Server 2012 DirectAccess: Useful NETSH Commands

During DirectAccess deployments, you can use several netsh commands as part of the initial deployment testing from a DirectAccess client. In the event of problems, this will often include the use of additional advanced netsh commands which are more troubleshooting focused.

The netsh tool is immensely powerful, and the following commands provide a good starting point to assess, understand and troubleshoot the DirectAccess client.

DirectAccess Client:

Settings and Status

Command: netsh dns show state

Description: This is probably the first and most useful command you will run, as it provides essential information on the current DirectAccess status and general configuration state.

netsh dns show state

netsh dns show state

Command: netsh namespace show policy

Description: This command is used to display the Name Resolution Policy Table (NRPT) that has been defined within Group Policy.

Command: netsh namespace show effectivepolicy

Description: This command is similar to the previous command but outputs the actual NRPT entries that are currently active on the DirectAccess client.

Common Transition Technology Interfaces

Command: netsh interface teredo show state

Description: This command shows the current status of the Teredo interface, if used at that time.

netsh interface teredo show state

netsh interface teredo show state

(Teredo not in use here)

Command: netsh interface httpstunnel show interfaces

Description: This command shows the current status of the IP-HTTPS interface, if used at that time.

netsh interface httpstunnel show interfaces

netsh interface httpstunnel show interfaces

Windows Firewall Settings and Status

Command: netsh advfirewall monitor show firewall

Description: This command is used to show the current status and configuration state of the local Windows Firewall.

 netsh advfirewall monitor show firewall      netsh advfirewall monitor show firewall

Command: netsh advfirewall show currentprofile

Description: This command is used to show the current Windows Firewall profile that is in use.

netsh advfirewall show currentprofile

netsh advfirewall show currentprofile

Command: netsh advfirewall monitor show mmsa

Description: This command is used to show the current status of the Windows Firewall main mode security associations that are present when the DirectAccess infrastructure and intranet IPsec tunnels are active.

Command: netsh advfirewall monitor show consec

Description: This command is used to show the current status of the Windows Firewall connection security rules which are used to define the DirectAccess infrastructure and intranet IPsec tunnels.

These commands can save you a lot of time during initial deployment!

Windows Server 2012 KMS Service Activation

So we have Windows Server 2012 and Windows 8 RTM and want to activate them with our KMS server. For this to be successful we need to update our KMS Service, with is currently servicing out Windows Server 2008 R2 servers and Windows 7 clients.

When we try to activate a Server 2012 server the following error will occur:

To resolve this issue:

Download and install the following update: KB2757817 (Update adds support for Windows 8 and Windows Server 2012 to Windows Server 2008, Windows 7, and Windows Server 2008 R2 KMS hosts).

How to obtain this update

The following files are available for download from the Microsoft Download Center:Collapse this tableExpand this table

Operating system Update
All supported x86-based versions of Windows Vista and of Windows Server 2008 Collapse this imageExpand this image

Download the update package now.

(http://www.microsoft.com/downloads/details.aspx?FamilyId=cca1a7a5-10f5-4aea-b0c5-999f2dc9f07f)

All supported x64-based versions of Windows Vista and of Windows Server 2008 Collapse this imageExpand this image

Download the update package now.

(http://www.microsoft.com/downloads/details.aspx?FamilyId=85cdb6a5-9658-47b3-b344-0284954a7379)

All supported IA-64-based versions of Windows Vista and of Windows Server 2008 Collapse this imageExpand this image

Download the update package now.

(http://www.microsoft.com/downloads/details.aspx?FamilyId=799f0f06-cbca-483c-8130-9bb99d8dc87e)

All supported x86-based versions of Windows 7 Collapse this imageExpand this image

Download the update package now.

(http://www.microsoft.com/downloads/details.aspx?FamilyId=a1829040-975f-43ab-877d-5cf4a5382987)

All supported x64-based versions of Windows 7 Collapse this imageExpand this image

Download the update package now.

(http://www.microsoft.com/downloads/details.aspx?FamilyId=23fd50b9-baa5-466f-9dff-af06729f23a9)

All supported x64-based versions of Windows Server 2008 R2 Collapse this imageExpand this image

Download the update package now.

(http://www.microsoft.com/downloads/details.aspx?FamilyId=bd2cda64-6319-4beb-91e3-9439048bf19d)

All supported IA-64-based versions of Windows Server 2008 R2 Collapse this imageExpand this image

Download the update package now.

 

If you don’t install this Update then registering a Windows Server 2012 KMS will throw an Error: 0xC004F050 The Software Licensing Service reported that the product key is invalid.

So install the update (Windows6.1-KB2757817-x64.msu) and restart the server!
Just restarting the KMS service (“net stop sppsvc” and “net start sppsvc“) is NOT enough.

Let’s see what is already running:

slmgr.vbs /dlv => The Windows 2008 R2 KMS key.

Uninstall the current KMS key using slmgr.vbs /upk
(We all know this has to be done from an elevated command prompt..)

Now it is time to install the new KMS key.

slmgr.vbs /ipk {YOUR_SERVER_2012_KMS_KEY}

slmgr.vbs /ato to activate the KMS Service

And now we can check our environment to see what we can activate:

slmgr.vbs /dlv => the Windows Server 2012 KMS key.

 

RoboCopy switches

So I was busy with the most fabulous copy tool ever – RoboCopy.
I always forget the exact switches, so for reference use here they are:

/S Copies subdirectories (excluding empty ones).
/E Copies all subdirectories (including empty ones).
/LEV:n Copies only the top n levels of the source directory tree.
/Z Copies files in restartable mode (that is, restarts the copy process from the point of failure).
/B Copies files in Backup mode (Backup copies are not restartable, but can copy some files that restartable mode cannot).
/ZB Tries to copy files in restartable mode, but if that fails with an “Access Denied” error, switches automatically to Backup mode.
/COPY:copyflags Copies the file information specified by copyflags, which can be any combination of the following :
D – file Data. S – file Security (NTFS ACLs).
A – file Attributes. O – file Ownership information.
T – file Timestamps. U – file aUditing infomation.
Source and destination volumes must both be NTFS to copy Security, Ownership or Auditing information.
/COPYALL Copies Everything. Equivalent to /COPY:DATSOU.
/NOCOPY Copies Nothing. Can be useful with /PURGE.
/SEC Copies NTFS security information. (Source and destination volumes must both be NTFS). Equivalent to /COPY:DATS.
/MOV Moves files (that is, deletes source files after copying).
/MOVE Moves files and directories (that is, deletes source files and directories after copying).
/PURGE Deletes destination files and directories that no longer exist in the source.
/MIR Mirrors a directory tree (equivalent to running both /E and /PURGE).
/A+:{RASHNT} Sets the specified attributes in copied files.
The following attributes can be set:
R – Read only S – System N – Not content indexed
A – Archive H – Hidden T – Temporary
/A-:{RASHNT} Turns off the specified attributes in copied files.
The following attributes can be turned off:
R – Read only S – System N – Not content indexed
A – Archive H – Hidden T – Temporary
/CREATE Creates a directory tree structure containing zero-length files only (that is, no file data is copied).
/FAT Creates destination files using only 8.3 FAT file names.
/FFT Assume FAT File Times (2-second granularity). Useful for copying to third-party systems that declare a volume to be NTFS but only implement file times with a 2-second granularity.
/MON:n Monitors the source directory for changes, and runs again when n changes have been detected, and the minimum time interval specified by /MOT has elapsed.
/MOT:n Monitors the source directory for changes, and runs again when a further n minutes have elapsed, and the minimum number of changes specified by /MON have been detected.
/RH:hhmm-hhmm Defines the time slot during which starting new copies is allowed. Useful for restricting copies to certain times of the day. Both values must be 24-hour times in the range 0000 to 2359.
/PF Makes more frequent checks to see if starting new copies is allowed (per file rather than per pass). Useful in stopping copy activity more promptly at the end of the run hours time slot.
/IPG:n Inserts a delay of n milliseconds after each 64k chunk of file data is copied. Useful for freeing up bandwidth on slow lines.
/IA:{RASHCNETO} Includes files with the specified attributes.
The following file attributes can be acted upon:
R – Read only A – Archive S – System
H – Hidden C – Compressed N – Not content indexed
E – Encrypted T – Temporary O – Offline
/XA:{RASHCNETO} Excludes files with the specified attributes.
The following file attributes can be acted upon:
R – Read only A – Archive S – System
H – Hidden C – Compressed N – Not content indexed
E – Encrypted T – Temporary O – Offline
/A Copies only files with the archive attribute set.
/M Copies only files with the archive attribute set and then resets (turns off) the archive attribute in the source files.
/XJ Excludes Junction points.
/XF file [file] Excludes files with the specified names, paths, or wildcard characters.
/XD dir [dir] Excludes directories with the specified names, paths, or wildcard characters.
/XC Excludes files tagged as “Changed”.
/XN Excludes files tagged as “Newer”.
/XO Excludes files tagged as “Older”..
/XX Excludes files and directories tagged as “Extra”.
/XL Excludes files and directories tagged as “Lonely”.
/IS Includes files tagged as “Same”.
/IT Includes files tagged as “Tweaked”.
/MAX:n Excludes files larger than n bytes.
/MIN:n Excludes files smaller than n bytes.
/MAXAGE:n Excludes files with a Last Modified Date older than n days or specified date. If n is less than 1900, then n is expressed in days. Otherwise, n is a date expressed as YYYYMMDD.
/MINAGE:n Excludes files with a Last Modified Date newer than n days or specified date. If n is less than 1900, then n is expressed in days. Otherwise, n is a date expressed as YYYYMMDD.
/MAXLAD:n Excludes files with a Last Access Date older than n days or specified date. If n is less than 1900, then n is expressed in days. Otherwise, n is a date expressed as YYYYMMDD.
/MINLAD:n Excludes files with a Last Access Date newer than n days or specified date. If n is less than 1900, then n is expressed in days. Otherwise, n is a date expressed as YYYYMMDD.
/R:n Specifies the number of retries on failed copies. (The default is 1 million.)
/W:n Specifies the wait time between retries. (The default is 30 seconds.)
/REG Saves /R:n and /W:n in the registry as default settings.
/TBD Waits for share names to be defined on a “Network Name Not Found” error.
/L Lists files without copying, deleting, or applying a time stamp to any files.
/X Reports all files tagged as “Extra”(including files not selected).
/V Produces verbose output (including skipped files).
/TS Displays source file timestamps in the output log.
/FP Displays full pathnames of files in the output log.
/NC Suppresses output of Robocopy file classes.
/NS Suppresses output of file and directory sizes.
/NDL Turns off logging of directory names. Full file pathnames (as opposed to simple file names) will be shown if /NDL is used.
/NFL Turns off logging of file names. File names are still shown, however, if file copy errors occur.
/NJH Turns of logging of the job header.
/NJS Turns off logging of the job summary.
/NP Turns off copy progress indicator (% copied).
/ETA Shows estimated time of completion for copied files.
/LOG:file Redirects output to the specified file, overwriting the file if it already exists.
/LOG+:file Redirects output to the specified file, appending it to the file if it already exists.
/TEE Displays output in the console window, in addition to directing it to the log file specified by /LOG or /LOG+.
/JOB:job Reads parameters from the named Job file.
/SAVE:job Writes the current parameter settings to the named Job file.
/QUIT Quits after processing the command line. No files will be copied. Use /QUIT with /JOB to view job file contents.
/NOSD Declares that no source directory is specified. Useful in template Jobs for which the source is provided at run time.
/NODD Declares that no destination directory is specified. Useful in template Jobs for which the destination is provided at run time.
/IF Includes files with the specified names, paths, or wildcard characters. Intended for use in Job files only.
/SD:path Explicity specifies the source directory for the copy. Intended for use in Job files only.
/DD:path Explicitly specifies the destination directory for the copy. Intended for use in Job files only.