”
“
IT Services | IT Consulting | Computer Repair | Computer Services | Computer Network | Business computer
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
Published: March 14, 2017
Version: 1.0
This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker sends specially crafted messages to a Microsoft Server Message Block 1.0 (SMBv1) server.
This security update is rated Critical for all supported releases of Microsoft Windows. For more information, see the Affected Software and Vulnerability Severity Ratings section.
The security update addresses the vulnerabilities by correcting how SMBv1 handles specially crafted requests.
For more information about the vulnerabilities, see the Vulnerability Information section.
For more information about this update, see Microsoft Knowledge Base Article 4013389.
The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.
The severity ratings indicated for each affected software assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin’s release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the March bulletin summary.
Note Please see the Security Update Guide for a new approach to consuming the security update information. You can customize your views and create affected software spreadsheets, as well as download data via a restful API. For more information, please see the Security Updates Guide FAQ. As a reminder, the Security Updates Guide will be replacing security bulletins. Please see our blog post, Furthering our commitment to security updates, for more details.
Operating System | Windows SMB Remote Code Execution Vulnerability – CVE-2017-0143 | Windows SMB Remote Code Execution Vulnerability – CVE-2017-0144 | Windows SMB Remote Code Execution Vulnerability – CVE-2017-0145 | Windows SMB Remote Code Execution Vulnerability – CVE-2017-0146 | Windows SMB Information Disclosure Vulnerability – CVE-2017-0147 | Windows SMB Remote Code Execution Vulnerability – CVE-2017-0148 | Updates Replaced |
Windows Vista | |||||||
Windows Vista Service Pack 2 (4012598) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3177186 in MS16-114 |
Windows Vista x64 Edition Service Pack 2 (4012598) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3177186 in MS16-114 |
Windows Server 2008 | |||||||
Windows Server 2008 for 32-bit Systems Service Pack 2 (4012598) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3177186 in MS16-114 |
Windows Server 2008 for x64-based Systems Service Pack 2 (4012598) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3177186 in MS16-114 |
Windows Server 2008 for Itanium-based Systems Service Pack 2 (4012598) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3177186 in MS16-114 |
Windows 7 | |||||||
Windows 7 for 32-bit Systems Service Pack 1 (4012212) Security Only[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
None |
Windows 7 for 32-bit Systems Service Pack 1 (4012215) Monthly Rollup[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3212646 |
Windows 7 for x64-based Systems Service Pack 1 (4012212) Security Only[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
None |
Windows 7 for x64-based Systems Service Pack 1 (4012215) Monthly Rollup[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3212646 |
Windows Server 2008 R2 | |||||||
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (4012212) Security Only[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
None |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (4012215) Monthly Rollup[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3212646 |
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 (4012212) Security Only[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
None |
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 (4012215) Monthly Rollup[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3212646 |
Windows 8.1 | |||||||
Windows 8.1 for 32-bit Systems (4012213) Security Only[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
None |
Windows 8.1 for 32-bit Systems (4012216) Monthly Rollup[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3205401 |
Windows 8.1 for x64-based Systems (4012213) Security Only[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
None |
Windows 8.1 for x64-based Systems (4012216) Monthly Rollup[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3205401 |
Windows Server 2012 and Windows Server 2012 R2 | |||||||
Windows Server 2012 (4012214) Security Only[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
None |
Windows Server 2012 (4012217) Monthly Rollup[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3205409 |
Windows Server 2012 R2 (4012213) Security Only[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
None |
Windows Server 2012 R2 (4012216) Monthly Rollup[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3205401 |
Windows RT 8.1 | |||||||
Windows RT 8.1[2] (4012216) Monthly Rollup |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3205401 |
Windows 10 | |||||||
Windows 10 for 32-bit Systems[3] (4012606) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3210720 |
Windows 10 for x64-based Systems[3] (4012606) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3210720 |
Windows 10 Version 1511 for 32-bit Systems[3] (4013198) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3210721 |
Windows 10 Version 1511 for x64-based Systems[3] (4013198) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3210721 |
Windows 10 Version 1607 for 32-bit Systems[3] (4013429) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3213986 |
Windows 10 Version 1607 for x64-based Systems[3] (4013429) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3213986 |
Windows Server 2016 | |||||||
Windows Server 2016 for x64-based Systems[3] (4013429) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3213986 |
Server Core installation option | |||||||
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) (4012598) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3177186 in MS16-114 |
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) (4012598) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3177186 in MS16-114 |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) (4012212) Security Only[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
None |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) (4012215) Monthly Rollup[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3212646 |
Windows Server 2012 (Server Core installation) (4012214) Security Only[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
None |
Windows Server 2012 (Server Core installation) (4012217) Monthly Rollup[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3205409 |
Windows Server 2012 R2 (Server Core installation) (4012213) Security Only[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
None |
Windows Server 2012 R2 (Server Core installation) (4012216) Monthly Rollup[1] |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3205401 |
Windows Server 2016 for x64-based Systems[3](Server Core installation) (4013429) |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Critical Remote Code Execution |
Important Information Disclosure |
Critical Remote Code Execution |
3213986 |
[1]Beginning with the October 2016 release, Microsoft has changed the update servicing model for Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2. For more information, please see this Microsoft TechNet article.
[2]This update is only available via Windows Update.
[3] Windows 10 and Windows Server 2016 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the Microsoft Update Catalog. Please note that effective December 13, 2016, Windows 10 and Windows Server 2016 details for the Cumulative Updates will be documented in Release Notes. Please refer to the Release Notes for OS Build numbers, Known Issues, and affected file list information.
*The Updates Replaced column shows only the latest update in any chain of superseded updates. For a comprehensive list of updates replaced, go to the Microsoft Update Catalog, search for the update KB number, and then view update details (updates replaced information is provided on the Package Details tab).
Remote code execution vulnerabilities exist in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited the vulnerabilities could gain the ability to execute code on the target server.
To exploit the vulnerability, in most situations, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv1 server.
The security update addresses the vulnerabilities by correcting how SMBv1 handles these specially crafted requests.
The following table contains links to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list:
Vulnerability title | CVE number | Publicly disclosed | Exploited |
Windows SMB Remote Code Execution Vulnerability | CVE-2017-0143 | No | No |
Windows SMB Remote Code Execution Vulnerability | CVE-2017-0144 | No | No |
Windows SMB Remote Code Execution Vulnerability | CVE-2017-0145 | No | No |
Windows SMB Remote Code Execution Vulnerability | CVE-2017-0146 | No | No |
Windows SMB Remote Code Execution Vulnerability | CVE-2017-0148 | No | No |
Microsoft has not identified any mitigating factors for these vulnerabilities.
The following workarounds may be helpful in your situation:
See Microsoft Knowledge Base Article 2696547.
Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later
For client operating systems:
For server operating systems:
Impact of workaround. The SMBv1 protocol will be disabled on the target system.
How to undo the workaround. Retrace the workaround steps, and select the SMB1.0/CIFS File Sharing Support check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.
An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited this vulnerability could craft a special packet, which could lead to information disclosure from the server.
To exploit the vulnerability, in most situations, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv1 server.
The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.
The following table contains links to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list:
Vulnerability title | CVE number | Publicly disclosed | Exploited |
Windows SMB Information Disclosure Vulnerability | CVE-2017-0147 | No | No |
Microsoft has not identified any mitigating factors for this vulnerability.
The following workarounds may be helpful in your situation:
See Microsoft Knowledge Base Article 2696547.
Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later
For client operating systems:
For server operating systems:
Impact of workaround. The SMBv1 protocol will be disabled on the target system.
How to undo the workaround. Retrace the workaround steps, and select the SMB1.0/CIFS File Sharing Support check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.
www.slipstick.com/outlook/config/recover-deleted-messages-pst-files/
If you don’t know what a Hex editor is, you probably shouldn’t be hex editing anything, but if you want to try, Google for “hex editor” – UltraEdit is probably the best and easiest one to use. Before doing anything to the PST with a Hex Editor, make a copy of the PST, or you may end up losing all of your e-mail.
Open the new PST in Outlook. The Deleted Items folder should now contain the deleted messages, unless Outlook has already deleted them for good by compacting the PST.
Log files OUTLOOK.exe-####-##-##.txt can simply deleted.
These are simply the log files that Outlook creates when there is a sync issue using between outlook and GAPPS
https://www.wintips.org/how-to-fix-svchost-exe-netsvcs-memory-leak-or-high-cpu-usage-problems
Svchost.exe is a generic and legitimate Windows process that loads several other critical services for proper Windows operation. But in several cases users are complaining that Svchost.exe is hogging their CPU or Memory resources without obvious reasons e.g. at moments when the user doesn’t run any programs.
In many occasions, I have troubleshooted the Svchost.exe (netsvcs) problem by using different solutions to resolve the problem depending on each situation.
From my experience, the Svchost.exe high usage problems – in most cases – occur on computers that are infected by a virus or a malware program. In the rest of the cases, the Svchost.exe (netsvcs) high CPU or Memory leak problems, can be caused by a Windows Update, or by a full Event log file or by other programs or services that start many processes during their execution. In this tutorial you can find detailed instructions on how to troubleshoot and resolve memory leak or high CPU usage problems caused by svchost {Svchost.exe (netsvcs)}.
Many viruses or malicious programs can cause the svchost.exe high CPU/memory usage problem. So, before you continue to troubleshoot the Svchost.exe high CPU usage problem, use this Malware Scan and Removal Guide to check and remove viruses or/and malicious programs that may be running on your computer.
Svchost.exe is a process that is needed by several services or programs in order for them to run. So, determine which service or program runs under the svchost.exe process and is hogging your system’s CPU and memory resources and then proceed to disable or totally uninstall that program (or service).
1. Press Ctlr+Alt+Del keys simultaneously and then open Task Manager.
2. At Processes tab, check the Show processes from all users checkbox.
3. Right-click on the high usage svchost.exe process and select Go to Service(s).
4. At services tab you should see several highlighted services that run under the svchost.exe process.
5. Now it ‘s time to find out which process is hogging CPU resources: To do that, you have two ways.
A) You can perform a sequentially search using Google (for all highlighted services) and see if the searched service is critical – or not – for your computer.
Or –
B) You can try to sequentially stop services (one by one) until CPU resources come back to normal. To stop a service temporary:
6. After you have figured out the culprit service or program, then navigate to Services in Computer Management to disable that service (or totally remove the culprit program).
To disable a service on your computer permanently:
1. Simultaneously press Windows key + R to open run command box.
2. In run command box, type: services.msc and press Enter.
3. At Services management window, right-click at the culprit service and choose Properties.
* Note: Most of the time, the culprit service is the Windows Update Service.
4. Change the Startup type to Disabled, press OK and restart your computer.
In some cases the svchost.exe high CPU (or high Memory) usage problem has to do with the large log files in Windows event viewer. So, another solution is to clear Event Viewer’s log. To do that:
1. Simultaneously press Windows key + R to open run command box.
2. In run command box, type: eventvwr and press Enter.
3. At Event Viewer: Double-click to expand Windows Logs.
4. Right-click on Application and choose Clear Log.
5. Perform the same operation and clear the Security, Setup, and System log.
6. Restart your computer.
In other computers, the svchost.exe high usage problem may occur when Windows searches for updates (in the background). In order to troubleshoot high CPU usage problems during Windows Update, perform the following steps.
Step 1. Force Windows to re-create an empty Windows Update Store folder.
The Windows Update Store folder (commonly known as “SoftwareDistribution” folder), is the location where Windows stores the downloaded updates. If this folder is corrupted, then you will face problems during Windows Update. So, first try to force Windows to re-create a new empty SoftwareDistribution folder. To do that:
1. Simultaneously press Windows key + R to open run command box.
2. In run command box, type: services.msc and press Enter.
3. Search for Windows Update service, then right click on it and select Stop.
3. Navigate to “C:Windows” folder.
4. Delete * (or rename e.g. to “SoftwareDistributionOLD”) the “SoftwareDistribution” folder.
* Note: Upon restart, the next time the Windows Update checks for available updates, a new empty SoftwareDistribution folder will be created automatically by Windows to store updates.
5. Restart your computer and then try to check for updates.
6. If the “svchost” high CPU usage problem persists, continue to the next step.
1. Download Microsoft’s Windows Update Troubleshooter to your computer.
2. Run Windows Update Troubleshooter and press Accept at the first screen.
3. Select the Detect problems and apply the fixes for (Recommended) option.
4. Let the program to fix problems with Windows Update and then restart your computer.
5. Check for Updates again and if the svchost.exe high CPU usage problem persists continue to the next step.
1. Navigate to Windows Update Agent download site and download the appropriate package for your Windows edition and version.
2. Run WindowsUpdateAgent*.exe
3. Close all open programs and choose Next.
4. Choose Agree and press Next.
5. Let the installer finish the installation and then restart your computer.
1. Navigate to https://technet.microsoft.com/library/security/ms13-097 and click at the appropriate Internet Explorer Cumulative Security Update (2898785) according to your Internet Explorer version and Windows Version.
2. At the next screen choose your IE’s (menu) language and choose Download.
3. Run “IE11_Windows*-KB289875*.exe” and follow the on screen instruction to install the update.
4. Restart your computer and check for updates again.
1. Navigate to System Update Readiness tool download site and download the DISM tool for your Windows edition and version. *
* Note: Windows 8 already contains the DISM tool and you don’t have to download anything. Just open an elevated command prompt and type: DISM.exe /Online /Cleanup-image /Restorehealth (Detailed instructions on how you can run DISM in Windows 8/8.1 can be found here)
2. Double click to install the downloaded file (e.g. Windows6.1-KB947821-v34-x86.msu).
3. When the installation is completed, restart your computer.
4. Force Windows to check for updates again and see if the svchost high usage problem still persists.
UPDATE – 16/10/2015
Other solutions that I have applied in different cases (computers) in which the “svchost.exe” high usage problem is caused while searching for updates.
Case 1: Applied on a new Windows 7 SP1 installation.
a. Uninstall the KB2562937 from Installed Updates.
b. Restart the computer.
a. Install the Security Update KB2993651 according your OS version.
UPDATE – 22/03/2016
(Applied to: Windows 7 SP1 & Windows Server 2008 R2 SP1.)
1. First make sure that you have already installed Internet Explorer 11 on your computer.
2. Download and install the KB3102810 security update according your OS version *. (If installation hangs, restart the computer and then immediately install the Update).
3. Restart your computer and then delete the “SoftwareDistribution” folder by following the instructions on Step 1 (only) from Solution 4 above.
4. Restart your computer and check for updates.
UPDATE – 29/06/2016
(Applied to: Windows 7 SP1 & Windows Server 2008 R2 SP1.)
1. Download and install the June 2016 Windows Update Rollup KB3161608 according your OS Version. *
* Note: If installation hangs: Restart your computer, Stop the Windows Update service and then Install the update.
https://github.com/stascorp/rdpwrap/releases
Download the latest RDPWrapxxxx.zip and extract to the computer.
Open the folder and run install.bat as Administrator.
https://groups.google.com/forum/#!topic/everest-erp/hS_6dJ-0LBA
Thank you “Eddie”:
There is two ways to kick people. There is no way that I have found or been privy to automate it. If I recall correctly, I was told there is not a set timer within everest for this.
The first is the bottom right corner you should see users:#/# click once on this and it should bring up the list of people logged in. right click within the popup from this and select clear all inactive users. This is not a guaranteed way to kick people but sometimes it will clear some. I have not looked into it more to see what the “timer” is to denote inactive, and from what I can tell it is hit or miss. Had the bossman leave his logged in for two days and could not clear inactive on him with this way. Anyhow, I strongly suggest you try this first. I’ll explain why in the next method.
Method two is going into SSMS (SQL Server Management Studio)
1> Connect to SQL server with Everest DB
2> Click “New Query” will populate a blank window.
3> under that button you will see a drop down for databases, Select your company DB ie. EVEREST_XXX
4> put: “exec usp_clear_user ‘XXX’ ” (replace XXX with user login you are trying to kick)
Will report success and the user will be kicked.
If this does not work you will need to add the procedure for this
5 if needed> open new query
place the following in and execute.
______________________________
use everest_GSI
go
drop procedure usp_clear_user
go
create procedure usp_clear_user
@user varchar(100)
as
begin
set nocount on
select distinct uid into #temp from everest_system.dbo.everest_spm where attribute = 3 and value = @user
delete from semaphor where client_id in (select uid from #temp)
delete from everest_system.dbo.everest_spm where uid in (select uid from #temp)
end
go
______________________________
Go back to Query one and rerun: exec usp_clear_user ‘XXX’
(side note procedure will only have to be done once.)
The draw back for this method is that it will make everest act funky on the users end. Get the, ever so informative, error box the the yellow ! sign that tells you absolutely nothing. It does no damage to the App server, it just hoses up the users program and will most likely need to be forced closed on the user side. The higher the everest version the more likely to happen. I could do this on 5.0.2.6 and it would often let you just reconnect with no issue but in the 6.X series it program locks every time on the user side and needs a force close.
(ctrl+alt+del>task manager>end task on everest.exe)
http://kcwebprogrammers.blogspot.com/2012/02/everest-number-of-users-that.html
I have a client for which I use the Everest SDK to connect to the Everest database from a web application. Last week, we started getting this error on the site:
“The number of users that simultaneously access SDK cannot exceed the 25 user(s) for this license”
Essentially, all 25 allowable connections were used up, so my web pages couldn’t connect to do anything. So none of the pages on the site that connected to Everest would work.
I thought that maybe I had a place in my code where I wasn’t closing a connection and the open connections had built up to 25. The SDK has a Clear method to clear sessions, and can be accessed from the SDK object browser, so I figured I’d just go in there and clear some sessions. The catch was that I couldn’t even log into the SDK object browser because there were no connections left to log in with. We tried rebooting the Everest server, we tried rebooting the web server, but neither one cleared the sessions.
Finally we filed a support ticket. After a couple days, we received this reply:
“I wanted to reach out to you to give you an update on your ticket.
You wanted to remove user session of SDK.
Please ensure all users are logged out from Everest.
Please open SQL Server Management Studio and select database EVEREST_SYSTEM .
Select ‘New Query’ and run the command “Delete from EVEREST_SPM” .
”
That did the trick. All connections were cleared and the web site was able to connect to Everest again via the SDK. The support technician also said that SDK connections are not separate from normal Everest connections. So that makes it sound like the problem could have been solved by just forcing a few Everest application users to log out. Seems like the reboot would have done that. But we’ll look into that solution more next time it happens.
netsh int tcp set heuristics disabled
possible settings are: disabled,enabled,default (sets to the Windows default state)
recommended: disabled (to retain user-set auto-tuning level)
Note this should be executed in elevated command prompt (with admin priviledges) before setting the autotuninlevel in next section. If the command is accepted by the OS you will see an “Ok.” on a new line.
TCP Auto-Tuning
To turn off the default RWIN auto tuning behavior, (in elevated command prompt) type:
netsh int tcp set global autotuninglevel=disabled
The default auto-tuning level is “normal”, and the possible settings for the above command are:
disabled: uses a fixed value for the tcp receive window. Limits it to 64KB (limited at 65535).
highlyrestricted: allows the receive window to grow beyond its default value, very conservatively
restricted: somewhat restricted growth of the tcp receive window beyond its default value
normal: default value, allows the receive window to grow to accommodate most conditions
experimental: allows the receive window to grow to accommodate extreme scenarios (not recommended, it can degrade performance in common scenarios, only intended for research purposes. It enables RWIN values of over 16 MB)
https://support.microsoft.com/en-us/kb/296882
If a global catalog is not available when a user initiates a network logon process, the user can log on only to the local computer. There must be a global catalog server available so that users can log on and locate Active Directory resources. We recommend that you have at least one global catalog server per site to speed up these processes.
If there is only one domain controller in the domain, the domain controller and the global catalog server are the same. If there is more than one domain controller in the domain, the domain controller that is configured as such hosts the global catalog.
To promote a domain controller to a global catalog server, follow these steps:
Promoting a domain controller to a global catalog server can take a long time. When the domain controller restarts, make sure that there is sufficient time for the account and the schema information to replicate to the new global catalog server before you remove the original global catalog from the original domain controller.
Note When the account and the schema information replicate to the new global catalog server, event 1119 may be logged in the Directory Services log on the domain controller. The event description states that the computer is now advertising itself as a global catalog server.
In a Windows 2000 domain with only one domain controller, you typically assign the roles of the global catalog and of the operations master (also known as flexible single master operations or FSMO) to the same domain controller. However, in domains with multiple domain controllers, consider the placement of these roles before you assign them. This is particularly important in forests with multiple domains. For additional information about the placement of the operations master, click the following article number to view the article in the Microsoft Knowledge Base: