For some reason that has escaped me Path MTU Discovery in Windows just doesn’t seem to figure out the MTU for a given path (something to do with routers being poorly configured to not respond to ICMP requests). So Windows uses the default. For the most part this doesn’t affect anyone, however if it dos affect you, it really annoys you. Failure of PMTUD will result in some websites not loading correctly, having trouble connecting to normally reliable online services and general Internet weirdness.

The resolution is to set your default MTU to one lower than the Ethernet default of 1500. Here is how:

Step 1: Find your MTU
From an elevated CMD Shell enter the following command:

netsh interface ipv4 show subinterfaces

You should get something like this

MTU         MediaSenseState  Bytes In    Bytes Out  Interface
----------  ---------------  ---------   ---------  -------------
4294967295  1                0           13487914   Loopback Pseudo-Interface 1
1500        1                3734493902  282497358  Local Area Connection

If you are using Ethernet cable you will be looking for “Local Area Connection” or “Local Area Connection 2″ (if you happened to plug into the second network port). If you are using Wireless you will be looking for “Wireless Network Connection”. The MTU is in the first column.

Step 2: Find out what it should be

In the CMD shell type:

ping www.cantreachthissite.com -f -l 1472

The host name should be a site you can not reach, -f marks the packet as one that should not be fragmented the -l 1472 sets the size of the packet (1472 = Ethernet Default MTU – Packet Header, where the Ethernet Default MTU is 1500 and the Packet Header is 28 bytes)

If the packet can’t be sent because it would need to be fragmented you will get something similar to this:

Packet needs to be fragmented but DF set.

Keep trying lower packet sizes by 10 (i.e. -l 1460, 1450, 1440, etc.) until you get a successful ping request. Raise your packet sizes by one until you get a “Packet needs to be fragmented but DF set.”. The last successful value plus 28 will be your MTU value.

In my case a packet size of 1430 succeeds but 1431 fails, so 1430 + 28 = 1458.

Step 3: Set your MTU

Now you have identified the interface you need to change and the ideal MTU for you, now it is time to make the change. Again from an elevated CMD Shell type the following replacing my MTU of 1458 with your own value:

netsh interface ipv4 set subinterface "Local Area Connection" mtu=1458 store=persistent

Or if you are using a Wireless connection:

netsh interface ipv4 set subinterface "Wireless Network Connection" mtu=1458 store=persistent

If all has gone well you should have a perfectly working internet connection.

I am sure I am not alone in knowing least 5 commands that I use day in and day out to manage workstations or servers on the network. I thought I would take the time to share some of these with you now.

dirquota

Windows 2003 R2 Only

dirquota is part of Windows 2003 R2 File Server Resource Manager (“FSRM”) which I use to manage quotas on home areas and shared folders. dirquota is the command line mechanism for managing the quota portion of FSRM, with the number of users we have it is important that we can modify quotas quickly, something the FSRM Quota GUI is not good at.

There I two basic forms I use every day:

dirquota quota list /path:<path>

Simply enough this will create a report for the path including peak usage, current usage and quota limit along with dates and times useful when determining what to do with the quota. Usefully the verbs quota and list can be abbreviated to q and l respectively, which saves a bit of typing.

The second form is to modify quotas:

dirquota quota modify /path:<path> /limit:<limit>

The command does what is expected; modifies the quota on the path to the specific limit. Again the verbs quota and modify can be abbreviated to q and m, in addition the limit parameter can be expressed in units, f.ex, 50MB, 500MB, 1G, 20G.

robocopy

All Windows Platforms

Robocopy (or Robust Copy) is the Swiss Army Knife of file copy tools while it doesn’t have a GUI it is more than capable of doing taking on any copy job. Originally part of the Windows Server Resource Kit it is not a standard command in Windows Vista and Windows 2008 Server.

Typing “robocopy /?” at the command line might be slightly overwhelming however there is one boiler plate command that will do the job.

robocopy <source> <destination> /E /ZB /COPY:DAT /R:3 /W:10 /XJ /XF *.tmp ~$*.doc

<source> and <destination> can be local paths, mapped drives or UNC paths.

• /E – copies files and folders recursively including empty folders, if you want to exclude empty folders replace /E with /S.
• /ZB – copies files in restartable mode, if that fails due to an access denied error then use backup mode, this will require administrator access to work, use /Z if you are not running as an administrator.
• /COPY:DAT – copies only Data, Attributes and Timestamps useful when taking a copy to move to a new file system and re-apply permissions from scratch. Check the help pages for information about other options.
• /R:3 /W:10 – Retry three times, wait 10 seconds between tries. Important if you have an Anti-Virus product configured to scan on access as you may get System Error messages when trying to access these files.
• /XJ – Exclude Junction Points. Very important for Windows Vista as the user profile “Application Data” folder points to itself causing recursive and eventually failing copy operations.
• /XF <filespec> – Exclude Files. There is rarely any point in copying temporary.

wuauclt /detectnow

All Windows Platforms

wuauclt stands for Windows Update Automatic Update Client, yes it is a bit of a mouth full, /detectnow is a simple operation to kick off the Windows Update client to detect if updates are required rather than relying on the detection schedule.

dsquery, dsmove

The Active Directory Users and Computers (ADUC) Microsoft Management Console Add-on is sufficient for the majority of Active Directory operations. There are situations where it is useful to be able to script an operation, for example the mass moves of objects from one location to another.

I tend to use Microsoft Excel to to transform a text file report to a list of directory commands, most recently I moved all laptops that had not accessed the domain for the past six weeks to an “Lost Computers” OU. At which point I disabled the computer account through ADUC.

dsquery computer -name LTA3-44 | dsmove -newparent “ou=Lost Computers,dc=domain,dc=co,dc=uk”

icacls

Windows Vista, Windows 2003 SP2 and Windows 2008 Only

icacls is the long awaited replacement to cacls and xcacls providing command line access to modifying Windows NTFS Access Control Lists. icacls provides more flexibility that cacls and xcacls making it a essential skill to learn for manageing mass permission changes on disks with many different users.

icacls /grant DOMAIN\rslater:(OI)(CI)F /T

• /grant DOMAIN\username – grants the specified permission to this user, /deny is also an option however one to be careful of.
• OI)(CI) – not some strange smiley, but means Object Inherit, Container Inherit, applies only to directories and means files and folders within the folder will inherit permissions from the folder.
• /T – recurse directories.

Final Thought

Every Systems Administrator, Programmer, Hacker, Scripter and Helpdesk Operator must have at least 5 commands that make their life easier, if you have posted about these commands on your blog please do leave a link in the comments. Equally if you think of a command while reading this blog entry feel free to post it in the comments.