"Obscurum per Obscurius"

Windows 7 Tip and Tricks - A Must Read!

MuadDib — Thu, 19 Nov 2009 14:06:00 GMT

As a Microsoft employee I have been using Windows 7 since the early internal betas. I have been impressed with the operating system (OS) since day one and it has improved with each iteration leading up to release. There are some nice, obvious user interface...(read more)

Favorites syncing on Windows Live Toolbar temporarily turned off... Missing Favorites? Don't Panic! (resolved, sync enabled)

MuadDib — Sun, 08 Nov 2009 20:21:00 GMT

More information can be found at this link - http://windowslivewire.spaces.live.com/Blog/cns!2F7EB29B42641D59!42814.entry Synchronized Favorites are a great feature and I have over 1400 synced between three computers. Like the article listed above say...(read more)

Microsoft Security Essentials

MuadDib — Wed, 30 Sep 2009 13:10:00 GMT

Microsoft Security Essentials released yesterday. Microsoft Security Essentials is a free* download from Microsoft that is simple to install, easy to use, and always kept up to date so you can be assured your PC is protected by the latest technology....(read more)

WIndows 7 Release is Less than a month Away...

MuadDib — Mon, 28 Sep 2009 03:45:00 GMT

Windows 7 officially goes on sale October 22, 2009. Many people installed the beta and RC versions of the operating system and have been very pleased. I too installed the early betas and eventually the RC code. I have been pleasantly surprised with all...(read more)

Who Is Logged In?

MuadDib — Mon, 10 Aug 2009 01:57:00 GMT

A few months back one of my customers was trying use RDP to connect to a large number of desktop computers to manually install some security updates. If the computer was being used the admin had to wait until the person using the computer logged out and...(read more)

Cool Gadget - USB to Ethernet Network Adapter

MuadDib — Sat, 20 Jun 2009 19:43:00 GMT

I was traveling last week and found myself without Internet connectivity in my hotel room. If there is one thing a field engineer needs why traveling is Internet connectivity. This is the second time I have stayed at a Courtyard Marriott and had no internet....(read more)

Windows 7 Release Candidate: Download instructions

MuadDib — Wed, 20 May 2009 15:27:00 GMT

The Windows 7 Release Candidate is available for download "free" (see previous post). In Microsoft terms, Release Candidate (RC) code is code that we think is ready for release to our customers but we are still doing some final test and evaluation before...(read more)

Like the NRBQ Song Says - "Ain't No Free"

MuadDib — Wed, 20 May 2009 03:01:00 GMT

I saw this post on the Genuine Windows Blog site today Pirated Windows 7 RC builds a botnet . So let me understand this. Instead of getting the software for free from Microsoft, people prefer to get it from some stranger(s) over the Internet for free...(read more)

How To Burn ISO Images to Media Using DVDBURN and CDBURN Utilities

MuadDib — Thu, 07 May 2009 14:39:00 GMT

Sites that distribute software like MSDN and TechNet make it possible to download ISO images of CDROMs and DVDs. An ISO image allows you to burn an exact duplicate of a piece of media. One of the challenges we all face from time to time is corrupt media....(read more)

Hyper-V Error "cannot connect to the virtual machine because the authentication certificate is expired"

MuadDib — Mon, 04 May 2009 20:20:00 GMT

This error appeared on one of my Hyper-V servers this morning. A search of TechNet revealed that KB967902 has an update that can be downloaded to correct the issue. The issue occurs because the because the Hyper-V Virtual Machine Management service (VMMS)...(read more)

Group Policy Resources

MuadDib — Thu, 30 Apr 2009 22:04:00 GMT

In the last couple of weeks I have been working with customers on GPO implementations. One of the first things I show them are the Excel spreadsheets that contain all the settings in a search able format. These spreadsheets are useful when you don't know...(read more)

Testing Domain Controller Connectivity Using PORTQRY

MuadDib — Mon, 30 Mar 2009 03:23:00 GMT

One common problem I see with Active Directory implementations is an Active Directory topology that is not fully routable. In a fully routable environment every domain controller (DC) can communicate with every other DC. While most customers "think" they have a fully routable environment in reality they do not. In some cases there are multiple firewalls between the DCs that are blocking ports or DCs connected across VPN links that do not have the proper ports open. For more information on how Active Directory replication works read the articles in the RESOURCES section below.

Here are the ports required by Active Directory as described in the "Service Overview" link below. The basic ports are TCP:

88 (Kerberos)
135 (RPC)
389 (LDAP)
445 (CIFS)
3268 (Global Catalog)

There are additional ports and protocols but these are enough to get started testint the basics.

The PORTQRY utility can be found in the Windows Server 2003 Support Tools and the newest version can be found in the links that follow. PORTQRY can be used to test connectivity on a port or range of ports from one server to another. For example to test TCP port 389 from the current computer to a server named VDC02 you would type the following command:

PORTQRY - n VDC02 -e 389 -p TCP

The query will return a great deal of information when you query 389 but you should see a line similar to the following if port 389 is reachable and able to respond:

TCP port 389 (ldap service): LISTENING

In order to speed up the process of testing you can use a batch file with a FOR loop in it to read server names from a text file and perform several ports test against a server. The sample script shown below will perform some basic testing but you might need to perform more detailed analysis if you are having problems (note somelines may be wrapped due to blog formatting).

:::::::::::::::::::::::::::: BEGIN SCRIPT :::::::::::::::::::::::::

@ECHO OFF
:: NAME: DCPortTest.CMD v1.0
:: DATE: 03/29/2009
:: PURPOSE: Test connectivity from one DC to one or more remote DCs
:: using PORTQRY utility.
:: The SERVERS.TXT contains a list of servers (one server per line)
:: to check connectivity to.

ECHO     DATE: %DATE% > DC_PORTQRY.TXT
ECHO     TIME: %TIME% >> DC_PORTQRY.TXT
ECHO     USER: %USERNAME% >> DC_PORTQRY.TXT
ECHO COMPUTER: %COMPUTERNAME% >> DC_PORTQRY.TXT
ECHO. >> DC_PORTQRY.TXT
ECHO. >> DC_PORTQRY.TXT
ECHO. >> DC_PORTQRY.TXT
FOR /F "tokens=1" %%i in (servers.txt) DO (
ECHO :::::::::::::::::::::: %%i :::::::::::::::::::::::::: >> DC_PORTQRY.TXT
ECHO Testing %%i
ECHO. >> DC_PORTQRY.TXT
PORTQRY -n %%i -e 88 -p TCP | findstr /i "88" >> DC_PORTQRY.TXT
PORTQRY -n %%i -e 445 -p TCP | findstr /i "445" >> DC_PORTQRY.TXT
PORTQRY -n %%i -e 389 -p TCP | findstr /i "389" >> DC_PORTQRY.TXT
PORTQRY -n %%i -e 3268 -p TCP | findstr /i "3268" >> DC_PORTQRY.TXT
PORTQRY -n %%i -e 135 -p TCP | findstr /i "135" >> DC_PORTQRY.TXT
ECHO. >> DC_PORTQRY.TXT
ECHO. >> DC_PORTQRY.TXT
)

:::::::::::::::::::::::: END SCRIPT :::::::::::::::::::::::::

RESOURCES

How Active Directory Replication Topology Works
http://technet2.microsoft.com/WindowsServer/en/Library/c238f32b-4400-4a0c-b4fb-7b0febecfc731033.mspx

Service overview and network port requirements for the Windows Server system
http://support.microsoft.com/kb/832017

New features and functionality in PortQry version 2.0
http://support.microsoft.com/kb/832919

Download PortQry Command Line Port Scanner Version 2.0
http://www.microsoft.com/downloads/details.aspx?FamilyID=89811747-C74B-4638-A2D5-AC828BDC6983&displaylang=en

Finding Scheduled Tasks Configured with Disabled Accounts

MuadDib — Tue, 13 Jan 2009 19:47:00 GMT

One of my customers has undergone a great deal of turnover in the past few weeks on the System Administration team. We discovered that a number of Scheduled Tasks configured on the servers were configured with the accounts of admnistrators (instead of service accounts!). The accounts were disabled when the admins left the organization and the Scheduled Tasks stopped working. We needed to find all the Scheduled Tasks configured with admin accounts instead of service accounts on the servers.

The simpe batch file below uses the SCHTASKS utility to dump the configuration information from each server listed in a SERVERS.TXT file and dump the output to a file named SCHED_TASKS_CONFIG.TXT.

<<<------------------------------BEGIN BATCH FILE------------------------- >>>

:: NAME: SCHED_TASK_ACCT.CMD v1.0
:: DATE: 1/13/2009
:: PURPOSE: TO dump the configuration of scheduled tasks on a server to a text file
:: so tasks configured with disabled accounts can be located.

ECHO %DATE% > SCHED_TASKS_CONFIG.TXT
ECHO %TIME% >> SCHED_TASKS_CONFIG.TXT
ECHO %USERNAME% >> SCHED_TASKS_CONFIG.TXT
ECHO. >> SCHED_TASKS_CONFIG.TXT
FOR /F "tokens=1" %%i in (servers.txt) DO schtasks /query /s %%i /v /fo list >> SCHED_TASKS_CONFIG.TXT

<<<------------------------------END BATCH FILE------------------------- >>>

Using a Logon Script to Install the SMS Advanced Client

MuadDib — Sun, 19 Oct 2008 16:16:00 GMT

One of my customers has an extensive lab environment with multiple forests, domains and workgroup computers. SMS 2003 was deployed to help manage the configuration of all these different systems. Between the locked down security settings (no C$, ADMIN$ shares!) and the number separate forest/domains/workgroups involved the ability to "push" the advanced client to desktops is no longer an option. After meeting with the client last week we decided to configure a logon script to install the SMS client. The script and associated files (CCMSETUP.EXE, CLIENT.MSI, SMSCLIENT.VBS) were placed in a folder named SMS in the NETLOGON share of the Domain Controllers. We then configured the LOGON SCRIPT properties of the Domain Administrator account to run the SMSSTARTUP.VBS script shown below to install the client.

Now for a quick run through of the code.

Declare our variables and create the objects we will be working with.
Determine the path to the NETLOGON \SMS folder we are using.
Check to see if the SMS client is installed (Set oSMSClient ... If Err.Number....)
Display a timed popup message with a Cancel button
Copy install files to local computer.
Run installation script (SMSCLIENT.VBS)
Set commands in the RunOnce registry key to delete the SMSCLIENTINSTALL folder the next time someone logs in.

SMSSTARTUP.VBS

'**********************************************
' SCRIPT: SMSStartup.VBS
' AUTHOR:
' DATE:   10/16/2008
' VERSION: 2.0
' PURPOSE: Check for thr presence of the SMS client,
'                  if not installed, copy files from the
'                 network to c:\smsclientinstall and install
' USAGE:     SMSStartup.vbs
'
'REVISION: 10/17/2008 added check
'                 to make sure files and folders exist
'                before moving to next step in script
'
'**********************************************
OPTION EXPLICIT
On Error Resume Next

Dim oSMSClient, intButton,objWshShell,sFolder, objFSO, sCurrentPath
Dim oExec

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objWshShell = WScript.CreateObject("WScript.Shell")
Set oSMSClient = CreateObject ("Microsoft.SMS.Client")

'Folder to copy SMS install files to
sFolder = "C:\SMSCLIENTINSTALL"

WScript.Sleep 15000

'Build path to SMS files
sCurrentPath = objWshShell.ExpandEnvironmentStrings("%LOGONSERVER%")
sCurrentPath = sCurrentPath & "\NETLOGON\SMS"

If Err.Number <> 0 Then 'change to zero when testing complete
     'Clear error buffer
     err.clear
    objWshShell.LogEvent 2, "SMS Client is not installed, installing now."
    intButton=objWshShell.Popup("Installaing SMS Client software on this computer in the background",5,"SMS Client Software Installation",1)
    'wscript.echo intbutton
    If intButton = 2 Then
        objWshShell.LogEvent 1, "SMS Client installation was cancelled by the user"
        wscript.quit
    End If

'copy files to local computer and begin client installation
Do While objFSO.FolderExists(sFolder) <> TRUE
CreateFolder sFolder
WScript.Sleep 10000
Loop

'copy files
'Check for files before continuing to next file
Do While objFSO.FileExists(sFolder & "\SMSCLIENT.VBS") <> TRUE
  objFSO.CopyFile sCurrentPath & "\SMSCLIENT.VBS", sFolder & "\", TRUE
  wscript.sleep 2000
Loop

Do While objFSO.FileExists(sFolder & "\Client.msi") <> TRUE
  objFSO.CopyFile sCurrentPath & "\client.msi", sFolder & "\", TRUE
  wscript.sleep 2000
Loop

Do While objFSO.FileExists(sFolder & "\ccmsetup.exe") <> TRUE
  objFSO.CopyFile sCurrentPath & "\ccmsetup.exe", sFolder & "\", TRUE
  wscript.sleep 2000
Loop

    'now run sms client install
    Set oExec = objWshShell.Exec("wscript.exe " & sFolder & "\SMSCLIENT.VBS")

    Do While oExec.Status = 0
      WScript.Sleep 1000
    Loop

'delete the folder by adding command to the Runonce key
'CMD.exe /c "RD /s /q c:\SMSCLIENTINSTALL"
objWshShell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SMS", "CMD.EXE /c " & CHR(34) & "RD /s /q C:\SMSCLIENTINSTALL" & CHR(34), "REG_SZ"

Else
'Computer has client, quit
wscript.quit
End If

Function CreateFolder(folder)
   Dim ofso, f
   Set ofso = CreateObject("Scripting.FileSystemObject")
   Set f = ofso.CreateFolder(folder)
   CreateFolder = f.Path
End Function

Sub DeleteAFolder(filespec)
   Dim ofso
   Set ofso = CreateObject("Scripting.FileSystemObject")
   ofso.DeleteFolder filespec,TRUE
End Sub

Configuring SMS to Work on Workgroup Computers and Computers in Other Domains (LMHOSTS)

MuadDib — Sun, 19 Oct 2008 16:09:00 GMT

As described in the previous post the lab environment includes multiple forests, domains and workgroup computers. One of the nice things about SMS 2003 is the fact that once the SMS Client has been installed on a system, you "own" that system and can manage it from that day forward. In the previous post, we discussed how to use a logon script to install the SMS Advanced Client. In this post we will discuss how to configure computers that are not located within the same domain as the SMS server to be able to find the SMS Management Point (MP) and Server Locator Point (SLP).

All Windows operating systems since Windows 2000 rely on DNS for name resolution. A clients still have WINS installed to support some legacy applications but most do not. An LMHOSTS file is similar to a HOSTS file. A HOST files is used to map DNS hosts names to IP addresses. An LMHOSTS file is used to map NetBIOS names to IP addresses. NetBIOS names differ from DNS names because you can have different types of NetBIOS names (e,g, domain, workstation service etc.). The LMHOSTS files is placed in the same folder as the HOSTS file (%WINDIR%\System32\Drivers\Etc).

An example of the LMHOSTS file is shown below. Copy the code below into Notepad and save the file as LMHOSTS (no extension) to the "%WINDIR%\System32\Drivers\Etc" folder. Customize the entries to match your environment. When you see the pound (#) sign in an LMHOSTS file it is usually followed by a comment unless it is followed by one of the special directives such as PRE< DOM, INCLUDE etc. The PRE directive loads the entires into the NetBIOS name cache on startup. The DOM directive is used to indicated a domain name. The INCLUDE directive is used to include another LMHOSTS file.

In the sample file below the first three lines are comments. The fourth line pre-loads the domain name where the SMS servers is located and provides the IP address of a DC in that domain. The next line provides the name and IP address of the SMS server (SMSSERVER1). The next line provides the name of the SMS Server Locator Point (SMS_SLP) and the line that follows defines the Management Point (MP_C01). Notice the entries for the SLP/MP look very different from the others. The "\01xa" is a NetBIOS suffix and there must be exactly 15 characters between the the first quote and the backslash. For the SMS_SLP line on change the IP address to the IP of the computer hosting the SMS SLP role. For the MP, change the IP and change the SMS site code in the file from C01 to the site code of your SMS site.

<------------------------------ BEGIN LMHOSTS ----------------------------------->

# LAB LMHOSTS File
#REVISION: 2
#DATE: 10/17/2008
192.168.101.143     DC01         #PRE #DOM:LABDOMAIN1 # Lab Domain DC
192.168.101.141    SMSSVR1 #PRE
192.168.101.141   "SMS_SLP        \0x1A" #PRE
192.168.101.141   "MP_C01         \0x1A" #PRE

<------------------------------ END LMHOSTS ----------------------------------->

When you start using LMHOST files you quickly realize that trying to manage the content of these files on multiple computers because a big pain real fast. If you need to make a change, you need to update every file with the change. Fortunately the #INCLUDE directive discussed earlier enables you to use a centralized LMHOSTS file. In our lab environment we created a share on the SMS server named "SMSLMHOST" and placed the first LMHOSTS file shown above there. The LMHOSTS file shown below was placed on the computers that needed a LMHOSTS. There are two entries shown. The first one provides the name/IP of the SMS server and the second directs the client to read the master LMHOSTS file stored on the server.

<------------------------------ BEGIN LMHOSTS ----------------------------------->

192.168.101.141 SMS1 #PRE
#INCLUDE \\SMSSVR1\SMSLMHOSTS\lmhosts

<------------------------------ END LMHOSTS ----------------------------------->

REFERENCE

NetBIOS Suffixes (16th Character of the NetBIOS Name)
http://support.microsoft.com/default.aspx/kb/163409/

HOWTO: Assign SMS Advanced Client to the Isolated Secondary Site
http://support.microsoft.com/kb/555853

LMHOSTS File Information and Predefined Keywords
http://support.microsoft.com/kb/102725

Domain Browsing with TCP/IP and LMHOSTS Files
http://support.microsoft.com/kb/150800

Chapter 10 - Using LMHOSTS Files
http://www.microsoft.com/resources/documentation/windowsnt/4/server/reskit/en-us/net/sur_lmh.mspx?mfr=true