Disabling SBCore service – SBS Shutdown every hour
With a few SBS 2003 to 2008 migrations going over the 21 day limit (unfortunately due to third party support on line-of-business applications) we found it necessary to use the below to stop the SBS 2003 server shutting down every hour. I do not recommend this or support this as it is in breach of Microsofts EULA - however in some scenario's it may be critical to ensure a smooth decommissioning of the old SBS 2003 server.
The below is the error log you should see:
Event ID: 1001
Type: Error
Source: SBCore
Description:
The server was shut down because it did not comply with the EULA. For more information, contact Microsoft.
To disable we followed the below:
- Download the Process Explorer tool from SysInternals - Here
- Load Process Explorer and look for the SBS Licensing Service - C:\Windows\system32\sbscrexe.exe
- Select this service and Suspend it - you should find the service greys out
- Open Regedit and expand the following key - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SBCore
- Right click this Key and add the Administrators group giving them Full Permission to the key (refresh this and you should see all the key entries now)
- Select the Start DWORD and change it from 2 to 4 (this sets the Disabled state)
- Open a File Explorer window and browse to the C:\Windows\system32\sbscrexe.exe file
- Right click this and load Properties / Security
- Add the Everyone group and set the Deny permission for Full Access (should then tick the sub permissions)
- Go back to Process Explorer and now kill the sbscrexe.exe service - this should now be disabled
- Check the SBCore service via services.msc - it should have a disabled state and now longer be running
- Job Done.
Install Exchange 2007 SP2 on SBS 2008
Currently running through an Exchange Service Pack 2 install for Microsoft's Small Business Server 2008. For ease of reference I thought I'd briefly list the main three steps below:
- Download the Exchange 2007 Service Pack 2 - Exchange 2007 Downloads
- Run through the following KB Article referencing "You cannot install Exchange Server 2007 Service Pack 2 on a Windows Small Business Server 2008-based computer" - KB973862
- Download the Service Pack Installation tool for Small Business Server 2008 - KB974271
*Update*
Service Pack 3 is now available for Exchange 2007 which no longer needs the above steps to install. I believe it is support for SBS 2008 and as per a few we've done already goes on straight away.
IE Start Menu shortcut broken
Recently had a Vista machine infected with the fake Windows Security Center rubbish, this was cleared relatively easy by running SuperAntiSpyware. We tend to favour MalwareBytes however this was being blocked by the infection (even after renaming mbam.exe to something else). Once SuperAntiSpyware had finished and the system was rebooted we ran MalwareBytes along with some online scanners (TrendMicro Housecall and ESET Online Scanner) to confirm the all clear.
After running the cleanup the system appeared back to normal with no further infections found. Once we loaded IE again (after resetting to default and disabling addons etc) it re-infected the client PC. This was a little frustrating as nothing seemed to pick up any malicious files, we cleared again and re-ran ccleaner to emtpy temp files which must have done the trick as the Internet Explorer Start Menu shortcut failed to load reporting the below:
explorer.exe
The application could not be found
The infection had tagged this shortcut to run the malicious installer upon launching IE. To resolve load regedit and navigate to the below registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet
\IEXPLORE.EXE\shell\open\command
You should only see the default path of IE in here (usually C:\Program Files\Internet Explorer\iexplore.exe), if not amend to resolve.
You can also download the following reg file to run that will make the above changes automatically.
iefix.reg (right click + save as) - Note: Only use this if you are sure of what you are doing, playing with the registry can screw things up! This file is mainly for my ease of use.
Exchange 2007 orphaned Delegate User causing Bouncebacks
Having recently deleted an Exchange 2007 User from AD we found a number of bounce back emails beginning to occur. The bounce backs would occur primarily on editing Calender items for other users as the now deleted user was still listed as a Delegate for them. We wanted to query Exchange as to which mailboxes the now deleted user was listed on. The bounce back email is below:
Delivery has failed to these recipients or distribution lists:
Username
The recipient's e-mail address was not found in the recipient's e-mail system. Microsoft Exchange will not try to redeliver this message for you. Please check the e-mail address and try resending this message, or provide the following diagnostic text to your system administrator.
FIX:
1. Open Exchange 2007 PowerShell
2. Run the below query replacing $User with the name of the deleted user (e.g John Smith). This will output the details into a text file (C:\delegates.txt).
-
get-mailboxcalendarsettings | where-object{$_.ResourceDelegates -match"$user"} | out-file c:\delegates.txt -enc ASCII