Office 365 and Exchange Migration Notes

This post is a collection of my recent Windows/Exchange administrative work.

Run AD Directory Sync Manually (New Version of Start-OnlineCoexistenceSync)



Import-Module ADSync
Start-ADSyncSyncCycle -PolicyType Delta


Start-ADSyncSyncCycle -PolicyType Initial

How do I check total mailbox sizes for Office 365/Exchange Online mailboxes?



# In PowerShell:
$LiveCred = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri -Credential $LiveCred -Authentication Basic -AllowRedirection 
Import-PSSession $Session

get-mailbox | get-mailboxstatistics | ft displayname, totalitemsize 

# When done:
Remove-PSSession $Session

Error during migration: MigrationPermanentException: Cannot find a recipient that has mailbox GUID ” error message when you try to move a mailbox in an Exchange hybrid deployment


  • Ensure the local user object doesn’t have an exchange GUID. From the local Exchange Management Shell:
    Get-RemoteMailbox <MailboxName> | Format-List ExchangeGUID
  • Get the GUID from the error message, or retrieve it from the O365/Exchange Online shell (connect as above):
    Get-Mailbox <MailboxName> | Format-List ExchangeGUID
  • Set the exchange GUID for the user from the local Exchange Management Shell:
    Set-RemoteMailbox <MailboxName> -ExchangeGUID <ExchangeGUID>
  • Force directory sync. Using the latest Azure AD Connect commands, on the server with the directory sync tool installed:
    Import-Module ADSync
    Start-ADSyncSyncCycle -PolicyType Delta
  • Monitor with “Azure AD Connect Synchronization Service Manager” GUI application if needed.


Error during migration:  MigrationPermanentException: Mailbox size 12.56 GB ‎(13,489,367,463 bytes)‎ exceeds target quota 2.3 GB ‎(2,469,396,480 bytes)‎.


  • If applicable to a single user, use ADSI Edit to set the “mDBUseDefaults” property to False on the applicable user object, then try again.
  • If database or organization-wide, use the Exchange Administrative Center to remove quotas for the database.

I have a migration batch that partially failed. Now I can’t get those mailboxes to migrate.


Scenario: A migration batch was partially successful (one or more mailboxes in the batch migrated properly). The errors for the remaining mailboxes have been corrected. I’d like to start a new migration batch containing the failed mailboxes, but the batch bombs out with an email to the Exchange Online administrator. The batch online looks like it’s still migrating, but the CSV with the results that was emailed contains the following error messages for each account:

The user "" is already included in migration batch "My Migration Batch Name."  Please remove the user from any other batch and try again.

In this case you need to remove user from migration batch using the Remove-MigrationUser cmdlet when connected to the Exchange Online PowerShell session:

  • Get the details of all users in migration batches, or get the details for the specific user being migrated:
  • Remove the user from the migration batch. Use the additional -Force parameter if you aren’t running interactively.
  • Clean up any migration batches that may still be in progress with the ‘already included’ error.
  • Create a new migration batch containing the affected mailboxes.

Fix: trying to overwrite ‘/usr/share/accounts/services/google-im.service’ installing kubuntu-desktop

I have an Ubuntu 16.04 desktop installation with Unity and wanted to try KDE, so I ran sudo apt-get install kubuntu-desktop. apt failed with the following message:

trying to overwrite '/usr/share/accounts/services/google-im.service', which is also in package account-plugin-google [...]

The original issue at Ask Ubuntu has several suggestions but none of them worked – any apt commands returned the same requirement to run apt-get -f install, which in turn gave the original “trying to overwrite” error message. synaptic also wasn’t installed so I couldn’t use it (or install it, as all other apt installation commands failed.)

I was able to get the dpkg database out of its bad state and continue to install kubuntu-desktop by running the following:

dpkg -P account-plugin-google unity-scope-gdrive
apt-get -f install

(Link to original Kubuntu bug for posterity:

This post was cross-posted to The Linux Experiment, where I haven’t written anything for months.

RiteBite and Invisalign, just over a year in

I’m just over a year in since starting Invisalign treatment with RiteBite Orthodontics – and here’s how things stand.

Positive Experience

I want to reiterate that I’m quite pleased with the experience I’ve had with Dr. Luis and RiteBite. Everyone at the Waterloo office has been friendly, professional and my appointments have always started on time. I feel like Invisalign was definitely a better option over braces. Even under the perpetually ticking clock of their Terminal Services-hosted dental software, everyone that’s put their hands in my mouth has done a great job.

Don’t you just love the graphics?

One of the best improvements RiteBite has made since I signed up has been the addition of the Case Graphics / Patient Records section to their patient portal. Despite its dated “win a 4th-gen iPod” banner on the landing page, it has X-rays and full sets of mouth and jaw pictures from every appointment where the digital camera comes out.

These photos are perhaps the most convincing tool they could use to convince customers that money spent on orthodontic/Invisalign treatment is worth it. The progress made after just eight months of trays was phenomenal. Teeth are shifting into their proper positions and I have much higher confidence in a successful result.

Social Media Milling, aka Poisoning the Well

RiteBite’s Internet presence/social media strategy is intended to attract new customers. They have a decent website and the usual Twitter / Facebook / Pinterest / Instagram accounts. Current patients are enrolled in the Patient Rewards Program, where 10 points = $1 in gift card value, redeemable with a minimum 100 points.

Straight out of 2001, the RiteBite Rewards Hub.

At a typical appointment (6-8 weeks apart) you might get 2 points for “brushing after signing in”, another 2 for “being on time”, and 3 for “wearing appliance as instructed”. The higher point values in this program are designed to encourage social media interaction – a YouTube video testimonial will get you 20 points, and 10 points goes to the author of a Google Maps review.

Given these values, it’s a bit of a grind to make it to your $10/100 point Tim Card.

Online review and social media activity for RiteBite is inevitably going to skew on the positive side, because there’s a reward for doing so. As a cynical tech worker, I’m also highly allergic to anything like a “selfie contest”. Occasionally I’ll get an email promoting one and I scowl before remembering that a large portion of RiteBite’s patients are teenagers with nothing better to do than hashtag.

Full disclosure: I was credited with a whopping 250 points for referring a friend to the practice shortly after I signed up, but I have yet to exchange them for anything.

Align Technologies Inc.

Be aware that Align Technologies, Inc. is also very heavily involved in managing their online presence and regularly comps “mommy bloggers” with treatment either for themselves or their kids. You can usually find these disclosures at the bottom of the page or post in question in FTC-compliant language. These posts exclusively skew positively for Invisalign over other types of treatment, and hammer home the main marketing points (can remove trays, easy to use, comparable in cost to braces, no metal mouth.)

They also appear to engage in patent-troll like behaviour, but I don’t currently have any solid opinion on the merits of their legal maneuvering.

Invisalign Drawbacks

I’d still pick Invisalign if I had to choose between it and conventional braces again, but consider the following:

  • For best results, trays have to be in for 20-22 hours per day, and you’re not supposed to drink anything other than water with the trays in. So it’s really only for meals that removing the trays is practical. I can’t just try a drink or have a bite of food – it becomes a whole ordeal to remove them, and then they’re supposed to be replaced as soon as possible. In what might be seen as a net positive for my health, I’ve switched to drinking soda water (rather than cola or coffee) during the work day because of this inconvenience.
  • Plastic in my mouth during the night sucks. I tend to drool overnight with the trays in, and even through a pillow protector I’ve ruined at least one pillow.
  • You still have to have attachments bonded to your teeth, which are initially rough on the inside of the mouth. The installation process is also unpleasant affixing as it requires your jaw to remain open in an odd position for several minutes for each attachment.
  • A surprise to me – and not really fully described at my initial appointment – is that my second set of trays required installation of a “button” (a metal protrusion cemented to a tooth) and use of an elastic. This also complicates insertion and removal. More complicated cases are likely to have more elastics and buttons.
  • It’s not completely painless. Switching to a new set of trays causes pressure and occasional tooth pain. I find popping two Advil is necessary on the first day of a new set, or otherwise I can’t concentrate at work.
  • Don’t lose or break your aligners; it’s a $150 replacement fee per set. I have heard that depending on where you are in your treatment process or cycle, you may be able to skip to the next set instead. With braces you have to be cautious about breaking brackets or loose wires, but with a set of trays it’s incredibly easy to leave them in a napkin at a restaurant or misplace the Invisalign case.

“4 Strikes and They’re Off!”

At RiteBite, apparently you can get kicked out of braces (or Invisalign) if you don’t have decent oral hygiene at four appointments. According to the initial contract I received, RiteBite also can “rat you out” to your dentist with a letter and won’t perform whatever orthodontic process was scheduled for the day.

Since I haven’t heard about this system since the initial package of paperwork, I think this is more of a way for parents to threaten their kids into compliance for orthodontic treatment – “if you get a 3 or less on this arbitrary grading system, you’re in trouble!” I suspect it’s not frequently employed to its full extent.

With this in mind, Invisalign itself does encourage better oral hygiene. You won’t want to put the aligners back on without cleaning your teeth well – a fragment of steak in between molars becomes very painful when compressed with plastic trays.

Aligner Use and Abuse: Beer, Whisky and Vodka

One of the really frequent questions online is “can I drink (beer) with Invisalign in?” I’ll refer you to “Another Invisalign Blog“, where the author has written specifically about Drinking Beer With Invisalign and Pros And Cons of Invisalign: Revised After 2+ Years of Wearing Aligners. Although the author’s recent posts have gone into the realm of what I’d consider unnecessary surgery, her writing was crucial for me in my early research.

I am sure that Dr. Luis would not approve of drinking anything other than water, but here’s my experience:

  • It is definitely possible to drink light-coloured beer with aligners in. In 2014 I tried this at Oktoberfest, matching each beer with a glass of water, and didn’t notice any discolouration afterwards. In contrast, for 2015’s festival of German-style debauchery I decided to remove them entirely for the evening.
  • Do not drink dark-coloured liquors with aligners in – it will absolutely stain the trays.
  • I will drink cider (Grower’s 1927 Premium Dry), vodka/soda or vodka/7Up with a set of trays still in, but am meticulous about removing, cleaning, and reinstalling them for the night and going to bed. The trays don’t seem to be any worse for wear as long as they are cleaned with a separate toothbrush dedicated to this task.

What’s Next

Since this post was initially drafted, I am presently waiting on a third set of trays, targeting completion in August 2016. The “button” remains on in between sets but the attachments get taken off.

I’ll follow up in a few months with progress on the next set.

Another “Let’s Encrypt” post for nginx

I’ve replaced the certificate on this site with one issued by Let’s Encrypt and plan to do so for all clients (or enable SSL in the first place) as their domains come up for renewal, or other maintenance work is contracted. The big downside is a 90 day expiry time, which requires a service nginx reload at least that often.

I had no end of issues using the official client as it wouldn’t create the .well-known/acme-challenge files necessary to get the domain to validate (yes, I checked directory permissions.) Instead, Vincent Composieux has some excellent instructions on just using the certonly parameter inside a script. Rundown, including my changes in case the article disappears:

  • clone letsencrypt repository to /opt/letsencrypt
  • create /usr/local/etc/
# We use a 4096 bit RSA key instead of 2048
rsa-key-size = 4096

email =
domains =,

authenticator = webroot

# This is the webroot directory of your domain in which
# letsencrypt will write a hash in /.well-known/acme-challenge directory.
webroot-path = /var/www/
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:50m;
ssl_dhparam /etc/ssl/dhparams.pem;

if ($myroot = false) {
        set $myroot $realpath_root;

location '/.well-known/acme-challenge' {
    root $myroot/;
    try_files $uri /$1;
  • For each site in /etc/nginx/sites-enabled, update the SSL definition to store the webroot in the $myroot variable, then have the root directive (and ssl.conf) reference it:
server {
        listen 443 ssl;
        # [...]
        set $myroot /var/www/;
        root $myroot;
        include global/ssl.conf;
        # [...]
  • Create the certificate: sudo /opt/letsencrypt/letsencrypt-auto certonly --config /usr/local/etc/
  • Add the certificate paths to each site in sites-enabled:
server {
        # [...]
        include global/ssl.conf;
        ssl_certificate /etc/letsencrypt/live/;
        ssl_certificate_key /etc/letsencrypt/live/;
        # [...]
  • To automatically renew certificates 30 days before expiry, checking each day: ln -snf /usr/local/bin/ /etc/cron.daily/

Some adjustments are obviously necessary for multiple sites but this got me past the point where site validation failed.

Invisalign on my own dime: orthodontics in Kitchener-Waterloo

I’ve been meaning to write about my experiences with Invisalign and the orthodontic consultation and treatment process since I started investigating various options in July 2014. On advice from my dentist Dr. Reddy and her staff at King Street Dental, I received several referrals to orthodontists in the KW area, and did my own research into reputation, pricing and treatment options.

Before getting into the orthodontic part of the piece, I would definitely recommend Dr. Reddy. In my experience, she handles both routine and emergency dental work to a very high standard.

Initially, Dr. Reddy suggested that she could extract one or more teeth to correct crowding in my lower jaw, but also indicated that I should look at orthodontic treatment as an alternative.


I received evaluations from three orthodontic practices in the Kitchener/Waterloo area:

TL;DR: Out of these three options, I opted for Invisalign treatment with RiteBite in August 2014 and began wearing the aligner trays in October 2014. As of October 2015 I am on a second box of trays, but from everything I’ve heard, I am on target to finish within 24 months.

My main concerns with orthodontic work were the following:

  • What is the cost? Despite the fact that I have health coverage through my employer, orthodontic coverage is generally limited to dependents under 19 years of age, so I’m on the hook for the whole bill. This is a common theme with corporate health benefits – even if you have 100% dental, orthodontic work is generally provided for your kids only.
  • Is it going to be a gigantic pain in the ass? I have heard horror stories of people breaking brackets and popping wires, unable to eat anything but soup after getting braces tightened, and having to use crappy plastic mouthguards or slimy retainers for the rest of their natural life. I also didn’t want things to drag on for months or years past the quoted timeframe.

I received significantly different options and opinions from each practice, so I’d highly recommend getting multiple evaluations performed. Payments are typically 0% financing with monthly installments over the expected course of the treatment, plus an upfront deposit. (You get a 2% to 5% discount at these practices for a lump sum payment, which I didn’t find to be worth it.)


I first went to Nicolucci Orthodontics, based on the initial recommendation by Dr. Reddy. I’ll note that my experience may have been negatively biased by the fact that it was my first consultation, and I wasn’t quite ready to make a decision on braces vs. tooth yanking.

Dr. Mai performed an initial evaluation, and the results complicated the situation. Before they would perform any orthodontic work, they’d want one lower tooth extracted. She and her assistant also indicated that I would likely require gum grafts, and that they wouldn’t begin treatment until my gum health improved. Treatment time was 24 to 30 months and the only option available was traditional braces.

Pricing was the least expensive (not by much) of the three practices at $5500. After reviewing the documentation in preparation for this post, on top of that was a “diagnostic records fee” of $300. The initial deposit requested was $2200 (so really $2500), then $3300 spread out over 24 months.

Even though I knew my oral health wasn’t especially great, I didn’t think it was bad enough to warrant a hard stop. The experience was really discouraging. I wasn’t impressed that tooth extraction and additional procedures were going to be needed on top of braces.


After the initial experience at Nicolucci, I wanted to price compare and see if there were other options available. TriCity was one of two additional referrals from Dr. Reddy’s office.

When I initially called to schedule the consultation, the receptionist indicated that there would be a $50 initial examination fee (which wasn’t listed on their website or referral card.) I balked a bit, and they were willing to waive the fee because “my dentist hadn’t mentioned it.” This was the only practice I went to that wanted to charge for the evaluation.

I was very impressed with Dr. Phan. He addressed all my questions, explained everything in a satisfactory fashion, and was upfront about timeline (24 months) and expected results. He and his assistant had no issues with my oral health and was willing to begin treatment immediately, using clear braces for the upper teeth and conventional metal brackets for the lower ones. He indicated this would give a better result in fixing the bottom crowding.

More critically, Dr. Phan did not want to extract any teeth, and suggested that if I did go ahead with any extraction operations, it could put me into a situation where I’d need up to four upper and lower teeth removed in order to get the results he wanted. His recommendation was to complete my other evaluations and then make a decision, but not to have any teeth pulled in the meantime.

Cost was the highest of the three options, at $6300. I don’t have a precise payment plan breakdown available but it also involved an upfront deposit followed by 24 months of equal payments.

Dr. Phan and TriCity ended up being a really close #2 in my evaluation – only beaten out by the later option of Invisalign with RiteBite.


My last stop was at RiteBite, which is Dr. Luis’ practice. They have three locations: Waterloo, Cambridge and Listowel. I’ve only ever been to the Waterloo location but apparently you can book appointments and receive treatment at any one of the offices.

Going into the office was a stark contrast to the other practices I had visited. All the chairs in the lobby were occupied by children and their parents, and this has been consistent at nearly every appointment I’ve been to since. It’s a bit of a zoo compared to the other options – TriCity was completely serene and had a very upscale waiting room, and Nicolucci had much more of a high-end surgical practice feel.

I was seen promptly, though, and one of the treatment coordinators took digital photos of various angles of my face and teeth, rather than having the orthodontist examine my mouth directly. I thought this was a novel and sensible approach. After a bit of evaluation of the pictures, Dr. Luis came in for a short discussion. The takeaway was his claim that “whatever I can do with braces, I can do with Invisalign” and that he also recommended against any tooth extraction prior to orthodontic work. Timeframe was quoted at 24 months as well.

Initially I wasn’t as comfortable with Dr. Luis as I was with Dr. Phan. Dr. Luis has an Bluetooth earpiece perpetually attached, and he seems in quite a hurry to get from patient to patient. The treatment room in the Waterloo office is an assembly line –  there are PCs at each station precisely timing the length of the visit based on the treatment plan for that appointment.

During later sessions, despite him clearly being torn in many directions, Dr. Luis has been quite friendly and given me his full attention when I posed questions. I also have to compliment the treatment staff: they are clearly on a tight schedule but are professional and perform tasks the right way, not just the fast way.

Pricing was the middle option – $5880 total (equal cost, regardless of braces or Invisalign choice), and the financial coordinator was easy to work with. My initial deposit could have been as low as $500, with the remainder of the balance spread out into payments over 24 months. They were also willing to charge my credit card on a recurring monthly basis for the instalments.

After a few email followups with my treatment coordinator and some research about Invisalign versus conventional braces, I ended up signing the treatment forms and going with Dr. Luis and RiteBite for this work.

What’s next?

A subsequent post will provide further details on Invisalign and RiteBite, having spent a year living with the trays and treatment. As a preview, though, I definitely recommend RiteBite/Dr. Luis and Invisalign as an orthodontic treatment option if it’s available.

Review: Roam Mobility in Las Vegas with a Nexus 5

I recently returned from a five day trip to Las Vegas, to once again play the low-limit blackjack at Hooters Casino Hotel, enjoy the complimentary drinks and see a few shows. I’ve done this before with friends, but the first major change is that this is the first year I’ve had cell coverage in the US thanks to Roam Mobility. I’d used them on a conference trip to San Francisco earlier this year and it was quite handy.

The general principle is that you pay $4/day for unlimited talk/text (including voice/SMS back to Canadian numbers), and also get a 300MB allotment of 4G/LTE data per day of the plan. Thus, if you buy three days you get 900MB to use at any time during the total plan. If you go through the allotment, it degrades to “unlimited” data at EDGE/128kbps speeds.

To get started, you have to buy a Roam SIM card ($20; comes in regular+micro combo pack or nano form factor) plus a $2 “LTE upgrade” fee as a one-time purchase. The SIM stays active for up to 365 days between plan purchases, so it’s worthwhile if you plan to use the service in the States at least once a year or can loan the SIM to someone who will use it. You also need an unlocked phone, and preferably one that supports the 1700MHz and 2100MHz bands used by T-Mobile US (Roam acts as a MVNO on T-Mobile service.)

I wasn’t entirely satisfied with how Roam Mobility worked with my Nexus 5 device during the trip. Some of the issues I encountered are specific to the Android device and some seem to be network/service related on Roam/T-Mobile US’ part. Here are a few caveats to consider.

Scheduling: Plan Early

Roam’s website lets you schedule plans in advance to start at a specific 15 minute time. I had scheduled a plan to start at 10:30PM Pacific in preparation for our flight landing shortly before that, and had switched my APN to ‘roam’ prior. When we landed, I was unable to get voice, data or SMS service in Terminal 3 despite having “five bars” of coverage. While power cycling the phone, I received SMSes advising that I had fewer than 30 voice minutes remaining. There was also a stuck voicemail indicator that simply redirected me to the Roam customer service line (which is closed at that time of night.)

Example messages I received while waiting for the Roam Mobility plan to activate. The phone is now set in Eastern time, so subtract three hours.
Example messages I received while waiting for the Roam Mobility plan to activate. In this screenshot the phone is set to Eastern time, so subtract three hours.


Service did not activate until 11:08PM, after we’d reached the hotel. I received another SMS from the 7850 shortcode advising that the 4-day plan was now active with 1200MB of data. Two friends of mine who were using Roam as well had no such difficulties – they had bought their plans briefly before boarding the plan and started service immediately. Their service became active on first power-up in the airplane while waiting to arrive at the gate in Vegas. So in short, if you want your Roam plan to be active right as you land, be generous with the start time.

From perusing the Roam support site after the fact, if you run into a similar problem, you may want to try messaging ‘start’ to *7850 to see if this kicks off the account provisioning process right away. I suspect this is what customer service would have told me to try if I called within business hours, but there wasn’t an easy way to get this information. I’d suggest that Roam add this trick as an message to their IVR in the ‘activate service’ option.

LTE Intermittent on Nexus 5

The coverage near the hotel and on the south end of the Strip (specific locations I checked included MGM Grand, Excalibur, and as far up as Bellagio) was very good, consistently displaying 4 to 5 bars of LTE. It also received and delivered Hangouts and BBM messages promptly. Coverage was also good near the north end by the Neon Museum and the Fremont Street Experience area.

However, when we headed slightly off-Strip, further down E. Tropicana to the Pinball Hall of Fame, my phone lost connectivity with no data symbol near the network indicator. The workaround was to back the network type down to 3G/HSPA. On the Nexus 5 this option is under Settings > (Wireless & Networks) > More… > Mobile networks > Preferred network type. Immediately after I forced 3G coverage, data began flowing again.

My travelling companions also didn’t suffer this issue: one was using an unlocked iPhone 5S and didn’t do anything special with his network settings throughout the trip, and the other had a Nexus 4 without LTE capabilities. For me, this problem took the advantage away from the $2 LTE upgrade to the SIM. I had to keep the phone in 3G only mode for the rest of the trip to ensure I could get coverage everywhere.

No Mobile Hotspot on Nexus 5

Due to some apparent shenanigans with Android 4.4, the phone tries to use a different APN when in tethering/mobile hotspot mode. This is documented on the Roam Mobility site as an issue specific to the Nexus 5, but I believe it could affect all stock Android devices. A fix is promised but the issue has definitely not yet been resolved in September 2014. Hooters has (slightly pokey) WiFi in room for hotel guests, and that was good enough to get my laptop online for flight check-in and researching shows.

As a note, though, it’s not just Android devices with an APN issue; once again the support site advises that iOS devices may need to get a custom configuration for hotspot use, and that BlackBerry 10 users could also encounter issues getting mobile hotspot capabilities to work.


Overall, compared to the data roaming gouge-fest from the usual Canadian carriers, Roam can’t be beat despite the issues I ran into. Next time, I’ll look at bringing a different or secondary phone to compare network and activation behaviours.

For a longer trip, I’d also consider a prepaid T-Mobile SIM ($10 SIM plus $30/month, 5GB LTE data.) The main issue with a T-Mo US SIM is that you’ll have to have it shipped to your destination or get one at a convenience store or dealer in the States, whereas Roam has retail presence at a variety of stores in Canada or will ship you a SIM for free.

If you’re currently with WIND Mobile, they have a $15/month US roaming option that can be purchased for 30 days and then removed from your account, which makes it a less expensive option than even buying the Roam SIM the first time. It also uses T-Mobile US towers so coverage should be the same.

Update, 2014-10-15: Looks like the Roam support team on Twitter is advising use of the ‘wholesale’ APN now rather than ‘roam’ to resolve issues with data connectivity. Something to try out if you ran into similar issues. I expect I’ll be using Roam early next year again and will report back.

WordPress file permissions and upgrades with

(Post updated 2015-05-07 with the results of some helpful feedback from mbrowne. Comments, GitHub issues and pull requests are always welcome!)

I maintain a Github repository of small useful scripts (at least to me) and occasionally get comments or email about them. I received an email yesterday asking about WordPress file permissions when applied with, which is a simple Python wrapper around a few common filesystem operations. I’d initially written about it a few years ago as a utility to allow sites to auto-update.

Since was written, it appears that there have been some changes in the way that WordPress performs upgrades. I’ll excerpt the issue from the original email:

I have recently ran your script on our wordpress website to fix permission issue.

But we are getting below error while we try to upgrade wordpress from admin panel.


“This is usually due to inconsistent file permissions.: wp-admin/includes/update-core.php”


When i look the permission I could see update-core.php file have only read permission for webserver user “www-data”. Is your script designed to set 644 for files in this folder ?

-rw-r--r-- 1 username www-data  47326 Aug  1 06:09 update-core.php


I took it upon myself to read some of the WordPress code that performs core updates, as well as some of the documentation. To answer the original question, does set 644 permissions on all WordPress files in the directory tree, then goes through the wp-content directory and adds group write permissions only where necessary.

The auto-update documentation at states:

When you tell WordPress to perform an automatic update, all file operations are performed as the user that owns the files, not as the web server’s user. All files are set to 0644 and all directories are set to 0755, and writable by only the user and readable by everyone else, including the web server.

Unfortunately this doesn’t seem to match with the behavior in the code – when a direct FS_METHOD is used for manipulating files rather than through FTP or SSH, operations get performed as the web server user (www-data). Therefore, the 644 permissions on wp-admin are too restrictive to allow core upgrades.

There are a few solutions to this problem:

  • If you do not accept the risks of having the webserver (www-data) user having write access to your WordPress contents, use the wp-cli ( core update command running as the user that owns the WordPress files. This is my preferred method and it can be scripted to batch update sites.
  • If you completely control the webserver and can be assured that nobody will upload a potentially malicious plugin or execute code that traverses the filesystem, set the permissions to 664 for all files (not directories) under wp-admin and wp-includes directories and have the group set to www-data:

    • find $WORDPRESS_DIR/wp-admin -type f -exec chmod 664 {} \;
      find $WORDPRESS_DIR/wp-includes -type f -exec chmod 664 {} \;
      chgrp -R www-data $WORDPRESS_DIR/wp-{admin,includes}
    • I would not recommend this in a shared hosting environment. When you upgrade, the more permissive group write flag will be preserved on these files (see the WP_Filesystem function in wp-admin/includes/file.php for details on how FS_CHMOD_DIR and FS_CHMOD_FILE are set.)
  • If you have FTP or SSH access to the server, and want to upgrade using this technique, remove the define('FS_METHOD', 'direct'); line from wp-config.php. This ensures that file delete, write and move operations are performed as the FTP/SSH user.

I will be adding parameters to shortly to address the last two points, and allow users to either set more permissive permissions on wp-admin/wp-includes directories or remove the FS_METHOD define.

Fixing SYSVOL DFS replication on Server 2012

Huge thanks to Matt Hopton at “How Do I Computer?” for this informative article on fixing DFS replication issues with the SYSVOL directory. In my case, symptoms were similar – AD group policies weren’t being successfully updated at a remote site with its own read-only domain controller. This was present in gpresult /h output.html, where scripts that had recently been added at logon to the main office DC earlier in the day were not able to be found on the branch domain controller.

Some additional notes:

  • Look in Event Viewer under Applications and Services Logs > DFS Replication for a warning with ID 2213, which provides the wmic command needed to resume replication
  • If the DC has been out of sync too long, there will be an Error with ID 4012; use:wmic.exe /namespace:\\root\microsoftdfs path DfsrMachineConfig set MaxOfflineTimeInDays=65and replace 65 with a number that is above the “server has been disconnected from other partners” value. Then, rerun the wmic command from the first event. Give it a few minutes and be patient and if all goes well, another event will pop into the log indicating successful initialization of the SYSVOL folder.

Restoring Windows on a Lenovo X230 with WIM/SWM files

After a bit of house tidying over the past few days, I managed to locate the power adapter for my Lenovo X230 laptop. Upon booting it up I realized that it had accumulated a number of outdated applications and crufty configurations, so I wanted to restore it to factory settings. Ordinarily I would immediately image with a stock Windows ISO, but since I’d paid for a Win7 Pro license, and wanted all the Lenovo applications restored (volume/brightness OSD, battery monitor in taskbar) I specifically wanted to restore to the OEM version and then remove the trialware.

The first problem that I ran into was that since Linux has been on this machine, and I’ve swapped the internal HDD to an Intel SSD, the partition table and MBR weren’t exactly in original. As a result, the common technique of pressing the ThinkVantage button at startup (or Enter, when prompted) and choosing to restore the system (or pressing F11) wasn’t going to work; the option is simply not present. To be clear, I still had three partitions in place: primary partition 1, a 1499MB “SYSTEM_DRV”; primary partition 2, a ~208GB “Windows7_OS” partition mapped to C:\, and primary partition 3, a 13.67GB “Lenovo_Recovery” partition mapped to Q:\. The SYSTEM_DRV and Lenovo_Recovery partitions all still had their files intact.

My first attempt was to hit F8 at boot, just prior to the Windows logo appearing, and select the “Repair your computer” option. From the WinPE-style GUI, I selected the bottom option called Lenovo System Recovery from the usual list of repair options (Startup Repair, Command Prompt, System Restore, etc.) This unceremoniously bombed out with a “Recovery failed” message and the wizard would not proceed. The Internet was generally pretty useless on this point, although various guesswork posts suggested that if you didn’t have a pristine OEM partition table the process would fail.

The next option was to try and create a set of recovery disks from Windows. Of course, the X230 doesn’t actually have a DVD-RW drive, so I figured I’d have to trick it into writing to USB somehow. Running the “Create Recovery Media” application (or Q:\LenovoQDrive.exe) I was thwarted by some quasi-DRM mechanism that insisted that I’d already created a set of media and to go away. Who knows, I may have managed to get it to create disks to an external DVD writer when I first bought the machine. As a side note, you’ll want to enable viewing of hidden and system files to more easily work with the Q drive and review its contents.

The Internet was much more forthcoming on bypassing this ludicrously stupid mechanism with StackOverflow to the rescue, and apparently there’s two very similar ways to restore recovery disk creation, depending on your laptop:

  • The utility uses an NTFS alternate file stream in Q:\FactoryRecovery\Recovery.ini:DONE, set to 0 and a newline when the media set hasn’t been created and 1 and a newline when in “no recovery set for you” mode. The fix:
    echo 0 > Q:\FactoryRecovery\RECOVERY.INI:Done
  • If this doesn’t work, edit Q:\FactoryRecovery\service_done.ini, and set DONE=0.

Unfortunately this entire process was fruitless, because even when I was able to get the recovery application to start and agree to begin creating disks, I was beset by this lovely error:



The next thing I tried was to install a newer version of Lenovo Rescue and Recovery (4.52), which also failed during the second phase of the installer with a return code 6 error message. Once again, this seemed to be related to my partition and bootloader monkeying.

At this point I’d had enough time to inspect the contents of the Q drive, and determined that there were several key files that would recover the system partitions:

  • Q:\factoryrecovery\cdrivebackup.swm through to Q:\factoryrecovery\cdrivebackup6.swm – a multipart WIM file with the original contents of the C:\ partition
  • Q:\factoryrecovery\sdrivebackup.wim – a single part WIM file with the original contents of the S:\ partition

There are a number of tools that will read WIM and SWM files, but the most popular referenced one is imagex.exe, part of the Windows Automated Installation Kit. It’s since been replaced by DISM for Windows 8, but I managed to get things restored with imagex. In case you don’t want to download the entire 1.7GB WAIK archive, here is the 64-bit version of imagex that worked for me.

I followed approximately the same steps from this Lenovo forum post with some minor changes:

  • I created a Windows 7 Pro SP1 installation USB stick from ISO and imaged it to a USB drive with the Windows 7 USB/DVD Download tool. If you need a Windows 7 ISO, I suggest looking for Digital River links and verifying the hashes against the original versions. This isn’t piracy – these ISOs still need a product key but we won’t even get that far, since we’ll be restoring the Lenovo copy of Windows.
  • Copy the imagex.exe file to the root of the USB stick.
  • Boot to the Win7 USB stick in BIOS, then choose the Command Prompt option. Determine where all your drives are mapped and replace drive letters in the commands below to reference the appropriate drive. For me, the mapping showed up as:
    • C:\ – 1499MB SYSTEM_DRV partition
    • D:\ – 208GB Windows7_OS partition
    • E:\ – 13.67GB Lenovo_Recovery partition
    • F:\ – USB stick containing Windows 7 ISO contents and imagex.exe
    • X:\ – memory-mapped Windows PE contents
  • Run the diskpart commands from the original post from phil5 with the following changes, replicated here for posterity. Lines beginning with # are comments for readability, don’t type them:
    list disk
    # This shows a list of drives attached to your system. In my case I had two disks, disk 0 (solid state drive) and disk 1 (USB stick that I booted Windows from.)
    select disk 0
    list partition
    # Determine the correct partitions for SYSTEM_DRV, Windows7_OS and Lenovo_Recovery. The following operations will be destructive so make sure you have the correct partitions selected!
    # Deleting SYSTEM_DRV (S:\)
    select partition 1
    delete partition
    # Deleting Windows7_OS (C:\)
    select partition 2
    delete partition
    # My original partition 1 was 1499MB, not 1199MB as indicated in the original post; command has been adjusted
    create partition primary size=1499
    select partition 1
    format fs=ntfs label="SYSTEM_DRV" quick
    assign letter=s
    create partition primary
    select partition 2
    format fs=ntfs label="Windows7_OS" quick
    assign letter=c
  • Recover the system with WIM/SWM files from the Lenovo_Recovery partition on Q:\ – the C drive is a multipart SWM archive and requires the /ref switch:
    F:\imagex.exe /apply /verify Q:\factoryrecovery\Sdrivebackup.wim 1 S:\
    F:\imagex.exe /apply /verify /ref Q:\factoryrecovery\Cdrivebackup*.swm Q:\factoryrecovery\Cdrivebackup.swm 1 C:\
  • Once complete, run the X:\bootrec.exe /fixmbr and X:\bootrec.exe /fixboot commands. Choose the Reboot option in the GUI, and again boot to the Windows 7 USB media. When entering, I was prompted to repair my boot process and restart – this was successful in bringing Windows back to a “Preparing to start your computer for the first time” splash screen and restoring the normal boot order.

After this process, you can run through the usual mechanisms of removing the Norton Internet Security trial and clicking OK to hilariously-worded dialog boxes like:


Congratulations! I would suggest that you perform the following action to make your life easier in future, since I still wasn’t able to successfully create a set of official recovery media after this was all done.

Get a 16GB or larger USB stick – 32GB would be ideal. Image it with a Windows 7 Pro SP1 ISO via the USB/DVD creator tool, then copy the Q:\factoryrecovery folder and imagex.exe to it. That way you have an all-in-one restore mechanism for your ThinkPad that can be run even if the Q:\ partition is removed in a horrible accident.

For now I’m just happy to have the system running again, even if I have 769.1MB of updates pending to download and install.

Better Mario Kart 8 connectivity using pfSense

(Update 2015-09-20: Several readers have also reported that the instructions in this post to set the Static Port flag for the WiiU’s outbound NAT also seems to help with Splatoon connectivity issues. Following this logic, this change may work for any WiiU game that shows similar problems.)

One of the more entertaining games I’ve played recently has been Mario Kart 8. Even though I’m not very good, it’s great with friends, despite what seems like Nintendo’s complete aversion to online gaming.

Since I’m used to the better mechanism of party chat on Xbox Live, typically I run Skype on a laptop throughout the session to the group of friends I’m playing with. The MacBook Pro built-in mic/speaker combination does decent enough noise cancellation, which means that multiple players in the same physical room can both spew profanity and have profanity spewn right back.

However, the configuration needed to get online play functioning properly (and staying working) is not exactly straightforward or even correct on most places on the Internet. Most troubleshooting steps, including those from Nintendo for connection error 118-0516, eventually advise that you place the WiiU console in a DMZ. I find this to be unacceptable, because:

  • (Update July 24/14: pfSense does have an option similar to a traditional DMZ, called 1:1 NAT and found under the Firewall / NAT / 1:1 configuration page. I still wouldn’t recommend it though, given that you may want to keep route certain ports to different services. Original content follows in struck out text.) pfSense doesn’t have a DMZ in the traditionally easily-configurable “send all inbound packets on any port to this NAT’d device” sense. There are ways to configure a DMZ in the more traditional network admin sense (eg: a separate network for Web servers) but there’s not an “easy button” equivalent to the Linksys/Netgear/D-Link version.
  • It might be a bit neckbeardy, but I don’t like giving full inbound access from the Internet to a device behind my firewall, despite the fact that it’s running a more restrictive OS and network stack.
  • Just ‘forwarding all ports’ to the WiiU interferes with other servers that I like to run on the same network connection. Lists of ports online elsewhere advise forwarding all UDP and a whack of (incorrect) TCP ports, but if I want to run Skype I don’t want to blindly send everything to the console.

The real key to getting past connection error 118-0516 with pfSense is to enable static port NAT for the WiiU. This setting also applies to other devices that use the Nintendo Network, such as the 3DS for Animal Crossing. Ensure you have performed basic network troubleshooting before reading further: these steps WILL NOT help if you have WiFi with packet loss or poor Internet connectivity in general.

(Seriously, don’t assume your WiFi is great because it works well for Internet browsing. Get numbers with ping and traceroute over an extended period of time, and correct the problem if it’s related to air quality or a flakey router.)

(Scroll down further if you just want to know how to change this setting.)

Rationale behind Static Port = No

Static Port is described briefly in the pfSense documentation as a security feature to avoid someone determining the device or OS behind your firewall, and is turned on by default.

The entire process works like this: when a LAN device attempts to create an outbound connection, there is both a source and destination port associated with that request. So your computer might request a website on destination port 80, but that request is “coming from”, or “sourced” from a port above 1024 picked by your operating system – something like 57894. You can see these ports by running netstat -n from your computer’s command prompt or terminal, and noting how local addresses with high ports have established connections to foreign addresses with standard ports like 443 and 80.

pfSense, thinking it’s doing us a favour, sees that outbound request and picks a “more random” source port on the WAN side to avoid exposing the internal source port. It keeps track of the LAN source port to WAN source port mapping in a state table. An more detailed example of this transaction might be:

Computer at wants to get a website at (port 80).
The OS on starts a request from port 57894: >

pfSense has to keep track of this request and send it out of the WAN connection. 
It picks a new random port (eg: 32564) when it gets to the Internet connection. > >

pfSense now knows the state:
port 57894 internal == port 32564 external

Then when the request comes back from, pfSense reverses the mapping: has a source port of 80 and sends data back to port 32564: > > (pfSense state) >

To avoid going much further into this, WiiU and other Nintendo Network devices don’t like how pfSense does the source port translation, and as a result you will see connection errors when trying to establish a session with other players.

Set a Static IP or Static DHCP Lease

Since we will be configuring firewall rules for a single, specific device and don’t want another device to accidentally take over this IP, the WiiU should have a static IP set, or a static DHCP lease assigned in pfSense. To set a static DHCP lease, access Status > DHCP Leases and locate the WiiU console in the list. Click the ( + ) button next to the device and provide an IP address outside of the usual range – for example, if I had a DHCP range of to, I might make the WiiU IP address It may be useful to note in the description that this static lease is for the WiiU console.

Save the configuration and restart the DHCP server when pfSense prompts, then power cycle the WiiU.

Changing the Static Port Setting

From the top menu, access the Firewall > NAT option, then select the Outbound tab. The first two options are:

  • Automatic outbound NAT rule generation (IPsec passthrough included) – the default
  • Manual Outbound NAT rule generation (AON – Advanced Outbound NAT)

You will need to change this mode to “Manual Outbound NAT rule generation”, if not already present, and save. Once saved, some rules should be automatically generated for LAN to WAN traffic as well as ‘localhost to WAN’.

Leave these rules alone and add a new rule by using the ( + ) button at the top of the list. Set the following properties:

Do not NAT: unchecked
Interface: WAN
Protocol: any

  • Type: Network
  • Address: The address of the WiiU (eg:, with a “/32” in the dropdown box
  • Source port: (leave blank)


  • Type: any
  • Address: (leave blank, should be disabled)
  • Destination port: (leave blank)


  • Address: interface address
  • Port: (leave blank)
  • Static port: check this box

No XMLRPC Sync: Unchecked, only useful in a multiple pfSense environment
Description: I provided “WiiU AON, static port

Advanced Outbound NAT for WiiU

When complete, ensure the rule is at the top of the list, then click Apply Changes. Your screen should look like the following image (although not necessarily including the OpenVPN rule):

pfSense AON List

After this, exit and re-enter Mario Kart 8 or your other Nintendo Network software. You should be able to join games and participate in online multiplayer sessions.

Wait, it’s still not working!

Still having troubles getting into games, or having other people join yours? You may need to perform some port forwarding operations. While there are suggestions to forward a number of TCP and UDP ports, I’ve run a packet capture during several multiplayer sessions with the following notes:

  • No TCP traffic was initiated or received by the WiiU across >30 minutes of successful Mario Kart 8 game sessions. This means that any port forwarding techniques involving TCP are placebos at best.
  • The WiiU does not attempt to establish a UPnP or NAT-PMP session on the router.
  • UDP ports are selected somewhat randomly from the list of non-privileged ports (>1024). In the sample session, the lowest port I saw was 9103 and the highest port was 61320.

Given these details, you could forward UDP ports 1025-65535 to the WiiU IP address in Firewall > NAT > Port Forward, but I would suggest limiting this range even further to UDP 49152-65535 (the dynamic ports as specified by IANA). An example screenshot with this configuration is provided for your convenience.

WiiU Port Forwarding

What’s next?

I intend to continue to run packet captures during Mario Kart 8 sessions with this configuration to collect more data, as well as review the pfSense firewall logs during any disconnections to see if any traffic is being explicitly blocked. I didn’t capture entire content, but to replicate the packet capture:

  • Enable SSH on the pfSense box
  • SSH in as root, and select option 8 (Shell) from the menu
  • tcpdump -i em1 -w /tmp/wiiu.pcap ‘src or dst’  – where em1 is your LAN interface, and is the IP address of the WiiU
  • Start game session, Ctrl+C once complete and SCP the .pcap to a different machine for analysis with Wireshark or other tools