Refreshing group policy - 2000/XP/2003

I keep forgetting how to refresh Group Policy on a Windows 2000 client:
secedit /refreshpolicy {machine_policy | user_policy}[/enforce]

The command changed from secedit to gpupdate in Windows XP and Windows 2003. From the secedit help file:
secedit /refreshpolicy has been replaced with gpupdate.

GPUpdate [/Target:{Computer | User}] [/Force]

USB problem in XP

Win XP only - from: http://searchwinsystems.techtarget.com/tip/1,289483,sid68_gci1102478,00.html?track=NL-297&ad=543642
in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\USB Edit or create a DWORD "DisableSelectiveSuspend" set it to 1 and reboot.

Window XP USB problems (hotfix): keyboard, file transfer, etc. - http://support.microsoft.com/kb/908673

Deploy printers by using Group Policy

Only available from a Windows 2003 R2 extended AD schema. Pretty cool if you ask me. Unfortunately Windows 2003 R2 costs money, it's NOT a free upgrade from Windows 2003 (SP1).

Deploy printers by using Group Policy
URL: http://technet2.microsoft.com/WindowsServer/en/Library/ab8d75f8-9b35-4e3e-a344-90d7799927231033.mspx

Handle mailto email link via gmail

Nice greasemonkey script to rewrite mailto email links to open Google's gmail compose window: http://blog.monstuff.com/archives/000238.html

Disable hotkey support in Citrix NFUSE / web interface

If an application, like a server application running inside a terminal emulator (Reflection, etc), uses the same keystroke as the Citrix client, it will intercept the keystoke and run the hotkey function instead of delivering the keystroke to the application. An example would be using shift-F3 for a text terminal session in an emulator: the ICA web client would, by default, intercept the keystroke and try to close the application window. Shift-F3 is assigned to "close remote application".

Disabling / changing hotkeys on NFUSE / Citrix web client is done via the template.ica file under the [wfclient] section:

How to Enable or Disable Hotkeys within an ICA file (including Template.ica) - http://support.citrix.com/article/CTX140219

Hotkey1Char=(none)
Hotkey1Shift=(none)

Command to remove all CRLFs from a file

Use the following command to remove CRLF (all) carriage returns and line feeds from a text file, effectively joining all lines into one single line.

Using the tr command in cygwin:
tr -d '\r\n' < sql.txt > sqlnew.txt

If you want to use the tr command outside of the Cygwin environment, the following files must be copied from \cygwin\bin to the directory you want to store them in:
tr.exe
cygwin1.dll
cygintl-3.dll
cygiconv-2.dll

Terminal Services licensing database corrupt/damaged

Trying to deactivate License Server (terminal services) via the "internet" method, I get the following error after hitting 'next' in the dialog:
"The Licensing wizard encountered an internal error from the license server.  Message Number: 0xc0110011"

System eventlog:
Event Type:     Error
Event Source:   TermServLicensing
Event Category: None
Event ID:       38
Date:           2/15/2006
Time:           2:48:25 PM
User:           N/A
Computer:       MyComputerName
Description:
Can't generate a license for client because of error 'Can't add certificate to store, error c0010020.'.


You cannot activate a Terminal Services license server in Windows 2000 Server or in Windows Server 2003 - http://support.microsoft.com/kb/887444

Windows Server 2003 Terminal Server Licensing - http://www.microsoft.com/windowsserver2003/techinfo/overview/termservlic.mspx
Frequently Asked Questions About Terminal Services 2003 - http://www.microsoft.com/windowsserver2003/community/centers/terminal/terminal_faq.mspx

call (888) 571-2048 to reach the Microsoft Clearinghouse.

File access via VPN very very slow

Ran into this one recently:  WinXP Pro client,  checkpoint VPN, 2 mapped drives to different members of a windows 2000 cluster.  One of the mapped drives was noticeably slower than the other.  I moved the cluster resource group to the other cluster member, it still was slow.  When I had the root of the mapped drive displaying in explorer, I noticed that it had a file handle open on desktop.ini in one particular sub-folder (caught this by using the 'shared folders' snap-in (fsmgmt.msc or compmgmt.msc).  When I deleted the desktop.ini file, the mapped drive was much, much faster.  I restored the desktop.ini file and it slowed down again.  I then looked at the folder properties and it was marked with the read only (R) attribute (on the directory only, not the files).  I turned the R attribute mask off the directory and the mapped drive was fast.  Turned the read-only attribute on again, the it was slow.

 

It's weird that this combination of read-only attribute on the folder and the desktop.ini in that folder would cause a significant file access slow down.  I didn't notice any speed different when connected at LAN speeds, but via the check point VPN there was a definite difference.

 

Here's the contents of the desktop.ini file:

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder Settings\Folder.htt
PersistMonikerPreview=%WebDir%\folder.bmp
[ExtShellFolderViews]
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}
[.ShellClassInfo]
ConfirmFileOp=0

 

How to determine browser cipher strength

You can determine the client's encryption cipher strength via the following links:
https://www.fortify.net/sslcheck.html
http://browsertest.ccra-adrc.gc.ca/rc.genr.tierp/BrowserSecurity-e.jsp

You can do this yourself if you've got a working web server with SSL support:

http://groups.google.com/group/alt.comp.lang.coldfusion/browse_thread/thread/9eb632db0cb87901/0da865711220098e?lnk=st&q=determine+browser+encryption+level&rnum=14&hl=en#0da865711220098e

Determine SSL ciphers running on your web server

SSL Digger - Nice free tool from FoundStone (division of McAfee) for determining what SSL versions and encryption ciphers your web server supports.  If you are running a crucial web server you might want to turn off the weak ciphers and SSL version (SSL2).  The browser and server are supposed to negotiate the highest cipher and SSL version, but some ciphers have already been proven to be weak and vulnerable to crack/attack.

www.foundstone.com  It's kind-of hard to navigate the site: click on resources, then on the left side, "free tools". You should see it under the "Foundstone S3i™ Tools".

Disable SSL2 and weak ciphers in IIS

How to disable SSL protocols and encryption ciphers in Microsoft IIS. For IIS (IIS6 and IIS5):
The ciphers and SSL protocols must be disabled via registry entries; thus a reboot is required after changing the settings. If I ever find some free time, I may create a GUI utility to easily enable/disable these cryptos.

See the following documents:

Description of the Secure Sockets Layer (SSL) Handshake - http://support.microsoft.com/kb/257591
TLS/SSL Tools and Settings - http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/3f98fdd9-ed64-49f7-9c20-a2d4581dfbea.mspx
How to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services - http://support.microsoft.com/kb/187498
How to Restrict the Use of Certain Cryptographic Algorithms and Protocols in Schannel.dll - http://support.microsoft.com/kb/245030/

The following are the registry entries I made to make one of my servers secure (Grade A by SSL Digger):

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\Multi-Protocol Unified Hello\Server]
"Enabled"=dword:ffffffff[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server]
"Enabled"=dword:ffffffff[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server]
"Enabled"=dword:ffffffff

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 128/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
"Enabled"=dword:ffffffff[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128]
"Enabled"=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168/168]
"Enabled"=dword:ffffffff

Adding CPU / RAM to ES45 Alpha Server

1.      shutdown, turn off and unplug power
2.      insert  hardware  -  see pages 129-140 of the ES45 manual:  http://h18002.www1.hp.com/alphaserver/download/ek-es450-ug-b01.pdf
3.      at chevron >>>  show config | more    and    show memory
4.      After boot:
  psrinfo –v  (processor info)
  vmstat -P  (Physical memory info)
  dxsysinfo -dash  (X windows display of CPU / memory activity)
5.      If you receive a “too many users logged on already” you may have to add the License PAK codes that were shipped with the cpu.  As root, run lmfsetup and enter the codes from the PAK.  After successfully entering the codes, it will ask to run an “lmf reset”, say yes and it will load the licenses into the kernel cache.

rDirectory - make AD web browsable

They've got a Free Community edition for those with small/limited needs, like creating an employee directory:

rDirectory: A Smart Choice for Your Evolving Directory Needs: "Simply put, rDirectory turns Active Directory into your enterprise-wide platform for securely publishing, accessing and maintaining information about virtually any directory-based corporate resource."

tail multiple log files in Win32 environments

Not just another tail command, but can match keywords, and can send mail notifications.
Tail for Win32 - Home Page

Updating to FireFox 1.5 on Linux (Ubuntu)

These same instructions can be tweaked for other distros as well:
FirefoxNewVersion - Ubuntu Wiki

Linux Distrobution Guide

http://distroguide.box.sk - Main Page - Distro Guide

Security Warning disabled

My company has a lot of sites in it's trusted sites zone in order for users to download files from these sites. It kills me when I use my Windows XP SP2 machine and IE. I'd do a google search and one of the results was a link to microsoft. When I clicked the link, I'd get a Security Warning message: The current Web page is trying to open a site in your Trusted sites list. Do you want to allow this?

What was weird about it was that I had NO, not one, site listed in the trusted sites zone. I later found this was because of group policy. A few days later after group policy refreshed on my machine, the sites showed up in the trusted sites list.

To remove this warning, in the trusted sites zone, open the custom settings under Miscellaneous, "Web sites in less privileged web content zone can navigate into this zone." set to enable.
See: Security Warning appears when you try to navigate to a Trusted site from a webpage

Read AND Write NTFS volumes from Linux - Captive

The best solution to writing NTFS formatted volumes in Linux; it uses the native ntfs.sys driver and therefore is very safe:

Jan Kratochvil: Captive: The first free NTFS read/write filesystem for GNU/Linux: "Captive: The first free NTFS read/write filesystem for GNU/Linux"

Packet capture tools

Open source and free packet sniffer/capture tools:
http://www.winpcap.org/ Also provides WinDump tool which is
based/proted from tcpdump. Reading the Windump FAQ first, even before
the manual, is essential.
And of course the big one: http://www.ethereal.com/

Kerberos Token Size and logon problems

Your kerberos ticket can't be bigger than 12000 bytes by default as it will cause logon issues. This is typically cuased by being a member of too many groups.

Microsoft Certified Professional Magazine Online Column: The Group that Broke the Camel�s Back