Attempting to launch XenApp 7.x application throws the error: Cannot start app “Outlook 2013”

Problem

You have received reports from a select few users that they receive the following error message when they attempt to launch an application from the StoreFront portal:

Cannot start App “Outlook 2013”

Logging onto the Citrix Delivery Controller and reviewing the application logs show the following warnings:

Log Name: Application

Source: Citrix Broker Service

Event ID: 1102

Level: Warning

User: NETWORK SERVICE

Computer: Citrix Delivery Controller

The Citrix Broker Service failed to broker a connection for user 'DOMAIN\G0052014' to resource 'Outlook 2013'. The virtual machine 'S30015-205-CX03.ad.domain.com' rejected a request to prepare itself for a connection. This problem usually indicates that the virtual machine is engaged in an activity such as restarting, entering a suspended state, or processing a recent disconnection or logoff.

If this problem persists, please restart the virtual machine.

**Note that S30015-205-CX03 is the application server with the VDA agent

Log Name: Application

Source: Citrix Broker Service

Event ID: 1101

Level: Warning

User: NETWORK SERVICE

Computer: Citrix Delivery Controller

The Citrix Broker Service failed to broker a connection for user ‘Domain\G0052014' to resource 'Outlook 2013'. The Citrix Broker Service cannot find any available virtual machines.

Please add more virtual machines to the site. If the problem is due to existing virtual machines not becoming available, see Citrix Knowledge Base article CTX126992.

Attempting to launch another application such as notepad logs a similar warning event:

Log Name: Application

Source: Citrix Broker Service

Event ID: 1102

Level: Warning

User: NETWORK SERVICE

Computer: Citrix Delivery Controller

The Citrix Broker Service failed to broker a connection for user 'DOMAIN\G0052014' to resource 'Notepad'. The virtual machine 'S30015-205-CX03.ad.domain.com' rejected a request to prepare itself for a connection. This problem usually indicates that the virtual machine is engaged in an activity such as restarting, entering a suspended state, or processing a recent disconnection or logoff.

If this problem persists, please restart the virtual machine.

Logging onto the StoreFront server and reviewing the event logs show the entries:

Log Name: Citrix Delivery Services

Source: Citrix Store Service

Event ID: 28

Level: Warning

User: N/A

Computer: Citrix StoreFront

Failed to launch the resource 'DR.Notepad' using the Citrix XML Service at address 'https://s30015-205-cx01.ad.domain.com:443/scripts/wpnbr.dll'. The XML service returned error: 'connection-refused'.

**Note that S30015-205-cx01 is the delivery controller.

Log Name: Citrix Delivery Services

Source: Citrix Store Service

Event ID: 28

Level: Warning

User: N/A

Computer: Citrix StoreFront

A request from the Citrix server to prepare for a connection was rejected while processing the initialization of desktop group Notepad for user DOMAIN\G0052014. This message was reported from the XML Service at address https://s30015-205-cx01.ad.domain.com:443/scripts/wpnbr.dll [NFuseProtocol.TRequestAddress].

Not all of the users are affected as there are many others who are able to launch applications without any issues.

Solution

What ended up being the cause of this was that the Citrix Remote Broker Provider service was stopped on the Delivery Controller and restarting the service corrected the issue.

Unable to delete Exchange 2016 mailbox database

Problem

You attempt to delete an Exchange 2016 mailbox database but receive the following error:

error

This mailbox database contains one or more mailboxes, mailbox plans, archive mailboxes, public folder mailboxes or arbitration mailboxes, Audit mailboxes. To get a list of all mailboxes in this database, run the command Get-Mailbox -Database <Database ID>. To get a list of all mailbox plans in this database, run the command Get-MailboxPlan. To get a list of archive mailboxes in this database, run the command Get-Mailbox -Database <Database ID> -Archive. To get a list of all public folder mailboxes in this database, run the command Get-Mailbox -Database <Database ID> -PublicFolder. To get a list of all arbitration mailboxes in this database, run the command Get-Mailbox -Database <Database ID> -Arbitration. To get a list of all Audit mailboxes in this database, run the command Get-Mailbox -Database <Database ID> -AuditLog. To disable a non-arbitration mailbox so that you can delete the mailbox database, run the command Disable-Mailbox <Mailbox ID>. To disable an archive mailbox so you can delete the mailbox database, run the command Disable-Mailbox <Mailbox ID> -Archive. To disable a public folder mailbox so that you can delete the mailbox database, run the command Disable-Mailbox <Mailbox ID> -PublicFolder. To disable a Audit mailbox so that you can delete the mailbox database, run the command Get-Mailbox -AuditLog | Disable-Mailbox. Arbitration mailboxes should be moved to another server; to do this, run the command New-MoveRequest <parameters>. If this is the last server in the organization, run the command Disable-Mailbox <Mailbox ID> -Arbitration -DisableLastArbitrationMailboxAllowed to disable the arbitration mailbox. Mailbox plans should be moved to another server; to do this, run the command Set-MailboxPlan <MailboxPlan ID> -Database <Database ID>.

Attempting to use the cmdlet Remove-MailboxDatabase throws the same error:

Executing the following cmdlets does not reveal any other types of mailboxes that reside in the database:

Get-Mailbox -Database EMDB09

Get-Mailbox -Database EMDB09 -Arbitration

Get-Mailbox -Database EMDB09 -Archive

Get-Mailbox -Database EMDB09 -AuditLog

Get-Mailbox -Database EMDB09 -PublicFolder

Get-Mailbox -Database EMDB09 -Monitoring

Solution

One of the possible causes of this is if you have a mailbox that uses this database as an archive database.  Below is an account that has the live mailbox in another database but uses this database we’re trying to remove as an archive database:

Executing the following PowerShell cmdlet would confirm this:

Get-Mailbox -Identity tluk | FL *archive*

An easier way to identify this if you don’t know which mailboxes may be using this database as an archive database is to execute the following cmdlet:

Get-Mailbox | where {$_.ArchiveDatabase -eq "EMDB09"}

If you are experiencing the issue above, simply move the archives left on this database to another database:

Setting up Test-ExchangeServerHealth.ps1 PowerShell health check script in Task Scheduler to automatically run daily

One of the scripts I've used a lot over the past few years is the Test-ExchangeServerHealth.ps1 PowerShell health check script written by Paul Cunningham.  The red, yellow and green colour coded report generated by this script allows me to easily review the status of critical Exchange services on devices with small viewing space such as a smartphone.  If you are unfamiliar with this script, further details about the script can be found in the following links:

Test-ExchangeServerHealth.ps1 – PowerShell Script to Generate a Health Check Report for Exchange Server 2016/2013/2010
https://practical365.com/exchange-server/powershell-script-exchange-server-health-check-report/

Generate Health Report for an Exchange Server 2016/2013/2010 Environment
https://gallery.technet.microsoft.com/office/Generate-Health-Report-for-19f5fe5f

This script could be scheduled to automatically run via the Task Scheduler and this post serves to provide the configuration for the action which sometimes can be difficult to find.  Note that I won’t go into the details of creating the scheduled task as that could be found in one of my previous posts here:

Setting up vCheck PowerShell health check script in Task Scheduler to automatically run daily
http://terenceluk.blogspot.com/2017/03/setting-up-vcheck-powershell-health.html

The following is the syntax required to configure the action:

Program/script: powershell.exe

Add arguments (option): -command "& 'C:\PS-Scripts\Test-ExchangeServerHealth.ps1' -ReportMode -SendEmail"

User attempting to access Microsoft Dynamics CRM Server 2016 receives a: “Server Error 404 - File or directory not found.” web page

Problem

You’ve recently deployed a new Microsoft Dynamics CRM Server 2016 environment:

… and had accounts created for the users in the organization but noticed that some users receive the following web page when attempting to access the portal via IFD and ADFS:

Server Error

404 - File or directory not found.

The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.

You’ve confirmed that the user is enabled in CRM:

You proceed to navigate to the ADFS sign page that the CRM deployment uses and sign in as the user:

What you quickly notice is that the following error is displayed when you sign in with the user’s credentials:

No Microsoft Dynamics CRM user exists with the specified domain name and user ID

A Microsoft Dynamics CRM user record does not exist with the specified domain name and user ID.

Solution

Note that I am by no means an expert with CRM but I made a “best effort” attempt at troubleshooting the issue and was able to identify the following:

1. The user account appears to be valid in the CRM portal because it pulled the correct information for the user
2. Although the account is displayed in the CRM portal, it appears it is not tied to a CRM record, which appears to suggest the Active Directory identity does not map to a CRM identity
3. Disabling and re-enabling the account does not correct the issue

What ended up enabling me to correct this problem was to:

1. Create a new temporary Active Directory user, which would not be created in the CRM directory (I could not use an existing user because they would already be created in CRM)
2. Quickly change the User Name field of the user experiencing the issue to the temporary user account
3. Save and Close the account properties
4. Change the User Name field of the user experiencing the issue from the temporary user account back to their identity
5. Save and Close the account properties

This appears to force CRM to map the user’s Active Directory identity to a CRM user record.  Below are a few screenshots that show the process:

Once the above has been saved and closed, reopen the account properties and change the User Name back to the correct identity.

Determining whether servers and desktops are protected from WannaCrypt / WannaCry Ransomware

It has been a busy week for most of my clients after the media published articles indicating that major organizations such as the NHS were infected by the WannaCry ransomware cryptoworm. Although a patch for this vulnerability was released as early as March 2017, some of my clients either had a portion of their servers unpatched or all of them since I’ve found it is not uncommon for companies to miss months of patching due to various business related reasons.  There has been a lot of information made available since last week but I’ve found that there are bits and pieces of important ones scattered on different sites so I wanted to write this post to include the information provided by Microsoft that I found useful when assisting clients to determine whether they are protected.

The Microsoft First Patch Released

The first available patch Microsoft made available for this vulnerability was released in March 2017 known as Security Update MS17-010, SMBv1 and information about this could be found at the following Security TechCenter bulletin:

Microsoft Security Bulletin MS17-010 - Critical
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Installing the patch above would protect the cryptoworm from spreading to other servers via the legacy SMBv1 protocol and an alternative workaround would be to disable SMBv1 all together which Microsoft recommends to do if the customer was running Windows Vista or later.

Versions of Windows Affected

All version of Windows are affected by the vulnerability and the following table provides the KBs required to protect the operating system:

• If one of updates is installed on the system, the system is protected.
• The vulnerability has been fixed in the March 2017 Security update but the March, April and May rollup also includes all previous updates including March security update)

Operating System	2017 March (Security Only)	2016 March (Monthly Quality)	2016 April (Monthly Quality)	2017 May (Monthly Quality)	Independent Update
Windows XP / Windows Server 2003 / Windows 8	NA	NA	NA	NA	KB4012598
Windows Vista / Windows Server 2008	NA	NA	NA	NA	KB4012598
Windows 7 / Windows Server 2008 R2	KB4012212	KB4012215	KB4015549	KB4019264	NA
Windows Server 2012	KB4012214	KB4012217	KB4015551	KB4019216	NA
Windows 8.1 / Windows Server 2012 R2	KB4012213	KB4012216	KB4015550	KB4019215	NA
Windows 10 1507 / Windows 10 LTSB 2015	NA	KB4012606	KB4015221	KB4019474	NA
Windows 10 1511	NA	KB4013198	KB4015219	KB4019473	NA
Windows 10 1607 / Windows 10 LTSB 2016 / Windows Server 2016	NA	KB4015438	KB4015217	KB4019472	NA

Determining whether patch is installed

On a Windows Server 2012 or 2008 server, you can use the wmic qfe list command to determine whether the patch is installed.  The following are the commands to execute on a Windows Server 2012 R2 or Windows 8.1 operating system when determining whether the required patch is installed:

wmic qfe list | find "KB4012213"

wmic qfe list | find "KB4012216"

wmic qfe list | find "KB4015550"

wmic qfe list | find "KB4019215"

**Note that if the KB after the find is case sensitive so use capital letters.

If the patches are not installed then no output would be written as shown in the following screenshot:

If the patch is found then the following output will be displayed:

Patching the Operating System Vulnerability

As mentioned in the Versions of Windows Affected section, the operating system is protected as long as one of the patches is installed so it is always advisable to install the latest rollup package rather than any of the previous rollups or security patch only.  However, if downloading a 200MB+ rollup package for a Windows Server 2012 operating system:

https://www.catalog.update.microsoft.com/Search.aspx?q=KB4019215

… is a problem for whatever reason then the alternative option is to download the security patch only which is around 37MB in size:

https://www.catalog.update.microsoft.com/Search.aspx?q=KB4012213

Alternative to Patching

If downloading and installing the appropriate patch is not an option then disabling SMBv1 could be an interim solution.  The following are instructions for how to disable SMBv1:

Windows Vista and later

• See Microsoft Knowledge Base Article 2696547

Windows 8.1 or Windows Server 2012 R2 and later

• For client operating systems:

1. Open Control Panel, click Programs, and then click Turn Windows features on or off.
2. In the Windows Features window, clear the SMB1.0/CIFS File Sharing Support checkbox, and then click OK to close the window.
3. Restart the system.

• For server operating systems:

1. Open Server Manager and then click the Manage menu and select Remove Roles and Features.
2. In the Features window, clear the SMB1.0/CIFS File Sharing Support check box, and then click OK to close the window.
3. Restart the system.

The following are links to articles that outline the impact of disabling SMBv1:

• https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/
• https://blogs.technet.microsoft.com/josebda/2015/04/21/the-deprecation-of-smb1-you-should-be-planning-to-get-rid-of-this-old-smb-dialect/

Unable to change Domain field when logging into VMware Horizon View with factor authentication enabled

Problem

You’re attempting to log into VMware Horizon View where 2 factor authentication is enabled and you use your email address or UPN as the User name:

However, you notice that you are unable to change the Domain field as the drop down box is greyed out and locked:

Solution

I am unsure as to whether this problem is specific to the SecurEnvoy 2 factor authentication software this environment had but a way to get around this is to use the format domain\username for the User name field instead:

Using this login format will unlock the domain drop down box so you can now select the domain:

Blocking a URL subdirectory and redirecting to request to the root with Citrix NetScaler

I’ve been asked several times in the past about how to block subdirectories when a website is published with a NetScaler and the most recent request was for blocking Exchange Server 2016 /ecp access.  As most Exchange administrators are aware, Exchange 2013 and 2016 allows an administrator to manage Exchange via the OWA URL but with the /ecp subdirectory.  This isn’t usually a concern when accessed via the internal corporate network but administrators get nervous when it is available via the internet.  With this recent request, I thought it would be a good idea use it as an example to demonstrate what the configuration would look like. 

**Note that this post is not endorsing the idea to block the ECP URL because I am unsure as to whether Exchange 2016 fully supports this without breaking any features for regular users as it did in Exchange 2013.  There has been several forum posts that appear to suggest it is ok but I’ll leave it up to others to decide to do it or not.

Step #1 – Create Pattern Set

Begin by creating a pattern set to match the ecp string with the following command:

add policy patset deny_ecp_url

Alternatively, you can create this via the GUI as well:

AppExpert > Pattern Sets > Add

Open the properties of the newly created Pattern Set, click on the Insert button and create the ecp pattern:

Step #2 – Create Rewrite Action

With the Pattern Set created, proceed with creating a Rewrite Action to replace /ecp with the root with the following command:

add rewrite action rw_deny_ecp_url_act replace HTTP.REQ.URL.PATH_AND_QUERY "\"/\""

Alternatively, you can create this via the GUI as well:

AppExpert > Rewrite > Actions

Type: Replace

Expression to choose target location*: HTTP.REQ.URL.PATH_AND_QUERY

Expression: "/"

Step #3 – Create Rewrite Policy

With the Rewrite Action created, proceed with creating a Rewrite Policy with the previous Rewrite Action assigned via the following command:

add rewrite policy rw_deny_ecp_url_pol "HTTP.REQ.URL.PATH.GET(1).TO_LOWER.EQUALS_ANY(\"deny_ecp_url\")" rw_deny_ecp_url_act

Alternatively, you can create this via the GUI as well:

AppExpert > Rewrite > Policies

Action: rw_deny_ecp_url_act

Undefined-Result Action*: –Global-undefined-result-action

Expression*: HTTP.REQ.URL.PATH.GET(1).TO_LOWER.EQUALS_ANY("deny_ecp_url")

Step #4 – Bind Rewrite Policy to Virtual Server

With the Rewrite Policy created, we can now bind it to the virtual server that publishes the Exchange OWA website via the following command:

bind lb vserver <virtualServerName> -policy rw_deny_ecp_url_pol -priority 100 -gotoPriorityExpression END -type REQUEST

Alternatively, you assign the policy via the GUI as well:

Traffic Management > Load Balancing > Virtual Servers

Bind a new Request Policy to the virtual server:

With the new policy binded to the virtual server, any requests to the /ecp directory should redirect the user to the regular OWA login page:

Which means they would never be able to reach this page: