By
Published
Apr 04 2019 04:54 PM
729
Views
First published on TechNet on Jan 07, 2011
Hey all, Ned here again. Welcome back from Christmas, New Years, etc. Today we talk some BitLocker, SSL, DFS, FRS, MS news, and some geeky goo. Despite us being offline for the past few weeks, we weren’t deluged with new questions – glad you took some time off, you deserved it.
Yoink!
Is it possible to have the Windows 7 machines that have been BitLocker’ed before the AD DS backup was setup automatically check in and store their recovery information? I have seen the two manage-bde commands that are needed but I was wondering if there was a script somewhere that could run at logon or system start up to register all those keys.
Yes, our sister site AskCore has a sample VBS you can use:
http://blogs.technet.com/b/askcore/archive/2010/04/06/how-to-backup-recovery-information-in-ad-a...
Despite the security and AD nature of BitLocker, it is not supported by us in DS – instead, the core operating system team handles it, as they own storage. Punt!
Please summarize the support (or lack thereof) for receiving fragmented SSL/TLS handshake messages by OS version and service pack. Which, if any, service pack(s) of WinXP or Vista supports receipt of fragmented handshake messages? For each OS/version that supports receipt of fragmented handshake messages:
[From Jonathan, naturally]
Only Windows 7 and Windows Server 2008 R2 have support for SSL record fragmentation, and then only so far as to accept and coalesce fragmented records. This support was introduced in the RTM release, and does not require a service pack update. Previous Windows OS versions do not support SSL record fragmentation of any sort.
Per RFC 2246, message length is an unsigned 24-bit integer, so the maximum message length is 16,777,215 ((1<<24) - 1) bytes.
There is no size limit on a certificate itself, but there is a size limit on each individual extension. On Windows, the size of a certificate extension must not exceed 4096 bytes. For example, 151 25-character DNS name entries, plus the overhead for encoding (~2 bytes per name), comes in at 4,081 bytes, just under the 4KB limit.
Fragmented handshake records are supported (exceptions below), including the following cases:
The exceptions are:
I went to add a new server as a DFS replication partner and noticed that on the "Replication Folders" tab is now says "Not Published". I then looked at all the replication objects and they also say "Not Published". The strange thing is our namespaces is still responding and seems to be conforming to the rules in place. Should I go through and republish all the replication groups to the namespace? What would cause this type of thing to happen?
First, some background. The attribute msDFSR-Dfspath on that replicated folder in AD is what stores a DFS Namespace path and lets the GUI populate those values. This is on the global DFSR RF “content” object within a given replication group. For example, a replicated folder named “primarybit” that exists in a replication group called “warrenpritest1” in the “Contoso.com” domain would show this:
Often though, no one ever set this value and it is only noticed a long time later – a problem that never was. :) The only way this normally gets set is if you use DFSMGMT.MSC to first create a DFS Namespace, create some links, then get prompted to configure replication (or if you create an RG and then select “share and publish in namespace”. If you just setup DFSR by itself, this field doesn’t get populated. It has no real effect on DFSR, DFSN, or end users – the field exists purely as a convenience to the administrator so that they know that the replication and namespace are related; just a visual thing for DFSMGMT.MSC.
You can edit the attribute manually to be the DFS Link path you want using ADSIEDIT, but I recommend instead using:
Once that’s done it will all fill in:
If you want to see when it might have been deleted, you can use:
It will show when they were modified:
[After a bit further chatting in the above Q & A]
It turns out that happened exactly when I migrated to 2008 mode in DFS. I wonder if I missed a step or something?
Ah! So that would be expected – when you “migrate” DFSN between modes you are actually recreating them from scratch. When the namespace is deleted that value is being cleaned out, but never put back – because the DFSN migration tools have no idea about DFSR at all. If you wanted to fix that as part of your migration, you can just add the DFSRADMIN command above to your steps.
I was using FRSDIAG to look at a system. The connstat.txt log file it created is blank. Do you know what can cause this?
Anything that makes the command NTFRSUTIL.EXE SETS not work normally will cause this; FRSDIAG just calls that command-line tool then parses the NTFRS_SETS.TXT output to make connstat.txt .
In this case it was FRS being in Journal Wrap. Since the NTFRS_SETS.TXT log only showed “DOMAIN SYSTEM VOLUME (SYSVOL SHARE) in state JRNL_WRAP_ERROR... DELETED REPLICA SETS” there was nothing useful to parse.
I’ve also seen it when a server had all of its FRS replica registry settings removed from under the Parameters registry key:
The service will start up and you will get an FRS event 13516. But then nothing will replicate ever. You will have to use a D2 non-authoritative restore to fix the server.
Want another way to know when the AskDS blog is updated? You can use the NetworkedBlogs Facebook App . This does not mean that I am going to create a Facebook account for myself. Not doing Twitter either. I got into computers 25 years ago to avoid being social.
On that subject, Mark sent in a link that any self-respecting geek should read: “ Wake Up Geek Culture. Time to Die ”. It’s written by Patton Oswalt , who is awesome and usually totally NSFW; in this case he kept it mostly PG. Just to prime the pump:
For the record, I know the last words of Roy Batty too and it sickens me.
Next, the best Kinect hack yet – Ultra Seven!
Definitely watch the whole thing. Hopefully there will be no Ultraman versus Spectreman slap fights in the comments section. Tokusatsu always seems to get people’s blood up.
If you don’t follow IO9 and Rock Paper Shotgun you are not maximizing your egghead quotient. They have started off the year with a few must-reads if you are a sci-fi or PC gaming spaz like myself:
There was plenty of interesting stuff at CES 2011, but the thing that caught my eye was the new Touch Mouse . How exciting can a mouse with no buttons be, right? Watch this video:
Finally, in case you missed it, we are going to start supporting System on a Chip RISC processors in the next version of Windows – specifically ARM. Everything old is new again ! According to NVIDIA this is the end of Intel and AMD , but I wouldn’t start throwing away all your x86 motherboards just yet.
Until next time.
Ned “can you at least fry the chicken head?” Pyle
Hey all, Ned here again. Welcome back from Christmas, New Years, etc. Today we talk some BitLocker, SSL, DFS, FRS, MS news, and some geeky goo. Despite us being offline for the past few weeks, we weren’t deluged with new questions – glad you took some time off, you deserved it.
Yoink!
- Bitlocker key backup script
- Support for fragmented SSL/TLS handshake messages
- DFSR and DFSN "not published"
- DFSN migration and publishing
- FRSDIAG blank connstat
- Geeky time
Question
Is it possible to have the Windows 7 machines that have been BitLocker’ed before the AD DS backup was setup automatically check in and store their recovery information? I have seen the two manage-bde commands that are needed but I was wondering if there was a script somewhere that could run at logon or system start up to register all those keys.
Answer
Yes, our sister site AskCore has a sample VBS you can use:
http://blogs.technet.com/b/askcore/archive/2010/04/06/how-to-backup-recovery-information-in-ad-a...
Despite the security and AD nature of BitLocker, it is not supported by us in DS – instead, the core operating system team handles it, as they own storage. Punt!
Question
Please summarize the support (or lack thereof) for receiving fragmented SSL/TLS handshake messages by OS version and service pack. Which, if any, service pack(s) of WinXP or Vista supports receipt of fragmented handshake messages? For each OS/version that supports receipt of fragmented handshake messages:
- What is the size limit for messages fragmented into multiple records?
- What is the size limit for each certificate in a certificates message?
- Would a valid 122K byte certificate with 6700 DNS names in the subject Alt Names extension be honored?
- If not, what are the size and DNS name count limits?
- Must a fragmented message begin at the beginning of a record?
- Or can a record contain the last fragment of one handshake message and the first fragment of the next one
Answer
[From Jonathan, naturally]
Only Windows 7 and Windows Server 2008 R2 have support for SSL record fragmentation, and then only so far as to accept and coalesce fragmented records. This support was introduced in the RTM release, and does not require a service pack update. Previous Windows OS versions do not support SSL record fragmentation of any sort.
Per RFC 2246, message length is an unsigned 24-bit integer, so the maximum message length is 16,777,215 ((1<<24) - 1) bytes.
There is no size limit on a certificate itself, but there is a size limit on each individual extension. On Windows, the size of a certificate extension must not exceed 4096 bytes. For example, 151 25-character DNS name entries, plus the overhead for encoding (~2 bytes per name), comes in at 4,081 bytes, just under the 4KB limit.
Fragmented handshake records are supported (exceptions below), including the following cases:
- A 1 byte handshake fragment can be included in the end of a record.
- A client receives 1 byte fragment in a 1 byte record.
The exceptions are:
- TLS alerts cannot be fragmented.
- The ClientHello must have at least 6 bytes, otherwise there is insufficient information to determine protocol version.
- ClientHello must not be fragmented.
Question
I went to add a new server as a DFS replication partner and noticed that on the "Replication Folders" tab is now says "Not Published". I then looked at all the replication objects and they also say "Not Published". The strange thing is our namespaces is still responding and seems to be conforming to the rules in place. Should I go through and republish all the replication groups to the namespace? What would cause this type of thing to happen?
Answer
First, some background. The attribute msDFSR-Dfspath on that replicated folder in AD is what stores a DFS Namespace path and lets the GUI populate those values. This is on the global DFSR RF “content” object within a given replication group. For example, a replicated folder named “primarybit” that exists in a replication group called “warrenpritest1” in the “Contoso.com” domain would show this:
Often though, no one ever set this value and it is only noticed a long time later – a problem that never was. :) The only way this normally gets set is if you use DFSMGMT.MSC to first create a DFS Namespace, create some links, then get prompted to configure replication (or if you create an RG and then select “share and publish in namespace”. If you just setup DFSR by itself, this field doesn’t get populated. It has no real effect on DFSR, DFSN, or end users – the field exists purely as a convenience to the administrator so that they know that the replication and namespace are related; just a visual thing for DFSMGMT.MSC.
You can edit the attribute manually to be the DFS Link path you want using ADSIEDIT, but I recommend instead using:
DFSRADMIN.EXE RF SET /RFDFSPath <other options>
Once that’s done it will all fill in:
If you want to see when it might have been deleted, you can use:
REPADMIN /SHOWMETA <DN of that content set>
It will show when they were modified:
Question
[After a bit further chatting in the above Q & A]
It turns out that happened exactly when I migrated to 2008 mode in DFS. I wonder if I missed a step or something?
Answer
Ah! So that would be expected – when you “migrate” DFSN between modes you are actually recreating them from scratch. When the namespace is deleted that value is being cleaned out, but never put back – because the DFSN migration tools have no idea about DFSR at all. If you wanted to fix that as part of your migration, you can just add the DFSRADMIN command above to your steps.
Question
I was using FRSDIAG to look at a system. The connstat.txt log file it created is blank. Do you know what can cause this?
Answer
Anything that makes the command NTFRSUTIL.EXE SETS not work normally will cause this; FRSDIAG just calls that command-line tool then parses the NTFRS_SETS.TXT output to make connstat.txt .
In this case it was FRS being in Journal Wrap. Since the NTFRS_SETS.TXT log only showed “DOMAIN SYSTEM VOLUME (SYSVOL SHARE) in state JRNL_WRAP_ERROR... DELETED REPLICA SETS” there was nothing useful to parse.
I’ve also seen it when a server had all of its FRS replica registry settings removed from under the Parameters registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Replica Sets <-- gone
The service will start up and you will get an FRS event 13516. But then nothing will replicate ever. You will have to use a D2 non-authoritative restore to fix the server.
Geeky Time
Want another way to know when the AskDS blog is updated? You can use the NetworkedBlogs Facebook App . This does not mean that I am going to create a Facebook account for myself. Not doing Twitter either. I got into computers 25 years ago to avoid being social.
On that subject, Mark sent in a link that any self-respecting geek should read: “ Wake Up Geek Culture. Time to Die ”. It’s written by Patton Oswalt , who is awesome and usually totally NSFW; in this case he kept it mostly PG. Just to prime the pump:
When our coworkers nodded along to Springsteen and Madonna songs at the local Bennigan’s, my select friends and I would quietly trade out-of-context lines from Monty Python sketches—a thieves’ cant, a code language used for identification. We needed it, too, because the essence of our culture—our “escape hatch” culture—would begin to change in 1987.
That was the year the final issue of Watchmen came out, in October. After that, it seemed like everything that was part of my otaku world was out in the open and up for grabs, if only out of context. I wasn’t seeing the hard line between “nerds” and “normals” anymore. It was the last year that a T-shirt or music preference or pastime (Dungeons & Dragons had long since lost its dangerous, Satanic, suicide-inducing street cred) could set you apart from the surface dwellers. Pretty soon, being the only person who was into something didn’t make you outcast; it made you ahead of the curve and someone people were quicker to befriend than shun. Ironically, surface dwellers began repurposing the symbols and phrases and tokens of the erstwhile outcast underground.
Fast-forward to now: Boba Fett’s helmet emblazoned on sleeveless T-shirts worn by gym douches hefting dumbbells. The Glee kids performing the songs from The Rocky Horror Picture Show. And Toad the Wet Sprocket, a band that took its name from a Monty Python riff, joining the permanent soundtrack of a night out at Bennigan’s. Our below-the-topsoil passions have been rudely dug up and displayed in the noonday sun. The Lord of the Rings used to be ours and only ours simply because of the sheer ******* thickness of the books. Twenty years later, the entire cast and crew would be trooping onstage at the Oscars to collect their statuettes, and replicas of the One Ring would be sold as bling.
For the record, I know the last words of Roy Batty too and it sickens me.
Next, the best Kinect hack yet – Ultra Seven!
Definitely watch the whole thing. Hopefully there will be no Ultraman versus Spectreman slap fights in the comments section. Tokusatsu always seems to get people’s blood up.
If you don’t follow IO9 and Rock Paper Shotgun you are not maximizing your egghead quotient. They have started off the year with a few must-reads if you are a sci-fi or PC gaming spaz like myself:
- 55 Science Fiction/Fantasy Movies to Watch Out For in 2011
- Ultimate Guide to Science Fiction and Fantasy Television in 2011
- The Exciting List Of 2011′s Excitements
There was plenty of interesting stuff at CES 2011, but the thing that caught my eye was the new Touch Mouse . How exciting can a mouse with no buttons be, right? Watch this video:
Finally, in case you missed it, we are going to start supporting System on a Chip RISC processors in the next version of Windows – specifically ARM. Everything old is new again ! According to NVIDIA this is the end of Intel and AMD , but I wouldn’t start throwing away all your x86 motherboards just yet.
Until next time.
Ned “can you at least fry the chicken head?” Pyle