how to find out what security descriptor for mslldp is

Since upgrading to Windows 8.1 at home, I've had issues with backing up the calculator using my Home Server (not that I helped by introducing a GPT disk and a UEFI rig at the same fourth dimension…). The symptoms were that the customer backup procedure appeared stuck at 1% progress for a long time before eventually declining.

I finally got a bit of fourth dimension to look at the machines in question over the weekend and here are the issues that appeared to be causing problems for which I needed to observe solutions:

• The PC is a UEFI auto.
• The PC uses a GPT hard disk.
• A VSS error was actualization in the issue log on the PC beingness backed upwards.
• A CAPI2 error was appearing in the event log on the PC being backed upwards.

The first ii bug were dealt with quickly by a hotfix for Dwelling Server 2011: http://back up.microsoft.com/kb/2781272. Annotation that the aforementioned issue also affects Windows Storage Server 2008 R2 Essentials and Windows Small Business Server 2011 Essentials. More than information for these platforms can be plant at http://back up.microsoft.com/kb/2781278

The VSS fault manifests as the upshot 8194 appearing in the event log of the PC that the backup attempt is run on:

Volume Shadow Copy Service fault: Unexpected mistake querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is oftentimes caused by incorrect security settings in either the writer or requestor procedure.

Test of the binary data for upshot 8194 indicates that 'NT Authorisation\NETWORK SERVICE' is account receiving the access denied error:

Event 8194 is acquired by the inability of one or more than VSS arrangement writers to communicate with the backup application VSS requesting process via the COM calls exposed in the IVssWriterCallback interface. The issue is not caused by a functional error in the fill-in application, but rather is a security upshot acquired by the selected VSS writers running as a service under the 'Network Service' (or 'Local Service') account, not the Local Organisation or Administrator business relationship. Past default, in order for a Windows service to perform a COM activation it must exist running as Local System or as a member of the Administrators grouping.

There are ii ways to fix this issue; either modify the account under which the erroring VSS writers are running from Network Service to Local System (at which betoken the service will be running with college privileges than was originally designed), or add the Network Service business relationship to the listing of default COM activation permissions allowing this user account to activate the IVssWrtierCallback interface. This latter pick is the preferred ane to apply and can be performed by completing the following steps:

1. Run dcomcnfg to open the Component Services dialog.
2. Expand Component Services, and so Computers and then correct-click on My Computer and select Properties:
   
3. Select the COM Security tab and click the Edit Default… button in the Access Permissions area at the height of the dialog.
4. Click Add and enter Network Service as the account to be added.
5. Click OK and ensure that only the Local Admission checkbox is selected.
6. Click OK to close the Admission Permission dialog, then clock OK to shut the My Computer Properties dialog.
7. Shut the Component Services Dialog and restart the estimator to apply the changes. Event 8194 should not longer appear in the event log for the Habitation Server backup.

The CAPI2 error manifests every bit the event 513 appearing in the result log of the PC that the backup attempt is run on:

Cryptographic Services failed while processing the OnIdentity() telephone call in the Organisation Writer Object.
Details: AddLegacyDriverFiles: Unable to dorsum upwards image of binary Microsoft Link-Layer Discovery Protocol.
System Fault:
Access is denied.
.

The Microsoft Link-Layer Discovery Protocol binary is located at C:\Windows\System32\drivers\mslldp.sys. During the backup process, the VSS process running under the Network Service business relationship calls cryptcatsvc!CSystemWriter::AddLegacyDriverFiles(), which enumerates all the commuter records in Service Control Manager database and tries opening each i of them. The function fails on the MSLLDP record with an 'Admission Denied' fault.

The mslldp.sys configuration registry key is HKEY_LOCAL_MACHINE\Organization\CurrentControlSet\Services\MsLldp and the binary security descriptor for the record is located at HKEY_LOCAL_MACHINE\Arrangement\CurrentControlSet\Services\MsLldp\Security.

Examining the security descriptor for mslldp using AccessChk (part of the SysInternals suite, available at http://technet.microsoft.com/en-us/sysinternals/bb664922) gives the post-obit consequence (notation: your security descriptor may differ from the permissions below):

C:\>accesschk.exe -c mslldp

Accesschk v5.ii – Reports effective permissions for securable objects
Copyright (C) 2006-2014 Marking Russinovich
Sysinternals – www.sysinternals.com

mslldp
  RW NT AUTHORITY\System
  RW BUILTIN\Administrators
  RW S-1-5-32-549
  R  NT SERVICE\NlaSvc

Checking the access rights of another driver in the same location gives the following consequence:

C:\>accesschk.exe -c mspclock

Accesschk v5.two – Reports effective permissions for securable objects
Copyright (C) 2006-2014 Marker Russinovich
Sysinternals – world wide web.sysinternals.com

mspclock
  RW NT Authorisation\SYSTEM
  RW BUILTIN\Administrators
  R  NT Authority\INTERACTIVE
  R  NT Dominance\SERVICE

In the example of mslldp.sys, there is no entry for 'NT Potency\SERVICE', therefore no service account will accept access to the mslldp driver, hence the error.

To correct this result, complete the following steps:

1. From an elevated command prompt, run
   sc sdshow mslldp
   You should receive the following output, or something like:
   D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;So)(A;;LCRPWP;;;S-1-5-eighty-3141615172-2057878085-1754447212-2405740020-3916490453)Due south:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
   Notation: Details on Security Descriptor Definition Linguistic communication can be establish at http://msdn.microsoft.com/en-us/library/windows/desktop/aa379567(five=vs.85).aspx
2. Add the 'NT Authorisation\SERVICE' entry immediately before the S::(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) entry and use this with the sdset option, for instance using the output from the sdshow option in a higher place, this would exist:
   sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-i-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
   Note: The higher up should all be on a single line when entering/pasting it; do not include line breaks in the command. It'southward also of import to utilize the output you receive from the command rather than that which I got as yours may be unlike.
3. Check the access permissions again with:
   accesschk.exe -c mslldp
   You lot should now come across a listing of permissions that includes 'NT Dominance\SERVICE':
   C:\>accesschk.exe -c mslldp

Accesschk v5.2 – Reports effective permissions for securable objects
Copyright (C) 2006-2014 Marker Russinovich
Sysinternals – world wide web.sysinternals.com

mslldp
  RW NT AUTHORITY\SYSTEM
  RW BUILTIN\Administrators
  RW Southward-i-5-32-549
  R  NT SERVICE\NlaSvc
  R  NT AUTHORITY\SERVICE

4. Now that the 'NT AUTHORIT\SERVICE' permission has been added, Network Service should exist able to access the mslldp.sys driver file.

Following the above fixes, my computer is now being successfully backed up using Domicile Server 2011.

On an instance of CRM 2011 that was being patched to Update Rollup half-dozen prior to patching to Update Rollup 8, the post-obit error occurred:

Arrangement.Exception: Action Microsoft.Crm.Setup.Common.Update.DBUpdateAction failed. —> Organisation.Data.SqlClient.SqlException: Timeout expired.  The timeout period elapsed prior to completion of the performance or the server is not responding.

The mistake was displayed as both a dialog on screen, and within the log file, KB2600640.log located at %APPDATA%\Microsoft\MSCRM\Logs

The solution was to raise the timeout that CRM applied for OLEDB connections from the original 30 seconds by creating 2 new registry keys at HKLM\SOFTWARE\Microsoft\MSCRM:

OLEDBTimeout (DWORD), value 86400 (decimal)
ExtendedTimeout (DWORD), value meg (decimal)

Then restart the CRM awarding puddle inside IIS.

Once the new settings were in place, the upgrade proceeded normally.

Modifying the URL used for CRM 2011 after installation tin can be achieved using the following steps:

• Update the IIS bindings for the CRM 2011 website on the server running CRM to the new value you desire to use
• Open IIS Manager
• Select the Microsoft Dynamics CRM website
• Click 'Bindings' in the activeness panel at the right of the screen
• Select the binding to alter
• Click 'Edit' and modify the host name and port to the new value.
• Close the dialog and IIS Manager.
• Update the ServerURL registry entry with the new URL you want to apply. The registry entry can exist institute at KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM. Note that the key value should be of the form http(south)://<New URL>:<Port Number>/MSCRMServices
• Modify the global settings for CRM from within the Microsoft Dynamics CRM Deployment Managing director*:
• First the Microsoft Dynamics CRM Deployment Director
• Correct-click on the 'Microsoft Dynamics CRM' entry at the superlative of the left pane of the window shown
• Click 'Properties'
• Select the 'Web Address' tab on the dialog which is shown
• Modify the addresses shown appropriately. Note that if the bounden type is modified from HTTP to HTTPS you will demand to install the advisable certificate into IIS likewise.
• Click OK to close the dialog and shut Microsoft Dynamics CRM Deployment Director
• Restart the Microsoft Dynamics CRM Asynchronous Processing Service, or restart the server

* Notation: This footstep replaces the use of the Microsoft CRM Deployment Configuration Tool used to make these changes for CRM 4.0.

System Eye Operations Manager doesn't seem to provide an like shooting fish in a barrel style (right me if I'm wrong here) to find out what database server and database proper noun it is using. Should you ever need to observe out, log onto your Management Server, showtime regedit and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Operations Manager\3.0\Setup and examine the DatabaseServerName and DatabaseName entries.

aungerining1988.blogspot.com

Source: https://blogs.blackmarble.co.uk/adawson/category/registry/

Share this post