How To Remove The Root Hints from Windows DNS

I ran into a problem while I was locking down a Windows DNS server where I would remove the root hints, but they would keep coming back. I first thought it was because of the "root hints" updates that Microsoft releases every so often. In reality, it was because the root entries were listed in the %windir%\system32\dns\cache.dns file. If you comment out those root hints with a semicolon (including the lines that start with a period (.)), then remove the root hints from your DNS server properties in the DNS Manager MMC snap-in. They should stay away. An example of the cache.dns file after it's been commented out is below.

;
;   cache.dns -- DNS CACHE FILE
;
;   Initial cache data for root domain servers.
;
;   YOU SHOULD CHANGE:
;   ->  Nothing if connected to the Internet.  Edit this file only when
;       updated root name server list is released.
;           OR
;   ->  If NOT connected to the Internet, remove these records and replace
;       with NS and A records for the DNS server authoritative for the
;       root domain at your site.
;
;   Note, if you are a root domain server, for your own private intranet,
;   no cache is required, and you may edit your boot file to remove
;   it.
;
;       This file holds the information on root name servers needed to
;       initialize cache of Internet domain name servers
;       (e.g. reference this file in the "cache  .  "
;       configuration file of BIND domain name servers).
;
;       This file is made available by InterNIC 
;       under anonymous FTP as
;           file                /domain/named.root
;           on server           FTP.INTERNIC.NET
;
;       last update:    Nov 5, 2002
;       related version of root zone:   2002110501
;
;
; formerly NS.INTERNIC.NET
;
;.                        3600000  IN  NS    A.ROOT-SERVERS.NET.
;A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
;
; formerly NS1.ISI.EDU
;
;.                        3600000      NS    B.ROOT-SERVERS.NET.
;B.ROOT-SERVERS.NET.      3600000      A     128.9.0.107
;
; formerly C.PSI.NET
;
;.                        3600000      NS    C.ROOT-SERVERS.NET.
;C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
;
; formerly TERP.UMD.EDU
;
;.                        3600000      NS    D.ROOT-SERVERS.NET.
;D.ROOT-SERVERS.NET.      3600000      A     128.8.10.90
;
; formerly NS.NASA.GOV
;
;.                        3600000      NS    E.ROOT-SERVERS.NET.
;E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
;
; formerly NS.ISC.ORG
;
;.                        3600000      NS    F.ROOT-SERVERS.NET.
;F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
;
; formerly NS.NIC.DDN.MIL
;
;.                        3600000      NS    G.ROOT-SERVERS.NET.
;G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
;
; formerly AOS.ARL.ARMY.MIL
;
;.                        3600000      NS    H.ROOT-SERVERS.NET.
;H.ROOT-SERVERS.NET.      3600000      A     128.63.2.53
;
; formerly NIC.NORDU.NET
;
;.                        3600000      NS    I.ROOT-SERVERS.NET.
;I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
;
; operated by VeriSign, Inc. 
;
;.                        3600000      NS    J.ROOT-SERVERS.NET.
;J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
;
; housed in LINX, operated by RIPE NCC
;
;.                        3600000      NS    K.ROOT-SERVERS.NET.
;K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129 
;
; operated by IANA
;
;.                        3600000      NS    L.ROOT-SERVERS.NET.
;L.ROOT-SERVERS.NET.      3600000      A     198.32.64.12
;
; housed in Japan, operated by WIDE
;
;.                        3600000      NS    M.ROOT-SERVERS.NET.
;M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
; End of File

Read More

Faulting application gpresult.exe, version 5.2.3790.3959, faulting module gpresult.exe, version 5.2.3790.3959, fault address 0x000000000001323c.

There is a problem with gpresult on 64 bit servers that can cause it to crash with the following errors.

Event Type:        Error
Event Source:    Application Error
Event Category:                (100)
Event ID:              1000
Date:                     4/11/2013
Time:                     3:01:51 PM
User:                     N/A
Computer:          SERVER
Description:
Faulting application gpresult.exe, version 5.2.3790.3959, faulting module gpresult.exe, version 5.2.3790.3959, fault address 0x000000000001323c.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 67 70 72   ure  gpr
0018: 65 73 75 6c 74 2e 65 78   esult.ex
0020: 65 20 35 2e 32 2e 33 37   e 5.2.37
0028: 39 30 2e 33 39 35 39 20   90.3959 
0030: 69 6e 20 67 70 72 65 73   in gpres
0038: 75 6c 74 2e 65 78 65 20   ult.exe 
0040: 35 2e 32 2e 33 37 39 30   5.2.3790
0048: 2e 33 39 35 39 20 61 74   .3959 at
0050: 20 6f 66 66 73 65 74 20    offset 
0058: 30 30 30 30 30 30 30 30   00000000
0060: 30 30 30 31 33 32 33 63   0001323c

To fix the problem, you need to change the value of HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit\Reg Values\MACHINE/Software/Microsoft/Windows NT/CurrentVersion/Winlogon/PasswordExpiryWarning/DisplayName to read "Interactive logon: Prompt user to change password before expire" instead of "Interactive logon: Prompt user to change password before expiration".

Also see http://support.microsoft.com/kb/971243

Read More

How to Disable Credential Caching in ADFS

If you have session problems in ADFS, you may need to disable Local Security Authority (LSA) credential caching on the AD FS server temporarily. This can affect any application that uses claims based authentication including SharePoint, CRM, Office 365, etc. To do this, you need to:

1. Create a new DWORD value named LsaLookupCacheMaxSize under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
2. Set the value of LsaLookupCacheMaxSize to 0.
3. Reboot the ADFS server.

Also see http://support.microsoft.com/kb/2535191

Read More

404 Error for Isolated Users in Dynamics CRM

I had an issue recently where one user was getting a 404 error when trying to log into CRM. While troubleshooting this issues I tried everything I could think of, including disabling Local Security Authority (LSA) credential caching on the ADFS server, recreating the user's Active Directory account, disabled/re-enabled her CRM account, purged her kerberos tickets, deleted her cookies, killed her ADFS sessions, rebooted servers, reset passwords, checked her security roles, etc. After trying every perceivable resolution, this is what I had to do to fix the issue.

1. Changed the logon account for the affected user to an unrelated service account that wasn't used in CRM, and disabled the CRM account.
2. Created a brand new account for the user in CRM, and assigned the security roles that the old account had.

Hopefully that works for you too.

Read More