Obscurum per Obscurius : Time Savers

Windows 7 Tip and Tricks - A Must Read!

MuadDib — Thu, 19 Nov 2009 14:06:00 GMT

As a Microsoft employee I have been using Windows 7 since the early internal betas. I have been impressed with the operating system (OS) since day one and it has improved with each iteration leading up to release. There are some nice, obvious user interface...(read more)

Who Is Logged In?

MuadDib — Mon, 10 Aug 2009 01:57:00 GMT

A few months back one of my customers was trying use RDP to connect to a large number of desktop computers to manually install some security updates. If the computer was being used the admin had to wait until the person using the computer logged out and...(read more)

Using a Logon Script to Install the SMS Advanced Client

MuadDib — Sun, 19 Oct 2008 16:16:00 GMT

One of my customers has an extensive lab environment with multiple forests, domains and workgroup computers. SMS 2003 was deployed to help manage the configuration of all these different systems. Between the locked down security settings (no C$, ADMIN$ shares!) and the number separate forest/domains/workgroups involved the ability to "push" the advanced client to desktops is no longer an option. After meeting with the client last week we decided to configure a logon script to install the SMS client. The script and associated files (CCMSETUP.EXE, CLIENT.MSI, SMSCLIENT.VBS) were placed in a folder named SMS in the NETLOGON share of the Domain Controllers. We then configured the LOGON SCRIPT properties of the Domain Administrator account to run the SMSSTARTUP.VBS script shown below to install the client.

Now for a quick run through of the code.

Declare our variables and create the objects we will be working with.
Determine the path to the NETLOGON \SMS folder we are using.
Check to see if the SMS client is installed (Set oSMSClient ... If Err.Number....)
Display a timed popup message with a Cancel button
Copy install files to local computer.
Run installation script (SMSCLIENT.VBS)
Set commands in the RunOnce registry key to delete the SMSCLIENTINSTALL folder the next time someone logs in.

SMSSTARTUP.VBS

'**********************************************
' SCRIPT: SMSStartup.VBS
' AUTHOR:
' DATE:   10/16/2008
' VERSION: 2.0
' PURPOSE: Check for thr presence of the SMS client,
'                  if not installed, copy files from the
'                 network to c:\smsclientinstall and install
' USAGE:     SMSStartup.vbs
'
'REVISION: 10/17/2008 added check
'                 to make sure files and folders exist
'                before moving to next step in script
'
'**********************************************
OPTION EXPLICIT
On Error Resume Next

Dim oSMSClient, intButton,objWshShell,sFolder, objFSO, sCurrentPath
Dim oExec

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objWshShell = WScript.CreateObject("WScript.Shell")
Set oSMSClient = CreateObject ("Microsoft.SMS.Client")

'Folder to copy SMS install files to
sFolder = "C:\SMSCLIENTINSTALL"

WScript.Sleep 15000

'Build path to SMS files
sCurrentPath = objWshShell.ExpandEnvironmentStrings("%LOGONSERVER%")
sCurrentPath = sCurrentPath & "\NETLOGON\SMS"

If Err.Number <> 0 Then 'change to zero when testing complete
     'Clear error buffer
     err.clear
    objWshShell.LogEvent 2, "SMS Client is not installed, installing now."
    intButton=objWshShell.Popup("Installaing SMS Client software on this computer in the background",5,"SMS Client Software Installation",1)
    'wscript.echo intbutton
    If intButton = 2 Then
        objWshShell.LogEvent 1, "SMS Client installation was cancelled by the user"
        wscript.quit
    End If

'copy files to local computer and begin client installation
Do While objFSO.FolderExists(sFolder) <> TRUE
CreateFolder sFolder
WScript.Sleep 10000
Loop

'copy files
'Check for files before continuing to next file
Do While objFSO.FileExists(sFolder & "\SMSCLIENT.VBS") <> TRUE
  objFSO.CopyFile sCurrentPath & "\SMSCLIENT.VBS", sFolder & "\", TRUE
  wscript.sleep 2000
Loop

Do While objFSO.FileExists(sFolder & "\Client.msi") <> TRUE
  objFSO.CopyFile sCurrentPath & "\client.msi", sFolder & "\", TRUE
  wscript.sleep 2000
Loop

Do While objFSO.FileExists(sFolder & "\ccmsetup.exe") <> TRUE
  objFSO.CopyFile sCurrentPath & "\ccmsetup.exe", sFolder & "\", TRUE
  wscript.sleep 2000
Loop

    'now run sms client install
    Set oExec = objWshShell.Exec("wscript.exe " & sFolder & "\SMSCLIENT.VBS")

    Do While oExec.Status = 0
      WScript.Sleep 1000
    Loop

'delete the folder by adding command to the Runonce key
'CMD.exe /c "RD /s /q c:\SMSCLIENTINSTALL"
objWshShell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SMS", "CMD.EXE /c " & CHR(34) & "RD /s /q C:\SMSCLIENTINSTALL" & CHR(34), "REG_SZ"

Else
'Computer has client, quit
wscript.quit
End If

Function CreateFolder(folder)
   Dim ofso, f
   Set ofso = CreateObject("Scripting.FileSystemObject")
   Set f = ofso.CreateFolder(folder)
   CreateFolder = f.Path
End Function

Sub DeleteAFolder(filespec)
   Dim ofso
   Set ofso = CreateObject("Scripting.FileSystemObject")
   ofso.DeleteFolder filespec,TRUE
End Sub

Configuring SMS to Work on Workgroup Computers and Computers in Other Domains (LMHOSTS)

MuadDib — Sun, 19 Oct 2008 16:09:00 GMT

As described in the previous post the lab environment includes multiple forests, domains and workgroup computers. One of the nice things about SMS 2003 is the fact that once the SMS Client has been installed on a system, you "own" that system and can manage it from that day forward. In the previous post, we discussed how to use a logon script to install the SMS Advanced Client. In this post we will discuss how to configure computers that are not located within the same domain as the SMS server to be able to find the SMS Management Point (MP) and Server Locator Point (SLP).

All Windows operating systems since Windows 2000 rely on DNS for name resolution. A clients still have WINS installed to support some legacy applications but most do not. An LMHOSTS file is similar to a HOSTS file. A HOST files is used to map DNS hosts names to IP addresses. An LMHOSTS file is used to map NetBIOS names to IP addresses. NetBIOS names differ from DNS names because you can have different types of NetBIOS names (e,g, domain, workstation service etc.). The LMHOSTS files is placed in the same folder as the HOSTS file (%WINDIR%\System32\Drivers\Etc).

An example of the LMHOSTS file is shown below. Copy the code below into Notepad and save the file as LMHOSTS (no extension) to the "%WINDIR%\System32\Drivers\Etc" folder. Customize the entries to match your environment. When you see the pound (#) sign in an LMHOSTS file it is usually followed by a comment unless it is followed by one of the special directives such as PRE< DOM, INCLUDE etc. The PRE directive loads the entires into the NetBIOS name cache on startup. The DOM directive is used to indicated a domain name. The INCLUDE directive is used to include another LMHOSTS file.

In the sample file below the first three lines are comments. The fourth line pre-loads the domain name where the SMS servers is located and provides the IP address of a DC in that domain. The next line provides the name and IP address of the SMS server (SMSSERVER1). The next line provides the name of the SMS Server Locator Point (SMS_SLP) and the line that follows defines the Management Point (MP_C01). Notice the entries for the SLP/MP look very different from the others. The "\01xa" is a NetBIOS suffix and there must be exactly 15 characters between the the first quote and the backslash. For the SMS_SLP line on change the IP address to the IP of the computer hosting the SMS SLP role. For the MP, change the IP and change the SMS site code in the file from C01 to the site code of your SMS site.

<------------------------------ BEGIN LMHOSTS ----------------------------------->

# LAB LMHOSTS File
#REVISION: 2
#DATE: 10/17/2008
192.168.101.143     DC01         #PRE #DOM:LABDOMAIN1 # Lab Domain DC
192.168.101.141    SMSSVR1 #PRE
192.168.101.141   "SMS_SLP        \0x1A" #PRE
192.168.101.141   "MP_C01         \0x1A" #PRE

<------------------------------ END LMHOSTS ----------------------------------->

When you start using LMHOST files you quickly realize that trying to manage the content of these files on multiple computers because a big pain real fast. If you need to make a change, you need to update every file with the change. Fortunately the #INCLUDE directive discussed earlier enables you to use a centralized LMHOSTS file. In our lab environment we created a share on the SMS server named "SMSLMHOST" and placed the first LMHOSTS file shown above there. The LMHOSTS file shown below was placed on the computers that needed a LMHOSTS. There are two entries shown. The first one provides the name/IP of the SMS server and the second directs the client to read the master LMHOSTS file stored on the server.

<------------------------------ BEGIN LMHOSTS ----------------------------------->

192.168.101.141 SMS1 #PRE
#INCLUDE \\SMSSVR1\SMSLMHOSTS\lmhosts

<------------------------------ END LMHOSTS ----------------------------------->

REFERENCE

NetBIOS Suffixes (16th Character of the NetBIOS Name)
http://support.microsoft.com/default.aspx/kb/163409/

HOWTO: Assign SMS Advanced Client to the Isolated Secondary Site
http://support.microsoft.com/kb/555853

LMHOSTS File Information and Predefined Keywords
http://support.microsoft.com/kb/102725

Domain Browsing with TCP/IP and LMHOSTS Files
http://support.microsoft.com/kb/150800

Chapter 10 - Using LMHOSTS Files
http://www.microsoft.com/resources/documentation/windowsnt/4/server/reskit/en-us/net/sur_lmh.mspx?mfr=true

Who's in the Local Administrators Group?

MuadDib — Sun, 12 Oct 2008 16:40:00 GMT

I was organizing files this weekend and ran across a script I created for a customer recently. They we trying to determine the membership of the local Administrators group on each computer on their network. The had determined that non-admin users were being added to the local Administrator group and needed to know how widespread the problem was. Once they determine that I recommended they use Group Policy, Restricted Groups to fix the problem.

The VBScript below follows my standard script format that starts with an input file (INPUT.TXT) with a list of computers and automatically creates a tab-separated (for analysis in Excel) output file based on the name of the input file and appends RESULTS.TXT to the name. Once we open the input for to read, and the output file for writing we start the loop. The real work happens in the DO WHILE loop. First thing we do is run a Function named Get ComputerStatus. Since we are connecting to a remote computer, I use this function to determine if a computer is online by pinging it. If it is online we continue, if not we write "Computer Could Not Be Contacted" to the log and get the next computer in the list. The EnumGroup function is used to get the membership of the local Administrators group and write it to the log file. Once we finish the files are closed and the log file is opened in notepad.

To use this script, copy the contents to notepad and save the file with a VBS extension. Create an input file with computer nameon each line. You can run the script by double clicking it but I prefer to run it from a command prompt using cscript so that I only have a single command prompt instead of a command prompt for every "ping". If anyone uses this script and finds it useful leave me a comment and/or a rating.

LocalAdminGroupMembership.vbs

'**********************************************
' SCRIPT: LocalAdminGroupMembership.vbs
' AUTHOR: Muaddib :-)
'  DATE: 08/21/08
' VERSION: 1.0
' PURPOSE: Used to Query remote computers and enumerate memebers of
'          local admin group
'   USAGE: 1. List computers to be queried in input.txt (other text file)
'          2. LocalAdminGroupMembership.vbs
'          3. Output file, results.txt will show status
'Revision:
'
'
'**********************************************

Option Explicit

'ON ERROR RESUME NEXT 'Do Not Uncomment until script is ready for production

Dim oWshShell, oFSO, oFileName1, oFilename2, objWMIService, colItems, sProtocol, sSearch, sNWStatus, sDate, iErrNumber
Dim objItem, strComputer, oExec, strPingStdOut, sStatus, bComputerOnline, aComputers, Computer, sOutPutFile, sInPutFile, sComputerStatus
Dim arrFileNAme, sOutPutFileName,objGroup, strOffset

CONST ForReading = 1
CONST ForWriting = 2
CONST ForAppending = 8

'Prompt for name of input file
sInPutFile = INPUTBOX("Enter name of input file. Input file must exist in the script folder.", "Enter Input File Name","input.txt" )
IF sInputFile = "" THEN
   wscript.echo "Operation was cancelled"
   wscript.quit
END IF

'Trim extension from sInputFile1
arrFileNAme = Split(sInPutFile, ".")
sOutPutFileName = UCASE(arrFIleNAme(0))
'Prompt for name of output file
sOutPutFile = INPUTBOX("Enter name of output file. Output file will be placed in script folder.", "Enter Output File Name",sOutPutFileName & "_RESULTS.TXT" )
IF sOutPutFile = "" THEN
   wscript.echo "Operation was cancelled"
   wscript.quit
END IF

Set oWshShell = Wscript.CreateObject("Wscript.Shell")
Set oFSO = CreateObject("Scripting.FileSystemObject")

'Open input file and read
Set oFilename1 = oFSO.OpenTextFile(".\" & sInPutFile, ForReading, False)
iErrNumber = err.number
'Check for missing file
IF iErrNumber = 53 THEN
Wscript.echo "Error - " & sInPutFile & " file was not found."
wscript.quit
END IF

Set oFilename2 = oFSO.OpenTextFile(".\" & sOutPutFile, ForWriting, True)

' OPTIONAL LOG HEADER
'Get date and write it to log
'sDate = Now()
'oFilename2.writeline "Log Started " & sDate
'oFilename2.writeblanklines 1

'Read external list of computers and check their status
DO While oFilename1.AtEndOfStream <> True
    strComputer = oFileName1.ReadLine

    IF GetComputerStatus(strComputer) = 1 Then
        'sComputerStatus = "Online"
        Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators,group")
        sComputerStatus = EnumGroup(objGroup, "")
      Else
        sComputerStatus = "Computer Could Not Be Contacted"
    End IF

    oFilename2.writeline strCOmputer & vbTab & sComputerStatus
Loop

'OPTIONAL LOG FOOTER
'sDate = Now()
'oFilename2.writeblanklines 2
'oFilename2.writeline "Log Completed " & sDate

'Close input file
oFilename1.close
'Close Log file
oFilename2.close

'Wscript.echo "Finished Scanning Computers" 'open log file
oWshShell.run "notepad.exe .\" & sOutPutFile, 5, FALSE

Set oWshShell = Nothing
Set oFSO = Nothing
Set oExec = Nothing
Set oFilename1 = Nothing
Set oFilename2 = Nothing

Function GetComputerStatus (strComputer)
'Function Returns a 1 if computer is available
'Used to determine if a computer is online before
'attempting WMI connection
'IP Address or computer name can be used
Dim sStatus
sStatus = 0
'   wscript.echo "Echo strCOmputer - " & strcomputer
Set oWshShell = Wscript.CreateObject("Wscript.Shell")
Set oExec = oWshShell.Exec("ping -n 2 -w 1000 " & strComputer)
strPingStdOut = oExec.StdOut.ReadAll
    If InStr(1,strPingStdOut, "reply from ",1) <> 0 Then
      sStatus = 1
    Else
      sStatus = 0
    End IF
    GetComputerStatus = sStatus
END FUNCTION

Function EnumGroup(objGroup, strOffset)
   Dim objMember, strMembers
   For Each objMember In objGroup.Members
      strMembers = strmembers & strOffset & objMember.Name & ", "
   Next
EnumGroup = strMembers
End Function

Sample INPUT.TXT

Computer1
Computer2
Computer3
Computer4

Sample Input_RESULTS.TX

Computer1 Computer Could Not Be Contacted
Computer2 Administrator, Administrator, Domain Admins, SMS_ADMIN,
Computer3 Administrator, Domain Admins, Administrator, SMS_ADMIN,
Computer4 Administrator, Domain Admins, Administrator, SMS_ADMIN,

Modifying Security on Active Directory Objects using a script

MuadDib — Fri, 14 Dec 2007 22:17:00 GMT

I was working with a customer this week and we found some user objects in Active Directory had incorrect security settings. I put together a list of commands for the customer to use. I thought a few of the FOR command examples below were useful so here you go...

These command can also be used in a script. Keep in mind the FOR command syntax changes slightly (FOR /?) when used within a batch file.

DUMP CNs for all users in an OU
DSQUERY USER "ou=test accounts, dc=contoso,dc=local"

Show security for an object in Active Directory
DSACLS "cn=Jane doe1,ou=test accounts, dc=contoso,dc=local"

Show security for the SELF security principle on an object in Active Directory
DSACLS "cn=Jane doe1,ou=test accounts, dc=contoso,dc=local" | find /i "self"

Use DSACLS on list of users in a file
FOR /F "tokens=* usebackq" %i in (`type users.txt`) DO dsacls %i
(NOTE ` is a back quote found on same key as ~)

Use DSACLS on output of DSQUERY USERS <OU DN>
FOR /F "tokens=* usebackq" %i in (`dsquery user "ou=test accounts,dc=contoso,dc=local"`) DO dsacls %i
(NOTE ` is a back quote found on same key as ~)

FOR /F "tokens=* usebackq" %i in (`dsquery user "ou=test accounts,dc=contoso,dc=local"`) DO dsacls %i | find /i "self"
(NOTE ` is a back quote found on same key as ~)

Reset a user to the default permissions as defined by the schema
DSACLS "cn=jane doe1,ou=test accounts,dc=contoso,dc=local" /S (case sensitive)

Perfrom same task for all users in an OU
FOR /F "tokens=* usebackq" %i in (`dsquery user "ou=test accounts,dc=contoso,dc=local"`) DO dsacls %i /S (case sensitive)

Controlling Virtual Machines with a Script

MuadDib — Mon, 16 Apr 2007 14:25:00 GMT

I discovered how easy it is to control virtual machines with a script this weekend. I have one server that I use to run virtual machines that I keep running all the time. When I patch this server, I need to shut down all VMs before it is restarted and then restart the VMs after the computer starts. After doing a quick search I discovered it only takes a few lines of code to shutdown or start a VM.

Shutdown a server named Server1
On Error Resume Next
Set objVS = CreateObject("VirtualServer.Application")
Set objVM = objVS.FindVirtualMachine("Server1")
Set objGuestOS = objVM.GuestOS
objGuestOS.Shutdown()

Startup a server named Server1
On Error Resume Next
Set objVS = CreateObject("VirtualServer.Application")
Set objVM = objVS.FindVirtualMachine("Server1")
objVM.Startup()

If you have multiple VMs you can put them all in the same script as shown below:

On Error Resume Next
Set objVS = CreateObject("VirtualServer.Application")
Set objVM = objVS.FindVirtualMachine("Server1")
Set objGuestOS = objVM.GuestOS
objGuestOS.Shutdown()
sleep 15000
Set objVS = CreateObject("VirtualServer.Application")
Set objVM = objVS.FindVirtualMachine("Server2")
Set objGuestOS = objVM.GuestOS
objGuestOS.Shutdown()

So to make things easier on me I wrote two simple scripts; one that starts the VMs and one that stops them. I then configured a local policy on the server to run the script that starts the VMs as a "Startup Script" so the VMs would start automatically every time the server is started.

Virtual Machine and Virtual Server Properties
http://www.microsoft.com/technet/scriptcenter/scripts/vs/default.mspx?mfr=true

Enable Remote Desktop

MuadDib — Fri, 01 Dec 2006 15:10:00 GMT

Remote Desktop is one of the greatest features added to the Windows operating system. It enables you to perform remote administration of servers from your desk or fix one of your kids computers from the couch. Of course it's only great if it is enabled on the computer you are trying to access. If you find yourself unable to connect to a remote computer because Remote Desktop has not been enabled you can enable it remotely by flipping a bit in the registry using regedt32.

Here's how:

Use regedt32 to open the registry of the remote computer.
Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
Change fDenyTSConnections to 0x00 (0x01 disables). If the key is not there create it.

To enable Remote Assitance set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\fAllowToGetHelp to "1"

This is old news to most of us in IT. I posted here because the information on the reg key is hard locate when you need it. I was on-site at a customer yesterday and spent 30 minutes trying to locate this in the Microsoft Knowledgebase without finding it.

Active Directory LDAP Searches

MuadDib — Wed, 25 Oct 2006 01:10:00 GMT

A nice feature in Windows Server 2003 Active Directory is the ability for an administrator to create saved queries in their admin console. The queries you can create through the GUI are pretty basic so to get the real benefit you need to create a "Custom Search", click the Advanced tab and enter an LDAP query. The only problem is... you have to enter an LDAP query.

For a lot of administrators, you come up against the LDAP query box, start to research how to write an LDAP query, get interrupted and never finish learning how to create an LDAP query. I know in my case I am not doing AD administration everyday so when the task of creating an LDAP query for a customer arises it has usually been so long since the last time I wrote one that I have forgotten how. So I was creating some queries for a customer today and decided I would post them here for future use. The LDAP code listed below can be cut and pasted into the the query editor in AD and saved.

First LDAP reference material:

LDAP Query Basics
http://www.microsoft.com/technet/prodtechnol/exchange/2003/insider/ldapquery.mspx

XADM: Browsing and Querying Using the LDP
http://support.microsoft.com/?id=255602

Search Filter Syntax
http://msdn2.microsoft.com/en-us/library/aa746475.aspx

Creating More Efficient Microsoft Active Directory-Enabled Applications (create efficient LDAP queries)
http://msdn.microsoft.com/en-us/library/ms808539.aspx

How to use the UserAccountControl flags to manipulate user account properties
http://support.microsoft.com/kb/305144

How to query Active Directory by using a bitwise filter
http://support.microsoft.com/kb/269181

Now on to the queries.

All XP Computers
Although this can be done easy enough with the GUI, I wanted to show the syntax so it can be used as a building block for more complex theories. One thing to notice is the query parameter "objectCategory=computer". By including this as part of our query we reduce the number of objects that have to be searched making for a faster query and less performance impact on the DC performing the query.
(&(objectCategory=computer)(operatingSystem=Windows XP*))

Windows XP Computers with Service Pack 2 Installed
(&(objectCategory=computer)(operatingSystem=Windows XP Professional)(operatingSystemServicePack=Service Pack 2))

Windows XP Computers with Service Pack 1 Installed
(&(operatingSystem=Windows XP*l)(operatingSystemServicePack=Service Pack 1)))

Windows XP Computers with No Service Pack Installed
This one is structured a Little different. Notice the "!" before operating SystemServicePack and the "*". The "!" means NOT so the statement reads "NOT equal to anything" instead of NULL or empty quotes ("") like some other languages.
(&(operatingSystem=Windows XP Professional)(!operatingSystemServicePack=*)))

Windows Server 2003 No Service Pack 1
(&((objectCategory=computer))(operatingSystem=Windows Server 2003)(!operatingSystemServicePack=*)))

Windows Server 2003 Service Pack 1 Installed
(&(objectCategory=computer)(operatingSystem=Windows Server 2003)(operatingSystemServicePack=Service Pack 1))

Windows 2000 Professional
(&(objectCategory=computer)(operatingSystem=Windows 2000 Professional))

Windows 2000 Server
(&(objectCategory=computer)(operatingSystem=Windows 2000 Server))

All Windows Server 2003 Servers
(&((objectCategory=computer))(operatingSystem=Windows Server 2003))

SQL Servers (running on Windows 2003) (please verify in your environment)
(&(objectCategory=computer)(servicePrincipalName=MSSQLSvc*)(operatingSystem=Windows Server 2003))

SQL Servers any Windows Server OS
(&(objectCategory=computer)(servicePrincipalName=MSSQLSvc*)(operatingSystem=Windows Server*))

Windows Vista SP1
(&(objectCategory=computer)(operatingSystem=Windows Vista*)(operatingSystemServicePack=Service Pack 1))

Windows Server 2008 Enterprise
(&(objectCategory=computer)(operatingSystem=Windows Server® 2008 Enterprise)(operatingSystemServicePack=Service Pack 1))

Windows Server 2008 (all versions)
(&(objectCategory=computer)(operatingSystem=Windows Server® 2008*))

Sample User Attribute Query (ExtensionAtrribute5)
(&(objectCategory=user)(&(extensionAttribute5>=20080101)(extensionAttribute5<=20080520)))

USER ACCOUNT CONTROL EXAMPLES

UAC - Smart Card Login Enforced on The User Object
(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=262144) )

UAC - PWD Never Expires
(&(objectCategory=person)(userAccountControl:1.2.840.113556.1.4.803:=65536))

UAC - CAC Enabled Accounts (no disabled accounts or password never expires)
(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!userAccountControl:1.2.840.113556.1.4.803:=65536)(userAccountControl:1.2.840.113556.1.4.803:=262144)(userPrincipalName=1*@mil))

UAC - Not CAC Enabled (no disabled accounts or password never expires)
(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!userAccountControl:1.2.840.113556.1.4.803:=65536)(!userPrincipalName=1*@mil))

So you get the idea of the basic syntax When you create your own queries make sure you use the the actual attribute name and not the label visible in the Active Directory Users and Computers interface. You can find the attribute names by using ADSIEDIT.MSC. Right click an object and select properties from the context menu. Scroll through the list of attributes till you find the one you are looking for. You should also copy the actual value from within ADSIEDIT.MSC and paste it into you query string to prevent typing errors (in case you type as bad as I do). Make sure when you enter the search string into the query editor there are no carriage returns or extra characters after the last parenthesis.

Read the article "Creating More Efficient Microsoft Active Directory-Enabled Applications" referenced above to make sure you are writing efficient queries that won't bring your LDAP server to its knees.

One other useful tip. Once you have created some saved queries, you can export them as XML files and share them with others. They can be imported into another management console in the same domain or a different domain.

One final tip. You can copy and paste the code from the samples above. Paste it into a text editor like Notepad first to remove all the formatting imposed by the HTML page.

Automate Network Adapter Configuration using NETSH

MuadDib — Tue, 24 Oct 2006 18:04:00 GMT

So I'm kind of lazy. Not in the "sleep late and don't go to work" slacker way, I just don't like doing dull repetitive tasks if they can be automated in some way. As a rule if I have to do the same task more than a couple of times I'm writing a script (or getting someone else to do it).

During the years I worked as a consultant it was not uncommon to connect my laptop to several different networks in the same day. In some cases they were DHCP enabled so connection was easy. For others I would have to configure the network adapter manually. Ugh!

Enter the NETSH commands. The NETSH command can be used to modify the network configuration on Windows 2000 and later computers. It's not the friendliest syntax to use but it is a real time saver once you learn to use it (I have noticed the version that ships with Vista seems almost intuitive). Listed below are sample script for using NETSH to set STATIC IP entries on an adapter and another script to set the adapter back to DHCP mode so the settings can be obtained automatically. The command syntax for Vista and XP are slight different due to the fact that Vista supports IPV6 natively so sample scripts for each OS are listed below. To use the code, paste it into a batch file and modify the "name=" to the name of the adapter in quotes and change the IP addresses.

VISTA - Static IP

netsh interface ipv4 set address name="Wireless Network Connection 2" source=static addr=192.168.0.100 mask=255.255.255.0 gateway=192.168.0.250 gwmetric=0
netsh interface ipv4 set dnsserver name="Wireless Network Connection 2" source=static addr=192.168.0.2 register=NONE
REM netsh interface ipv4 set wins name="Wireless Network Connection 2" source=static addr=155.217.27.9
REM OR if no WINS server
netsh interface ipv4 set winsserver name="Wireless Network Connection 2" source=dhcp
ipconfig /all

VISTA - DHCP

netsh interface ipv4 set address name="Wireless Network Connection 2" source=dhcp
netsh interface ipv4 set dnsserver name="Wireless Network Connection 2" source=dhcp
netsh interface ipv4 set winsserver name="Wireless Network Connection 2" source=dhcp
ipconfig /renew "Wireless Network Connection 2"
ipconfig /all

XP - Static IP

netsh interface ip set address name="BROADCOM" source=static addr=192.168.27.40 mask=255.255.255.224
netsh interface ip set address name="BROADCOM" gateway=192.168.27.33 gwmetric=0
netsh interface ip set dns name="BROADCOM" source=static addr=192.168.98.12 register=NONE
netsh interface ip set wins name="BROADCOM" source=static addr=none

XP - DHCP

netsh interface ip set address name="BROADCOM" dhcp
netsh interface ip set dns name="BROADCOM source = dhcp
netsh interface ip set wins name="BROADCOM" source=dhcp

Remote Desktop Connection (akaTerminal Server) Keyboard Shortcuts

MuadDib — Fri, 13 Oct 2006 18:05:00 GMT

I use Remote Desktop all day at work. It is especillay helpful when writing documentation. One of the problems I always run into is trying to remember which keyboard short you can use to capture a screen-shot in a TS session. Since I had to dig these up again today I decided to post them here where they are easy (for me) to find.

Shortcut key             Description
ALT+PAGE UP          Switches between programs from left to right.
ALT+PAGE DOWN     Switches between programs from right to left.
ALT+INSERT              Cycles through the programs in the order they were started.
ALT+HOME                Displays the Start menu.
CTRL+ALT+BREAK    Switches the client between a window and full screen.
CTRL+ALT+END         Brings up the Windows Security dialog box.
ALT+DELETE             Displays the Windows menu.
CTRL+ALT+(-)            Places a snapshot of the active window, within the client, on the Terminal server clipboard
                                 (provides same functionality as pressing PrintScrn on a local computer.)
CTRL+ALT+(+)           Places a snapshot of the entire client window area on the Terminal server clipboard
                                  (provides the same functionality as pressing ALT+PrintScrn on a local computer.)

NOTE: for last two commands use the symbol on the numeric keypad without the ().
keypad

Windows Live Favorites

MuadDib — Sun, 01 Oct 2006 07:24:00 GMT

So I am an information junkie. When I surf the web I am constantly bookmarking things I'll use in the future ( OK sometimes). One of the biggest problems with bookmarks is having more than one computer. If you have more than one computer keeping your bookmarks synchronized is a pain. Until now.

Windows Live Favorites lets you access you favorite sites from any computer. You simply log into the web site and “import” your favorites into the web site. You can also “export” your favorites to a bookmark.htm file that can be imported into another computer.

Windows Live Favorites
http://favorites.live.com

To automate the management of your favorites on multiple computers you can add the Windows Live Toolbar and the Windows Live Favorites Toolbar Button. Once these are installed all your computers will synchronize their bookmarks with htt://favorites.live.com enabling you to have the same bookmarks on every one of your computers. Adding a favorite on one computer adds it to all computers. You can create sub-folders (e.g. Work, Personal, Hobby etc.) in your favorites to help organize all your shortcuts.

Windows Live Toolbar
http://toolbar.live.com

Windows Live Favorites Toolbar Button
http://gallery.live.com/liveItemDetail.aspx?li=b3636b52-acd2-4278-91ae-04cefb380004&bt=2