VM Application aware back up fails on a 2012 R2 DC Guest (Event Id: 8229 VSS seen on Guest) on a 2016 host

This one was odd and I don't have the full history but got passed a call were Altaro was warning that an application aware backup was not possible and it was falling back to crash consistent.  As it was a DC server ideally it should be application aware.

The DC was Windows 2012 R2 running on 2016 Hyper-V server.  All the settings looked good and running Windows backup within the guest was able to backup with no issues.

Every time Altaro tried to take a back up with application the guest logged an event with id 8229 and an error code of 0x800423f4.

This appears to be an issue with the integrated servers triggering the backup within the guest and has an update that resolves the issue.  Has to be installed on the guest.

KB5001088: "BackupComplete" event message is not received when backing up Windows Server 2012 or Server 2012 R2 VMs residing on Windows Server 2016 or Server 2019 host (microsoft.com)

Powershell Script to reset Windows 2016+ Remote Desktop Host firewall

This a quick script to reset a Windows Servers firewall and insert the fix for cleaning down the rules when user logs off on a Remote Desktop Host.

#Powershell

Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System"
New-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System"
Remove-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules"
New-Item "HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules"
(New-Object -ComObject HNetCfg.FwPolicy2).RestoreLocalFirewallDefaults()
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy' -Name  'DeleteUserAppContainersOnLogoff' -Value '1' -PropertyType 'DWORD' –Force

#EOF

Enable Windows Photo Viewer within Windows 10, 2016, and 2019

Here is the Reg keys to enabled the Windows Photo Viewer that is still part of Windows 10, 2016, and 2019.

This is works well for 2019 Remote Desktop Host

https://gist.github.com/AndyUK24601/cc26266e7af84df3297d7d63271c18fc

Before doing this I would make sure that the following below location still exists as Microsoft may remove it later down the line

"C:\Program Files (x86)\Windows Photo Viewer"

You will also need to run the following too in cmd as admin

regsvr32 "C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll"

Side note,  running the REG does make it the default straight away

Remote Desktop Host firewall is filled with multiple firewall rules

Every time a user connects in to the RDH,  firewall rules are made for the users Windows Apps but never cleaned down.

This can have a few issues linked to it like Black screening on the host or the start menu not displaying but depending on the Windows version you mileage will vary.  In all case it can lead to slowing down of the system.

For Windows Server 2016 you will need to confirm the following update is installed KB4467684,  Server 2019 should already be able to do this but I would bring it in line with all updates to just be sure.

Make a GPO if you have more then 2 RDH and put this Key in place.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
DeleteUserAppContainersOnLogoff (DWORD)
Value: 1

No Microsoft document appears to back this up but it is listed in a few updates and talked about as a known issue under KB4467684

Using 3rd party antivirus on Windows server 2016 and 2019

If you using a 3rd party AV on Windows server 2016 or 2019 the Windows Defender Antivirus is locked in to active mode regardless of set up.

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility

The options are to use the registry key to switch it to passive mode

• Path: HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
• Name: ForceDefenderPassiveMode
• Type: REG_DWORD
• Value: 1

Or uninstall which can be done via PowerShell

• Uninstall-WindowsFeature -Name Windows-Defender
• Uninstall-WindowsFeature -Name Windows-Defender-GUI

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016#need-to-uninstall-microsoft-defender-antivirus