Spat's WebLog (Steve Patrick)

lerp

I needed a quick function to return a point..

Spat

public Point Lerp(Point p0, Point p1, double amtInterpolate)
    {

        double xlerp = p0.X + ( p1.X - p0.X ) * amtInterpolate;
        double ylerp = p0.Y + ( p1.Y - p0.Y ) * amtInterpolate;
        Point newPoint = new Point(xlerp, ylerp);
        return newPoint;
            
            
    }

Debugging managed code.. from a newb for managed code debugging

Why am I using VMWare?

Well, I have had to resort to VMWare. I don’t have anything against it really, I used to use it exclusively, but I would rather use an MS platform if it does what I need it to.

Unfortunately the  VPC version for Win7 does not support 64 bit guests and I run a bunch of DCs etc.. and need to have 2k8R2 ( Win7 Server ) as well - but Win7 Server dropped support for 32 bit versions.

So, I made and ISO of the setup files and download the latest VMWare player.. when I input the ISO file, I repeatedly get the following error and could not get past it. “VMWare player has stopped working” – would you like to debug? No… not now.

Finally I came across this blog:

http://www.blogsdna.com/1918/how-to-install-windows-7-on-windows-xp-vista-using-vmware-player-complete-guide.htm

And I wondered why in the world he went to all that trouble? But, I figured he knew better, so instead of trying to specify an ISO in the initial setup, I created the VM with the Win7 options:

Once I did that, I setup the CDROM as the ISO and that worked great!

Anyway.. in case someone else runs into it , maybe this post will help.

Oh, and if any VM guys are reading - I really would like to see VPC on Win7 support 64bit! :)

Spat

Playing with Silverlight..

Testing a few things with SL, eventually want a TFS integrated reporting tool. But, this was more for just fun.

Cool new features in 2k8 R2 for Certificate Services

I really dont like posting about another post.. but its too cool not to in this case :)

There are some really awesome new features for Cert Services in 2k8 R2.. check it out in the Certificate Enrollment Web Services Whitepaper

Original post:

http://blogs.technet.com/pki/archive/2009/09/15/certificate-enrollment-web-services-whitepaper.aspx

Doc download link:

http://download.microsoft.com/download/C/2/2/C229E624-36E4-4AD8-9D86-F564ED539A16/Windows%20Server%202008%20R2%20Certificate%20Enrollment%20Web%20Services.doc

Logging for MUI language packs

Quick post..

If you are having errors when installing the MUI language packs on Win7\Server 2008 R2 - the logs are located in the users profile appdata path: 

C:\Users\Administrator\AppData\Local\Temp\lpksetup folder

Here is a snip of a log for an example:\

SNIP:

15:30:50:034 : PERF: Create language from CAB (C:\tools\langpacks\zh-hk\lp.cab) - ENTER

15:30:53:495 : DEBUG: CreateFromIdentity("Microsoft-Windows-Client-LanguagePack-Package~31bf3856ad364e35~amd64~zh-HK~6.1.7600.16385")

15:30:55:014 : DEBUG: CreateFromIdentity("Client")

15:30:56:784 : DEBUG: Client is not a language type package, or does not match the type of your OS (e.g., server language packs mismatched with a client OS). Check to be sure that you are using language packs which match your machine.

15:30:56:871 : WARN: Unable to create langpack

15:30:56:897 : WARN: CbsClient::CreateLanguagePackFromCabImpl(C:\tools\langpacks\zh-hk\lp.cab) failed with hr = 0x80070032

spat

How to enable WPP tracing for a component at boot time?

Been away for a while , busy with lotsa interesting online services projects ( my "new" group ) .  I'll see if I can blog about any of those interesting tidbits.. in the meantime.

WPP tracing is all over the place in Win7 – a quick count of registered providers shows 672 available providers  via “logman .exe query providers”

We can choose a random one to pick on today – like BITS ( background intelligent transfer services ) .

Here we can view the available flags for this provider.

C:\>logman query providers "BITS Service Trace"

Provider                                 GUID

-------------------------------------------------------------------------------

BITS Service Trace                       {4A8AAA94-CFC4-46A7-8E4E-17BC45608F0A}

Value               Keyword              Description

-------------------------------------------------------------------------------

0x0000000000000001  LogFlagInfo          LogFlagInfo Flag

0x0000000000000002  LogFlagWarning       LogFlagWarning Flag

0x0000000000000004  LogFlagError         LogFlagError Flag

0x0000000000000008  LogFlagFunction      LogFlagFunction Flag

0x0000000000000010  LogFlagRefCount      LogFlagRefCount Flag

0x0000000000000020  LogFlagSerialize     LogFlagSerialize Flag

0x0000000000000040  LogFlagDownload      LogFlagDownload Flag

0x0000000000000080  LogFlagTask          LogFlagTask Flag

0x0000000000000100  LogFlagLock          LogFlagLock Flag

0x0000000000000200  LogFlagService       LogFlagService Flag

0x0000000000000400  LogFlagDataBytes     LogFlagDataBytes Flag

0x0000000000000800  LogFlagTransferDetails LogFlagTransferDetails Flag

0x0000000000001000  LogFlagPeer          LogFlagPeer Flag

PID                 Image

-------------------------------------------------------------------------------

0x00000190

0x00000190

The command completed successfully.

But let’s get to the point. How do you enabled a trace log and maintain it across reboots?

You can follow the reg setting keys\values documented here - http://msdn.microsoft.com/en-us/library/aa363687(VS.85).aspx

The primary key  is  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger

You can also download the DDK and use tracelog.exe  with the /addautologger command see http://msdn.microsoft.com/en-us/library/dd852200.aspx

Luckily Logman.exe , which is included in the OS, has a nifty CLI switch to enable this.

The trick is to preface the log session name  with “autosession\”.

C:\Windows\system32>logman create trace "autosession\SpatsBITSTrace" -p "BITS Service Trace" -o SpatsBITSTrace.etl

The command completed successfully.

You can add the parameters for buffers, flags and other from the cmd line as well.

This creates the following reg values and automatically sets them under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SpatsBITSTrace\{4A8AAA94-CFC4-46A7-8E4E-17BC45608F0A}

Just like any  tracing session you can stop it via:

                logman stop “SpatsBITSTrace” -ets

You can delete this tracing logger permanently ( so it will not  restart on the next boot ) via

                logman delete “autosession\ SpatsBITSTrace” 

Hope it helps someone .

spat

How to determine virtual machine host name "virtual server"

Recently had a problem where the lab folks forget where my VM was installed to and I needed some RAM added to it.  I needed to find the physical host name of the machine the VM was running on.  Turns out that there is a handy dandy reg key one the VS devs pointed out to me:

 HKLM\Software\Microsoft\Virtual Machine\Guest\Parameters\PhysicalHostName

Hope it helps someone, I spent quite some time trying to figure it out on my own.

spat

More Kerberos fun with PAC’s- decrypt the PAC

I had been meaning to blog about this for a while, and recently was teaching a class when a friend of mine looked into the exact steps and issues – thanks Woody.

It may be interesting to peek into the PAC every once in a while and make sure everything is OK. Yaknow – like a long lost cousin. See http://blogs.msdn.com/spatdsg/archive/2007/03/07/pac-validation.aspx  for more info on PAC data

This is good for labs – not so much for production. But here goes.

It’s laid out here: http://wiki.wireshark.org/Kerberos

1. Download the ktexport utility - http://www.ioplex.com/utilities/

2. Run it on your DC against LSASS.EXE’s PID

3. C:\TEMP\ktexport.exe 376

4. It will create a file called sam.keytab

5. Create a directory called c:\temp

6. Copy sam.keytab to c:\temp.

7. Copy the wireshark trace to c:\temp

8. Open the trace in wireshark

Go to Edit -> Preferences:

Enabled the ability to decrypt the blobs.

Specify the sam.keytab file – no path info as it does not seem to like it. ( for example c:\temp\sam.keytab does NOT work )

Now – I have found I need to restart Wireshark sometimes, but check your kerb data – like an AS_REP packet and you should see:

  AuthorizationData AD-IF-RELEVANT

                        Type: AD-IF-RELEVANT (1)

                        Data: 308202D2308202CEA00402020080A18202C4048202C00400...

                            IF_RELEVANT AD-Win2k-PAC

                                Type: AD-Win2k-PAC (128)

                                Data: 040000000000000001000000300200004800000000000000...

                                    Num Entries: 4

                                    Version: 0

                                    Type: Logon Info (1)

                                        Size: 560

                                        Offset: 72

                                      PAC_LOGON_INFO: 01100800CCCCCCCC200200000000000000000200C0C1160B...

                                            unknown MIDL blob

                                                Unknown: 0x00081001

                                                Unknown: 0xcccccccc

                                                Blob Length: 544

                                                Unknown: 0x00000000

                                            PAC_LOGON_INFO:

                                                Referent ID: 0x00020000

                                                Logon Time: Mar 25, 2009 16:25:54.415046400

                                                Logoff Time: Infinity (absolute time)

                                                Kickoff Time: Infinity (absolute time)

                                                PWD Last Set: Mar 18, 2009 12:31:33.473204800

                                                PWD Can Change: Mar 19, 2009 12:31:33.473204800

                                                PWD Must Change: Apr 30, 2009 11:19:05.216948800

                                                Acct Name: shannon

                                                    Length: 14

                                                    Size: 14

                                                    Character Array: shannon

                                                        Referent ID: 0x00020004

                                                        Max Count: 7

                                                        Offset: 0

                                                        Actual Count: 7

                                                        Acct Name: shannon

                                                Full Name: shannon

                                                    Length: 14

                                                    Size: 14

                                                    Character Array: shannon

                                                        Referent ID: 0x00020008

                                                        Max Count: 7

                                                        Offset: 0

                                                        Actual Count: 7

                                                        Full Name: shannon

                                                Logon Script

                                                    Length: 0

                                                    Size: 0

                                                    Character Array

                                                        Referent ID: 0x0002000c

                                                        Max Count: 0

                                                        Offset: 0

                                                        Actual Count: 0

                                                Profile Path

                                                    Length: 0

                                                    Size: 0

                                                    Character Array

                                                        Referent ID: 0x00020010

Have fun!

Spat

OK so some folks have let me know that Ktexport crashes LSASS.EXE - obviously no fun.

So here is what I tested:

I installed WindowsServer2003-KB843071-x86-enu.exe from "Ktpass.exe may not create a Kerberos keytab file successfully when you use the /target switch and the /mapuser switch on a Windows Server 2003-based computer or on a Windows 2000-based computer"

• In this case the user's UPN is Shannon@mil
• The users samAccountName is  Shannon
• The users password is Password.
• The users domain is request132027.local

I ran the following:

C:\TEMP>ktpass.exe /out shannon.keytab /princ shannon@MIL /crypto RC4-HMAC /pass Password /ptype KRB5_NT_PRINCIPAL

Key created.

Output keytab to shannon.keytab:

Keytab version: 0x502

keysize 45 shannon@MIL ptype 1 (KRB5_NT_PRINCIPAL) vno 1 etype 0x17 (RC4-HMAC) keylength 16 (0x76756bad6a045177f68d583c1152e3c5)

I used this keytab in wireshark:

Seemed to work out OK.  If you were doing it for a machine it would not work since you don't know the machine password .. I have not tried setting the password etc..

spat

Informal survey..iPhone VS Windows Mobile..

Coming from support, I have seen many different causes for crashes and hangs,  memory leaks and BSOD’s.  Of course, again I am colored by my experiences  and it reflects in the title of my blog “When things go wrong.. “  I only see the bad side of things.   But, I have long held the opinion that Windows is a  stable OS for the most part, and I know for a fact that many many root causes of cases I saw were 3^rd party applications and drivers.

Anyway, to the point.   I was rebooting my Samsung Epix ( again ) the other day and was quite frustrated with the experience.  I started to think, maybe I have too many applications running.

But isn’t that part of the reason for me getting the WinMobile phones?
 

 I love the fact that I can RDP to my desktop, watch a ripped DVD , chat on IRC and play games or listen to podcasts all on the same device.   I run CORE media player, RDP desktop client, have any number of games and 3 different mobile browsers on my phone.  Is the cost for this flexibility, the stability of my phone?  If I cannot use it for its core function, a phone, but it works great as a ‘mini computer’  -- Am I OK with that? 

Here are my specs – and the apps which are on almost all the time.

·         Samsung Epix – WinMo 6.5

·         AE button plus ( runs in background )

·         Audio Notes

·         Google Maps

·         CorePlayer

·         Live Mesh

·         Newsbreak

·         Pocket IE

·         SkyFire

·         Pocket Outlook

·         ActiveSync

·         BlueTooth on for headset ( runs in background )

·         Voice Command On ( runs in background )

Now, I keep hearing about this Apple App store with bajillions of apps – forget the recent report that said no one uses them after the first week or so.

I asked a few co-workers if their iPhones  needed to be rebooted and if so, how often.  Most of them said almost never – then the follow up questions “ How many 3^rd party apps do you run?” Almost none.

 So does an iPhone suffer from the same dilemma? How often  do you iPhone lovers users have to reboot your phone? Are you a heavy app user or more of a core system user?

Do you feel that you can ( or should have to ) sacrifice  stability for extensibility?

random thoughts on a snowy Sunday afternoon...

Spat

There and back again.. the journey of a bug in ADFS

Let's look at a bug fix.. end to end.

So back in November, my friend Jim Simonet had posted a question about a problem with ADFS using ADAM as the auth store and specifying that it connect via  LDAP over SSL.

He could connect to ADAM via LDP on 636, so we knew ADAM and the certificate validation\chaining process seemed OK.
With SSL it was failing and the logs show:

Note the highlighted section above.

Logging is always a good place to start, if you have the source code of course.

All of the web.security stuff  which includes GetClaimsForUserNameWorker  is in managed code.  I am still making my way through debugging managed code and am not entirely comfortable with it ( in other words I have not really done enough of it ),  I know folks who swear it is easier but if you ask me, doing this :

1.       !name2ee [Assembly name (including extension] [Class Full Namespace]. For example: !name2ee SyncBlkDeadLock.exe SyncBlkDeadLock.Form1. That is the class on which we want to place a breakpoint in one of its methods. The output will look like this.

2.       !dumpmt -md [MethodTable handle that we got from the previous command]. For Example: !dumpmt -md 0×00a8543c. The output will look like this.

3.       !dumpmd [MethodDesc handle that we got from the previous command]. For Example: !dumpmd 0×00a853d8. This is the handle for the method
SyncBlkDeadLock.Form1.Thread1Handler().The output will look like this.

4.       In the field “Method VA” we now have th method Virtual Address and we can set a breakpoint on that address.

Is not easier than this:

1.       bp foo!func

Maybe that's why I have not really dug into it much. But, to each their own. (  I know I can no longer avoid it either via debugging it, or writing it -- , much like I can no longer avoid PowerShell )  So, due to my lack of time, and general propensity to fall back on familiar tools and ways.. I figured that something is eventually going to call into wldap32.dll – either directly, or  via the slightly higher ADSI functions.

I tend to try to nail things at the lowest level. What I mean is, if I know some hunk of managed code is calling to ADSI, which is calling to WLDAP32, which is calling to the Network.. I may want to start at the very lowest level in order to at least get an idea of where things are coming from. Does that make sense? On we go.

I knew I didn’t need to catch it at the network layer, a little overkill there. So I decided on wldap32 – specifically wldap32!ldap_connect  , since this is where we connect.

This eventually returned 0x51 LDAP_SERVER_DOWN , but if I dug deeper it returned 0x35 LDAP_UNWILLING_TO_PERFORM

err.exe shows us ( http://www.microsoft.com/downloads/details.aspx?FamilyId=BE596899-7BB8-4208-B7FC-09E02A13696C&displaylang=en  )

So you see – the lower ldap levels set LDAP_UNWILLING_TO_PERFORM , which got set to LDAP_SERVER_DOWN which the  ADFS logs translated into "The server is not operational".  This has long been a pet peeve of mine.  If we could only consistently maintain the REAL error returned, I think it would help a lot of folks ( IMO ) . But, there are so many layers and layers of code that this is nearly impossible and is the ROI really worth it?  How could it be implemented across so many layers?

Anyway.. OK we know that 0x35h is not a good thing, so how to find where this was set?

This take s little bit of digging, but  the windbg command “pc”  (step to next call ) help a bit and just keep an eye on error returns. Narrowed it to here..

Anywho – once I found where it was being set, I can see that it was examining the flags passed to it and failing based on them.

The ldap options included one or both ( I can’t  recall exactly ) of the following flags:

The key of course, is the phrase "Cannot be used over an SSL connection". So , off Jim goes to file a bug,,,

In between then and now, lots of hand waving :

Then there is the PM, Dev and Test reviews, possible security reviews and much talk about WAR and customer impact etc.. but eventually we get there.

The public KB is now available:

AD FS cannot connect to an ADAM store over an SSL connection on a Windows Server 2003 R2-based server

http://support.microsoft.com/?kbid=959923

And that, is the story of that hotfix

Spat

Joining a domain via Smartcards

http://technet.microsoft.com/en-us/library/cc721959.aspxundefined

A snip from the article:

Smart card root certificate requirements for use when joining a domain

When using a smart card to join a domain, the smart card certificate must comply with one of the following conditions:

The smart card certificate must contain a Subject field that contains the DNS domain name within the distinguished name. If it does not contain this field, resolution to the appropriate domain will fail, causing the domain join with smart card to fail.

The smart card certificate must contain a UPN in which the domain part of the UPN must resolve to the actual domain. For example, the UPN "username@engineering.corp.example.com" would work, but "username@engineering.example.com" would not work because the Kerberos client would not be able to find the appropriate domain.

The solution for both of the listed conditions is to supply a hint (enabled via the X509HintsNeeded registry setting) in the credentials prompt when joining a domain.

If the client computer is not joined to a domain, then the client will only be able to resolve the server domain by viewing the distinguished name on the certificate (as opposed to the UPN). For this scenario to work, the Subject field for the certificate must include "DC=" for domain name resolution.

To deploy root certificates on smart cards for the currently joined domain, the following command can be used:

certutil –scroots

Just a note - this has some issues unless you also deploy this hotfix..  http://support.microsoft.com/kb/957656

This is a post Vista SP1 fix..

Spat

More fun with Kerberos and Web Sites

SPN’s.

Service Principal Names.

I am not going to go into the details of how SPN’s are used right now, see my other posts on Kerberos or go use your favorite search engine to determine how they are used.

Most of this post will relate to web sites and access to sites via Kerberos.

Scenario:

Servername: 2k8STS1.CONTOSO.COM
A Record =2k8STS1.CONTOSO.COM
CNAME record = ALIAS.BOGUS.COM

So of course, now when I ping ALIAS.BOGUS.COM it will hit 2k8STS1.CONTOSO.COM

Now – from IE, when I type in HTTP://ALIAS.BOGUS.COM , what SPN will be in the ticket request?

How come it was not ALIAS.BOGUS.COM ?

If you want it to use the name as typed into the browser, for the TGS_REQ, then you need to apply http://support.microsoft.com/kb/911149 ( 2k8 already has the code to honor it so all you need is the reg key )

And create the key = FEATURE_USE_CNAME_FOR_SPN_KB911149

Afterwards IE will use the CNAME for the SPN in the TGS_REQ.

The other item you may want to be aware of is :

http://support.microsoft.com/default.aspx/kb/908209

From the KB:

Internet Explorer 6 cannot use the Kerberos authentication protocol to connect to a Web site that uses a non-standard port in Windows XP and in Windows Server 2003

You have two Web sites that have different ports and identities. These two Web sites are running on the same computer. For example, Web site 1 runs on port 80 under identity "id1" and Web site 2 runs on port 81 under identity "id2”.

• Both the Web sites use Kerberos authentication protocol version 5.

• You use the Setspn utility to declare the Service Principal Name (SPN) for Web site 2.

• You use the same host name to connect to Web site 1 and to Web site 2. You use Microsoft Internet Explorer 6 to make this connection.

For example, you use http://examplewebserver to connect to Web site 1 and http://examplewebserver:81 to connect to Web site 2. In this example, you use the same examplewebserver host name to connect to both Web sites.

In this scenario, Internet Explorer 6 can use the Kerberos protocol to connect to Web site 1. However, Internet Explorer 6 cannot use the Kerberos protocol to connect to Web site 2.

 Have fun.. spat

James saved me many hours of pain..

Gotta love the internet. The Tubes.

I was trying to install\reinstall IIS in Windows Server 2008 and it would not install.

Web Server (IIS)
   Error: Attempt to install IIS Management Console failed with error code 0x80070643.  Fatal error during installation
   Error: Attempt to install Static Content Compression failed with error code 0x80070643.  Fatal error during installation
   Error: Attempt to install HTTP Logging failed with error code 0x80070643.  Fatal error during installation
   Error: Attempt to install Static Content failed with error code 0x80070643.  Fatal error during installation
   Error: Attempt to install Directory Browsing failed with error code 0x80070643.  Fatal error during installation
   Error: Attempt to install HTTP Errors failed with error code 0x80070643.  Fatal error during installation
   Error: Attempt to install Request Monitor failed with error code 0x80070643.  Fatal error during installation
   Error: Attempt to install Request Filtering failed with error code 0x80070643.  Fatal error during installation
   Error: Attempt to install Default Document failed with error code 0x80070643.  Fatal error during installation
   The following role services were not installed:
   Web Server
      Common HTTP Features
         Static Content
         Default Document
         Directory Browsing
         HTTP Errors
      Health and Diagnostics
         HTTP Logging
         Request Monitor
      Security
         Request Filtering
      Performance
         Static Content Compression
   Management Tools
      IIS Management Console

Before I spent any number of hours tshooting this , I decided to hit the internet with a quick search. I held out little hope of finding a resolution for such a horrid looking error.

But - within 2 links I hit on this one -- http://social.technet.microsoft.com/forums/en-US/winserversetup/thread/1486efdd-1dbb-477a-9c9e-af8a8fb81c24/

Hoorah!!

Here's to you James B White from   C.S.H. Consultants Pty Ltd.  - your attitude of "This has been raised before, however that person opted for a reinstall before it got anywhere. I really dont want to do that."  saved me a boatload of time this morning.  Thanks to you,  I fixed it between eating breakfast and brushing my teeth.

One more thing - just in case the link above goes away - here was James resolution:

Spatdsg

Honey, I lost the (private) keys -- EFS keys missing?

Interesting  EFS issue the other day..

Customer was rolling  out EFS so they set up DRA's and this worked great. When they encrypted files the DRA's  showed up just fine in the file information. However, when they went to decrypt a file via the assigned DRA account – it failed to recover the file.

Efsinfo.exe showed:

The user had the certificate imported to the user’s store:

Note the thumbprint ( hash )  shows on the file and is the same cert in our store.

When you see  “Encryption test passed”   displayed by certutil.exe, this means that it successfully encrypted data via the public key and decrypted the data via the private key .

This is typically a good test to determine if you have access to the private key and you can use it.  But, in this case the decryption\recovery was still failing.

Unfortunately, there is no logging in the security subsystem to determine why it was failing the recovery. After a debug  we could see that it was failing in CryptAcquireContext with error 0x80090016  NTE_BAD_KEYSET

MSDN documentation states:

So why was certutil.exe able to encrypt and decrypt using this key?

Turns out that certutil.exe uses CryptAcquireCertificatePrivateKey whereas other code ( the EFS code ) goes  to the certificate property, get the keyprovinfo, calls CryptAcquireContext with the CSP name and key container name.

Now, if the CRYPT_KEY_PROV_INFO is incorrect, or the container is incorrect this will fail.

In order to correct this information we ran:

                certutil -repairstore -user MY "F456 453E F3E2 876A A435 5633 BF5A F45E F5DF 6C0B"

The  –repairstore fixed  the problem of an incorrect container and we then can decrypt the files correctly.

Unfortunately, I never did get more information as to why or how we got into this state.. too bad.  If someone runs into this and feels like helping me out – shoot me mail BEFORE you try and fix it like this J

Thanks!

SpatDSG