windows 2003 sp1 bug in file sharing

I guess by default in Windows 2003 SP1, you must use the actual server name when connecting to it via SMB.  In other words, you can't use a dns CNAME record to connect to that box's shares unless you do the following registry change:

http://www.intelliadmin.com/blog/2006/01/cname-sharing-disabled-in-windows-2003.html

Explorer Destroyer - Switch to Firefox, Make money from Adsense Referral

Very interesting... Get paid by Google to help switch people to Firefox. Google is doing this because the Firefox that's downloaded is bundled with the Google Toolbar. It requires a Google Adsense account: www.google.com/adsense

Explorer Destroyer - Switch to Firefox, Make money from Adsense Referral

ryan powers | parodybag.net | Google Calendar Event Notifications for Verizon Wireless Customers

Work around for Verizon customer that want to use SMS notification via google calendar:
ryan powers | parodybag.net | Google Calendar Event Notifications for Verizon Wireless Customers

Firefox keyboard shortcuts

keyboard shortcuts for Firefox I didn't know about.

F7 - Caret browsing

ALT-ENTER open URL in new TAB

ctrl-enter adds www. .com shift-enter www. .net ctrl-shift-enter www. .org

open find dialog: / just like in vi. (this tip came from Daniel http://dmiessler.com/archives/752 )

Can't start Windows Firewall

Couldn't start windows firewall via control panel/security center. Tried starting the Windows Firewall services manually and got the following message:

could not start the windows firewall/internet connection sharing ics services

error 10047: an address incompatible with the requested protocol was used..

Fix: netsh winsock reset
then reboot
see -- After you run Microsoft Windows AntiSpyware (Beta), you have network-related problems, or you receive an error message

DNS/Wins/DHCP links and articles

How to enable or disable DNS updates in Windows 2000 and in Windows Server 2003 - http://support.microsoft.com/kb/246804  (Good KB on how DNS updates are performed)


How to configure DNS dynamic updates in Windows Server 2003 - http://support.microsoft.com/kb/816592/
When one of these events triggers a DNS update, the DHCP Client service, not the DNS Client service, sends updates. If a change to the IP address information occurs because of DHCP, corresponding updates in DNS are performed to synchronize name-to-address mappings for the computer. The DHCP Client service performs this function for all network connections on the system. This includes connections that are not configured to use DHCP.



If you use multiple Windows Server 2003-based DHCP servers on your network and if you configure your zones to enable secure dynamic updates only, use the Active Directory Users and Computers snap-in to add your DHCP server computers to the built-in DnsUpdateProxy group. When you do this, all your DHCP servers have the secure rights to perform proxy updates for any one of your DHCP clients. For more information, see the "Using DNS servers with DHCP" topic or the "Manage groups" topic in Windows Server 2003 Help.


Netbios name resolution requirements of exchange server 2003 - http://www.computerperformance.co.uk/w2k3/services/WINS_exchange.htm

WINS in Windows 2003 - http://www.computerperformance.co.uk/w2k3/services/WINS_Home.htm

WINS/DNS Integration - http://www.computerperformance.co.uk/w2k3/services/WINS_DNS.htm

WINS replication - http://www.computerperformance.co.uk/w2k3/services/WINS_Replication.htm

WINS troubleshooting - http://www.computerperformance.co.uk/w2k3/services/WINS_Troubleshooting.htm

DNS preferred order - http://support.microsoft.com/kb/286834

How to migrate a WINS Database from Windows 2000-based WINS server to a Windows 2003-based WINS server - http://support.microsoft.com/kb/875419
How to view and transfer FSMO roles in Windows Server 2003 - http://support.microsoft.com/kb/324801
How to move a DHCP database from a computer that is running Windows NT Server 4.0, Windows 2000, or Windows Server 2003 to a computer that is running Windows Server 2003 - http://support.microsoft.com/kb/325473
How to upgrade Windows 2000 domain controllers to Windows Server 2003 - http://support.microsoft.com/kb/325379

videos: Managing Windows Server 2003 Best Practices (FSMO,DHCP,DNS,WINS) -  http://www.microsoft.com/technet/community/events/windows2003srv/tnt1-106.mspx

dhcp bp - http://technet2.microsoft.com/WindowsServer/en/Library/75cd0e1f-f464-40ea-ac88-2060e6769f331033.mspx
wins bp - http://technet2.microsoft.com/WindowsServer/en/Library/ed9beba0-f998-47d2-8137-a2fc52886ed71033.mspx

dsa.msc /server=ipaddress

Ascii chart with the control codes/characters

ASCII table with control chars:
http://www.commonsoftinc.com/Babylon_Cpp/Documentation/Res/KASCIICharTab
le.htm

shell file name completion

On some Linux distros-
To have the shell complete the name using the Esc, Esc keystrokes:

set -o vi-esccomplete

Find unix (HP-UX) memory hog

Finding HP memory hog:

UNIX95= ps -xeo 'vsz pid args' |sort -nr|more

Curl and proxysg

Getting past proxysg via curl:

curl -u : --ntlm --location-trusted -b cookie.jar -c cookie.jar http://www.bonhamconsulting.com

with curlrc in place:  (--location disables the -L in the curlrc file)
curl -u : --ntlm --location --location-trusted -b cookie.jar -c cookie.jar http://www.bonhamconsulting.com

Listing HP-UX kernel parameters

HP Kernel parameters:

listing:
sysdef

kmtune
kmtune -l
kmtune -l -q {parameter}
ex: kmtune -l -q dbc_max_pct or just: kmtune -q dbc_max_pct

How to monitor a terminal session

shadow/view/watch a telnet session:

on the viewer's telnet session: chmod 666 /dev/pts/xx

on the "watched" session side, do: program_name | tee /dev/pts/xx

or just: script /dev/pts/xx

Test smtp using telnet

telnet smtp_server 25

RSET   (does a reset, if you happen to screw up one of the lines)

HELO mymail.me.local
MAIL FROM:<fromme@me.local>
RCPT TO:<toyou@you.local>
data

From: fromme@me.local
To: toyou@you.local
Date: Tue, 02 Aug 2005 12:24:31 -0500
Subject: this is a test

This is a manual smtp mailing test.

.


Note the single period on a line by itself at the end of the message.

View full email message source in Outlook 2003

View full email message source, not just headers in Outlook 2003:

http://www.slipstick.com/mail1/viewheaders.htm

HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Options\Mail\SaveAllMIMENotJustHeaders = 1 (Reg_Dword)

Citrix Metaframe client hangs

If the Citrix Metaframe client hangs after it says "connection established", "negotiating capabilities", then upgrade to version 9 or higher.  I think there are some issues running version 8.00.24737 as a "regular" or restricted user and not an administrator or power user.

STP on TruCluster NICS

Any NICs in a Tru64 TruCluster environment, whether they be the cluster interconnect or the regular public lan NICs, should have spanning tree protocol (STP) turned off on the port they are connected to. See the TruCluster Server Cluster Administration guide (part number: AA-RHGYE-TE

On a Cisco switch, in enable mode:

config t
interface FastEthernet0/1
no spanning-tree portfast

Don't forget to save the running config to nvram.

Remove the drunk monkey logo

Has this ever happened to you?:  one day you reboot your Windows 2000 machine to find that the default blue background at the control-alt-del screen has been changed to a white background with 3 drunk monkeys at the bottom of the screen.  For some odd reason this also coincides with departure of a former employee.  Curious huh?

 

Anyway to get rid of the monkeys, look in

HKEY_USERS\.Default\Control Panel\Colors

 

copy the value of Background_old to Background

 

in

HKEY_USERS\.Default\Control Panel\Desktop

 

copy the value of Wallpaper_old to Wallpaper

 

You can also get rid of the C:\winnt\drunk_logo.bmp file.

Spam map

Worldwide spam map:  http://www.trustedsource.org

also seems to include info specific domains.

Get AlphaServer SRM console version

To get the SRM console version (firmware) on an Alpha Server via a shell:

consvar -g version

Output will be something like this:

version = V7.0-3 Jun 16 2005 14:53:11

 

Get some more detailed info with the first two lines of output:

# consvar -v -l
Firmware Rev: 7.0-3
system fam:38  cpu:8  smm:1978

 

get the PALcode similarly:

consvar -g pal

 

Output will be something like this:

pal = OpenVMS PALcode V1.98-43, Tru64 UNIX PALcode V1.92-33

Remove formatting from man pages

To remove the formatting from man pages so that you can redirect them to text and view in vi or another editor you can create a shell alias and associated script:

 

alias mantext='~/bin/mantext.ksh'

 

mantext.ksh:

man $1 | sed -e 's/.//g'

 

Now use mantext instead of man when redirecting a man page to a file.

 

transition from batch to unix shell scripts

Converting DOS Batch Files to Shell Scripts - http://www.tldp.org/LDP/abs/html/dosbatch.html
Beginner's Guide to Unix Shell Programming - http://www-rnks.informatik.tu-cottbus.de/de/staff/mm/docs/BeginnersGuideToUnixShellProgramming.html

cron deficiencies

I was told to make a process run the first day of every month, but cron doesn't have the "smarts" to do it.  I found the following solution to be adequate:

From: http://www.darklab.net/resources/hpux-mailinglist/0715.html

DO SOMETHING ON THE LAST DAY OF A MONTH
 
Unfortunately, cron does not give us a simple way to say
'run this on the last day of month'. Fiddling with the
different length months, leap years, y2k bugs and so on is
messy. Here's a simple solution that gives all the dirty
work to some well tested utility. The idea is to check whether
*tomorrow* is the first day of a month.
 
Solution 1 (using date, change MET to your local time zone)
 
#!/bin/sh
if test `TZ=MET-24 date +%d` = 1; then
   # today is the last day of month
fi
 
You can call this script from cron, say with a crontab of
4 2 28-31 * * /path/to/your/script

Copy IAS configuration

I was getting a Reason-Code 16 in the system eventlog on a Windows 2003 ISA server and didn't know if the secret for the Radius clients was wrong, or if my config was wrong.  I had a Windows 2000 IAS server that was functioning fine.

I copied the IAS config from the Win2k box to the 2k3 box:
http://support.microsoft.com/kb/317589

By running netsh aaaa config > 2000.txt   and then running netsh exec 2000.txt on the Windows 2003 server.

Then my 2003 IAS started working.

RightFax Fax Cover Sheet conversion issues

The workservers would hang or crash when using Microsoft Word to convert the FCS.  You couldn't stop them in the Enterprise Fax Manager; they would just stay in a "stopping" state.  You would have to kill the workserver.exe processes.  Converting these to the RightFax native PCL format solved the issue and increased the stability and performance of RightFax in a huge way.

 

FCS (Fax Cover Sheets) are stored in Rightfax\FCS.  The source (word document) file is in a subfolder of FCS.  Typically the cover sheet should be PCL format.  See the AdministratorsGuide.pdf for details on how to create a FCS.

 

Using the built-in Windows 2000 HP LaserJet 4000 PCL driver produced the best results for us.

 

Here are some articles from Captaris that are useful:

190 - How do I run a RightFax 8.x or 9.0 WorkServer in Debug Mode?

3537 - Important information on Server Side Application (SSA) conversion using Microsoft Office applications

 

Basically don't use Word to do your fax cover sheet (FCS) conversion…..

Changing MSDE sa password

How to change the sa password of a MSDE database - http://support.microsoft.com/kb/321081

 

RightFax 9.0 upgrade from 8.5

I recently lead an upgrade and migration to a new physical server from Rightfax 8.5 on Win2k to 9.0 (with SP2) on Win2003 with Brooktrout TR114 Fax boards.  Here are some "Answer ID" documents from Captaris' knowledge base that are fairly important when migrating the configuration to a new server:

www.captaris.com look under support / knowledge base

 

2933 - RIGHTFAX 9.0 UPGRADE FAQ
2110 - Upgrading to RightFax version 9.0

 

I would also recommend taking screen shots or documenting all the settings in the control panel's applets on the old server.

 

Rightfax installs MSDE by default and it has a default 'sa' account with a blank password.  See the following answer ID and kb article title for a description of the areas in the Rightfax configuration that you need to change.

3449 - How do I change my 'sa' password in MSDE, and where do I modify the password in RightFax 9.0 SP1?

 

During the install I mistyped the password or username that a number of the Rightfax services run under.  (The installer will tell you the password or username is wrong but doesn't let you go back and correct the issue).  This causes the Workserver1, workserver2, workserver3 services never to be created and thus the Rightfax services don't startup properly.  I got a bunch of errors in event logs.  To recreate the services (this applies to any Rightfax service), you use the proper RightFax control panel applet (or right-click, configure the service in Enterprise Fax Manager).  In this case, open the "RightFax WorkServer" applet and then select the button at the bottom: "Select Service Account" and fill in the fields.  When you OK out of the dialogs the Workserver1,2,3 will be recreated.  Again if you foo-barred the password during the install you will need to do this on the following control panel applets:  RightFax E-Mail Gateway, RightFax Server (in the Advanced tab), and the RightFax WorkServer.  If more Rightfax options are installed, more applets may be installed.

 

Also Windows 2003 contains Brooktrout fax board drivers, but they don't work with the driver that RightFax needs/uses.  I had to follow the following knowledgebase articles:

215 - RightFax & Windows 2003 - How to remove the Brooktrout TR114/TruFAX PnP driver

After following that article I still needed to remove the faxboards in the RightFax DocTransport applet then re-add them.  This recreated the FaxBoard service so that it did not depend on the bfax driver.  If I didn't remove the fax boards and re-add them, then I got a whole bunch of errors in the event log.

Windowsupdate error 0x80072F76

When trying Windows Update (www.windowsupdate.com or update.microsoft.com) I got the following error instead of the normal "Express" and "Custom" scan buttons:

The website has encountered a problem and cannot display the page you are trying to view. The options provided below might help you solve the problem.
error 0x80072F76

Along with these entries in %systemroot%\WindowsUpdate.log:
2006-03-18 15:29:28  372 cd0 Misc WARNING: DownloadFileInternal failed for http://update.microsoft.com/v6/windowsupdate/selfupdate/wuident.cab : error 0x80072f76
2006-03-18 15:29:28  372 cd0 WUWeb FATAL: CheckIfClientUpdateNeeded failed: error 0x80072f76

http://support.microsoft.com/kb/836941

TDS accelerator was enabled and running.  I disabled the TDS download accelerator and was able to scan for updates on Windowsupdate.

 

urldecode

Online pages where you can post URL encoded (%20, etc...) data and get the decoded (human readable) version. On both of these sites you can encode or decode a URL.
http://www.albionresearch.com/misc/urlencode.php
http://www.simplelogic.com/Developer/URLDecode.asp

disable the F8 safe mode

Here's how to disable the F8 key to get into safe mode.  You may want to use this in a kiosk environment where you want to prevent someone going into safe mode:

http://groups.google.com/group/microsoft.public.win2000.security/browse_thread/thread/4db76c0cf6d216be?hl=en&
aka http://tinyurl.com/h89j3

http://www.kixtart.org/ubbthreads/showflat.php?Cat=&Number=132165&page=&view=&sb=5&o=&vc=1

Unload application disbled /greyed out in IIS

In IIS6 application unloading / recycling is handled differently.  You may notice that the "Unload" button is greyed out or disabled in the Application Settings area.  This is because the application is in native IIS 6 mode using application pools.  Synonymous to unloading the application in IIS 5 is the concept of recycling the application pool in IIS6, see the Application Pools folder in IIS manager (inetmgr).  The only time the Unload button will work is if the IIS web service is running in IIS 5.0 isolation mode and the Application Protection is set to either Medium or High.

HSG80 controller - setting time

set [this_controller | other_controller ] time 11-mar-2006:08:10:15

For instance, to set the time on the attached controller ("this" abbreviated) to 3/11/2006 at 8:10:15 am --
set this time 11-mar-2006:08:10:15

blogger "mail-to-blogger" feature stops working - marked as draft

If you used to be able to use the mail-to-blogger feature to email posts and have them publish directly to you blog, but now they don't publish and instead sit in your lists of posts as a draft, then your blog has been flagged as possible spam blog.

Why are all my posts being set to drafts? - http://help.blogger.com/bin/answer.py?answer=1263

Edit just one draft and by the word verification area click the ? question mark. Blogger will review your blog to verify it's not spam and you'll be able to publish like you used to. I'm not certain what triggers blogger to mark the blog as spam, but this blog was marked and hopefully they'll review it and find it's nothing more than silly old me.

What's a Spam Blog? - http://help.blogger.com/bin/answer.py?answer=1260 (excerpt: they can be recognized by their irrelevant, repetitive, or nonsensical text) -- that pretty much characterizes my style of writing: "nonsensical text"! HA!

Admin Scripts - Earn $100

You can earn $100 by sending TechRepublic your original sys admin scripts. I've got a few that I think may earn me some money. Might as well..
http://techrepublic.com.com/5100-1035_11-6045607.html?tag=search

nslookup command line options

nslookup usually operates in interactive mode. You can specify options like debug, d2, type= , etc. in interactive mode using the ' set' command. Those same options can be specified by using switches directly without going into interactive mode; in fact any option that can be set in interactive mode can be used in a switch:
nslookup -type=mx domain.tld nslookup -debug domain.tld

To bring up nslookup's help in interactive mode, just issue a ? (question mark). To bring up the syntax that is listed below I had to provide more than two options on the command line: nslookup 1 2 3 brought up:
Usage:
nslookup [-opt ...] # interactive mode using default server
nslookup [-opt ...] - server # interactive mode using 'server'
nslookup [-opt ...] host # just look up 'host' using default server
nslookup [-opt ...] host server # just look up 'host' using 'server'

html links without clicking

Very cool javascript that activates a html A element just by hovering the cursor over the link: http://labs.mininova.org/noclick/
They've got some other interesting things HTML/javascript, etc: http://labs.mininova.org

Refreshing group policy - 2000/XP/2003

I keep forgetting how to refresh Group Policy on a Windows 2000 client:
secedit /refreshpolicy {machine_policy | user_policy}[/enforce]

The command changed from secedit to gpupdate in Windows XP and Windows 2003. From the secedit help file:
secedit /refreshpolicy has been replaced with gpupdate.

GPUpdate [/Target:{Computer | User}] [/Force]

USB problem in XP

Win XP only - from: http://searchwinsystems.techtarget.com/tip/1,289483,sid68_gci1102478,00.html?track=NL-297&ad=543642
in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\USB Edit or create a DWORD "DisableSelectiveSuspend" set it to 1 and reboot.

Window XP USB problems (hotfix): keyboard, file transfer, etc. - http://support.microsoft.com/kb/908673

Deploy printers by using Group Policy

Only available from a Windows 2003 R2 extended AD schema. Pretty cool if you ask me. Unfortunately Windows 2003 R2 costs money, it's NOT a free upgrade from Windows 2003 (SP1).

Deploy printers by using Group Policy
URL: http://technet2.microsoft.com/WindowsServer/en/Library/ab8d75f8-9b35-4e3e-a344-90d7799927231033.mspx

Handle mailto email link via gmail

Nice greasemonkey script to rewrite mailto email links to open Google's gmail compose window: http://blog.monstuff.com/archives/000238.html

Disable hotkey support in Citrix NFUSE / web interface

If an application, like a server application running inside a terminal emulator (Reflection, etc), uses the same keystroke as the Citrix client, it will intercept the keystoke and run the hotkey function instead of delivering the keystroke to the application. An example would be using shift-F3 for a text terminal session in an emulator: the ICA web client would, by default, intercept the keystroke and try to close the application window. Shift-F3 is assigned to "close remote application".

Disabling / changing hotkeys on NFUSE / Citrix web client is done via the template.ica file under the [wfclient] section:

How to Enable or Disable Hotkeys within an ICA file (including Template.ica) - http://support.citrix.com/article/CTX140219

Hotkey1Char=(none)
Hotkey1Shift=(none)

Command to remove all CRLFs from a file

Use the following command to remove CRLF (all) carriage returns and line feeds from a text file, effectively joining all lines into one single line.

Using the tr command in cygwin:
tr -d '\r\n' < sql.txt > sqlnew.txt

If you want to use the tr command outside of the Cygwin environment, the following files must be copied from \cygwin\bin to the directory you want to store them in:
tr.exe
cygwin1.dll
cygintl-3.dll
cygiconv-2.dll

Terminal Services licensing database corrupt/damaged

Trying to deactivate License Server (terminal services) via the "internet" method, I get the following error after hitting 'next' in the dialog:
"The Licensing wizard encountered an internal error from the license server.  Message Number: 0xc0110011"

System eventlog:
Event Type:     Error
Event Source:   TermServLicensing
Event Category: None
Event ID:       38
Date:           2/15/2006
Time:           2:48:25 PM
User:           N/A
Computer:       MyComputerName
Description:
Can't generate a license for client because of error 'Can't add certificate to store, error c0010020.'.


You cannot activate a Terminal Services license server in Windows 2000 Server or in Windows Server 2003 - http://support.microsoft.com/kb/887444

Windows Server 2003 Terminal Server Licensing - http://www.microsoft.com/windowsserver2003/techinfo/overview/termservlic.mspx
Frequently Asked Questions About Terminal Services 2003 - http://www.microsoft.com/windowsserver2003/community/centers/terminal/terminal_faq.mspx

call (888) 571-2048 to reach the Microsoft Clearinghouse.

File access via VPN very very slow

Ran into this one recently:  WinXP Pro client,  checkpoint VPN, 2 mapped drives to different members of a windows 2000 cluster.  One of the mapped drives was noticeably slower than the other.  I moved the cluster resource group to the other cluster member, it still was slow.  When I had the root of the mapped drive displaying in explorer, I noticed that it had a file handle open on desktop.ini in one particular sub-folder (caught this by using the 'shared folders' snap-in (fsmgmt.msc or compmgmt.msc).  When I deleted the desktop.ini file, the mapped drive was much, much faster.  I restored the desktop.ini file and it slowed down again.  I then looked at the folder properties and it was marked with the read only (R) attribute (on the directory only, not the files).  I turned the R attribute mask off the directory and the mapped drive was fast.  Turned the read-only attribute on again, the it was slow.

 

It's weird that this combination of read-only attribute on the folder and the desktop.ini in that folder would cause a significant file access slow down.  I didn't notice any speed different when connected at LAN speeds, but via the check point VPN there was a definite difference.

 

Here's the contents of the desktop.ini file:

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder Settings\Folder.htt
PersistMonikerPreview=%WebDir%\folder.bmp
[ExtShellFolderViews]
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}
[.ShellClassInfo]
ConfirmFileOp=0

 

How to determine browser cipher strength

You can determine the client's encryption cipher strength via the following links:
https://www.fortify.net/sslcheck.html
http://browsertest.ccra-adrc.gc.ca/rc.genr.tierp/BrowserSecurity-e.jsp

You can do this yourself if you've got a working web server with SSL support:

http://groups.google.com/group/alt.comp.lang.coldfusion/browse_thread/thread/9eb632db0cb87901/0da865711220098e?lnk=st&q=determine+browser+encryption+level&rnum=14&hl=en#0da865711220098e

Determine SSL ciphers running on your web server

SSL Digger - Nice free tool from FoundStone (division of McAfee) for determining what SSL versions and encryption ciphers your web server supports.  If you are running a crucial web server you might want to turn off the weak ciphers and SSL version (SSL2).  The browser and server are supposed to negotiate the highest cipher and SSL version, but some ciphers have already been proven to be weak and vulnerable to crack/attack.

www.foundstone.com  It's kind-of hard to navigate the site: click on resources, then on the left side, "free tools". You should see it under the "Foundstone S3i™ Tools".

Disable SSL2 and weak ciphers in IIS

How to disable SSL protocols and encryption ciphers in Microsoft IIS. For IIS (IIS6 and IIS5):
The ciphers and SSL protocols must be disabled via registry entries; thus a reboot is required after changing the settings. If I ever find some free time, I may create a GUI utility to easily enable/disable these cryptos.

See the following documents:

Description of the Secure Sockets Layer (SSL) Handshake - http://support.microsoft.com/kb/257591
TLS/SSL Tools and Settings - http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/3f98fdd9-ed64-49f7-9c20-a2d4581dfbea.mspx
How to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services - http://support.microsoft.com/kb/187498
How to Restrict the Use of Certain Cryptographic Algorithms and Protocols in Schannel.dll - http://support.microsoft.com/kb/245030/

The following are the registry entries I made to make one of my servers secure (Grade A by SSL Digger):

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server]
"Enabled"=dword:ffffffff[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"Enabled"=dword:ffffffff[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
"Enabled"=dword:ffffffff

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:ffffffff[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168/168]
"Enabled"=dword:ffffffff

Adding CPU / RAM to ES45 Alpha Server

1.      shutdown, turn off and unplug power
2.      insert  hardware  -  see pages 129-140 of the ES45 manual:  http://h18002.www1.hp.com/alphaserver/download/ek-es450-ug-b01.pdf
3.      at chevron >>>  show config | more    and    show memory
4.      After boot:
  psrinfo –v  (processor info)
  vmstat -P  (Physical memory info)
  dxsysinfo -dash  (X windows display of CPU / memory activity)
5.      If you receive a “too many users logged on already” you may have to add the License PAK codes that were shipped with the cpu.  As root, run lmfsetup and enter the codes from the PAK.  After successfully entering the codes, it will ask to run an “lmf reset”, say yes and it will load the licenses into the kernel cache.

rDirectory - make AD web browsable

They've got a Free Community edition for those with small/limited needs, like creating an employee directory:

rDirectory: A Smart Choice for Your Evolving Directory Needs: "Simply put, rDirectory turns Active Directory into your enterprise-wide platform for securely publishing, accessing and maintaining information about virtually any directory-based corporate resource."

tail multiple log files in Win32 environments

Not just another tail command, but can match keywords, and can send mail notifications.
Tail for Win32 - Home Page

Updating to FireFox 1.5 on Linux (Ubuntu)

These same instructions can be tweaked for other distros as well:
FirefoxNewVersion - Ubuntu Wiki

Linux Distrobution Guide

http://distroguide.box.sk - Main Page - Distro Guide

Security Warning disabled

My company has a lot of sites in it's trusted sites zone in order for users to download files from these sites. It kills me when I use my Windows XP SP2 machine and IE. I'd do a google search and one of the results was a link to microsoft. When I clicked the link, I'd get a Security Warning message: The current Web page is trying to open a site in your Trusted sites list. Do you want to allow this?

What was weird about it was that I had NO, not one, site listed in the trusted sites zone. I later found this was because of group policy. A few days later after group policy refreshed on my machine, the sites showed up in the trusted sites list.

To remove this warning, in the trusted sites zone, open the custom settings under Miscellaneous, "Web sites in less privileged web content zone can navigate into this zone." set to enable.
See: Security Warning appears when you try to navigate to a Trusted site from a webpage

Read AND Write NTFS volumes from Linux - Captive

The best solution to writing NTFS formatted volumes in Linux; it uses the native ntfs.sys driver and therefore is very safe:

Jan Kratochvil: Captive: The first free NTFS read/write filesystem for GNU/Linux: "Captive: The first free NTFS read/write filesystem for GNU/Linux"

Packet capture tools

Open source and free packet sniffer/capture tools:
http://www.winpcap.org/ Also provides WinDump tool which is
based/proted from tcpdump. Reading the Windump FAQ first, even before
the manual, is essential.
And of course the big one: http://www.ethereal.com/

Kerberos Token Size and logon problems

Your kerberos ticket can't be bigger than 12000 bytes by default as it will cause logon issues. This is typically cuased by being a member of too many groups.

Microsoft Certified Professional Magazine Online Column: The Group that Broke the Camel�s Back

Gmail browser cache full message

Message from gmail after logging in:  Your browser's cache is full and may interfere with your Gmail experience.  Fix this   Hide

This only happens when using Gmail via the secure https method: https://mail.google.com/mail

caused by the Advanced option in Internet Explorer (in IE: tools/internet options/Advanced tab, security section) setting:  "Do not save encrypted pages to disk"  When this option is checked, gmail believes the cache is full because the pages won't be saved to disk, thus gmail thinks the cache is full.  Uncheck the box or ignore/hide the error message.

Renaming device files in Tru64

On Tru64, it sucks when a faulty device is replaced and the new device now uses a different device file.  The example below is how to delete the old device from hardware manager's database and how to rename the device special files using dsfmgr.

 

for reference: man hwmgr_ops

 

First, delete the old device:
# hwmgr show scsi -type tape
  -get hwid of old device
  -in this case tape1 was hwid 165
# hwmgr delete -id 165
 hwmgr: Delete operation was successful
 
Second, move the new device file to the old name.
# dsfmgr -m tape2 tape1

Alpha Server performance

Quick way to gauge how a CPU upgrade will increase performance on your
Alpha box:
http://h18002.www1.hp.com/alphaserver/performance/perf_by_name.html

Frontpage error submitting form

Problem:  Can't submit frontpage developed form.  The error message in the browser is: Frontpage error.  In the application event log on the server hosting the frontpage extended web the following two entries will appear:

Event Type:     Warning
Event Source:   FrontPage 5.0
Event Category: None
Event ID:       1000
Description:
Microsoft FrontPage Server Extensions:
      (OS Error #13 Message: Permission denied)

Event Type:     Warning
Event Source:   FrontPage 5.0
Event Category: None
Event ID:       1000
Description:
Microsoft FrontPage Server Extensions:
   http://frontpageserver - Error #2005d Message: The server extensions were unable to access the file "service.lck". Please check the file permissions.


Solution:  http://frontpageserver/_vti_bin/_vti_adm/fpadmdll.dll?page=webadmin.htm   Click on 'Check server health' choose 'Tighten security', detect and fix for the web or subweb that is experiencing the problem

That solved the issue I was experiencing.

Good vi tutorial

http://www.nuxified.org/vi_survival_guide

I like the % command which moves the cursor to the next matching bracket or paren. set showmatch to have it move to the beginning match when closing the bracket.

New Dell and Sonic Update Manager

Brand new Dell Dimension 1100; after removing a bunch of the bundled software, I kept getting a Windows Installer message after bootup asking for the Sonic Update Manager disk.  "1" was listed in the "look in"/disk location.  The solution can be found here:  http://forums.us.dell.com/supportforums/board/message?board.id=sw_other&message.id=48777&view=by_date_ascending&page=2

Which points to the following:  http://consumer.installshield.com/kb.asp?id=Q111006

I just downloaded and ran the first program listed.  Then ran the second program listed on the installshield.com web page.  The message never reappeared since....

Source of tech news: digg.com

www.digg.com  is a great source for lots of science / technology news.  A number of the links that I've posted on this blog have be found via digg.com

Open source Linux home theatre software: freevo and A/D converter

Home theatre software which Incorporates lots of open source projects including MythTV: http://freevo.sourceforge.net/about.html

How to build a Linux analog to digital converter:  http://linuxgazette.net//118/chong.html

Gmail 'operation' aborted in IE

Using Gmail, I have come across some emails that kill Internet Explorer if I open them.  The emails that do it for me are ones from financial institutions, but I've heard that others have the same issue with emails from different origins.  What happens is that when you open the 'bad' message, IE pops up it's "Security Information" box and says: "This page contains both secure and nonsecure items.  Do you want to display the nonsecure items?".   It doesn't matter if you select Yes or No, because IE will give an error message: "Internet Explorer cannot open the Internet site https://mail.google.com/mail/.   Operation aborted"   Then once you click OK, you get either an "Action canceled" or "The page cannot be displayed" errors.

This seems to happen only when using gmail via SSL:  https://mail.google.com/mail   You can view the message without any problems via gmail and standard http - http://mail.google.com/mail   The problem only seems to happen in IE;  using https://mail.google.com/mail  via FireFox, I have no problems opening the emails.  Another way around the issue is to open the email in a new window: turn on the keyboard shortcuts for gmail and then do a shift-o to open the message in a new window; it will open just fine that way.   Sometimes just trying to open the message after a few times will get it to open successfully.  Another thing that works is to open the message first using the standard http interface: http://mail.google.com/mail,  then without closing the browser, change the URL to secure http - https://mail.google.com/mail  then view the message without a problem.

The above was tested using fully patched IE6 on Windows XP, SP2  and using FireFox 1.5.  It may act the same way with different versions of both IE and firefox.

TCP/IP filtering and security in Windows 2003

Some good links to sources for doing TCP, UDP, and IP protocol filtering in Windows 2003:

Microsoft Windows Server 2003 TCP-IP Implementation Details - http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/networking/tcpip03.mspx

Configure TCP/IP to use TCP/IP filtering - http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/676ec0f3-4200-43d4-a512-7c637493c387.mspx

List of IP protocol numbers from IANA - http://www.iana.org/assignments/protocol-numbers
Some common IP protocols are:
1 - ICMP
6 - TCP
17 - UDP

Open Source M database / compiler

GT.M High end database + MUMPS compiler -
http://sourceforge.net/projects/sanchez-gtm
Possible alternative to Intersystems Cache?

See your IP address

See what IP address your device/PC is reporting itself to be.  Check what IP address your company has assigned to the external NAT on the firewall:

http://www.whatismyip.com/

 

burn DVD / CD from the command line free

Command Burner - http://www.commandburner.com

 

http://www.experts-exchange.com/Storage/Q_21651217.html

Browser Capabilities and browscap.ini

You can use the ASP object BrowserType (MSWC.BrowserType) to find browser capabilities within your web app.  Browscap.ini also affects the values returned from this object.

 

Browser Capabilities Component
http://www.microsoft.com/windows2000/en/server/iis/default.asp?url=/windows2000/en/server/iis/htm/asp/comp3xx0.htm

 

ASP Browser Capabilities Component
http://www.w3schools.com/asp/asp_browser.asp

 

HOW TO: Add Internet Explorer 6 Information to the Browscap.ini File
http://support.microsoft.com/kb/311227

vdump to tape and file simultaneously

Use vdump to output to stdout, pipe it to tee and have tee send it to the tape device, then redirect stdout from tee to a file or another tape device.

 

Example:

fileset to backup: /mycrap/mountpoint

 

vdump -0f - /mycrap/mountpoint | tee /dev/ntape/tape1c > /morestuff/vdumpbackup

 

Using the -q (quiet) option still results in 4 lines from vdump going to stderr:

path     : /mycrap/mountpoint

dev/fset : crapdomain#mntpt
type     : advfs
advfs id : 0x3cbae55e.010baf45.b

You can kind just redirect stderr to /dev/null in that case.  I don't like the idea of that in case of 'real' errors going to stderr, then you'll miss them.  The above example would then be:

vdump -0f - /mycrap/mountpoint 2>/dev/null | tee /dev/ntape/tape1c > /morestuff/vdumpbackup

 

 

FCA2684 and EMC ClARiiON Cx500

Tru64 needs and entry entered into the ddr.dbase file:

backup the /etc/ddr.dbase first.  Here's the entry needed, put it under the DISKS section:

 

SCSIDEVICE
    #
    # Entry for CLARiiON Storage
    #
    Type = disk
    Stype = 2
    Name = "DGC"
    #
    PARAMETERS:
      #
      TypeSubClass = hard_disk, raid
      BlockSize = 512
      BadBlockRecovery = disabled
      DynamicGeometry = true
      DisperseQueue = false
      TagQueueDepth = 32
      PwrMgmt_Capable = false
      LongTimeoutRetry = enabled
      ReadyTimeSeconds = 90
      InquiryLength = 120
      RequestSenseLength = 120
      #
    ATTRIBUTE:
      #
      # Disable PR/AWRE/ARRE and enable I/O Barrier
      #
      AttributeName = "DSBLflags"
      Length = 4
      ubyte[0] = 25
      #
    ATTRIBUTE:
      #
      # Disable Start Unit with every VPD Inquiry
      #
      AttributeName = "VPDinfo"
      Length = 16
      ubyte[6] = 4
      #
    ATTRIBUTE:
      #
      # Report UDID value in hwmgr -view devices
      #
      AttributeName = "rpt_chgbl_dev_ident"
      Length = 4

 

After this is entered, you need to recompile the ddr.db file using the ddr_config -c command.  You'll need to contact you SAN guy to create the LUN and setup security on the SAN side of things.  Once that's done, you should be able to see the LUN after you scan: hwmgr -scan scsi   then view the devices: hwmgr -show scsi

 

 

ASP code to log events to application event log

How To Log Events from Active Server Pages - http://support.microsoft.com/kb/301309

 

Note the "Troubleshooting Notes" section if it doesn't work.  I used the WSH method and it worked, even though the anonymous account was a part of the guests group and the RestrictGuessAccess was not set.

 

Bandwidth speed test for broadband connections

http://www.bandwidthplace.com/speedtest/

For DSL or Cable broadband connections. Many other ones out there, but this one does not require Flash or Java to perform the test.

This one much more to offer: a latency and upload speed test and has links for pasting results in forums and what-not.
http://www.speedtest.net/

modify Tru64 kernel parameters

How to modify Tru64 kernel parameters / attributes / subsystems:

 

Always backup the /etc/sysconfigtab file first before attempting any of this!!

Always merge instead of using the -u or -a option of sysconfigdb; you will overwrite what was in /etc/sysconfigtab.

see sysconfigdb -l proc  to see what values are recorded in /etc/sysconfigtab

sysconfig -q proc max-threads-per-user max-proc-per-user > dave

vi dave
proc:
max-threads-per-user = 8192
max-proc-per-user = 8192

sysconfigdb -m -f dave proc

sysconfig -q pts nptys > dave
vi dave
pts:
nptys = 2048

sysconfigdb -m -f dave proc

sysconfig -q ipc sem-msl sem-mni shm-max > dave
vi dave
ipc:
sem-msl = 50
sem-mni = 128
shm-max = 2147483648

sysconfigdb -m -f dave ipc

restart the system

verify the values:
sysconfig -q proc max-threads-per-user max-proc-per-user
sysconfig -q pts nptys
sysconfig -q ipc sem-msl sem-mni shm-max

 

make a bootable tape for tru64

sysman boot_tape

 

 

Tru64 boot hanging on configuring network

Tur64 hung on bootup after the:

Configuring network:

setting hostname: node1

 

Nothing network related would work.  I'd get a connection refused message when trying to telnet or ssh in....  That's because it hadn't loaded the rest of the network scripts: /etc/inet.local, etc.

 

I forgot to set MAX_NETDEVS in rc.config.  I control-c out of the hang, changed rc.config by: rcmgr set MAX_NETDEVS 24   and restarted.  Everything worked fine.

determine if cluster group is running on current node

How to determine if a particular cluster group is running on the current node:

 

mygroup=name of cluster group

 

cluster group mygroup /status | findstr /i "%computername%"
if %errorlevel%==0 echo Yes group is running on this node

 

System error 997 trying to online application in cluster

I got error 997, overlapped io operation bringing a generic application online in Windows 2000 cluster:

cluster.exe is the command line tool to administer a Windows cluster (NT,2000,2003). See cluster /? for options.


C:\>cluster resource solitaire /offline
Taking resource 'solitaire' offline...

Resource Group Node Status
---------- ---------- ------ ----------
solitaire CluGrp Node1 Offline


C:\>cluster resource solitaire /online

Bringing resource 'solitaire' online...

System error 997 has occurred.
Overlapped I/O operation is in progress.


Error Message: System Error 997 Has Occurred -- http://support.microsoft.com/kb/248408


solution: use the /wait switch see below:


C:\>cluster resource solitaire /online /wait:2

Bringing resource 'solit' online...

Resource Group Node Status
--------- ------ ----- -------
solitaire CluGrp Node1 Online

Epic Client communications registry settings

[HKEY_LOCAL_MACHINE\SOFTWARE\Epic Systems Corporation\EpicEComm]
"TraceFile"="c:\\trace.log"
"TraceMode"="0"
"ClientConfigFile"="c:\\test.txt"

 

usr8022 and dwl-G132 won't connect

usr8022 and dwl-G132:

G132 sees access point, but won't associate or connect to it.

192.168.123.254

blank password.

wireless tab --  Change basic rate to 1-2-5.5-11(mbps)  instead of 1-2-5.5-11-22(Mbps)

must reboot router  tools tab --  reboot


possibly:  (seemed to work either way)

using D-Link ariplus xtremeG wireless utility, under advanced change the frequency from 802.11b/g-2.4GHz  to 802.11b-2.4GHz

accesskey attribute on html tags

http://diveintoaccessibility.org/day_15_defining_keyboard_shortcuts.html

create keyboard shortcuts for html forms, links and other elements....

DHCP Client service and Dynamic DNS relationship

Today I couldn't ping, nslookup or connect to a server.  Others in my team could ping and connect, they were resolving the server name via WINS.  I don't have any WINS servers listed in my TCPIP config.  So I decided to check on the server:

 

C:\>ipconfig /registerdns

 

Windows 2000 IP Configuration

 

Error: The system cannot find the file specified.
: Refreshing DNS names

 

C:\>services.msc

--- The DHCP Client service was disabled.  DHCP Client service is responsible for registering the hostname in a Dynamic DNS environment.

 

Changed the startup type to Automatic, started the DHCP Client service, and re-ran the ipconfig /registerdns  command.

 

See: Dynamic DNS updates do not work if the DHCP client service stops  -  http://support.microsoft.com/kb/264539

 

DVD burning with cdrtools / cdrecord and cygwin

http://www.paehl.com/open_source/?CDRTOOLS_with_DVD_Support

 

Good guy Dirk brings a lot of open source and other free tools to the Win32/Windows platforms:

http://www.paehl.com

 

 

Free cookie analyzer

Galleta: from foundstone -

http://www.foundstone.com/index.htm?subnav=products/navigation.htm&subcontent=/products/overview.htm

 

converts an IE cookie to a (tab, or other) delimited file.  Good stuff for FREE!

 

Public/Private key authentication with Putty and OpenSSH

I like Steve Friedl's blog, and I saw an interesting tidbit on this one: http://www.unixwiz.net/archives/2005/11/_secure_linuxun.html

It's great when great minds share information like this freely. It helps all of those searching for solutions to find the answers quickly. His web site is full of good stuff as well: http://www.unixwiz.net/

Thanks Steve!

Technet virtual labs - FREE

TechNet Virtual Labs - http://www.microsoft.com/technet/traincert/virtuallab/default.mspx allow you to test Microsoft's software in a 'sandbox' environment. I haven't tried one yet, but it seems to be a very good idea.

Best of all there's FREE!!!! You people know how I'm a big proponent of Free!

Microsoft Exchange Server 2003 Outlook Web Access Web Administration

download here: http://www.microsoft.com/downloads/details.aspx?FamilyID=4bbe7065-a04e-43ca-8220-859212411e10&displaylang=en

It wouldn't work when I installed it. I had my default web site stopped when I did the install. I started the web site, and installed OWAAdmin again, but still didn't solve the problem. Had to right-click and uninstall the OWAAdmin.MSI file. Then I installed again, and all was well.

Guess what? You don't need to do manual segmentation anymore, you can use this tool.

I keep getting prompted for credentials when I access it, I assume it needs admin rights on the exchange server.

I also had to re-create the client side scripts for .NET:
C:\WINNT\Microsoft.NET\Framework\v1.1.4322> aspnet_regiis -c
Start copying the ASP.NET client side script files for this version (1.1.4322.0).
Finished copying the ASP.NET client side script files for this version (1.1.4322.0).

Exchange 2003 OWA customization

Add / remove portions, features of OWA (Outlook Web Access).  Remove calendar, public folders, etc....

How to modify the appearance and the functionality of Outlook Web Access by using the segmentation feature in Exchange 2003

- http://support.microsoft.com/kb/833340

 

Creating and Deploying Outlook Web Access Themes - http://www.microsoft.com/technet/prodtechnol/exchange/guides/CreatingOWAThemes/9bb177d9-2bbe-4c01-bb21-2f6ce96089a8.mspx

 

 

Tru64 LPD and EVM - can't shutup LPD

No matter what the EVM configuration files ( /etc/evmdaemon.conf and /etc/evmlogger.conf ) state, if you have the 'activity monitor' set up in evmdaemon.conf, any events that hit EVM will count against the threshold for the activity monitor.  Even if you configure EVM to ignore or otherwise not log certain events, EVM will still trigger this activity monitor.

 

I had a ton of print jobs being printed certain hours of the day.  I wanted to stop the LPD daemon from posting these events (stop it from being chatty), because they were just normal system functions/activity that I don't think should count against the activity monitor, escpecially since I know this server will be busy handling print jobs already.  No matter what I tried, LPD always posted 3 events to EVM for each print job.  It seems no matter what configuration changes you make, you can't tell LPD to shut the hell up.  Even changing /etc/syslog_evm.conf didn't help at all.  Surprise, surprise.  Looks like the LPD daemon is hardcoded to post to EVM ----- which really sucks, you Compaq/DEC/HP engineers!!!:

 

LPD daemon started - Status: 0  PID: 1081011
LPD job submit requested - Status 0  Printer myprintername
LPD job submit completed - Status 0  Printer mypritnername  Job number 0

 

 

When enough of these events happened I would receive the following email message from EVM:

 

SUBJECT: EVM ALERT [600]: EVM daemon: High event activity - exceeds 500 in 10 minutes

============================ EVM Log event ===========================
EVM event name: sys.unix.evm.daemon.event_activity

 

    This high priority event is posted by the Event Manager (EVM)
    daemon when it detects a high number of events occurring over
    several minutes.

 

    Action: Use the event viewer or the evmget(1) command to review the
    event log for the source of the activity.  If the log does not show
    high activity around the time at which this event was posted, it is
    likely that the events were low priority, and hence were not
    logged.  You can monitor low-priority events by running the
    evmwatch(1) command with an appropriate filter, or by temporarily
    reconfiguring the EVM logger to log low-priority events.

 

    Note: You can change the parameters which control the posting of
    this event by modifying the daemon configuration file,
    /etc/evmdaemon.conf.

 

======================================================================

 

Formatted Message:
    EVM daemon: High event activity - exceeds 500 in 10 minutes

 

Event Data Items:
    Event Name        : sys.unix.evm.daemon.event_activity
    Priority          : 600
    PID               : 1048856
    PPID              : 1048577
    Event Id          : 326425
    Member Id         : 2
    Timestamp         : 24-Nov-2005 15:08:06
    Host IP address   : 192.168.1.1
    Cluster IP address: 192.168.1.3
    Host Name         : host.domain.com
    Cluster Name      : cluster
    User Name         : root
    Format            : EVM daemon: High event activity - exceeds $count in
                        $period minutes
    Reference         : cat:evmexp.cat:100

 

Variable Items:
    count (INT32) = 500
    period (INT32) = 10

 

======================================================================

 

 

Script to generate/post EVM events:

num=0

 

while [ $num -lt 500 ]
do
 num=$(expr $num + 1)
 echo $num
 echo 'event { name sys.unix.print.lpd }' | evmpost
done

Script to capture all EVM posts, regardless if they are logged or not:

#!/usr/bin/ksh
file=/usr/users/davidbon/evmwatcher.log
evmwatch -A -f "[priority >= 0]" -t "@priority  @timestamp @@" >> $file

 

VMWare workstation audio / sound volume level

Hate it when your guest VM changes the volume in the host OS? just follow the steps in the FAQ:
http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=853

in workstation 4 and above just add the following line somewhere inside your .vmx config file:
pciSound.enableVolumeControl = "FALSE"

Happiness!

quickly access Microsoft KB article

Here's a quick way to access Microsoft's KB (Knowledge Base) technet articles if you know the Article ID:

 

the url is:  http://support.microsoft.com/kb/{ARTICLE#}   where {ARTICLE#} is the article number

 

For instance If you're looking for article 257903, the you can get to it this way: http://support.microsoft.com/kb/257903   - Cluster Network Name May Not Come Online with Event ID 1052

 

 

Migrating from single print server to clustered print server

Migration of a single Windows 2000 print server to a Windows 2000 clustered print server.

'printserver1' is the name of the old print server.

 

I ran the Print Migrator wizard to get the printers on the cluster.  My plan:  on the night of the conversion, I would shutdown printserver1 and add a "network name" resource in the cluster configuration for printserver1 so that any clients that didn't run the vbs logon script(see my migration blog article) to change the connections would still be able to print without any noticeable effects.  That was my plan at least.  The following was the Murphy's law version of what happened:

 

After the shutdown of printserver1, tried to bring online the printserver1 'network name' resource.  But, I couldn't bring the printserver1 'network name' resource online.  I kept saying 'failed'.  The following events were posted to the system eventlog.

NOTE: make sure the advanced property, 'affect the group', is turned off, otherwise if you do have problems with the resource coming online, it won't cause the group to fail.  You can always turn that option on once the resource is stable and working. 

 

Event Type: Error
Event Source: ClusSvc
Event Category: Services
Event ID: 1069
Date:  11/23/2005
Time:  2:00:24 AM
User:  N/A
Computer: NODE1
Description:
Cluster resource 'printserver1' failed.

 

*************************************
*************************************

 

Event Type: Error
Event Source: ClusSvc
Event Category: (2053)
Event ID: 1052
Date:  11/23/2005
Time:  2:00:24 AM
User:  N/A
Computer: NODE1
Description:
Cluster Network Name resource 'printserver1' cannot be brought online because the name could not be added to the system.
Data:
0000: 0e 50 00 80               .P.€   

 

 

 

Cluster Network Name May Not Come Online with Event ID 1052 - http://support.microsoft.com/kb/257903

 

Solution (for me anyway):

delete all dns A and PTR records for printserver1
delete all wins records for printserver1

 

run nbtstat -RR on each node in cluster
then brought printserver1 network name online

 

Event ID 8 on Windows 2000 cluster

Windows 2000 cluster, running IIS ftp as a cluster resource:
Event log entry almost every 5 seconds, even when no connections are being made to the IIS ftp server:

 

Event Type: Error
Event Source: MSFTPSVC
Event Category: None
Event ID: 8
Date:  11/22/2005
Time:  5:55:45 PM
User:  N/A
Computer: NODE1
Description:
FTP Server could not create a client worker thread for user at host 192.168.1.50.  The connection to this user is terminated.  The data is the error.
For additional information specific to this message please visit the Microsoft Online Support site located at: http://www.microsoft.com/contentredirect.asp.

 

Solution:
Put the IP of the cluster (192.168.1.50 in this case) in address restrictions and the event log entry no longer happens, except for when an unauthorized IP tries to connect to the cluster ftp.  You must restart the IIS resource in the cluster to stop the event log from appearing.

 

client behavior:

C:\>ftp cluster
Connected to cluster.domain.com.
530 Connection refused, unknown IP address.
User (cluster.domain.com:(none)):

 

C:\>ftp node1
Connected to node1.domain.com.
Connection closed by remote host.

not quite related to this issue, but has same event log entry:
Event ID 8 When Clients Try to Access IIS FTP Site - http://support.microsoft.com/kb/293637

Epic Print Service running on Windows 2000 cluster

The upgrade from EPS version Fall 2004 to Spring 2005 IU2 caused the EPS service name to change from "epicprintservice" to  "EpicPrintService722".  Had to change that in the cluster configuration which requires the resource to be taken offline/ brought online when change is complete.

 

Caveats to running EPS on a windows print cluster:

1.  One locally installed printer must exist on each cluster node/member.  Restart(take offline/bring online in cluadmin) the EPS service if the printer was installed while EPS was running.

2.  Printer Path in the Epic device table needs to be the full unc for the printer.  Using the short name (the printer name by itself) doesn't work if all your printers are defined on the cluster name and not on the nodes directly (which is the way print clustering works).