are located in different network segments divided by a firewall. I opened port 55555 for DFS replication.

The replication itself works fine and the health report (-> DFS Management -> Create Diagnostic Report ) reports no errors for the w2k8 box. But the same report says "Cannot retrieve report. The RPC server is unavailable" for the w2k12 box.
While the report is generated I can see with a packet sniffer that packets send to random high ports are blocked by the firewall. This doesn't happen for the w2k8 box and shouldn't happen when the RPC port used for DFSR ist configured to 55555 (static).  It's somewhat irritating, that the health report shows errors while DFS replication is working fine.

Any ideas? Thanks!

Kind Regards
Christoph

Guys,

I have multiple shared folders from my server for which some of the users have delete rights as well, I am monitoring those file from security audit, I have already enabled the Audit Object monitoring on the server, Now what I want is there any software or option available which can notify me whenever any user delete anything from the shared folder, any third party software or any option is available is windows server 2008/12/03...?

Thanks in advance.

Hi

I have recently introduced some Windows 8.1 systems into our environment, a Sony laptop and a non branded custom build, both systems are running Windows 8.1 Pro.

Our environment is as follows:

Windows Server 2008 domain
PPTP VPN for laptop users using a Watchguard X515.
Netgear ReadyNAS 2100 for Network Folders.
Folder redirection in place for Documents and Desktop.
Offline files in use. Users have the ability to make shared network files available offline if required.

The first device we had with 8.1 Pro was a Sony laptop for our Marketing Director.  He has manually made a few shared network folders available offline for when he is out of the office and unable to connect to the VPN.  

We first noticed an issue a few weeks ago when he came to me telling me that one of his documents were corrupt.  The file was one of the ones he has made available offline.  When he got into the office he ran a manual sync, to put the updates onto our shared drive.  When he next came to open it, the file was corrupt with the following message:

'Excel cannot open the file 'XXXX XXXX.xlsx' because the file extension is not valid. Verify that the file has not been corrupted and that the file extension matches the format of the file'.

I ran the file through Excel's file repair, which couldn't fix the problem and I tried a few software packages from the internet which said the file was unrecoverable, to no avail.  We tried to recreate the issue but couldn't so we put it down to a one off.  A few days later, it happened again under the same circumstances.

I put it down to something happening while the laptop was offline, however whilst researching this, the same problem happened on a Windows 8.1 Pro Desktop.  This system never leaves the office, which led to some confusion.

Everywhere I look points to ransomware, however I have run full scans with Sophos and Malwarebytes, and both come back clean, and the issue is only occurring on 8.1 Pro systems, 7 Pro and 8 Pro systems are fine.

The user with the 8.1 Pro desktop created a test spreadsheet for me, and this morning we managed to recreate the problem.  When running a manual sync, the Offline Files comes back with an error, stating that the network copy has been deleted, would you like to copy the local copy or delete it?  When we copy the local copy to the network, and then try to open it, we get the previous error about file corruption.

Any help would be greatly appreciated as I will have to roll the systems back to Windows 7 if I cant get it resolved, which would be a shame as the laptop is has a flip screen to turn it into a tablet.

Cheers

Jim

Hi All

Can we maintain different file versions(Up to 90) in the server. 

If yes can we do it on the group policy with out any other applications.

I am not whether it can be possible or not please let me know.

Thanks

I have a customer who had a chronic problem in past with files coming up missing. I set up a file system auditing process that runs nightly, but the email report is frequently not read. I decided to create a domain group called deletion prevention, and everyone in this group is prevented from deleting any files in various directories and subdirectories. The problem is that this is working too well. A user cannot open a file on network drive S: and save to network drive T:. The copy process complains about access to a .tmp file. They can get around this by saving the file in a location they have unrestricted access to, and then copying over the drive T:, but this is a hassle. Also, everytime a document or spreadsheet is edited, a .tmp file is left behind, so we have some folders with a large number of .tmp files.

There has to be a better way of doing this. Can anyone help me out? Thanks

I seem to have repeated problems renaming folders on my Data2 (F)drive.

I keep getting a message saying: "Finder wants to make changes. Type your password to allow this."

After I type my password I get a message saying "You don't have permissions to rename the item."

It is  HP Proliant ML370 G6 Tower, Intel Xeon E5520, 6GB Memory.

Please help!

Thank you!

Tweedtheatrekat

I need help with hidden NTFS files they are blue and lock. I am very good with computer I tried everything properties sharing and customizing, changing wrights type and they will not change. I need a network grugru. help please.

Rod Biser

We are having a very weird issue when trying to access file shares from a remote site. If we use the UNC path (\\servername\sharename\folder) we never have the problem.   Also, if we go to the drive letter and click through the folders, we don't experience the problem.

The problem only arises when pasting the absolute path into windows explorer (ex. L:\foldername\foldername). Once we do that, it hangs for a second and then sends you back to the initial share, and the path in explorer shows <drive letter>\.\.\ (ex. L:\.\.)

As the jpg attached shows. For security rules,  I had to block the share name /server name

I have never seen an issue like this. It only happens from 2 remote offices. Other remote offices are fine

Have a Windows 2003 Server with software RAID-1, and the primary drive failed.

I tried editing the boot.ini of the 2nd drive but all I get is a black screen and blinking cursor.

The drive had 2 partitions. One of them shows up when we plug the drive into a PC, but the 2nd partition is unrecognized.

Boot.ini was:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=" "

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows Server 2003, Standard" /noexecute=optout /fastdetect

I tried adding this after:

multi(0)disk(0)rdisk(1)partition(1)\WINDOWS=" "
multi(0)disk(0)rdisk(1)partition(2)\WINDOWS="Windows Server 2003, Standard" /noexecute=optout /fastdetect

Any ideas?

We have a file server that is being decommissioned. This question is not about redirecting users to another server, which is often accomplished with a DNS alias.  What we need to do is post some instructions for people still trying to connect to this server.  What I'd like to do is redirect any incoming file share connections (regardless of what share name and sub-folder the request is for) to a new share on the same server.  By default, Windows clients receive an error if the exact path they're looking for is not present.  With web servers, you can redirect a url to a different url, even when the original url doesn't even exist; I'm looking to do the same thing with network shares.  I'd prefer to do it within Windows itself, but would entertain 3rd party server apps too.

Thanks,

Rich

I need to change the primary server on my DFS replication members.

Windows 2008 R2

I have a network of Server 2008R2 servers consisting of Windows 7 X64 SP1 Pro / Enterprise clients.  Every once in a while, a huge chunk of computers on my network will all freeze.  During this freezing behavior, any programs that are trying to read / write to the file server lock up, such as word, explorer, Internet explorer, etc.  This freezing behavior doesn't occur if I use an account that doesn't map drives or use folder redirection.

I have two file servers that use DFS-R to replicate files between them, however do not use DFS namespaces.  I have used a DNS alias to refer to them (eg fileserver.local), and have registered the SPN's to the server.  I have tried changing my group policys for folder redirection and mapping to use the fqdn of the server (server1.local).  At one point I had accidentally registered the SPN's on both file servers, but I have corrected this and rebooted all computers.  The output of "setspn -l server1: is as follows, with the DFSR, TERMSRV, WSMAN and RestrictedKrbHost omitted;

host/fileserver

host/fileserver.local

host/server1

host/server1.local

I have also applied the "DisableStrictNameChecking" and "DNSOnWire" as directed in this article

http://chenz.azurewebsites.net/?p=101

In the eventlog on the file server, I periodically see the following error messages.

A Kerberos Error Message was received:
 on logon session
 Client Time:
 Server Time: 18:37:45.0000 8/5/2014 Z
 Error Code: 0xd KDC_ERR_BADOPTION
 Extended Error: 0xc00000bb KLIN(0)
 Client Realm:
 Client Name:
 Server Realm: domain.LOCAL
 Server Name: hrlscsv001fp$@domain.LOCAL
 Target Name: hrlscsv001fp$@domain.LOCAL@domain.LOCAL
 Error Text:
 File: 9
 Line: f09
 Error Data is in record data.

I also see the following problems in a wireshark capture, it will appear for hundreds of files for a specific client at once;

The client sends an Ioctl request FILE_SYSTEM function:0x006b.  Some scripts describe that error as this ("STATUS_ILL_FORMED_PASSWORD","Unable to update the password. The value provided for the new password contains values that are not allowed in passwords."),

The server sends back Ioctl response, Error: STATUS_NOT_SUPPORTED

http://i.imgur.com/Jf17Vs8.png

I also see tons of failed kerberos authentication failures where the status is KRB5KRB_AP_ERR_MODIFIED.  It seems like computers freeze when this happens and eventually resort back to NTLMv2 authentication.  These error will occur for 5+ min on individual clients.  Other clients can authenticate properly when this happens.

http://i.imgur.com/h2WBAUx.png

This allows happens, and after this the client authenticates via NTLM instead of kerberos

http://i.imgur.com/vYV4yBz.png

Hi,

I have an issue on my Windows 2008 server whereby we get this message opening files, mostly Excel Spreadsheets

Using Computer Management on the server we can see who has the file open and close it down. Sometimes as well it will tell us the user who has the file open, however this is often incorrect.

Has anyone see this before?

Dave