netsh save the day

During the weekend I was working with my development team on a new Oracle based app installation.
The part that interested me was a problem they had getting connections work with our remote backup location. This location has a 2nd Oracle server which we sync to the main production machine in our NY office.
The problem seem to be DNS related and not being able to resolve names from that machine we got stuck with the installation. The fact that it was a weekend installation made our frustration even deeper...

I had to find a way to use different DNS settings per interface, an easy task to do via windows explorer BUT I had to get the application to switch settings per request, only when required.
The requirement: The server should use the default domain DNS settings at all time and change it only while processing this one task (and then switch back).
The affected interface is my NIC2Oracle gigabyte card.
Obviously you can't do it manually out of the test\install environment.
I had to find a way to automate it and this is where netsh came to the rescue.
Using the following command you can set the DNS using cmd:

netsh interface ip set dns "NIC2Oracle" static xx.xx.xx.xx

The problem is that this command is still short because it doesn't set a primary and secondary DNS servers.
To achieve this you have to know that if you want to set a primary and secondary DNS address, add index=1 and index=2 respectively to the lines of netsh command.
Adding index=1 and index=2 at the end of the command above will set it as primary or secondary and allow the change I need using a simple batch. When the specific process is done, another batch with the reverse order can switch it back.
How simple...

Lotus Notes Expired ID file

Security is the reason Domino Server require all ID files to recertify once every 2 years (that is the default, can be changed manually).
When the expiration date get close Domino is kind enough to notify the user and there is your problem...
Typically there are 3 groups of users:
Some users will actually read the message that ask them to forward it to an administrator (a one click action).
Most of them will call you and ask why they received the message.
The problem is with the other group, those who ignore it. This group cause problems since they will show up one morning (as one of my dearest users did this morning) and will be locked out of Notes with this error on screen

Server Error: Your certificate has expired

When you have such a user you have to use the Administrator console using this procedure: How to manually recertify an expired ID.
Now don't get me wrong. It is not that complicated and I'm not complaining but it does involve an extra step: Physically access the users client to import the new recertified ID file. While in a small shop it is not that bad, in a larger environment it is a huge pain.
How to avoid it? Educate your users, explain about this certification and hope they'll remember next time and hope they leave before the renewal date because most chances are they will not remember.

Lotus Notes send on behalf of

Today, just as I got ready to leave for the day my CEO popped from nowhere and said "I need your help". Thank you very much!
He walked into his office and asked me to look at his Lotus Notes. One of our sale guys sent an invite to few clients where the CEO was Cc'd but the attachment only showed a pdf icon but had no real file attached to the mail.
Since it was late afternoon in the US and the sales guy leave in London he asked for a solution right here right now and did not want to wait for the next day. My task was simple: Resend those emails from the sales guy's mailbox as if he sent them. Make sure the attachment is there for real.
The reason it the attachment was missing to begin with was the mobile he used to forward it didn't support attachments. Go figure...
Problem with Notes is that you can send on behalf directly from your inbox but to make it look as if the other guy sent it himself, you must have a client configured for him, using his ID file. Since this guy never work in my office I have no such PC.
One way to do it was reconfiguring my own PC to use his ID. I can do it but do not like this path since there is always something with Notes when switching IDs.
Instead, I used the Web Access (I was lucky to have his password). Using Copy\Paste I got the text and addresses to the browser and attached the file too. One important thing to remember is sending with the Send and Save option which save a copy of that mail to his mailbox

Yahoo! Mail screen resolution

A user called in with a problem: she can't open her Yahoo! Mail account. She does log in and see the main template, it show "3 unread messages" at the screen title but the messages are not loading.
When I stepped to her desk I noticed that her iexplorer.exe process uses 99% of the CPU. I killed it and asked her to try again. Same problem, same solution. I tried a different approach and used my test account on Yahoo! (I never use it but this is why I keep it). Unlike her, I was able to get a message error (is it because my mailbox is empty?) which provided me with the solution as you can see in the picture.
When I changed her screen settings to 1024 x 768 she had no problems loading her mail. Now it is up to her to decide if she want her 15" monitor to show large fonts with the existing 800 x 600 which she like with no personal mail or change it to the smaller font with Yahoo! Mail working...

Free version of GFI WebMonito for ISA Server

Using ISA Server as a firewall years back and as my Proxy server for the last few years I learned to appreciate GFI's WebMonitor application.
Now it has a FREE version!
If you never tried it before because you did not have the budget or just because you never heard of it, this is the perfect opportunity.
The monitoring provide data that most small shops do not have about WHO and HOW MUCH. If you do not have any bandwidth usage data it will upgrade your capabilities and since it's free it's a win-win.
I'm using the paid version with all 3 scan engines and few rules that block downloads and specified file types. When I've installed the trial on my ISA server 2000 (yeah, many years ago) I had no budget and had to fight for the money. I wish they had this version back then...

552 552 Message exceeds fixed maximum message size

A client sent a 6MB email to one of my users and got the following message:

This is an automatically generated Delivery Status Notification

Delivery to the following recipient failed permanently:

Username@MyDomain.com

Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 552 552 Message exceeds fixed maximum message size (state 18).

Checking my Trend Micro IMSS log I couldn't find any reference to this email.
Now I know IMSS will not send a notification anyway even if the size limit exceeds my 10MB limit per message and it should log it. 2 points that sent me off track with this.
I asked the client to contact her email provider (she is using an Exchange based hosting solution) and they sent me the following response:

Title: NDR: Message rejected; too large
Created: 09/29/2009 12:03:36
Summary of issue(s): Receiving a NDR that states that the recipient is rejecting the message because of its size.

Steps taken: Had her send the message to our test account. It works. The email is about 6 MB. The limit of outgoing on our servers it around 52 MB's. It is an issue on the recipients end. She will get in contact with them.

At this point I asked her to forward the original email to a test GMAIL account I hold. From there I forwarded the email to my user and got a similar failure message.
Calling Trend Micro was the next step. I had a technician on the line in no time and he Webex'd my IMSS server to find no logs and tell me that it must be something before IMSS, maybe my firewall. The only way to prove him wrong was bypassing IMSS and forwarding all SMTP directly at my Domino server. yeah, exactly what I need...

Googling gave me nothing. It was all around Exchange 2007.
So I was thinking again about IMSS settings and started playing with the settings. When I doubled the message size limit from 10MB to 20MB I was able to receive the email and see it in the log.
I guess that is a bug in the IMSS software. Great product but it is the 2nd bug I found in it this year...

Google fail. Again...

Google is aware that some people are experiencing an e-mail outage. This is becoming a quarterly or even bi-monthly event...

at 10:29AM this message was posted:

We're aware of a problem with Google Mail affecting a small subset of users. The affected users are unable to access Google Mail, but we've provided a workaround below. We will provide an update by September 24, 2009 11:29:00 AM UTC-4 detailing when we expect to resolve the problem. Please note that this resolution time is an estimate and may change.
You can access Gmail via IMAP

at 12:58PM, after few additional messages they posted the following message:

The problem with Google Mail should be resolved. We apologize for the inconvenience and thank you for your patience and continued support.

My users had problem with both Gmail contacts and Gtalk (or Gmail chat). At few points they couldn't log in or refresh their Gmail mailbox.
I had users both in NY & London complaining and I doudt it was just a "small subset of users" as Google claim.

Recovering a file from Backup

Earlier today I've received a call from one of my users asking to recover a file from backup. He explained that last week's power shutdown caused some files mess up in his home directory.
Blame it on the network, that's the way to go!

I wrote down the file name and exact path and loaded Backup Exec's Restore wizard. Looking at all my weekly full backups I found the Friday prior to the power shutdown and restored the file he was looking for. He wasn't happy.

The explanation I received was that "the system" saved a second copy of that file under a different name!
I had to insist it is not possible since systems do not save files or rename them and no other user has access to the home folder of that user.
More to the fire he claimed that the recovered file is older then the one he was looking for. At this point I had to ask him how does it relate to the power shutdown if whatever happened more then a week earlier???

Went back to Backup Exec and located the file from previous week where the creation date and modified date where exactly identical, similar to the date he created the file. That file also was "wrong".

At this point I innocently suggested that he might have saved it in a different location. 10 minutes and a long lecture on his methodical file organization system later he called again: He found the file under a different folder.

One technical tip I want to share from my experience this morning relate to the recovered file.
I did not want to recover the file to the original location (and by now you understand why). I usually recover files to the local disk at c:\BE_Recovery
When the recovered file come from a home folder the NTFS permissions are still in affect and you can't access it.
In order to see the files at \\Home\DomainName\Username, copy them to any other location or delete the folder and files when you're done, you have to do 2 things:
Add the domain admin with modify permissions
Allow permission inheritance to sub folders

Advanced Group Policy Management 4.0

Advanced Group Policy Management (AGPM) is coming out next month and it is time to take a first look at this new exciting tool.
It will be released as part of Microsoft Desktop Optimization Pack (MDOP) 2009 R2.
The new release include 3 main features you should know about:
Multi Forest/Multi Domain Support
AGPM 3.0 does not support multi-forest/multi-domain environments and requires to use import/export which essentially breaks the change management workflow. AGPM 4.0 allow moving GPOs from one environment to another. Even in my shop I have 2 forests and few domains.
Check mark for the SMB environment usability!

Windows 7/Windows Server 2008 R2 Support
The new version will add support for Windows 7 & Windows Server 2008 R2 settings reporting and editing.
Microsoft recommend that if you edit policy with Windows 7, make sure you run Windows Server 2008 R2 on the back end.
Another check mark for the SMB environment usability!

Search and Filtering
Well, don't get too excited. You still can't search for settings.
The search feature allow you to locate a policy by it's name or partial name.
While it is a nice improvement it is not really useful for the average SMB.

You can download the Microsoft guide for AGPM 4.0 here.

It’s 3 a.m. Who Do You Want Answering the Phone?

Last night, just before 3AM most of our floor lost power.
The first to take the hit where PCs as they do not have any power backups.
My servers and routers kept going for additional 90-110 minutes based on the UPS they connected to.
I have a bunch of APC UPS systems both from the 2200 & 3000 series.

An hour and a half later, just few minutes after most UPS died, the power came back. For most servers it was too late...

When I received that phone call I had to connect to my ASA and I was happy when it worked. Poking around I verified all the critical routers and switches are up and the Domain Controllers for all 3 domains are running.
One server didn't want to be cooperative, it did reply to ping but wouldn't allow and RPC based connection to the Windows environment. I had to reboot it but I was home in my pajamas and 45 precious minutes away.
iLO saved me! lucky me, this one server had a working, connected & configured iLO.
In few minutes I had this server restart itself and this time it did. what a relief!


In less then an hour I was able to start all the services, run all the programs and test all the network components. 1 hour - that is the time it would take me get dressed and commute to the office...

The aftermath:
Coming to the office I found that some PCs and few server where up all night. The meaning is that it was not some general building outage but a more specific one. I called the building electrician and he found out that the meter box, which is as old as our building got too hot and caused this power outage. We're going to replace all 3 meter boxes tonight after hours.

Preparing to such a major shutdown is very important. Few things to remember:
This is the time to check all your procedures and backups.
This is when you use the contact list you've collected all those years, calling all your vendors so they know your network will be down.
Make sure the users are aware of the shutdown.
Call your phone system support and make sure they know about it, you might need them.

Diskpart Command-Line Utility

I had to make some partitioning changes on few machines. The thought of doing it manually, one by one was depressing. So I spent some time reading and playing with DiskPart and saved myself precious time.

DiskPart is a text-mode command that enables you to manage objects (disks, partitions, or volumes) by using scripts or direct input at a command prompt.

DiskPart is present in XP, Vista and Windows 7. The XP version is more limited because it does not offer advanced features for resizing partitions.

It is a powerful tool that can be used in many ways. I'll go over some basics.
Before you can use DiskPart commands on a disk, partition, or volume, you must first list and then select the object to give it focus. When an object has focus, any DiskPart commands that you type act on that object.

To start the tool, all you have to do is type DiskPart in command line. You'll get a new prompt with the DISKPART> sign replacing c:\

The tool uses two types of commands:
1. Commands which specify the target of action: List, Help, Rem, Select, Exit
2. Commands that apply directly to the element: Active, Assign, Create, Extend, Shrink

You can resize partitions, add or remove them and generally speaking do most of the FDISK or Disk Partition utility functions

One big advantage for DiskPart is it's scripting power. You can use it in script for a range of tasks.
To initiate a Diskpart script, use the diskpart /s script.txt command. By default, Diskpart can quit command processing and return an error code if there is a problem in the script. To continue to run a script in this scenario, include the noerr parameter on the command.

Check the Microsoft Command-line page for DiskPart

DiskPart is a powerful tool. Make sure you're familiar with it and use it carefully

Wi-Fi 802.11n approved - do I care?

The technical blogosphere is buzzing. BBC, CNET, neowin and everyone else cover the approval of the 802.11n high-throughput wireless LAN standard by the IEEE.
It took almost 7 and we have a 6 time faster wireless connection. Most vendors already use it or require a firmware upgrade for the existing hardware.

As always, I try to look at the news in the OneManITShop eyes:
How would it change MY life?
Will it make a difference to MY Shop?

Networks that already use wireless will be better off upgrading to the new standard if hardware permit. But under the current economy I wouldn't invest in new hardware unless you work with huge files or video (but then, why are you on wireless?).
If you're just on the verge of installing a new wireless network or expand the current infrastructure you have to make sure 802.11n is supported. The problem is you 'll have hard time any piece of hardware that does not support it so it is a non issue.

The big difference would be for those who try to make a case for wireless. If you're one of those your case got 6 times stronger. Since most PCs come with a Gig NIC I see the network as the bottleneck and this is where you can make your case: Using 802.11n get you closer to the Gig NIC but with the flexibility of a laptop. You do not compromise that much on bandwidth as you had to with previous standards and you get to keep the wireless environment.
I see it as a big plus. With the right rap your management will too.

Domain Trust – part III

Part I covered the basic concept of Domain Trust.
Part II covered the different Trust types.
Now it’s time to go over Trust related troubleshooting skills

The first step is determining the type of Trust. There are few ways to complete this task:
Active Directory Domains and Trusts console - The Domain ‘Properties’ box has a Trusts tab with all available Trusts for the Domain

Active Directory Users and Computers console – For the Domain, the View menu has an ‘Advanced Features’ option. The ‘System’ container has a list of objects; we’re looking here at the ‘Trusted Domain’ type.

NLTEST - Resource kit tool that can display Trusts (among other data). The following command will show all trusted domain:
NLTEST /server:server name /trusted_domains

ADSI Edit – Another Resource kit tool that can do the job. Expanding the domain in question and browsing to the System class properties will give you the list of Trusted domains.

Each of these provides significant data on the Trusts and related problems. Make sure you’re familiar with each one of them and capable of using them if required.

WinNT presented a great tool that survived till this day: NLTEST
NLTEST test secure channels between domain controllers that trust other domains.
Though it is a WinNT document, this tool work great on every domain level and like the previous list, it is a very important tool that should be available and used by any domain admin.

“Restricted Groups” in Group Policy

Ever had to add users to a local admin group but had no access to the computer? Add a special user account in the Administrator group of every computer on the network for remote administrative functions?
Group Policy Restricted Groups enables you - as the administrator - to configure group memberships on the client computers or member servers. Cool. Useful!!!

The “Restricted Groups” option allow 2 types of settings:

Members
Members Of

Members– This setting allows you to control the members of the group that you specify for the policy. The members can include both user and group accounts. When you configure the members of a group, it will overwrite the existing membership of the group and replace the members with those specified within the GPO. If you were to configure this setting and leave the members blank, then the group would not have any members after the GPO applied to the computer.

Member Of – This setting allows you to control which other groups the specified group has membership in. All groups that you configure in this interface must meet the approved group nesting rules. Therefore, you can’t configure a local group to have membership in another group, since local groups can’t be placed in Active Directory groups, nor placed in other local groups. If the list of groups in this section is left blank, it will not remove the specified group from any existing groups, it will just not place it in additional groups.

Simple yet an efficient time saver.

Derek Melber wrote a good security piece on restricted groups

Netsh.exe - DHCP backup and more

Early this morning I had a problem on one of my DHCP servers. One scope got messy and I wanted to get it fixed fast enough so ealy birds coming in will not notice the problem.
Lucky me i had a recent backup of my DHCP so all I had to do was restoring it to the server.

Netsh.exe utility is a functional tool that can be used for many tasks around your domain. my particular task here was importing the backup file I created as part of my DR plan.

Running the tool on the actual DHCP server those are the required commands:

netsh
dhcp server \\servername

EXPORT
export c:\backup\dhcpdb all (all=>backup ALL scopes)
or
export c:\temp\dhcpdb 192.168.20.0

IMPORT
import c:\backup\dhcpdb all (all=>import full config)
or
import c:\temp\dhcpdb 192.168.20.0

This is a very simple procedure that can save you time when DHCP fail.
You can use this tool for many more tasks, monitoring your system from command line.

How to change Drive Letter display

A simple request from a user made me work a bit before I found this neat solution:
Mapped drives at Windows Explorer are display by default as:
- (OneManITShop Data on FileServer\ShopData M:)
A much easier way to see it, and this users requrested just that is the other way around:
(M: OneManITShop Data on FileServer\ShopData)




An easy solution (I do not use 'the solution' since some other solution available out there) is a simple Registry change:
In regedit (type regedit in command line)look for the following key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer
edit or create the DWORD value "ShowDriveLettersFirst" and set it to the desired value:

* 0 = Default display (drive letters after description)
* 1 = Network drive letters first, Local drive letters after
* 2 = Descriptions only, no drive letters displayed
* 4 = Drive letters before description

My user's request required option 4. Happy user at the end of the day :)

Laptop support

I always struggle with this subject: a user come back from vacation and instead of chocolate, she bring her laptop and want you to fix it. Why? Because she used the hotel WiFi and her unsecured private laptop is now a bag full of viruses.
As the cheap (well, more FREE then cheap) available technician I'm the obvious choice for the user but should I provide this service?
This is one of the major dilemmas of the OneManITShop administrator at a small firm. You can't say no, definitely not to partners or managers but due to the delicate politics in a small place, not even to the last employee in the food chain.

So I get this laptop and meet some familiar friend: Personal Antivirus. a nasty maleware that I've seen in the past. I was lucky to remember the solution I used last time so it didn't take that long and using Malewarebyte's software I was able to get it off the laptop without a sweat.



This is a great tool that never failed me. It gets the latest update and start working, scanning the hard drive. Within the hour I got the list of the rogue files to be deleted and the laptop was cleaned.

Keep in mind that in a small shop users expect you to be available for their personal computer support and as long as they keep it reasonable, try to keep them happy and safe. Educate them - on the long run you'll get something back, either they'll learn something and prevent future problems or you'll need something back and they'll be more then happy to pay back a favor.

Microsoft Office License

I have a single user working from his home in London. Sharing our services is easy and I hardly ever hear from him. This morning I got a call from this guy and he told me that he will need Microsoft Publisher license for his soon to be expired 60 day trial.

Sound like an easy task, right? Wrong!
My first thought was going to Amazon and buy a new box, since he already got the software he does not need the CD and I can just give him the key. Make sense and easy to do BUT there is one catch – different countries have different licensing policies. Yes, the same Microsoft has different policies and prices for different countries where EU is even more complicated because of the antitrust case with Microsoft.

Calling Microsoft here in the US resulted with a simple answer – you have to buy the license in the UK. Can you blame them for preferring € or £ over $US?
(tip: the €\£ signs come up when holding ALT and typing 0128\0163)

Calling my Microsoft sales rep (which is not a Microsoft employee but work for one of the biggest retailers) the answer was different, he said that for Office licenses the license is per language and if I need an English version I can buy it in the US.

I Googled and Binged but wherever you go, including Microsoft.com you get different answers or interpretations of the rules.
I’m still waiting for few answers but one cannot stop wondering why can’t Microsoft make licensing easier?

SubInACL - Security Information Tool

I had to give some users access to specific service on one of my servers but didn’t want them to have full domain admin permissions. Changing a service is not something Microsoft built a solution for so I had to be creative. As always, I checked for available 3rd party tools but ended up using this magical hidden native tool: SubInACL.exe

SubInACL is one of those shy command-line tool that not too many guys know about. It is part of the Windows Resource Kit Tools and it’s about time you too will get familiar with it.

SubInACL enables you to obtain security information about different types of files, services and registry keys.
The info you obtain with SubInACL can be transferred in few ways: from user to user, from local or global group to group, and from domain to domain. The average OneManITShop will find the first and second options handy though the domain to domain transfer option can also be useful.

Microsoft describes 4 uses for this tool:
• Display security information associated with files, registry keys, or services. This information includes owner, group, permission access control list (ACL), discretionary ACL (DACL), and system ACL (SACL).
• Change the owner of an object.
• Replace the security information for one identifier (account, group, well-known security identifier (SID)) with that of another identifier.
• Migrate security information about objects. This is useful if you have reorganized a network's domains and need to migrate the security information for files from one domain to another.

back to my problem, let's say my user is "Dave" and I need Dave to be able to stop and start the Print Spooler service. This is the command to make it work (TO=start+stop -> see full list below):

subinacl /service Spooler /GRANT=MyDomain\Dave=TO

The full list (Look under method 3):
• F : Full Control
• R : Generic Read
• W : Generic Write
• X : Generic eXecute
• L : Read controL
• Q : Query Service Configuration
• S : Query Service Status
• E : Enumerate Dependent Services
• C : Service Change Configuration
• T : Start Service
• O : Stop Service
• P : Pause/Continue Service
• I : Interrogate Service
• U : Service User-Defined Control Commands

So this is one in many options for this great tool. You should also download and play with the options. You never know when it will become handy!

bug report: Firefox 3.x & eBlaster 6.x

I had this problem on few different XP machines: Firefox crash over and over. When you select the 'restart' option at the crashed message screen it will reopen only to crash again.
All the PCs are Windows XP SP2 and they all have a copy of eBlaster 6.0.3084.
Surprisingly an upgrade fixes the problem...
Installing eBlaster 6.0.3102 (and the required boot) make the problem go away...
Nothing on eBlaster's site indicate they did anything to fix the problem but hey, if it's fixing it who am I to complain!