When so-called 'professionals' do IT wrong.

As an IT Service Provider, have you ever visited a potential client and had an overwhelming urge to punch the current IT support company in the face? I've had a few of these recently and unfortunately the only thing one can do in this situation is facepalm and try to explain to the client that it's very lucky they called us in before something catestrophic happened...

 

 

I'm not trying to judge - We are all human and mistakes are naturally acceptable - but when you blatently lie to the client and take their money with a smile, you are not only giving real IT people a bad name, but you let down the human race as a whole...

 

I totally understand if they couldn't get the client to purchase a better quality server, but why then charge for SBS 2011 Standard and an Office 365 subscription?

 

Or how about the guys that put the Exchange logs on an external USB drive because they couldn't figure out how to get the backup to work and ran out of space on the internal drives? And then the client wonders why Outlook goes offline when someone walks into the chaos that is the server room closet and trips over the external drive's power cord :-/

 

And the people that thought it would be a good idea to have 3 different routers - all with DHCP enabled, running the same scope, but different gateway and DNS settings on 1 simple network range for 5 users? C'mon!

 

Then the company that was going to sell the client a SAN and not upgrade their VMware Licence to Essentials Plus, effectively making it an extremely overpriced DAS...

 

Maybe I'm just being overly critical here, but I say if you're going to charge to do something, at least do it ethically, and to a basic set of best-practises defined by the vendor of the product you are using...

 

Ok, rant over...



 

Feel free to post your horror stories in the comments :-)

 

-Ninjatek

Restore Folders that have been Hidden by a Virus

A common move for a virus is to change all the folders on a drive to Hidden System Folders. This gets very confusing when you see the drive is 80% used, but only has a few files on it…

As soon as you realise something funny like this has happened, run an Anti-Virus Scan on the drive (whoever borrowed your drive doesn’t have adequate AV protection). Once you have got a clean result you need to get your folders back.

To View the hidden folders:
dir /ah

To remove the Hidden and System attributes from folders:
attrib *. -h -s /s /d

Step by Step:

1. Open a command prompt (Start -> CMD)
2. Type in: cd\ (This will take you to the root of the drive)
3. Type in the affected drive letter, eg: E:
4. To view the hidden folders, type in: dir /ah
5. To make them all visible again, type in: attrib *. -h -s /s /d

-Ninjatek

MailMarshal – Still receiving mail from a Blacklisted Domain/Email Address

If you have Blacklisted a domain or single address but still receive mails from someone at that domain, I have two possible solutions for you.

Take a look at this hypothetical example:

1. A user receives an email from a company with an ‘aggressive’ marketing campaign (spam)
   
   
2. The user replies using as many expletives as possible
   
   
3. The spammers now know they are getting through your anti-spam protection, so email the user more than ever.
   
   
4. The user now asks IT to block the spammer.
   
   
5. IT blocks the spammer’s email address.
   
   
6. Spam still gets through.
   
   
7. IT blocks the spammer’s whole domain.
   
   
8. Spam still gets through.

Option 1:

When the user replies to the spammer (Step 2), Mail Marshal adds the spammers address to its Auto-Harvested Whitelist. Even when IT adds the email address to the Blacklist, the whitelist takes precedence.

To resolve, simply delete the entry from the Auto-Harvested Whitelist.


Option 2:

If the Spamee has never responded to the Spammer (ie, start at Step 4 in above example), then they could be using an email marketing company to send their spam out for them, in which case the Email address might be different to the address/domain that you have blacklisted.

By default MailMarshal has a Connection Rule to check against the Global Blacklist to block mails coming into the organization. The only problem with that is a Connection Rule can only see the address, so in the case of our example the mail will still get through.

To deal with this you will need to create a new Standard Rule to be able to check the originator address header field (Sender address). This Rule will then catch any mails that make it past the default Connection Rule.



References:
http://www.m86security.com/KB/Print12238.aspx


Happy Blocking!

-Ninjatek

Move WSUS Database and Content Directory to another Drive

WSUS is great, but when it starts filling up your server's already full hard drive it turns into a problem.

Here are the steps to move your WSUS Database and Content Directory from C:\WSUS to D:\WSUS on the same server (D: being the new hard drive you just installed)

Moving the Content Directory

From a Command Prompt, locate WSUSUTIL.exe (C:\Program Files\Update Services\Tools) and run the following:

wsusutil.exe movecontent D:\WSUS\ D:\WSUS\move.log

(where D:\WSUS is the destination)

Moving the WSUS Database

1. Stop Update Services and IIS Admin Service

2. Open MS SQL Server Management Studio Express

3. Connect to Database Engine - \\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query

4. Detach SUSDB (Tasks->Detach); Tick the Drop Connections box

5. Move the SUSDB Folder from C:\WSUS to the new location

6. Attach SUSDB (Right Click Databases -> Attach)

This can also be done via CMD Prompt without SQL Studio – Something I have not tested yet:

To detach:
SQLCMD.EXE -E -S np:\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query -Q "sp_detach_db 'SUSDB'"

To attach:
SQLCMD.EXE -E -S np:\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query -Q "sp_attach_db @dbname=N'SUSDB',@filename1=N'D:\WSUSDB\SUSDB.mdf', @filename2=N'D:\WSUSDB\SUSDB_log.ldf'"

And that's it. Now you have more space on C: for that cat-lady to store more photo's of Mittens :-/

Mailbox Move Fails in Exchange 2010

During a recent migration project from Exchange 2003 to Exchange 2010, I received an error while moving a mailbox over to the new server…

Active Directory operation failed on ADSERVER. This error is not retriable. Additional information: Insufficient access rights to perform the operation.
Active directory response: 00002098: SecErr: DSID-03150BB9, problem 4003
(INSUFF_ACCESS_RIGHTS), data 0
The user has insufficient access rights.

After comparing the AD user’s ACL against another user that was already migrated, I noticed some major differences. The problem was that sometime in the past someone had fiddled where they shouldn’t have been fiddling…

Solution:

In Active Directory, go to View and tick Advanced Features
Go to the user’s properties, select the Security Tab
Click Advanced
Tick “Include inheritable permissions from this object’s parent”

BackupExec 2010 not completing job: “Remove Media from the Drive”

When I ran the first backup job on the newly installed HP LTO-5 Ultrium 3280 Tape drive, it gave an interesting alert.

The alert was: “Please remove the media from the drive”

Odd…

Apparently since LTO4, the drive has a sensor to check whether there is a tape in the slot or not. If you have set the job to automatically eject the media, then BackupExec will not complete the job until you manually remove the tape from the drive, even though it is ejected, OR respond to the alert.

The solution is to create an automatic response to this specific alert, telling BackupExec to clear the alert when it comes up. This will enable the job to complete successfully.

To set the Automatic Response:

Alerts -> Configure Alert Categories -> Media Remove -> Automatically clear alert after: 1min

The log as per Windows Event Viewer Application Log:

Log Name: Application
Source: Backup Exec
Date: 6/22/2011 11:22:25 PM
Event ID: 58063
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: BackupSVR
Description:
Backup Exec Alert: Media Remove
(Server: " BackupSVR ") (Job: "Full Daily Backup") Please remove the media from the drive, and Respond OK.

How to NOT use remote gateway with Windows VPN

Have you ever been connected to a VPN, then realise you need to download something, so you have to disconnect the VPN to get your local network’s fast download speed? Well you don’t actually have to...

I use the Windows VPN client a lot to connect to a lot of my remote clients, and as long as the portion of their network that I need to connect to doesn’t run over multiple subnets, I don’t need to use the default gateway of the remote network. This means you can be connected to the VPN and still use the internet using your local connection. It’s a lot faster than over the VPN I promise :-)

The option you need to change is nicely hidden away, so I understand why this is not a well-known feature:

• Right Click on the VPN connection
• Click Properties
• Select the Networking Tab
• Click TCP/IP v4
• Click Properties
• Click Advanced
• Untick Use default gateway on remote network

Recover POP Mail Password

If you work with clients with POP mail accounts at all, then this tool is going to save you A LOT of time and effort when they lose their password (NOTE: not IF, WHEN)

http://www.nirsoft.net/utils/mailpv.html

It’s called Mail PassView (created by the legends at NirSoft) and it supports pretty much any mail client there is. It also makes a great tool for when you need to backup a PC. Just export all the mail accounts and details to a text file and copy that over with the rest of the data.

Do you have any really useful freeware apps to share? Send a link to ninjatek777@gmail.com

Give Users Full Control & Ownership Permissions to their Subfolders on a Share

Here’s a great script to give user’s full control and ownership of their subfolders in a share (with their username as the subfolder name).

Problem:

You have a share on SERVER called USERS that has your user’s folders (their username = subfolder name). The problem is that none of the users have permissions to their folders…

\\SERVER\USERS\JBond

\\SERVER\USERS\BGates
\\SERVER\USERS\SBallmer

The Users folder is located at C:\USERS\

Solution:

• Create a batch file called UserFolderOwner.bat containing the following code:

@echo off

if {%1}=={} @echo Syntax: UserFolderOwner FolderPath&goto :EOF

if not exist %1 @echo UserFolderOwner - %1 not found&goto :EOF

pushd %1

for /f "Tokens=*" %%a in ('dir %1 /b /AD') do (

 @echo y| cacls "%%a" /t /e /c /g "%UserDomain%\%%a":F

 subinacl /subdirectories "%%a" /setowner="%UserDomain%\%%a"

 subinacl /subdirectories "%%a/*.*" /setowner="%UserDomain%\%%a"

)

popd

• Download and install SubInAcl

The Batch file UserFolderOwner.bat uses SubInAcl to give the user Ownership of the subfolder and CACLS to set Full Control permissions

To run the batch file from CMD type: 

UserFolderOwner.bat ParentFolder

Where ParentFolder is the path to the Folder (C:\USERS)

Let that run and you will have saved yourself hours of manual labour…

Many Thanks to Jerold Schulman at WindowsITPro.com for creating this great script! (JSI Tip 8648).

Trusteer Rapport BSoD

Trusteer Rapport is an application that over 70 banks around the world have asked their customers to use to prevent Phishing and Malware attacks. I came across an issue this week where this application would cause the computer to Blue Screen of Death every time the user attempted to go to his Online Banking.

This is obviously not what it is intended to do.

Chatting to their tech support (very efficient), it came out that it is a known problem caused by a conflict between Rapport's protection mechanism against "Kernel Keylogging" and the computer's mouse driver configuration.
They say it should be fixed in an upcoming version, but if you have this issue, here is a work-around:

1) Open Rapport's Console (Start > Programs > Trusteer Rapport > Rapport Console)

2) Click on the arrow icon to move to page 2

3) Click on "Edit Policy" in the "Security Policy" widget

4) Type the required characters

5) Locate "Block Kernel Keylogging (PS/2)" and choose "Never" in the drop-down list next to it

6) Locate "Block Kernel Keylogging (USB)" and choose "Never" in the drop-down list next to it

7) Click on "Save"

8) Restart your PC and see if the problem still occurs

Proxy Autodetection using a PAC file and WPAD

This is a really great and really easy feature to implement on your network. It basically means that you never need to manually enter the details for your proxy server in your internet browser…It will pick it up automatically…how cool is that?!

OK, so here’s the gameplan:

1)      Create a PAC (Proxy Automatic Configuration) file

2)      Publish your PAC file

3)      Enable Autodetection using WPAD (Web Proxy Autodiscovery Protocol)

a.       DHCP – preferred for IE

b.      DNS – required for other browsers (eg Firefox)

4)      Use Group Policy to Enable Automatically Detect Settings option in IE

1 - Creating a PAC file

PAC files contain JavaScript code used to define where to find a proxy server under certain conditions. I’m not going to get into the advanced functions of PAC files, as there are plenty of great resources on the web already (see end of post)

Here is a basic PAC file for a single address range network with no special conditions. All you need to do is change the BOLD to your network’s details. We want to be able to configure WPAD through DNS as well as DHCP, so we will need this file to be called wpad.dat (lowercase) – The DNS method requires this naming format.

Copy this into notepad and save it as: wpad.dat

function FindProxyForURL(url, host)

{

 if (isPlainHostName(host))

 {

  return "DIRECT";

 }

 if (isInNet(host, "192.168.0.0", "255.255.255.0"))

 {

  return "DIRECT";

 }

  if (isInNet(myIpAddress(), "192.168.0.0", "255.255.255.0"))

 {

  return "PROXY 192.168.0.1:8080";

 }

}

In the above example:

The IP range is: 192.168.0.0

Subnet Mask is: 255.255.255.0

Proxy Server IP is: 192.168.0.1

Proxy Server Port is: 8080

You can test your PAC file by entering it manually into Internet Explorer:

Tools -> Internet Options -> Connection -> LAN Settings -> Use Automatic configuration script

Address: file://C:\wpad.dat                    (With the wpad.dat file located on the C: root)

2 – Publishing the PAC file

We will publish our PAC file using IIS. If you don’t have IIS running yet, pause reading now while you quickly add it.

Ready?

Great…

If you are using IIS 6:

·         Right Click on the domain name and click Properties

·         On the HTTP Headers tab click MIME Types

·         Click New
Extension: .dat
MIME Type: application/x-ns-proxy-autoconfig

·         Click OK.

If you are using IIS 7:

·         Click on the Server

·         On the right hand side double click MIME Types

·         On the Right hand Pane click Add…
Extension: .dat
MIME Type: application/x-ns-proxy-autoconfig

·         Click OK.

Copy the wpad.dat file to the C:\inetpub\wwwroot\  directory of the IIS server.

3a – Enabling Autodetection using DHCP

·         Open the DHCP console

·         Server 2003: Right Click the server's name

·         Server 2008: Right Click on IPv4

·         Click Set Predefined Options…

·         Right Click on IPv4 and click Set Predefined Options…

·         Click Add…
Name: WPAD
Data type: String
Code: 252

·         In the String Value box, type the URL of the PAC file (eg: http://192.168.0.1/wpad.dat)

·         Right click Server Options and click Configure Options

·         Confirm that 252 – WPAD is ticked and contains the correct URL.

·         Right Click Scope Options and click Configure Options

·         Scroll Down and tick 252 – WPAD

·         Click OK

3b – Enabling Autodetection using DNS

·         Open the DNS console

·         Right click the appropriate Forward Lookup Zone and click New Host (A)

·         In Name type: wpad

·         Enter the IP address of the IIS server

NOTE: WPAD in Server 2008 DNS server Global Query Block List

If you are using Server 2008 you may not be able to ping WPAD once you have added the Host Record. This is because it is blocked by a new security measure called DNS server global query block list.  Please be aware of the reasons for this list before you remove wpad from it. Microsoft has an in depth document on the subject (See Source below).

To remove WPAD from the Global Query Block List, remove it from the following registry value:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\GlobalQueryBlockList

Source:   Google Search: DNS_Server_Global_ Query_Block List.doc

4 - Use Group Policy to Enable Automatically Detect Settings option in IE

Now that we are this far it should be working great…As long as the Automatically Detect Settings option is ticked in the client’s Internet Explorer. Here’s how to make that the default option for everyone in the domain using Group Policy:

·         Open Group Policy Management

·         Right Click on the Default Domain Policy and click Edit (or create a new GPO)

·         Go to the following: User Configuration\Policies\Windows Settings\Internet Explorer Maintenance\Connections

·         Open the Automatic Browser Configuration setting

·         Select Automatically detect configuration settings

·         Click OK

And that’s it…If all went well you won’t have to manually enter proxy settings in IE again. Below are some sites that explain how to use all the advanced settings of a PAC file.

http://findproxyforurl.com/pac_functions_explained.html

https://calomel.org/proxy_auto_config.html