How to Fix ADSelfService Plus SSL Path Errors (GoDaddy P7B Guide)

If you manage ManageEngine ADSelfService Plus on Windows Server 2022 and rely on GoDaddy for your SSL certificates, you have likely run into the dreaded error:

"Unable to find a valid certificate path. Try uploading additional CA certificates."

This happens because the native ADSelfService interface only lets you upload a single certificate file. If you upload just your main domain certificate, the application lacks the root and intermediate links required to establish a secure chain of trust.

Thankfully, the solution is simple. You just need to package GoDaddy's Apache/CentOS download files into a single, comprehensive .p7b bundle using built-in Windows utilities. Here is the step-by-step breakdown.

Step 1: Prep the GoDaddy Files for Windows

When you download the Apache (CentOS) certificate archive from GoDaddy, you get a handful of files including your primary domain .crt, a -root.pem file, and an -intermediate.pem file. Windows needs to map these out before it can pack them together.

• Locate the -root.pem file. Right-click, select Rename, and change the extension from .pem to .crt.
• Double-click this newly renamed root file, click Install Certificate..., select Local Machine, and click through to finish the wizard.
• Locate the -intermediate.pem file, rename its extension to .crt, and repeat the same Local Machine installation step.

Step 2: Export the Combined .P7B Chain

Now that Windows recognizes the root and intermediate paths locally, it can cleanly bind the whole family history into a single file wrapper.

1. Double-click your primary domain certificate file (e.g., yourdomain-certificate.crt).
2. Navigate to the Details tab at the top of the interface and click Copy to File... to open the Certificate Export Wizard.
3. Click Next, then choose the option for Cryptographic Message Syntax Standard - PKCS #7 Certificates (.P7B).
4. CRITICAL: Make sure to check the box that reads "Include all certificates in the certification path if possible." (This is the exact toggle that eliminates the ManageEngine path error).
5. Click Next, click Browse, choose a destination folder (like your Desktop), and save it as adselfservice.p7b. Click Finish.

Step 3: Upload and Bind in ADSelfService Plus

With your new unified chain ready, you can now feed it directly to your server application.

• Log into the ADSelfService Plus portal with an admin account.
• Go to Admin > Product Settings > Connection.
• Click the Apply SSL Certificate tool button.
• Under the 'Apply Certificate' radio toggle, browse for the adselfservice.p7b file you exported in Step 2.
• Type in the original password you created when generating the Certificate Signing Request (CSR) on this machine, then click Apply.

Final Step: Bounce the Service

The system should accept the file immediately without throwing any path validation warnings. You will be prompted to restart the service to finish the installation.

Dell windows 11 activation: hardware license extraction & injection

Step 1: Get the Code

Right-click the Start Menu and open Terminal (Admin) or Command Prompt (Admin). Run this command:

wmic path softwarelicensingservice get OA3xOriginalProductKey

Step 2: Copy the Key

Highlight and copy the 25-character product key that appears on the screen (formatted as XXXXX-XXXXX-XXXXX-XXXXX-XXXXX).

Step 4: Activate

Go to Settings > System > Activation. Click Change product key, paste your extracted code, and hit Activate.

Deleting an AD User's Local Profile on Windows 11

Once the AD account is removed from Active Directory, clean up the local profile on the Windows 11 machine.

Method 1: System Properties (Quickest)

1. Press Win + R, type sysdm.cpl, press Enter.
2. Go to Advanced → User Profiles → Settings.
3. Select the domain user profile and click Delete.

Method 2: Command Line (If UI Fails)

1. Open Command Prompt as Administrator.
2. Delete local account reference:
   net user "Username" /delete
3. Delete profile folder:
   rd /s /q "C:\Users\Username"
4. Clean registry:
   Open regedit → go to
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
   Delete the SID matching the user.

Fixing Windows 11 Bloated capabilityaccessmanager.db-wall Files

If your Windows 11 storage is mysteriously vanishing, a glitching system file named capabilityaccessmanager.db-wall might be the culprit. This file handles app privacy permissions (like camera and microphone access). When a Windows update or an app gets stuck in a loop, this file can balloon to dozens of gigabytes.

Because it is a vital system process, Windows will block you from deleting or stopping it in Normal Mode, often leaving the service stuck in a permanent "Starting" phase.

Here is how to break the loop, take ownership, reclaim your disk space, and properly restore your system permissions so you don't lose Wi-Fi functionality.

Step 1: Boot into Safe Mode

Since the Capability Access Manager service (camspvc) is likely stuck in a zombie "Starting" state, Windows locks the file in Normal Mode. Safe Mode prevents the service from launching at all.

1. Hold the Shift key while clicking Restart in your Start Menu.
2. Go to Troubleshoot > Advanced options > Startup Settings > Restart.
3. Upon reboot, press 4 or F4 to enable Safe Mode.

Step 2: Open Command Prompt as Administrator

Once you are in Safe Mode, you need elevated privileges to override system file protections.

1. Click the Start menu, type cmd.
2. Right-click Command Prompt and select Run as administrator.

Step 3: Take Ownership and Delete the Bloated File

Windows protects this folder fiercely. You must explicitly grant your administrator account ownership to break the system lock and delete the file.

1. Run the following command to take ownership of the file (replace C:\Path\To\Folder with your actual path, usually under C:\ProgramData\Microsoft\Windows\CapabilityAccessManager):

   takeown /f "C:\Path\To\Folder\capabilityaccessmanager.db-wall" /a

2. Grant the Administrators group full control permissions over the file:

   icacls "C:\Path\To\Folder\capabilityaccessmanager.db-wall" /grant administrators:F

3. Force-delete the bloated file:

   del /f /q /a "C:\Path\To\Folder\capabilityaccessmanager.db-wall"

Step 4: CRITICAL - Reset Folder Permissions (Fixes Broken Wi-Fi)

Do not skip this step! Because the Capability Access Manager controls hardware permission checks, changing folder ownership breaks your Wi-Fi interface. You must restore the directory back to default Windows system control before rebooting.

If you try this in Normal Mode, you will get an "Access Denied" error due to active process locks. While still in Safe Mode, run the following command:

icacls "C:\ProgramData\Microsoft\Windows\CapabilityAccessManager" /reset /T /C

Step 5: Reboot Normally

Restart your computer back into Normal Mode.

Windows will automatically generate a brand-new, healthy, and tiny capabilityaccessmanager.db-wall file. Because permissions were reset correctly in Safe Mode, the service will start normally, your hardware handshake will succeed, and your Wi-Fi capabilities will remain completely functional!

How to Fix the "External Recipients Not Allowed" Error in Gmail Mail Merge

If you or your team frequently use Google Workspace's built-in mail merge paired with Google Sheets, you might occasionally run into a frustrating roadblock: the "External Recipients not allowed" error.

This happens because Google Workspace defaults to strict internal-only sharing rules to prevent data leaks. Fortunately, if you have Administrator privileges, you can fix this across your domain in under a minute.

The 3-Step Admin Fix

1. Navigate to User Settings: Log into your Google Admin Console and go to Apps > Google Workspace > Gmail > User settings.
2. Enable External Settings: Scroll down the page until you locate the Mail merge block.
3. Apply and Save: Check both the "Allow mail merge" box and the nested "Allow for external recipients" checkbox. Click Save at the bottom of your screen.

SYSTEM NOTE: Security policy updates inside Google Admin can take anywhere from a few minutes up to 24 hours to fully propagate globally across your organization's user accounts.

JAMF deployment user missing default dock

If you manage a fleet of Macs using Jamf Pro, you’ve likely run into this baffling enrollment glitch: A user completes Automated Device Enrollment (ADE), logs in for the first time, and looks down to find a completely barren Dock. No Safari, no Launchpad, no System Settings—just the Finder and the Trash icons.

Why Does This Happen?

This "stripped-down" Dock state happens because of a race condition during enrollment. When Jamf pushes a Dock payload before the macOS user template has fully initialized the desktop environment, the macOS Dock agent (com.apple.dock) panics. Unable to find application paths that are still installing in the background, macOS defaults to the absolute bare minimum configuration required to operate: Finder and Trash.

The Quick Fix: Reset the Dock Domain

You don't need to wipe or re-enroll the machine. If you are sitting at the affected Mac, you can bypass complex file paths by targeting the preference domain directly via the Terminal:

1. On the target Mac, open the Terminal application.
2. Type or paste the following exact command line:

defaults delete com.apple.dock; killall Dock

What this command does:

• defaults delete com.apple.dock: Targets the current user's cached preference domain and obliterates the broken layout data without throwing "file not found" errors.
• killall Dock: Forcefully restarts the Dock process. When it respawns, it pulls the fresh deployment layout dynamically assigned by your Jamf framework.

Preventing This Globally:

To stop this from happening to future enrollments, avoid using Jamf Policies triggered on "Enrollment Complete" to manage Dock items. Instead, deploy your Dock setup using an MDM Configuration Profile. Configuration profiles hook natively into Apple's management framework at a deeper level and are significantly less prone to timing bugs during first login.

Fix Core Isolation Turned off on Windows 11

 For instance old driver for WD (wdcsam64_prewin8.sys):

1. windows start type CMD and right-click on it to run as an administrator
2. type dism /online /get-drivers /format:table
3. Find wdcsam64_prewin8.sys and note the Publisher name.
4. enter this command with the publisher name:
   pnputil /delete-driver PUBLISHER.inf /uninstall /force.

More info:

How to Fix Wdcsam64_prewin8.sys Core Isolation Turned off – MiniTool

 

ADSelfService GINA Mac Uninstall

Posted on February 28, 2024 by vrpc

Uninstallation Steps:

Open Terminal

Open /Library/PrivilegedHelperTools/

Del ADSSPLoginAgent

Go to login screen and confirm the changes.

 

Mac OS X Login Agent Installation (manageengine.com)

For some reason Microsoft SQL express 2017 and 2019 requires TLS 1.0 during installation.

Here is the registry settings [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]:

The same is for Server and Client

Make sure to revert it back to DisableByDefault =1 and Enabled =0

MX-100 1:many NAT not working as expected

1:many NAT on MX-100 not usable for zoom connector or barracuda spam firewall

I have discovered that the 1:many meraki NAT implementation will always send outgoing traffic on the primary public IP instead of the IP assigned to the 1:many NAT rule.
 
I have spend hours on trying to find out why I am not able to use these two NAT services:
 

1. zoom meeting connector which should  be  possible to configured using 1:many NAT unfortunately not on meraki MX-100 device:
   https://support.zoom.us/hc/en-us/articles/204898919-Configure-Meeting-Connector-Controller-Port-Forwarding
   The solution to this is not to use 1:many NAT rule and use 1:1 NAT unfortunately this will require two public IPs or more if you add other zoom on-premise services.
    
2. barracuda spam firewall and exchange server.
   I decided to offload some traffic from the barracuda firewall for traffic which is not related to SPAM checking and use the build in 1:many NAT instead of 1:1 on the MX-100.
   This resulted in outbound email be send using the primary IP instead of the assigned 1:many NAT
   This will result in SPF verification to fail and outgoing email be rejected from outside servers.
   Had to revert back to 1:1 NAT and deal with occasional overload on barracuda firewall due to web traffic.
    
   cheers

Add mac computer to MDM server after initial setup

 This solution works currently on mac OSx Catalina 10.15.x.

If you need to add mac which didn't get added during first run to MDM server or was added to MDM server after the initial configuration and you want to add it without having to re-install operating system:

Open terminal and run this command:
sudo profiles renew -type enrollment