Archive for the 'Windows Server' Category

Shorten the download interval on the Exchange Server 2003 Pop3 Connector

Published
by
Greg
on July 9, 2007
in Networking, Registry and Windows Server
. 3 Comments

The shortest interval to download user email with the Exchange Pop3 connector is 15 minutes. Too long for most people. To shorten that to 5 minutes, you have to update/add a registry value in this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SmallBusinessServer\Network\POP3 Connector

Add Dword:

“ScheduleAccelerator”=dword:00000003

 

It works by dividing the default schedule interval by that value. For example, the server connector is set to 15 minutes, the lowest setting. Set the reg value to 3, so 15 divided by 3 equals 5. This makes it a 5 minute interval.

Open file security warning on mapped drive

Published
by
Greg
on July 6, 2007
in Networking, Security, Windows Server and Windows XP
. 0 Comments

When opening files on the network over mapped drive OR UNC, you receive a “publisher” or “security” warning before running the file. Very annoying.

In IE, you add the server or domain to your “local intranet” security zone. In my case, my server was: main.domain.local
It was mapped on O: drive.

 

So in the zone I added:
\\main
O:\
domain.local
\\domain.local

That took care of all kinds of connections.

On a domain wide setting: In active directory, I added a group policy for the file types of moderate security.

Go to a domain policy, I did the Default Domain Policy on mine. > Open User Configuration > Administrative Templates > Windows Components > Attachment Manager.

And edit the item: Inclusion List for Moderate Risk file types

Add: .doc;.xls;.exe;.pdf
(just the most common, you might want more)

Add the type you want to exclude from the security warning. Reboot the client computer, or run gpupdate on it to get the new policy. Problem went away for me!

Self-Signed IIS SSL Certificates using OpenSSL

Published
by
Greg
on June 18, 2007
in Linux, Networking, Security and Windows Server
. 0 Comments

Gregs Uberfast version:

Linux:

openssl genrsa -des3 -out CA.key 1024
openssl req -new -key CA.key -x509 -days 3650 -out CA.crt
chmod 400 CA.key
chmod 400 CA.crt

(the above made a new CA, you want to install the crt into IE’s trusted certs.)

Win:

Make cert request in IIS – take to Lin.

Linux:

(All one line)
openssl x509 -req -days 3650 -in certreq.txt -CA CA.crt
-CAkey CA.key -CAcreateserial -out mail.server.crt

Win:

Take that mail.server.crt and install in IIS. People browsing yoru site will get a “not valid CA” type error, especially in IE7, and they’ll need to accept that. Otherwise, you need to buy a real cert. If it’s only your users on the site, then just have them install the CA.crt into IE, as then they will trust the authority/key from the web server. Every user will need to do that.

Recovering/Restoring Exchange server to a new server

Published
by
Greg
on June 12, 2007
in Networking and Windows Server
. 0 Comments

Greg Fischer
6/15/07

I used Exchange 2000 on Windows 2000 for this, 2003 might be a little different. Obviously, you need to make sure you have the backups in the first place, this assumes you have done this, and we will only focus on recovery. Also, this is intended for Small businesses with only 1 Exchange server and some, just a little, tolerance for downtime. You maybe can apply some of this in a large organization, but probably not.

Using NTBackup (online data):

(work in progress)

OLD Server: Felix
NEW Server: Ruphus

  1. Setup a new server as Ruphus. This can be in the same domain and exist with the old server, BUT you will not be able to reconnect the user mailboxes on the new server. That’s a different story and I have not tested procedures for it. We are going to assume the old server is Gone, bye-bye, toast! Also, see notes on seting up a test domain controller and network for full recovery. But at this point, you should have a new Windows server up and running, a DC or not.
  2. Install Exchange, install SP’s on Ruphus.
  3. Open System Manager, delete the Felix from the Exchange site. (will give warnings, but ok)
  4. At this point, we do not have all the configuration from the old server, and for the purposes of this guide, we are not going to bother and assume you can setup your SMTP and other items from memory. In a very large Exchange environment, this might not be possible though, but this guide is intended for those of us with only 1 Exchange server on a small network.
  5. On Ruphus rename the old mailbox and public store databases, and/or create new databases that have the same “exact” logical names as were on Felix. (in System Manager, browse to Servers, and find your public and mailbox stores. Right click and select Rename.)
  6. Run NTBackup, go to Restore, and find your Felix Information Store database, check the mailbox stores listed. (and log files, which will probably be an option)
    1. Click Start Restore.
    2. Select Ruphus as the server
    3. Select a temp directory, in my case I used the large D: drive. (d:\temp)
    4. Check the boxes (I think, Last set, and Mount db’s?)
    5. Start recovery.
  7. Reboot, and make sure your stores mount.
  8. Now, if you have setup a new server on a test network OR your old server is toast and you are trying to recover a new server, then you will need to reconnect the mailboxes to the user accounts. For this you will use a tool called, “mbconn.exe”. On your exchange cd, under: SUPPORT\UTILS\I386
    Find the mbconn.exe and run it. (a gui)
  9. In here, you connect to Ruphus, and select the store you want to reconnect mailboxes. It should display all the orphaned mailboxes. Then you go to Action, Preview All, and select the AD container with your user accounts, and select OK. I should put green checkmarks next to the mailboxes that it matches to. Then you go to Action, and Apply.
    Re-apply this to any leftover mailboxes if they are in different OU’s. For example, you might have users in Accounting, or Marketing OU’s. Each will Preview and Apply separately until you have reconnected all of them.
    NOTE: You probably wont be able to reconnect a few items, like System Attendant mailbox, as they are created new on Ruphus. Also, you will need to do this procedure for each mailbox store separately.
  10. Check Recipient Update Services in Exchange and set the properties accordingly, they will be set to the old server and domain controllers. Tell the objects in RUS to rebuild.
  11. Dare I say, “login as a user and see if Outlook works” … ?

Using Offline Database:

Coming later…

Notes on setting up a DC

In my case, I wanted to have a test network, and also a way to do fast recovery of the network on a new server that is offsite. Instead of recovering a DC and AD, I just installed a new server on my existing domain. I made sure it had BASIC drives, not DYNAMIC! And then I setup the server as a backup DC. Make sure you select it as a Global Catalog too! Also, make sure DNS is setup and configured on it!

So, at this point, I had a new DC, GC, DNS server, acting as a backup on my domain. I went in the AD sites and services, and performed a manual replication in the NTDS settings for each server. I also made a ghost image of this server, so I can make a step back, and/or do this again for backup procedures. Keep in mind, once you move ahead though, you’ll probably need to do all this again each time you want a current snapshot of AD for recovery. So what I would do is, setup a basic Win2k load NOT joined to the domain with all the service packs and IE updates, and even Office (I find usefull), and all your utilities you need. (don’t forget the Adminpak!) Then, make a ghost of this server, before doing the join and DCpromo.

Now, we’ve got our replicated server. Lets shut it down, and set it up on the new testing network. (MAKE SURE!!! You cannot communicate with the old one, make them physically separate!) And once removed and setup on the new network, you will need to manually delete this newly dcpromo’d server from your existing network. (see below)

AT this point, we need to sieze all the roles, and make this server the master of the domain. So, look it up online, run the ntdsutil command program and seize all the 5 FSMO’s. Then, go into DNS and remove anything regarding the old servers. (don’t’ forget the server properties listing the old ones as Name servers too) And also, in _msdc SRV records, remove the old servers. After all that, you might need to go in to ADSIEdit (in the adminpak) and find the old servers and delete them in the CN=Configuration container. And if necessary, go in the AD Computers and in Domain Controllers, and delete the servers. And one more… Go into AD sites, and delete the NTDS replication entries and servers. Whew! I think that’s it! You should have a single DC on a test network. This all takes only minutes once you do it a couple times, so it’s not that bad. The hardest part is remembering the ntdsutil command, which you need to lookup online. Just verify that the new server actually holds all the FSMO roles.

We should have a new server all ready to go on the testing/recovery network! All user accounts and settings intact! And now we can begin Exchange!

Things I do not like about EFS and a better solution called Truecrypt

Published
by
Greg
on February 19, 2007
in Backup, Security, Windows Server, Windows Vista and Windows XP
. 0 Comments

I am not expert on these things (encryption), but I have done some reading and found some issues with Encrypted File System I don’t like. I may not describe the issues correctly, so this is just my opinion more than anything.

1. In Windows 2000, don’t even bother. It can be bypassed with their recovery agent or administrator. So if you lose your laptop, the data can be accessed.

2. In XP, it is better and more secure. I think there is no data recovery agent, but I think a local administrator account on a non-domain install of XP will still have the private keys.

3. The private keys are on that hard drive!

4. You still see all the files. The file names are all viewable, and that may be a security risk for some companies. It’s better than nothing, but I don’t like that too much.

5. You can’t encrypt the whole system. Or a whole partition for that matter. You must encrypt a folder, and at that, only the files in that folder are encrypted.

6. Here’s the one I like least… with EFS, when you open a file, it is decrypted to a tmp file. This file is deleted once you finish with it, but as you know, files are not “wiped” from the drive when they delete, they just remove the pointer to it. So unless data is overwritten in that place of the drive, that data is accessible to anyone. If you had a spreadsheet with SSN’s or credit card numbers, and you just happen to lose your system to someone who knows what to do with it, you got a big problem!!

7. There’s more, I just can’t think of them.

Anyway, after doing some reading… I found that Bitlocker in Vista will be a very nice solution. But you have to buy Enterprise or Ultimate versions of Vista to get it. Bitlocker can encrypt the entire OS partition. Now that is nice! That is exaclty what we wanted! And if you set it up correctly, using a key or PIN at boot, it will make an extremely secure setup. One drawback, you can only encrypt the partition the OS is on, not other partitions. You’ll need to use normal EFS for them.

That’s nice, but I have Vista Business. And I don’t want to spend more money right now. Plus, on my main system and pretty much all my clients, they have 2000 and XP. Guess what I found to get me by? TrueCrypt. www.truecrypt.org. Nice product!! And it’s open-source and free!!!!

With TrueCrypt, you can password protect an entire partition with AES 256-bit encryption. You can use multiple ciphers and even key based access using a USB drive. (Bitlocker can do the USB drive thing too!) It’s a tiny program running in the systray. And in my case, I am just running a password authentication and 256bit AES on a separate partition, so my performance is pretty good too, though not as fast without encryption. Now, with XP I will be making redirections to My Documents to that private drive, and saving all my “work-in-progress” there. That, to me, operates reasonably, and pretty darn secure. I could do more to secure it, like use a key file on my usb key drive. Then you cannot get into any of my private data without the key drive inserted! But I need to test that first.

TrueCrypt can also create a virtual drive from a file.� That might be handy, but performance is just a little slower that way.� It cannot encrypt your OS partition though, which is a drag, but at least I can encrypt a separate partition and you cannot see the file system structure.� It has a lot of neat features. Definitely worth trying if you want lock down things.

Master Browser checking with browstat

Published
by
Greg
on February 1, 2007
in Networking and Windows Server
. 0 Comments

All these years and I’ve never known how to determine what the “master browser” was on my networks. How many times do you see those event log errors about “such and such is not the master browser” or “unable to get a browse list”. Not that I know how to fix all that, but at least I can find out WHAT THE MASTER IS in the first place!

There’s a cool utility called: browstat

Run from command line. There is one stupid thing though, you need to determine your Netbios transport first. To do that, run: net config rdr

C:\>net config rdr

Computer name                        \\MYSERVER

Full Computer name                   myserver.yourdomain.com

User name                            administrator

Workstation active on

        NetbiosSmb (000000000000)

        NetBT_Tcpip_{0FCE584B-9B98-4D26-A241-1A070D06767A} (00188B3A1EE6)

        NetBT_Tcpip_{F55EF45C-33E5-4842-A4AC-8DFF82D07B76} (00188B3A1EE8)

Software version                     Windows 2000

Workstation domain                   YOURDOMAIN

Workstation Domain DNS Name          YOURDOMAIN.com

Logon domain                         YOURDOMAIN

COM Open Timeout (sec)               0

COM Send Count (byte)                16

COM Send Timeout (msec)              250

The command completed successfully.

So you can see… what a mess! You need this:

NetBT_Tcpip_{0FCE584B-9B98-4D26-A241-1A070D06767A}

And to get your master browser run this:

browstat getmaster NetBT_Tcpip_{0FCE584B-9B98-4D26-A241-1A070D06767A} YOURDOMAIN

It should return something like: Master Browser: MYSERVER

You can also run: browstat status YOURDOMAIN
This will list all kinds of useful info, including your transports.  It shows your backup servers, as well as your master browser.

How to change server comment or description showing in network neighborhood

Published
by
Greg
on February 1, 2007
in Networking, Registry and Windows Server
. 0 Comments

We had some computers showing a set of numbers as the computer on a mapped drive. They happened to be some numbers auto-added by Dell setup, I think. But that’s not the issue. It’s just showing the wrong thing on a mapped drive.

For example: Running “net view” shows a server like so:

Server Name   Remark

\\server    8400238585

So on our mapped drive it looked like this:

N: Sharename on 8400238585 (Server)

That is so annoying!!!

The fix…

First, change the server comment so it makes sense. On the server:

Right click My Computer, select Manage.
Right click the top item (Computer Management),and select Properties.
Go to Network Identification, and type in the Description you would rather have.

You probably need to restart the Server service or even reboot that server to take effect. You can also do that to other servers from the same location, by right clicking the same item and selecting “Connect to another computer”.

You can also update this in the registry, can’t remember exactly where. But I think its a key called “srvcomment” under HKLM\Currentcontrolset\Services\lanmanserver.

You can also run this on the server:
net config server /srvcomment:”My new description”

Now, to fix XP you need to do this:
http://support.microsoft.com/kb/330193

How to set Do not Display Last User Name and No Shutdown

Published
by
Greg
on May 11, 2006
in Networking, Registry, Windows Server and Windows XP
. 0 Comments

This used to drive me nuts. Go to Group Policy, set the Last Username display setting to enabled, and you still see the username at logon. What? Most sites you find when searching for this will tell you to adjust the policy (group or local). OR, they will tell you to remove the DefaultUserName in the registry. For some reason, these do not always work, and I haven’t figured out why. (particularly on a domain controller.)

Anyway, here’s the trick. Keep in mind, that this will disable the last logged on user at ALL logon prompts, terminal (RDP) logons and local console logons.

To make sure that the last username does not show at logon screen go here:

HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon

In there, make sure there is a value for:

DontDisplayLastUserName

It should be a REG_SZ type: String value. So, if it’s not there, add it, and make the value = 1

That’s it.

BIG NOTE: I have not tested this on a domain controller yet. But I think this will do it. It works great on 2000 Server (non-DC) and on XP Pro.

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Name: NoClose
Type: REG_DWORD
Value: 1

This will disable the Shutdown command on the start menu.

On the shutdown registry hack above/below, put it in HKLM to affect the whole server/dc/workstation.

Worthless IT Certs?

Published
by
Greg
on January 20, 2006
in Business, Networking, PC Repair and Windows Server
. 0 Comments

A few minutes ago I ran into a blog by someone that said something that needed to be said. IT Certs are not really worth getting. I just wanted to save my comments on my own blog to reiterate and edit later.

Here’s my comments on his blog:

Having spent a few years as an IT Manager for a small company, I can say that I never looked at Certs in my stack of resumes. (Except maybe, A+, maybe) In fact, I put very little importance on College education. I wanted to see a couple years providing real, and creative solutions. This gave me a good ground work to start the interview process, and then determine if the personality would work.
I have seen a couple educated people, looking to get certs, not even be able to replace a hard drive. Or even tell me why certain DNS issues were causing problems. In my IT world, these people will never do. Learn how to do pc repair, then networking (the non-microsoft way too, ie. Linux) and you’ll be 100% better off.
In my experience getting jobs (and now clients), having the NT cert from back in 98, not a SINGLE person has ever asked me about it! I was always hired because of a referral, and my experience spoke for itself.
Besides, I feel that Certs really say, “I know the books smarts that this vendor wants me to know, not necessarily what the real world needs.” I would even say that, having the NT cert, only half of it was useful information.