Sharing & Learning - I am a system administrator

window search service and remote query to a index on the server

2010-09-29T15:51:00.002-04:00

Well, finally I figure out the last piece of the puzzle...It works fast with Windows 7 and with "word wheel" feature that google.com just had. Somehow the search return take longer on Windows XP machine installed the WDS 4.0.

see this ..http://biztechmagazine.com/article.asp?item_id=416

Most important piece of this WSS remote query is here.

One final note: Remote Search works well in Vista but there’s one limitation. When you open a remote share that you want to search, be sure to open it either by browsing Network in Windows Explorer or by typing a UNC path of the form \\servername\sharename, where servername must be the NetBIOS name of the server, not the server’s IP address or fully qualified domain name (FQDN). For some reason, if you specify a FQDN in your UNC path and then try to search a share, grep is used instead of the remote index.

Voice VLAN provision

2010-07-09T15:55:00.004-04:00

Back in 2007, I have used Cisco Switch to provision Mitel Voip phone, and phone will use a different VLAN than PC and share the same data drop. However, I forge the technical detail how the hell the Phone is smart enough to get a different VLAN.

Now, I know it is because CDP. Actually, the there are other options, such as DHCP VLAN provision. Polycom SIP phone support CDP as well. Here is the link.

Automatic Configuration of VLAN ID
In the Network Settings menu, there is another field called “CDP”; this controls whether the phone
supports the Cisco Discovery Protocol. Among many other things, CDP allows the Ethernet switch to
inform an IP phone what VLAN ID it should use without requiring manual configuration of each
phone.
4
If CDP is enabled and a VLAN ID is also manually configured, any value received via CDP will
override the manual configuration. If no VLAN ID is received via CDP, the phone will fall back to the
configured value, if present, or to the native VLAN.
QoS Configuration
By default, the phone sends all audio packets with 802.1p tag and IP Precedence values of 5, which
is the highest priority level available for user traffic. This can be adjusted via the
qos.ethernet.rtp.user_priority and qos.ip.rtp.precedence values in the configuration files. Marking
audio packets with DSCP values is currently not supported.

More infomation avaiable at voip-info.org and this link

http://wiki.voiceroute.org/wiki/Overview_of_Auto-provisioning_Phones

iPhone Apps and Google mobile

2010-06-25T17:30:00.003-04:00

Apparently,iPhone app is the major factor of why iPhone is smarter than other smart phone, like Blackberry. I have used Blackberry for so many years for email only, until this year I have to ditch blackbery.

Google created the Android mobile OS because it wants its search engine to remain relevant as the world migrates more toward mobile computing. But Google’s biggest challenge in mobile search is not other search engines or platforms, it’s apps — particularly iPhone apps.

——————————————————————————————————————————————————

When I filled up the iPhone with mobile apps as part of my recent experiment, one of the first apps that I downloaded and put on the iPhone home screen was the Google app. Since Google is the home page on all the PCs and laptops that I work on, I assumed my behavior on the iPhone would be similar to the computer. I was wrong.

Once I downloaded a fleet of useful iPhone apps, I quickly discovered that I used Google far less on the iPhone than I do on a computer - even over Wi-Fi, and even when doing many of the same activities. That is partly due to the fact that mobile search needs to improve, but it is also do to the nature of the smartphone itself.

When I’m sitting at a computer, I typically use Google at least 2-3 times per hour. It’s usually the first place I go to get information. Google is not as much of a sleuth as it is a concierge. For example, when I’m pulling up a site, I often don’t use a bookmark or type the URL into the address bar. It’s just quicker to open my home page (Google) and type in the company name. This behavior is a bit lazy, but it’s effective because it’s the path of least resistance.

However, the opposite is true on smartphones — especially the iPhone with so many specialized apps and no qwerty keyboard. In my tests with the iPhone, I discovered that Google is usually my last resort for finding information. In fact, I typically only use Google search 2-3 times per day from the iPhone.

Typing is just not as fast on a smartphone (even with the full qwerty keyboard on BlackBerry). Pointing, scrolling, and selecting are all much easier and quicker. As a result, many of the things that I would usually do with a Google search from my computer, I do through an app on the iPhone. For example:

* Instead of looking up a business address on Google, I use the universal White Pages app on the iPhone
* Instead of looking up a local business category (e.g. “Computer recycling”) in Google, I use the Yellow Pages app, which will even automatically calculate my location via GPS, if I allow it
* Instead of looking up a local taxi company when I’m traveling, I can use the Taxi Magic app on the iPhone (again, it will automatically get my location from GPS if I allow it)
* Instead of looking up local restaurants in Google, I can use the Yelp iPhone app
* Instead of searching for the professional credentials of a business associate on Google and being unsure if the results will have pages that might not work well on a smartphone, I can use the Linkedin or Facebook iPhone apps to do a quick people search.
* Instead of using news aggregators like Google News and Techmeme - which I tend to use on my PC - on the iPhone I usually go straight to news sites with strong iPhone apps or pages, such as AP News, Reuters, New York Times, Wall Street Journal, and MoneyWatch (a CBS sister site to TechRepublic).

The last example points to one of the reasons why mobile apps trump mobile search. With mobile search you don’t always know whether the stuff you click on in the search results will be viewable or functional on your smartphone. But if you have a mobile app or site that’s designed for that smartphone then you can be relatively confident that a search using that app will quickly return results (and links) that are optimized for a smartphone.

There’s also another factor. The limited screen size and computing capacity of smartphones force developers to make their apps laser-focused on a specific task. This automatically guards against feature-creep and makes most apps simpler and faster to use. As a matter of fact, there are some sites and services where I prefer their iPhone apps or pages to their Web sites because the smartphone version is much more focused, easier to navigate, and faster.

For more insights on Google, iPhone, and other tech topics, follow my Twitter stream at twitter.com/jasonhiner

As I’ve been conducting my iPhone apps experiment I’ve also noticed that I’m starting to reach for the smartphone instead of the laptop more often, even when I’m in fixed locations such as conference rooms or even at home. The instant-on access, portability, and growing library of quality iPhone apps are all factors driving this behavior.

No matter how you look at it, these trends add up to bad news for Google in mobile search because it translates into fewer people needing its search engine. And the mobile trends are accelerating. According to comScore, U.S. users who access the mobile Web from a smartphone on a daily basis jumped from 10.8 million in January 2008 to 22.4 million in January 2009.

“This underscores the growing importance of the mobile medium as consumers become more reliant on their mobile devices to access time-sensitive and utilitarian information,” said Matt Donovan, senior vice president of mobile at comScore.

There’s also big business associated with mobile search. ABI Research sees mobile advertising ramping up at a time when most other advertising mediums are declining. In terms of mobile search specifically, ABI Research sees the market expanding from $813 million in 2008 to $5 billion by 2013.

“While mobile search incorporates more contextually relevant information such as location,” said ABI Research director Michael Wolf, “consumers will increasingly look to search as a way to discover content and pertinent information that could drive purchasing behavior. Providers that can supply the most applicable solutions tailored toward mobile users will ultimately win in the marketplace.”

Right now, specialized apps are providing a much more tailored experience than mobile search portals like Google and Yahoo. I believe Google realizes what’s at stake and the trends that are working against it - at least partially - and that’s why it has developed its own mobile platform with the Android OS.

Nevertheless, Android is fighting an uphill battle against the iPhone and its growing momentum in mobile applications. Plus, Android will have to battle RIM’s BlackBerry platform and Palm’s new webOS platform Both RIM and Palm already have a strong legacy of building a platform ecosystem for developers, an area where Android has struggled so far, even with its open source appeal.

The bottom line is that I fully expect smartphones to become the most widespread global computing platform in the next five years, driven heavily by the developing world, where the smartphone will be the primary PC for the majority of users. And as smartphones become more dominant, it is going to naturally migrate some power and influence away from search (and Google) and toward mobile computing applications.

2010-06-25T17:12:00.001-04:00

IT consultants usually want to say yes to all client requests, but some challenges, such as running cable, are better left to qualified professionals with specialized skills.

——————————————————————————————–

Clients develop new ways of challenging IT consultants every year. My consulting firm has been asked to install and configure VoIP phone systems; we’ve been charged with physically moving server racks and equipment between facilities; I’ve even found myself installing and terminating Ethernet cabling in new buildings. But just because IT consultants are asked to complete ancillary projects doesn’t mean they should.

It’s a hard lesson to learn. Not many IT consultants want to tell a client no, even when the client requests services outside the consultant’s area of expertise. Not all consultancies specialize in building Web sites, developing proprietary applications, installing or configuring VoIP systems, moving server rooms, installing associated electrical and HVAC systems, or running cabling; however, many consultancies are still tempted to say, “yes, we can do that for you” in response to almost any client request.
Do what you do

The trouble is many of the ancillary tasks clients request require specialized skills and expertise. Cabling is a perfect example. While a well-meaning consultant might agree to run three or four new cable drops for a long-time client to save delays and the hassle of identifying a qualified cable installer, such favors can prove troublesome. I know because I’ve run my share of cabling.

Some cabling adventures remind me of lessons I learned from installing drywall myself during a home remodel. Hanging four or five sheets of drywall took me an entire Saturday. First I had to get the drywall from the home improvement warehouse to my home, and I didn’t have the right truck, which complicated the effort. Then I struggled to maneuver the drywall, hang it in place, and secure it properly. Taping and mudding consumed another day. Later I watched a home improvement show in which professional drywall installers completed the same work in approximately one hour.

The lesson is simple: Different professions require different skills, tools, and expertise. That’s why I don’t think most IT consultants should install cabling. IT consultants who are used to wearing business dress clothing and not to carrying a toolbox are probably not well suited to hefting rolls of cabling up stairs, running plenum-grade wiring in tight spaces, or fishing Ethernet through finished walls. It’s a dirty job that requires specialized tools and a solid understanding of industry standards and even building codes.
Establish a value-added partnership

This doesn’t mean that you need to leave clients who require cabling assistance out in the cold. Instead, consider establishing a tight partnership with a cabling contractor. By working closely with a qualified contractor, your office can assist clients in addressing all their cabling needs, going so far as to serve as the centralized contact and invoicing party. If you cut a fair deal with the contractor, you can even make some extra money in the process.

Have you ever run cabling for any of your clients? What other ancillary projects or dirty jobs have you worked on for clients? Do you partner with contractors for any type of work that falls outside your area of expertise? Let us know in the discussion.

First Day at Consultant

2010-06-25T16:09:00.001-04:00

An IT consultant’s first day on a new site is often like a new employee’s — you do almost nothing. Neither you nor your client can afford to waste time, but it happens just the same.

The main problem is communication (or lack thereof). You don’t know the company’s routine and personnel, and the client and users don’t know what you need from them. Realistically, you can’t expect to walk through the door and go straight to work on the first day. But with a little planning and cooperation from your client, that first day can be productive.
How to prepare for a successful first day

The project and the industry will dictate many unique requirements, but you can accomplish a lot on your first day if you go in well-informed and prepared. Here are seven tips for making sure your first day onsite isn’t a waste:

#1: Learn about the company
Your client may think that, as “the expert,” you already have all the answers, but you can’t do your best work in a vacuum. To avoid creating solutions that create more problems and to provide the best service possible, you need a view of the big picture. To that end, request a copy of the client’s mission statement and goals. If possible, procure a copy of the employee manual. You’ll also want the company to make full disclosure of all IT manuals and policies that impact your project.

#2: Set clear and realistic expectations
Make sure your new client understands that you’ll spend the first few days of your contract exploring the company’s facility, getting to know key personnel, and researching the project. Clients often expect consultants to have immediate answers and that’s unrealistic. You need time to assess the project and explore possible solutions.

It’s also helpful to provide the client with feedback at the end of your first day. A simple list of who you met with that day and what you plan to do the next day or two can prevent unrealistic expectations and instill confidence on the part of your client.

#3: Know your inside contacts
Ideally, you’ll have at least a few days after signing the contract before you actually put your services into action. Use that time to meet with or call the person you’ll work with the most in-house. If it’s the head honcho, you’ve got your work cut out for you, as they can be rather impatient once the deal is made, and “talk to my assistant about that…” might not get you the information you need. One way or another, you’ve got to make contact with someone inside who can help you organize that first day — you can’t do it alone. You’ll also need a list of all users, their contact information, their functions within the company, and their relationship to your project.

The key to a successful first day with a new client isn’t just your preparation, but helping the client plan for your arrival. You must work in tandem to get the most out of that first day.

#4: Meet personnel ahead of time
If possible, don’t wait until the first day to meet the client’s personnel; try to arrange a good time to drop in and say hello to everyone. That’s not always possible, but knowing your way around ahead of time can take the edge off that first morning. Not every client will want to accommodate you on this request, so defer to his or her wishes.

#5: Make sure key personnel will be available
Determine who you want to meet with on that first day and ask them to arrange their schedules accordingly. Work directly with your in-house contact or contact individuals directly. If you run into obstacles, such as key personnel being on vacation, consider postponing your start day. Remember, you client won’t think to check on these details. Postponing your start date because key personnel aren’t available is preferable to billing a client for wasted time.

#6: Conduct a technical equipment check ahead of time
Check on meeting rooms, telephone lines, and other equipment you might need, such as a computer, projector, video or audio conferencing, and so on. For instance, if you want to make a short presentation to a group of users, you’ll need a conference room and perhaps some video equipment. Not every client will have everything you need, so once you know what’s available, you can adapt or bring your own equipment.

You’ll need the cooperation of your in-house contact to schedule meeting rooms and equipment so there are no surprises. Arrive early if necessary to arrange the room and equipment. Even if someone in-house agrees to do this for you, arrive early enough to make sure everything is in place and that all the equipment works. In fact, you might have to set up everything yourself, but knowing what to expect will help you avoid delays.

#7: Have a backup plan
Remember all that documentation you requested the client provide — mission statements, manuals, and so on? Take those with you that first day. Despite your best efforts, if your plans fall through, you can spend the day perusing those documents.

Logon Script

2010-06-15T14:26:00.001-04:00

Logon Script FAQ

Frequently Asked Questions About Logon Scripts:

1. How do I setup Logon scripts in a domain with Active Directory?
2. Why would I choose one method over another?
3. Can I use both methods to assign Logon scripts?
4. How do I setup Logon scripts so they support all of my clients?
5. How do I configure a Logon script for a user on the "Profile" tab in AD Users & Computers?
6. What languages can I use for Logon scripts?
7. Can I use a VBScript program for a Logon script on all clients in my domain?
8. How do I configure a Logon script with Group Policy?
9. What about Logoff, Startup, and Shutdown scripts in Group Policy?
10. What permissions are required for Logon scripts to run?
11. What can be done with a batch file Logon script, besides launch a VBScript program?
12. What about Logon scripts in an NT domain?

1. How do I setup Logon scripts in a domain with Active Directory?

There are two ways to assign Logon scripts. First, you can specify the Logon script on the "Profile" tab of the user properties dialog in the Active Directory Users and Computers MMC. Second, you can specify a Logon script in Group Policy.

2. Why would I choose one method over another?

You would assign a Logon script on the "Profile" tab of the user properties if you have client computers with Windows 95, Windows 98, Windows ME, or Windows NT. Group Policy is not applied on computers with these operating systems. If all of your clients have at least Windows 2000, you could use Group Policy to assign Logon scripts.

3. Can I use both methods to assign Logon scripts?

You can, but if a user logs on to a computer with Windows 2000 or above, both Logon scripts will run.

4. How do I setup Logon scripts so they support all of my clients?

If your users can Logon to both older clients (like Windows 95, Windows 98, Windows ME, or Windows NT) and the newer clients (like Windows 2000 and Windows XP), you should assign a batch file as the Logon script on the "Profile" tab for each user in the Active Directory Users and Computers MMC. The batch file can launch a VBScript program, as explained below. Once all of your clients are at least Windows 2000, you can use a VBScript program as the Logon script, and use Group Policy to assign Logon scripts to all users in a domain, site, or organizational unit.

5. How do I configure a Logon script for a user on the "Profile" tab in AD Users & Computers?

The field labeled "Logon script" on the "Profile" tab of the user properties dialog in the Active Directory Users and Computers MMC corresponds to the "scriptPath" attribute of the user object. The default location for Logon scripts specified by this attribute is the NetLogon share. By default, all users have read access to this share. The NetLogon share on the Domain Controller is located in the following folder:

%SystemRoot%\sysvol\sysvol\\scripts

where %SystemRoot% is usually "c:\winnt" and is the DNS name of the domain, similar to "MyDomain.com". This folder is replicated to all Domain Controllers in the domain. The usual practice is to enter the name of the Logon script, for example "NetLogon.bat", in the field labeled "Logon script" on the "Profile" tab for the user and place this file in the NetLogon share. The Logon script will run for the user when they Logon to any computer that is joined to the domain. You can also enter a UNC path in the "Logon script" field and place the file in another location. However, this location should be one that is replicated to all Domain Controllers. Alternatively, you can use a script or utility to assign the Logon script to the "scriptPath" attribute of the user object in Active Directory. A VBScript program to assign a value to this attribute for many users in bulk would be much faster than manually entering values for users one at a time in the MMC.

GPO loopback, and apply user setting a group of computer account

2010-06-15T14:22:00.001-04:00

Ever have an instance where you needed to apply a consistent user experience on a specific computer no matter who logs in... but also allow their individual user settings to come through to map drives or favorites?

user setting Group Policy Loopback mode to the rescue.

The default behavior of Group Policy application goes like this: If a user account that resides in an OU falls under the scope of a Group Policy, it will apply all settings that are defined in the User Configuration-node in the Group Policy Editor. They just apply the user portion of the policy. So do computers. They just apply the Computer Configuration settings from all Group Policies under whose scope they fall. Quite simple logic: User logs in -> user account in Active Directory -> User Configuration applies; Machines boots up -> computer account in Active Directory -> Computer Configuration applies.

Given the problems above, people sometimes need to have certain User Configuration policies applied â€“ on all workstations. That can be useful if you run a Terminal Server environment where people need to get certain User Configuration settings like screen savers or something. You might also need that if you want to run machines with a predefined user environment, no matter who logs in. Locked down kiosk computers for example. This all are points where Group Policy’s Loopback processing mode can help. By linking a Group Policy object with the loopback processing setting enabled to an OU, you force the computer (~computer accounts) to look at and apply the user configuration settings of all Group Policies as well:
Computer Configuration\Administrative Templates\System\Group Policy\

How does Group Policy application work, if you have enabled loopback? Well, let’s create a scenario. Bob wants to log on to the domain using his machine machine1. Machine1 lies in the scope of a Group Policy that enables loopback processing. When booting the computer, Bob will not notice any changes to the computer. It simply boots up - in the background, all computer configuration settings that machine1 should get applied, will be applied. Until now, normal behavior. Bob can now log in. After he logged in, machine1 will process the following policies depending on what loopback mode was configured on machine1.

If Merge Mode was selected, machine1 will first pull and apply all user configuration settings from the Group Policies of Bob’s Active Directory user account. That is, what would also happen if loopback wasn’t configured. After having applied Bob’s policies, machine1 applies all user configuration settings that are configured for the machine1 computer account in Active Directory. The fact that machine1’s user configuration settings get applied after Bob’s ones means, that machine1’s settings will win if there is a setting-contradiction. Last policy wins, or last writer win? if we want to say so.

If Replace Mode was selected, machine1 simply applies all user configuration settings of the Group Policies given for machine1’s Active Directory user account - nothing more. With Replace Mode enabled, the machine doesn’t even look at the settings Bob would normally get applied.

Not that, when machine1 looks at the user configuration settings it shall apply, it actually impersonates the user logged in. In our scenario, if Bob was logging in, machine1 will look at all policies it should apply according loopback, but with Bob’s permissions on every policy.

Grand Perspective and disk space usage report

2010-05-26T14:39:00.000-04:00

http://alternativeto.net/desktop/grandperspective/?platform=windows

this grand Perspective is a wonderful disk space usage analysis tool , because it use the visual cube /box to present the result. It is better than pie diagram or top 10 list, because it use color and box in a box, and in a box to present the disk use…. It don’t check the file ownership of NTFS, or the creator, but it is useful enough to just look at the name of folders.

Another one usefully is treesize…pro. Free.

Hyper -V

2010-05-20T12:22:00.003-04:00

1. Vmware tool equavalent..IC.
2. 3 type of virutal disk .. dynamic, fixed, and differencing disk. Differencing disk is important to know.

Activation has change for Vista and Windows 30
1. 30 day grace period, you can install it without providing product key
2. 3 way to activate in volume license.
KMS volume license is the new way to activate
it require no user intervention, but it require a host, and require registration in DNS.
all KMS client must be able to connect to KMS host every 180 day or 180+90 days.
Large organization need both KMS and MAK... The KMS host should automatically create a SVR record on DNS server.

Technet Promotion and benefit

2010-05-11T11:46:00.001-04:00

A 28% discount* on a new TechNet Plus Direct Subscription (USD $349) can be provided to you by your Microsoft Certified Trainer: [fill in your name].

The discount code is [fill in your unique discount code]. Go to TechNet Subscription to order.

Are you looking for:
• more information when you leave the classroom
• the ability to access Microsoft software to create and recreate new scenarios and technologies
• the opportunity to continue building your skills and knowledge

A TechNet Plus Direct license includes all of the following benefits in one location. Each subscription is for one (1) user.

• TechNet Technical Information Library – Rights to download and access the entire contents of the knowledgebase through our Offline Technical Library Viewer:
o Set search criteria that allows you and your student to view the same content
o Provide direct information on specific What, Why and How queries. You can both view deeper, quicker and broader content in one central place
• Evaluation Software: Full version software for evaluation purposes without time limits such as Windows Server 2008, Windows 7, Office 2010, Exchange, , SharePoint, and over 70 products
• Microsoft E-Learning Courses – Three courses updated quarterly. Total of twelve (12) per year – a value over $1200
• Technical Support - Two technical support calls included per subscription year, and a 20% discount on additional support calls – a value over $500
• Security updates, tools, and utilities – can be accessed via the TechNet subscriber portal upon release
• Online Support Options– unlimited support on TechNet managed forums, and 24/7 online concierge IM chat support

* Terms & Conditions:
Offer expires on June 30, 2010. Pricing may vary by country, exchange rates and local taxes. Offer applies to new Technet Plus Direct subscriptions only. See below for full details. Must be used in accordance with the Microsoft License Terms for Technet Subscription. The offer is for a discount of up to 28% off the US estimated retail price of USD$349 of a 1 year TechNet Plus Direct Subscription (“Subscription”); however, actual Subscription price may vary by country and region due to currency exchange rates and local taxes. Each individual acquiring a Subscription is responsible for all taxes related to the Subscription. The discount is valid only for new TechNet Plus Direct subscriptions and may not be combined with any other promotions, discounts or offers. The Subscription discount offer is limited to one per individual and may not be used on volume license orders. Each Subscription and related benefits may only be used by one individual. Subscriptions may not be transferred, shared, or sold. To receive the discount on the Subscription, the potential subscriber must place the Subscription order on or before June 30, 2010, via the Microsoft web site below or via phone though the customer service center in his/her region, and provide the promo code given by his/her Microsoft Certified Trainer.This offer is only valid in the United States.

2010-03-30T15:43:00.000-04:00

Home Depot Kids Workshop - The huge hardware conglomerate is a great refuge for Dads everywhere, but now they offer kids workshops one Saturday per month (check your local Home Depot for time and location). At the workshop kids learn how to build birdhouses, bat houses, stock car racers, airplanes, wooden flowerpot holders and more. It's a great Saturday morning activity where your kids can learn the skills necessary to fix your roof when you get too old to climb up there.
Tin can and string telephone - You don't necessarily need tin cans for this project. Two plastic or styrofoam cups and some twine will do.

Using a tack or the end of a pin, punch a hole into the center of the bottom of each cup.
Cut a piece of light string 25 feet or longer.
Feed one end of the string through the hole of one of the cups
Tie a large knot on the string so it doesn't fall back through the hole.
Feed the other end of the string through the other cup and tie a knot like you did for the first cup.
Now give the cup to your child and walk away from each other until the string is tight.
Now you can whisper back and forth into your child's new telephone.

funny animal

2010-03-30T15:39:00.000-04:00

Funny animals

Paper, pen/pencil & a dice

Details

Gender: Both
Activity Type: Games & colouring

Description

The numbers on a dice represents the following things on an animal:

1 - leg
2 - tail
3 - head
4 - neck
5 - ear
6 - body

Roll the dice and draw parts of an animal according to the numbers you get, as listed above. Keep going for a set time, say one minute. See what a funny animal you end up with!

backup plan question

2010-03-25T11:20:00.004-04:00

The allowed downtime has a significant impact on the investments into network
infrastructure and equipment needed for backups. For each type of data, list the
maximum acceptable downtime for recovery, that is, how long specific data can
be unavailable before recovered from a backup. For example, user files may be
restored in two days, while some business data in a large database would need
to be recovered in two hours.

Recovery time consists mainly of the time needed to access the media and the
time required to actually restore data to disks. A full system recovery takes more
time, because some additional steps are required. For more information, see
“Disaster recovery” on page 134.

How long should specific types of data be kept?
For each type of data, list how long the data must be kept. For example, you may
only need to keep user files for three weeks, while information about company
employees may be kept for five years.

How should media with backed up data be stored and maintained?
For each type of data, list how long the media with data must be kept in a vault,
a safe, external location, if you use one. For example, user files may not be stored
in a vault at all, while order information may be kept for five years, with
verification of each medium after two years.

To how many media sets should the data be written during backup?
Consider writing critical data to several media sets during backup to improve the
fault tolerance of such backups, or to enable multi-site vaulting. Object mirroring
increases the time needed for backup.

netstat and troubleshooting tools

2010-03-25T09:35:00.003-04:00

I think I know netstat very well. Until today I found it is not true. I miss some great feature.

Netstat -ab

this -ab switch list the firewall port and owner process information. It help to determine which program/file open which TCP port.

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 huajo-win-7:0 LISTENING
RpcSs
[svchost.exe]
TCP 0.0.0.0:445 huajo-win-7:0 LISTENING
Can not obtain ownership information
TCP 0.0.0.0:3389 huajo-win-7:0 LISTENING
CryptSvc
[svchost.exe]
TCP 0.0.0.0:5357 huajo-win-7:0 LISTENING
Can not obtain ownership information
TCP 0.0.0.0:49152 huajo-win-7:0 LISTENING
[wininit.exe]
TCP 0.0.0.0:49153 huajo-win-7:0 LISTENING
eventlog
[svchost.exe]
TCP 0.0.0.0:49154 huajo-win-7:0 LISTENING
Schedule
[svchost.exe]
TCP 0.0.0.0:49157 huajo-win-7:0 LISTENING
[services.exe]
TCP 0.0.0.0:49193 huajo-win-7:0 LISTENING
[lsass.exe]
TCP 10.27.1.23:139 huajo-win-7:0 LISTENING
Can not obtain ownership information
TCP 10.27.1.23:49233 plan-actdir:1026 ESTABLISHED
[OUTLOOK.EXE]
TCP 10.27.1.23:49236 exchange:1167 ESTABLISHED
[OUTLOOK.EXE]
TCP 10.27.1.23:49773 host72:http CLOSE_WAIT
[OUTLOOK.EXE]
TCP 10.27.1.23:49774 www3:http CLOSE_WAIT
[OUTLOOK.EXE]
TCP 10.27.1.23:49779 unset:http CLOSE_WAIT

OOB and blog need to going on

2010-03-13T23:28:00.002-05:00

This blog is out of blog for quite a while . And now this can be a good place to store the new product I found recently.

www.opendns.com this has been enable on my home network since Jan 2010.
www.virustotoal.com this site allow you to submit file to detect if this is a virus, trojan or other malicious content inside. I can also send attachment to scan@virustotoal.com as well.
www.vmreference.com vmware diagram and a double-paged 11/17 cheatsheet

backward compatibility and function levels

2009-06-26T16:44:00.002-04:00

Windows 2008 has bring two more function level to domain controller compatibility in Microsoft Domain World. More and more, I consider the function level or mode ( for exchange ) as part of backward compatibility that Windows has to deal with when new mode is co-exist with olde mode and replace the old mode eventually. The consequence of raise function level / mode is that you can not have a old version domain controller join in this domain/forest/exchange organization any more. That is it, raising the function level lose the backward compatibility when come to what version of domain control can join in the same active directory.

Of course, raising function level is not a reversible change. You can not roll back the change. The raise open up the advance feature the new version come with.

Note: Network clients can authenticate or access resources in the domain or forest without being affected by the Windows Server 2003 domain or forest functional levels. These levels only affect the way that domain controllers interact with each other.
Daniel Petri has an excellent article cover this topic.

http://www.petri.co.il/understanding_function_levels_in_windows_2003_ad.htm

csvde utility can import/export AD objects but not able to modify

2009-06-18T18:19:00.004-04:00

This link below contain best example and learning points on CSVDE utility to create AD objects in a batch import/export way.

http://www.computerperformance.co.uk/Logon/Logon_CSVDE_Export.htm

I have used the /i switch to import about 500 plus objects , and it finished in a flash of time. The process also create a log that is easy to read and useful. For export, the permission is "list content" so normal user account that allow to brower AD object such as computer /printer/user will be able to use this tool to export a huge list of information. I often compare this tool with Adexplorer snapshot taken function. Each has its advantage to use.

Steps to restore a system state for Active Directory

2009-06-18T18:16:00.002-04:00

How to restore for AD? you cannot restore the System State Data while the
Active Directory is running. Thus, you need to boot the computer into Directory
Services Restore Mode. This is similar to Safe Mode and will not start the Active
Directory. Be aware that during this time the machine won't act as a DC and won't
perform functions such as authentication. To restore the System State Data after
starting the computer in Directory Services Restore Mode:
1. Start NT Backup.
2. Select the Restore tab.
3. Select the backup media, and select System State.
4. Click Start Restore.
5. Click OK in the confirmation dialog box.
6. Reboot the computer into normal mode.

Active Directory restore and ntdsutil.exe

2009-06-18T18:09:00.002-04:00

Because Active Directory uses multimaster replication to synchronize all the DC
databases throughout an Active Directory domain, performing a normal restore is not
sufficient when objects such as user accounts, groups, or organizational units get
accidentally deleted or incorrectly modified. All objects in Active Directory are assigned
Update Sequence Numbers (USNs) that determine which objects are the most up to date
when replication occurs between DCs. After you perform a normal, or nonauthoritative,
with older USNs will become deleted again when the DC is restarted in normal mode and
replication takes place. To ensure that the restored Active Directory objects do not get
deleted again via replication, you must use the ntdsutil.exe command-line tool to mark
the restored Active Directory objects as authoritative while the computer is still in
Directory Services Restore Mode. Run this tool before the server restart.

When an object is marked for authoritative restore its update sequence number is changed so that it is higher than any other update sequence number in the Active Directory replication system.
This will ensure that any replicated or distributed data that you restore is properly
replicated or distributed throughout your organization.

How to promote a domain controller from backup media

2009-06-18T17:59:00.001-04:00

When you install a domain controller for the new branch office, the DCPROMO
process needs to replicate a copy of the Active Directory from an existing domain
controller. Due to the need to minimize network traffic, Window Server 2003 offers
the DCPROMO /ADV option. This is used to promote a domain controller and copy
the Active Directory from a backup copy. To deploy an additional domain
controller in an existing domain, you can either let replication copy domain
information from an existing source domain controller over the network or you can
use the install from media feature, new in Windows Server 2003. Install from media
allows you to pre-populate Active Directory with System State data backed up from
an existing domain controller. This backup can be present on local CD, DVD, or
hard disk partition. Installing from media drastically reduces the time required to
install directory information by reducing the amount of data that is replicated over
the network. Installing from media is most beneficial in environments with very
large domains or for installing new domain controllers that are connected by a slow
network link. To use the install from media feature, you first create a backup of
System State from the existing domain controller, and then restore it to the new
domain controller by using the Restore to Alternate location option.
To install Active Directory on the second domain controller:
1. Log on to the Windows Server 2003-based member server.
2. If you want to copy domain information from restored backup files, at the command
line, type: dcpromo /adv
References:
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/Default.asp?u

AD and Server system recovery

2009-06-18T14:07:00.005-04:00

From Directory Services Restore Mode you can choose whether to do an authoritative or
non-authoritative restore of the Active Directory database.
During a normal restore operation, Backup operates in non-authoritative restore mode.
This means that any data you restore, including Active Directory objects, will have their
original update sequence number. The Active Directory replication system uses this
number to detect and propagate Active Directory changes among the servers in your
organization. Thus, any data that is restored non-authoritatively will appear to the Active
Directory replication system as though it is old, which means the data will never be
replicated to your other servers. Instead, if newer data is available from your other
servers, the Active Directory replication system will use this to update the restored data.

Following is the procedure to recover from a system failure using ASR: ( note that ASR only backup necessary system data that can recover a system, and it doesn't backup user data; thus this is not need to be routine backup plan)
1. Collect the following:
1. The Windows 2003 CD-ROM.
2. The ASR floppy disk.
3. The ASR backup media.
2. Boot from the Windows 2003 CD-ROM.
3. Press F2 at the beginning of text mode setup, when prompted.
4. When prompted, insert the ASR floppy disk.
5. Follow the on-screen instructions.
6. Continue to follow the on-screen instructions

A: System State - The System State data includes the registry, COM+ Class Registration
database, files under Windows File Protection, and system boot files. Depending on the
configuration of the server, other data may be included in the System State data. For
example, if the server is a certificate server, the System State will also contain the
Certificate Services database. If the server is a domain controller, Active Directory and
the SYSVOL directory are also contained in the System State data.
C: NETLOGON is used for backward compatibility with Windows NT 4.0 and Windows
9x computers that do not have the Active Directory client software installed.
D: NTDSutil is used to recover deleted objects in Active Directory by marking those
objects as authoritative, following a normal, or non-authoritative, restore of the System
State with the Backup Utility. The ntdsutil command is used to perform an authoritative
restore of Active Directory. The ntdsutil is used to mark the restored Active Directory database as authoritative.

- Configure Volume shadow copy and deploy client software to user via GPO
Volume shaow copies are used to provide copy data at a given point in time.
To use shadow copies, client computers need special software installed.
The Previous Versions Client can be installed through a Windows Installer Package
that is located on your Windows Server 2003 machine in \system32\clients\twclient\
of the systemroot directory (typically named WINDOWS).After it is installed, this
tool enables users to access previous versions of files that were included in a shadow
copy.
You can deploy the Previous Versions Client installation package through Group Policy.

When performing a backup, the Windows Server 2003 Backup utility by default creates a
volume shadow copy, which is a duplicate of the volume at the time the copy process
began. This enables the Backup utility to back up all selected files, including those that
are currently open by users or the operating system. Because the Backup utility uses a
volume shadow copy, it ensures that all selected data is backed up and any open files are
not corrupted during the process. If "Disable Volume Shadow Copy" check box is checked, files that is open or in use is skipped when the backup is performed.

ERD commander 2005

2009-06-08T14:11:00.000-04:00

I am looking for a tool to crack the admin password for a recent installed Windows 2003 server on my VMware workstation. My coworker recommend me a tool from SystInternal/Winternal, called ERD commander 2005. It is a windows PE live CD bundled with rescue /recover tool sets.

Knowing of the issue that they can resolve and concerns on what kind of model / machine this tool can apply to, I tried this tool on three machines and able to reset password on two machines. Finally, I want to come up an overview of DONTs and DOs
DONTS
1. when booting from a DELL e6400 laptop with a SATA HD operated in IRRP mode, it incure a blue screen every time during the boot
2. able to boot into its PE environment on a Asus Mothboard PC with a SATA HD, but not able to detect and connect network adaptor. Also, boot from a live CD is slow than a ISO image file, and work on the program is even slower.
3. able to boot on a VM, but not able to detect and connect network. Running in a VM is much faster than over a live CD
4. not reconiged the USB memory key when in a VM environment
DOs
1. crack admin password. Use locksmith and select user name
2. system file repair, system compare with another computer on the network
3. undelete files; restore file that has been deleted
4. provide utility of disk management, but not sure if it can extend /shrink/resize a partition, like gparted
5. able to view events, autoruns, services, drivers, and change the startup mode for service /drivers
6. able to wipe out data on the disk. Two algrithem to choose
7. able to remove hotfix, service pack, roll back the system restore point if exist

hide-n-seek in Active Directory

2009-06-03T08:51:00.000-04:00

The current workplace I am working has implemented an security policy to hide IT user, group and computer object from help desk staff. It is a OU based the control, which deny IT helpdesk group from listing content of OU. So helpdesk can have admin.pak installed and launch ADUC but can only work on MAC of normal user and computer.

Back to blog

2009-05-25T08:59:00.000-04:00

I have missed many days to work on my blog, labs and study. I has suffered the seasonal pollen allergy again this year. It causes me sneezing. And they are very bad and pailful sneeze, and make me feel all my energy is gone and pressure go against my ear drum so much that I believe my ear drum will fail one day because of this.

But here am I. I have learned to use mouth to breath in and out and pinch my nose before any indication of sneeze.

I recently has start my MCSE 2008 track, but I need to take MCSE 2003 exam first. It was 8 years ago that I have taken exam last time. I hate to take the exam, but I know there is a reason for it and I have to live with it. Both my CCNP and MCSE have expired many years now.

So I booked the easiest one, 70-270 (XP client , core) to start, and passed on Sunday. I trust my experience on XP and recent work with XP deployment and image, but the study still give me a golden opportunity to understand what Microsoft think and how great the product is. The more I learn , the more I like it. It help me to tight up many loosed end, just like to button every single button on a complicated cloth even it is unnecessary for carry out the daily routine.

Here are the list of those buttons that I just recently understand their existence:

windows file protection, AKA, WFP; and sfc.exe command to scan dll and system executable file; this answer one of question why XP is stable than thos OS prior to it
Simple file sharing. Which is configurable for XP home and disable for XP pro if joined in a domain. It make the sharing easier/ guest account/ only share tab avaiable
In place upgrade. It is very important during early adoption era for a product like this. Upgrade a windows 2000 /98 to XP with winnt32.exe command
USMT , user state migration tools vs. file and setting transfer wizard
gpresult, rsop, secedit,gpedit and many aspects to the GP and intellimirror
AIPA addressing. or 169.254.0.0/16 address space
compatibility mode
all user profile and default user profile
remote assistant

ZT: how to add OEM SATA driver

2009-05-12T10:23:00.000-04:00

Here is a quick but hopefully useful guide for adding mass storage device drivers to Windows XP SP2 and Windows PE 2005.

This guide explains how to add the Intel SATA driver (very common) to scripted install, sysprepped images and Windows PE 2005.

Download the IntelSATA drivers (Intel Matrix Storage Manager) from www.intel.com and extract them to a temporary folder, C:\Drivers\IntelSATA in this example

The content of the C:\Drivers\IntelSATA folder should have the following files

iaahci.cat

iaahci.inf

iastor.cat

iastor.inf

iastor.sys

txtsetup.oem

Adding mass storage drivers to Windows XP unattended setup (scripted, via unattend.txt)

On the distribution share, containing the Windows XP SP2 setup files , create a folder structure like \i386\$OEM$\TEXTMODE, copy the C:\Drivers\IntelSATA content to this folder.

On the distribution share, containing the Windows XP SP2 setup files , create a folder structure like \i386\$OEM$\$1\Drivers\IntelSATA, copy the C:\Drivers\IntelSATA content to this folder.

Modify the unattend.txt file to look like this

[MassStorageDrivers]

"Intel(R) 82801HR/HH/HO SATA RAID Controller (Desktop ICH8R)" = OEM
"Intel(R) 82801HR/HH/HO SATA AHCI Controller (Desktop ICH8R)" = OEM
"Intel(R) 631xESB/632xESB SATA RAID Controller (Server/Workstation ESB2)" = OEM
"Intel(R) 631xESB/632xESB SATA AHCI Controller (Server/Workstation ESB2)" = OEM
"Intel(R) 82801GHM SATA RAID Controller (Mobile ICH7MDH)" = OEM
"Intel(R) 82801GR/GH SATA RAID Controller (Desktop ICH7R/DH)" = OEM
"Intel(R) 82801GR/GH SATA AHCI Controller (Desktop ICH7R/DH)" = OEM
"Intel(R) 82801GBM SATA AHCI Controller (Mobile ICH7M/DH)" = OEM
"Intel(R) 82801FR SATA RAID Controller (Desktop ICH6R)" = OEM
"Intel(R) 82801FR SATA AHCI Controller (Desktop ICH6R)" = OEM
"Intel(R) 82801FBM SATA AHCI Controller (Mobile ICH6M)" = OEM
"IDE CD-ROM (ATAPI 1.2)/PCI IDE Controller" = "Retail"

[OEMBootFiles]

iaStor.inf
iaahci.inf
iaStor.cat
iaahci.cat
iaStor.sys
Txtsetup.oem

[Unattended]

OemPreinstall = Yes

OemPnPDriversPath = "Drivers\IntelSATA”

DriverSigningPolicy = Ignore

Note: the IDE CD-ROM (ATAPI 1.2)/PCI IDE Controller" = "Retail is important for standard IDE failback

Adding mass storage drivers to Windows XP for sysprep (imaging)

Modify sysprep.inf to look like this . Since we manually update sysprep.inf, do not add BuildMassStorageSection = Yes to the [Sysprep] section

[Sysprep]

[SysprepMassStorage]

; Added for Intel SATA Controller Support

PCI\VEN_8086&DEV_2652&CC_0106=C:\Drivers\IntelSATA\iaahci.inf

PCI\VEN_8086&DEV_2653&CC_0106=C:\Drivers\IntelSATA\iaahci.inf

PCI\VEN_8086&DEV_27C1&CC_0106=C:\Drivers\IntelSATA\iaahci.inf

PCI\VEN_8086&DEV_27C5&CC_0106=C:\Drivers\IntelSATA\iaahci.inf

PCI\VEN_8086&DEV_2681&CC_0106=C:\Drivers\IntelSATA\iaahci.inf

PCI\VEN_8086&DEV_2821&CC_0106=C:\Drivers\IntelSATA\iaahci.inf

PCI\VEN_8086&DEV_2652&CC_0104=C:\Drivers\IntelSATA\iastor.inf

PCI\VEN_8086&DEV_27C3&CC_0104=C:\Drivers\IntelSATA\iastor.inf

PCI\VEN_8086&DEV_2682&CC_0104=C:\Drivers\IntelSATA\iastor.inf

PCI\VEN_8086&DEV_27C6&CC_0104=C:\Drivers\IntelSATA\iastor.inf

PCI\VEN_8086&DEV_2822&CC_0104=C:\Drivers\IntelSATA\iastor.inf

; End of drivers added for Intel SATA Controller Support

;

; Generic drivers

Adding mass storage drivers to Windows PE 2005

Method 1 (via winpeom.sif), requires one folder per controller and updating of each txtsetup.oem even if the drivers supports many controllers

In this example we add support for the PCI\VEN_8086&DEV_2652&CC_0104 and PCI\VEN_8086&DEV_27C3&CC_0104 controllers

Note: Both using the same driver

Create a folder structure like \i386\system32\Drivers\DiskDrivers\IntelSATA_2652

Create a folder structure like \i386\system32\Drivers\DiskDrivers\IntelSATA_27C3

Copy the content of the c:\tmp\IntelSATA folder to both directories (yes duplicate)

In the \i386\system32\Drivers\DiskDrivers\IntelSATA_2652 folder modify the [defaults] section of txtsetup.oem to match the driver

Method 2 (via txtsetup.sif), make the driver support all it’s controllers without modifications…

Extract the WinPE 2005 iso or compile a custom WinPE 2005 image

Copy the iastor.sys file from c:\tmp\IntelSATA to \i386\system32\drivers

Modify the \i386\txtsetup.sif folder

In the [SCSI.LOAD] section add

Iastor = iastor.sys,4

In the [HardwareIdsDatabase] section, add

PCI\VEN_8086&DEV_2652&CC_0106 = iastor

PCI\VEN_8086&DEV_2653&CC_0106 = iastor

PCI\VEN_8086&DEV_27C1&CC_0106 = iastor

PCI\VEN_8086&DEV_27C5&CC_0106 = iastor

PCI\VEN_8086&DEV_2681&CC_0106 = iastor

PCI\VEN_8086&DEV_2821&CC_0106 = iastor

PCI\VEN_8086&DEV_2652&CC_0104 = iastor

PCI\VEN_8086&DEV_27C3&CC_0104 = iastor

PCI\VEN_8086&DEV_2682&CC_0104 = iastor

PCI\VEN_8086&DEV_27C6&CC_0104 = iastor

PCI\VEN_8086&DEV_2822&CC_0104 = iastor

getcomputername script

2009-05-08T10:59:00.000-04:00

Const ADS_SCOPE_SUBTREE = 2

set fs = CreateObject("Scripting.FileSystemObject")
set textstream = fs.CreateTextFile("hosts.xml", True)
Set rootDSE = GetObject("LDAP://RootDSE")
domainContainer = rootDSE.Get("defaultNamingContext")

Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"

Set objCOmmand.ActiveConnection = objConnection
objCommand.CommandText = _
"Select Name, distinguishedName from 'LDAP://" &

domainContainer & "' " _
& "Where objectClass='computer'"
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst

Do Until objRecordSet.EOF
'Wscript.Echo "Computer Name: " &

objRecordSet.Fields("Name").Value
'Wscript.Echo "distinguishedName: " &

objRecordSet.Fields("distinguishedName").Value
arrPath =

Split(objRecordSet.Fields("distinguishedName").Value, ",")
strOU = ""
for each a in arrPath
if left(a,2) = "OU" Then
strOU = "/" & right(a,len(a) - 3) & strOU
End If
Next
'Wscript.Echo "Path: " & StrOU
textstream.WriteLine objRecordSet.Fields("Name").Value
objRecordSet.MoveNext
Loop
textstream.close
Wscript.Echo "Finished..."

psexec and pstools

2009-05-08T09:57:00.000-04:00

http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

psexec is very useful tool that can be use during deployment
another tool is autorun

Deployment tool - WPKG

2009-05-07T14:26:00.000-04:00

My boss like the open source tools and software for many reasons. Here I am evaluating an open source deployment tool, WPKG.

- What it requires?
WPKG require

a WPKG network shared folder and a domain account that can access this share folder from everywhere
a domain admin account or local-admin-for-all-workstation account to push out the wpkg client service to all workstation, via psexec
the network shared folder will has a wpkg.js as the main executable script; and profile.xml and package.xml. The xml files will define the installation details for each software. And host file ( define wich workstation get which profile-package)

- How it works?
http://wpkg.org/Screenshots
http://wpkg.org/WPKG_QUICK_INSTALL
The WPKG Installer will create a windows service on the client machine. The service will run at system boot, and read the configuration xml files from the WPKG network share. The service will be created to run as the local SYSTEM user (the other user credentials discussed below are different).
- How it compare with others?
This is a "pull" type of deployment. It means that workstation initial the installation, by start the service or restart the computer. I don't believe this product can push the deployment although it claim to be a push/pull tool.

one community advantage is it has a collection of silent installer detail, including software A-Z and windows hotfix.
http://wpkg.org/Category:Silent_Installers

- Conclusion
compare with other tools, Altiris , SMS, which can push out a software installation. This product is not strong.

It seems don't provide any other functions other than install software. It has no database, no inventory of computer specs. It need you to familar with the technical detail of unattended mode of the each application. It won't do the after-install configuration. So the use is quite limited.

- Testimonial
I read through, and found that many has mentioned the it can install other non-msi software.
http://wpkg.org/Testimonials

Firewall, DSL, PPPoE and Path MTU discovery

2009-05-03T16:02:00.000-04:00

When configure DSL broadband setup, PPPoE mode is usually the option to choose, not the bridge mode, which do not require username/password and broadcast or share the link with your neighbour. PPPoE will bring 28 byte or more overhead to Ethernet fram underneath, thus the MTU size on the source need to reduce ( 1500 -28) to avoide the fragment along the way.
I remembered when I worked for Truestar 4 years ago, there are many times I need to reduce the MTU size to as low as 1460 because BELL support ask me to do so.
More often than not, there is a Path MTU discovery method built-in to automatically do this for you to automatically detect the smallest MTU size for all intermediate devices. However, many firewall discard the ICMP, which cause the discovery failed.

http://en.wikipedia.org/wiki/Path_MTU_discovery

Acronis Universal Restore summary and errors

2009-04-29T12:35:00.000-04:00

Acronis UR will work 60% at the first attempt when restore to a dissimillar hardware by specify a Chipset driver or storage driver. And for some type of machine, the restore always works fine.
For example, the DELL 630. I have restored a VM image , a HP compaq d530 image, a DELL 170 image. And every single time, the Acronis UR replace the driver correctly and the DELL 630 laptop just boot up fine. After log in, I need to go through those non-boot-essential PnP drivers, and install them so that I can clear those question mark in the device manager. I still need to run the chipset driver setup again, because it has a set of devices depend on.

The other 40% time I have failed at the first attempt, but I get it boot up eventually. These model are DELL optiplex 330, and DELL D620.

Two type of errors have occure to me.
First, it is that restore progress bar is not moving any more when it has only 7-12 second left. I force power off the machine and power on to interrupt and it actually boot up fine. So this error can be ignore
Second, the restore operation is successfully as the pop up says, but windows XP will reboot itself after seeing XP splash logo briefly. I found the Acronis log has a warning about can not locate a file. The correct steps right now is:
1. Make a disk to disk restore, which will delete the target disk; partition to partition won't delete disk or MBR.
2. see if there are error in log, if yes, launch the recovery again without test the booting
3. maek a partition to partition restore without select MBR; resize the partition necessary to take all space on target
4. specify the drivers
5. if this is not working, then do not specify the driver from USB key, but specify check box on "search removable medium" in next page; In this way, I let Acronis to search driver instead of providing driver from my USB key
6. If the log has not entry, it is working. Give it a power boot.

regenerate a GUID for TM client

2009-04-28T16:04:00.001-04:00

TM installation come with a imgsetup.exe file that enable you to seal the image and let it run at next reboot and generate an unique GUID while report to TM server.

See this link for detail.
http://blog.itprohelp.com/2009/04/imaging-pcs-with-trend-micro-officescan.html

command line switch - update.exe and hotfix.exe

2009-04-27T11:33:00.000-04:00

Overview of the installation process

When you run a Windows software update package without command-line switches, the Hotfix.exe or Update.exe Setup program is automatically run to install the software update. The following actions are performed by the Setup program:

The installation program (Hotfix.exe or Update.exe) examines the service pack version you currently are using. If your service pack version is earlier than the software update version, but not earlier than the minimum version specified by the software update, and the language is the same, the Setup program automatically installs the software update. If your service pack version is later than the software update version, the installation does not continue.
If the software update language version does not match your operating system language, the installation does not continue.
If no version conflict exists, Hotfix.exe or Update.exe installs the software update.
The installation program registers the software update under one of the following registry keys:
HKEY_LOCAL_MACHINE \Software\Microsoft\Updates\\\KB
HKEY_LOCAL_MACHINE \Software\Microsoft\Windows NT\CurrentVersion\Hotfix\Q
HKEY_LOCAL_MACHINE \Software\Microsoft\Windows NT\CurrentVersion\Hotfix\KB
Removal information for the software update is stored in a hidden folder named $NtUninstallQnnnnnn$ or $NtUninstallKBnnnnnn$ in %Systemroot%.

Back to the top

Command-line switches for the Update.exe program

The following tables list the command-line switches that are supported by each different version of the Update.exe program.

Collapse this tableExpand this table

Standard switch	Description of the switch	Versions of Update.exe that support this switch
/help	Displays command-line help.	Version 5.3.24.3 and later versions support the /help switch. For compatibility with older versions, the /? switch can be used.
/passive	Unattended Setup mode. No user interaction is required, but installation status is displayed. If a restart is required at the end of Setup, a dialog box will be presented to the user with a timer warning that the computer will restart in 30 seconds.	Version 5.3.24.3 and later versions support the /passive switch. For compatibility with older versions, the /u switch can be used.
/quiet	Quiet mode - same as unattended mode, but no status or error messages are displayed.	Version 5.3.24.3 and later versions support the /quiet switch. For compatibility with older versions, the /q switch can be used.
/norestart	Do not restart the computer when the installation is finished.	Version 5.3.24.3 and later versions support the /norestart switch. For compatibility with older versions, the /z switch can be used.
/warnrestart	Presents a dialog box with a timer warning the user that the computer will restart in x seconds. (Default is 30 sec). Intended for use with either /quiet or /passive switches.	Version 6.1.22.0 and later versions support the /warnrestart switch.
/forcerestart	Restart the computer after installation and force other applications to close at shutdown without saving open files first.	Version 5.3.24.3 and later versions support the /forcerestart switch.
/promptrestart	Presents a dialog box to prompt user to restart if required. Intended for use with /quiet.	Version 6.1.22.0 and later versions support the /promptrestart switch.
/forceappsclose	Forces other programs to close when the computer shuts down.	Version 5.4.15.0 and later versions support the /forceappsclose switch. For compatibility with older versions, the /f switch can be used.
/nobackup	Do not back up files for uninstall.	Version 6.1.22.0 and later versions support the /nobackup switch. For compatibility with older versions, the /n switch can be used.
/overwriteoem	Overwrite OEM files without prompting.	Version 6.1.22.0 and later versions support the /overwriteoem switch. For compatibility with older versions, the /o switch can be used.
/integrate:`path`	Integrates the software updates into the Windows installation source files located at the path specified. Note that `:path` refers to the folder that contains the i386 folder.	Version 5.4.15.0 and later versions support the /integrate:`path` switch. For compatibility with older versions, the /s switch can be used.
/log:`path`	Allows user to specify where to create the log file.	Version 6.1.22.0 and later versions support the /log switch.
/ER	Enable extended error reporting.	All versions support the ER switch.
/verbose	Enable verbose logging. Creates `%Windir%`\CabBuild.log upon install that details files to be copied. Using this switch may cause the installation to occur much slower.	Version 5.3.24.3 and later versions support the /verbose switch. For compatibility with older versions, the /v switch can be used.
/d:`path`	Specifies a backup directory for Windows Service Pack installation. `:path` indicates the destination folder for the backup files. The default backup location is `%Systemdrive%`\$ntservicepackuninstall$.	This switch is not available for updates other than Service Packs and is available only in Installer versions 5.3.16.5 and later versions.
/extract[:`path`]	Extracts files without starting Setup. If ":`path`" is not included, you are prompted for the path of a destination folder to extract the files. If ":`path`" is used, the files are extracted to the specified destination folder.	Version 5.3.24.3 and later versions support the /extract switch. For compatibility with older versions, the /x switch can be used.
/hotpatch:disable	Disables hotpatching functionality, and installs the cold patch only.	This is only to be used for Windows Server 2003 packages that support hotpatching and is available in versions 6.1.22.0 and later. For more information on hotpatching, see the "References" section in this article for a link to the "Inside Update.exe" whitepaper.

Notes

We are adopting a consistent set of command-line switches that you can use to deploy packages that contain software updates. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
824687 (http://support.microsoft.com/kb/824687/ ) Command-line switches for Microsoft software update packages
For backward compatibility, Windows software updates that implement the new standard switch names also support the setup switches that are used by the earlier version of the Update.exe. However, we recommend that you stop using the old switches because this support may be removed in future software updates.
All the switch options that are listed use a forward slash (/). For compatibility with older versions, a hyphen (-) can still be used instead of the forward slash (/).
To safely remove a software update, remove the one most recently installed first. For example, assume that hotfix A and hotfix B both replace the same file or registry keys, and that you installed hotfix A before you installed hotfix B. To return your system to the state before the installation of hotfix A, you must uninstall hotfix B before you uninstall hotfix A. For more information about how to remove Update.exe updates, click the following article number to view the article in the Microsoft Knowledge Base:
823836 (http://support.microsoft.com/kb/823836/ ) Removing Windows software updates in the wrong order may cause the operating system to stop functioning

2009-04-27T11:32:00.000-04:00

AppDeploySM Package Knowledge Base

Class Act Variants 0.x

Company: University of Aberdeen
Setup type: Native Windows Installer setup (MSI)
Package Difficulty Rating: not yet established
Most Commonly Reported Method Used: not yet established

Notes

These are a series of Educational programs written by University of Aberdeen.

Although the applications are standard MSIs, when you first run them you are prompted for a serial code, and then prompted to accept the EULA.

Each of these steps creates a file in the same folder as the executable.

Here's the steps I used..

Install the MSI on a test PC, run it, enter the serial, and accept the EULA.

Browse to the folder of the exe - usually C:\Program Files\Educational Networking\[something]

Copy the files license.lic and tocagreed.yes to a server folder.

Now on your deployment script, it should be a simple case of run the MSI, and then copy these two files back.

In my case, the school purchased about 15 sub-packages, each with their own MSI.. I used a small autoit script which does them en-masse..

Each of these also needs .NET 3.5 (version 3521022), so I have the script check for it and install it if it isn't there.

Apologies in advance for the shocking code - you're more than welcome to tidy it up! :-)

Folder structure is:
[autoit script compiled exe]
Folder called LicFiles containing the 2 files listed above
Then as many sub-folders as needed containing the MSIs for each sub-program.
Folder called DotNet35
within that:
silent.bat
dotnetfx35.exe
hotfixes\NDP20SP2-KB958481-x86.exe
hotfixes\NDP30SP2-KB958483-x86.exe
hotfixes\NDP35SP1-KB958484-x86.exe
hotfixes\WindowsXP-KB961118-x86-ENU.exe

DotNet35\silent.bat is:
start /wait dotnetfx35.exe /q:a /c:"setup.exe /q /norestart" /norestart
start /wait hotfixes\NDP20SP2-KB958481-x86.exe /passive /norestart
start /wait hotfixes\NDP30SP2-KB958483-x86.exe /passive /norestart
start /wait hotfixes\NDP35SP1-KB958484-x86.exe /passive /norestart
start /wait hotfixes\WindowsXP-KB961118-x86-ENU.exe /quiet /norestart

Autoit script code:
; Install Class Act Variants

#Include <_filelisttoarraynew2g.au3>
#Include

; Search through for all MSIs in the folder, and install 'em

Dim $Syntax
Dim $Header
Dim $MSIFilesArray[100]
Dim $FilesArray[100]
Dim $BatFile

$BatFile = @TempDir & "\CA.bat"

$Syntax = "@Echo Off" & @CRLF
$Header = ""

Dotnetcheck()
ListMSIFiles()
InstallApps()
RegisterApps()

EXIT

; ===================================================================================
Func dotnetcheck()

$DotNetVerNum = 0
$DotNetVerMin = 3521022

; Check if .NET 3.5 is installed

$DotNetKey = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5"
$DotNetVer = RegRead($DotNetKey, "Version")

If @Error = 0 then
$DotNetVerString = StringReplace($DotNetVer, ".", "")
$DotNetVerString = StringMid($DotNetVerString, 1, StringLen($DotNetVerMin))
$DotNetVerNum = Number($DotNetVerString)

;msgbox(0, "", $DotNetVerString & @CRLF & $DotNetVerNum)
EndIf

If $DotNetVerNum > $DotNetVerMin then
Return
EndIf

; Generate .NET 3.5 installer

$DotNetDir = @ScriptDir & "\DotNet35"
$DotNetBATFilename = "silent.bat"

If FileExists($DotNetDir & "\" & $DotNetBATFilename) then
$Syntax = $Syntax & "PUSHD " & Chr(34) & $DotNetDir & Chr(34) & @CRLF
$Syntax = $Syntax & "CALL " & Chr(34) & $DotNetBATFilename & Chr(34) & @CRLF
$Syntax = $Syntax & "POPD " & @CRLF

EndIf

EndIf
EndFunc
; ===================================================================================

; ===================================================================================
Func ListMSIFiles()
$Filter = "*.msi"
$iFlag = "1" ;files only
$i_recurse = "1"

$MSIFilesArray=_FileListToArray3(@ScriptDir, $Filter, 1, 1)
If @Error = 0 then
If $MSIFilesArray[0] > 1 then
For $loop = 1 to $MSIFilesArray[0]
$Syntax = $Syntax & "MSIEXEC /i " & Chr(34) & $MSIFilesArray[$loop] & Chr(34) & " /qn /norestart" & @CRLF
Next
EndIf
EndIf
EndFunc
; ===================================================================================

; ===================================================================================
Func InstallApps()

$Log = FileOpen($BatFile, 2)
FileWriteLine($Log, $Syntax)
FileClose($Log)
RunWait($BatFile, @ScriptDir, @SW_HIDE)
EndFunc
; ===================================================================================

; ===================================================================================
Func RegisterApps()
; Copy the licence and EULA acceptance files to each folder

$Dir = @ProgramFilesDir & "\Educational Networking"
$Filter = "*.exe"
$iFlag = "1" ;files only
$i_recurse = "1"
$LicDir = @ScriptDir & "\Licfiles"

$FilesArray=_FileListToArray3($Dir, $Filter, 1, 1)
If @Error = 0 then
If $FilesArray[0] > 1 then

For $loop = 1 to $FilesArray[0]
$exe = $FilesArray[$loop]
$break = StringInStr($exe, "\", 0, -1)
If $break <> 0 then
$exedir = StringMid($exe, 1, $break -1)
;msgbox(0, "", $
FileCopy($LicDir & "\*.*", $exedir, 1)
;msgbox(0, "", $exedir)
EndIf
Next
EndIf
EndIf
EndFunc (Provided by sirclive)

Command Lines

No Entries.

Related Links

No Entries.

Lockdown Information

No Entries.

http://www.appdeploy.com/packages/detail.asp?id=1508

Citrix Web interface

2009-04-26T01:49:00.000-04:00

I got this error when access Web interface.
ERROR: The Citrix MetaFrame servers cannot process your request at this time. The Citrix XML Service object was not found. [404 Not Found]

I have tried to re-registry Citrix XML server on port 8080 a few time , but it don't work until I issue the command "iisreset".

Overall, here are the steps, based on the notice that Citrix XML service could not start ( start it in service console, it will move, but alway in the non-run status, no errors).

net stop ctxhttp ( it will stop XML service)
ctxxmlss /U
ctxxmlss /r80 ( it will failed because port 80 is in use by IIS)
ctxxmlss /r8080
net start ctxhttp

IISreset
also , make sure the configuration here are also correct by go to http:///citrix/metaframe/wiadmin
login with domain admin or citrix admin credential and configure Server to use 8080 for xml port.

reference:
This link explain configure of web interface admin

http://www.dabcc.com/miab/miab30/Implementation-Phase-14.-3.-Web-Interface-2.1-Web-Administration-Tool-MIAB-3.aspx

This link has all the screenshot for Presentation server 4.0 install.. A lot of screen shot image.

http://www.saunalahti.fi/pesonpa/projects/citrix_metaframe_4/citrix_metaframe_4.php

this link explain Addressing Using the Citrix Secure Gateway

http://grounding.co.za/blogs/trevor/archive/2007/11/08/addressing-using-the-citrix-secure-gateway.aspx

Exisint image file - Universal restore

2009-04-21T00:19:00.000-04:00

http://www.acronis.com/r/support/en/kb/502/aur_restore.html

What is the System Administrator

2009-04-16T22:57:00.000-04:00

System Administrator is one of IT position that is well defined but the context can be very scalable depend on specific company.
Here is the link from wikipedia

http://en.wikipedia.org/wiki/System_administrator

Free remote control hosting service

2009-04-11T22:47:00.000-04:00

My friend Ed told me that he is using a free remote control service, Teamviewer. Here is the link to there site to download a free Windows or Mac agent . A session ID and password is used to control the remote screen/control sharing.
http://www.teamviewer.com/index.aspx

Secondary logon and Citrix

2009-04-09T16:21:00.002-04:00

Citrix can be used very creatively. For example, if you work in a multi forest/domain environment, IT staff would need to hop on to domain tools with different domain crendential. Secondary logon will be use so you won't need a secondary PC. Runas is the command that come with Windows product, which I knew it before. However, Citrix access gateway seem provide a better, easy-adopted, scalable interface to provide secondary logon as well as application/tool delivery. Once you login with your 2nd crendential, the available tools in that domain context are just there for you to click. I believe this is a great use of Citrix seamless integration technology.

More than that, you can customize the tools that you want helpdesk to use and restrict the permission as less as you want. Here you see, you can use this to delegate many things.

To sum it up, the Citrix model can be:
Financial/Business applications --> Citrix ---> non-IT users
admin tools --->Citrix ---> IT user with delegate control
Multiple domain ----> Citrix ---> user

Add one more layer increase the flexibility and give more granular control over the application

Logonserver and roaming profile

2009-04-09T16:21:00.001-04:00

echo %logonserver% or set logonserver http://forums.windowsitpro.com/web/forum/messageview.aspx?catid=50&threadid=46915&enterthread=y&feed=ArticleLink This link tells me a best practise. Do not configure prime and 2nd DNS server in a differnent namespace. All DNS server need at least to see the same namespace to be predictive. http://www.petri.co.il/forums/showthread.php?t=2302 http://support.microsoft.com/kb/831651 time synch with DC, Hotfix for Netbios over tcp, and windows firewall are all possible cause roaming profile not locate error. see this link http://www.chicagotech.net/winissues/roamingprofile1.htm Of course, the permission could be a problem and recreate the user profile is always the first thing to check

Explicit is better than implicit.

2009-04-08T21:42:00.000-04:00

Beautiful is better than ugly.
Explicit is better than implicit.
Simple is better than complex.
Complex is better than complicated.
Flat is better than nested.
Sparse is better than dense.
Readability counts.
Special cases aren't special enough to break the rules.
Although practicality beats purity.
Errors should never pass silently.
Unless explicitly silenced.
In the face of ambiguity, refuse the temptation to guess.
There should be one-- and preferably only one --obvious way to do it.
Although that way may not be obvious at first unless you're Dutch.
Now is better than never.
Although never is often better than *right* now.
If the implementation is hard to explain, it's a bad idea.
If the implementation is easy to explain, it may be a good idea.
Namespaces are one honking great idea -- let's do more of those!

Exchange Support case - Public folder in 2006

2009-04-07T22:49:00.000-04:00

Here are some knowledge base (KB) articles that you will find useful. Articles on Virtual Memory Fragmentation: How to troubleshoot virtual memory fragmentation in Exchange Server 2003 and Exchange 2000 Serverhttp://support.microsoft.com/kb/325044 How to optimize memory usage in Exchange Server 2003http://support.microsoft.com/kb/815372 The "HeapDecommitFreeBlockThreshold" registry keyhttp://support.microsoft.com/kb/315407 Exchange memory use and the /3GB switchhttp://support.microsoft.com/kb/328882 Use of the /3GB switch in Exchange Server 2003 on a Windows Server 2003-based systemhttp://support.microsoft.com/kb/823440 Articles on Log Files: XADM: Using Eseutil to Determine Which Logs Have Been Committedhttp://support.microsoft.com/kb/182961 How to remove Exchange Server transaction log fileshttp://support.microsoft.com/kb/240145 XADM: How Circular Logging Affects the Use of Transaction Logshttp://support.microsoft.com/kb/147524 Articles on how to configure antivirus software for Exchange: Exchange and antivirus softwarehttp://support.microsoft.com/kb/328841 Recommendations for troubleshooting an Exchange Server computer with antivirus software installedhttp://support.microsoft.com/kb/245822 Overview of Exchange Server 2003 and antivirus softwarehttp://support.microsoft.com/kb/823166 Articles on Public Folders: Best Practices for Public Foldershttp://www.microsoft.com/technet/prodtechnol/exchange/2003/pubfoldersbp.mspx Understanding Public Folder Replication and Referralshttp://support.microsoft.com/kb/273479 Overview of the Public Folder Migration toolhttp://support.microsoft.com/kb/822895 How to troubleshoot public folder replication problems in Exchange 2000 Server and in Exchange Server 2003http://support.microsoft.com/kb/842273 XADM: How to Rehome Public Folders in Exchange 2000http://support.microsoft.com/kb/288150 Public folder routing is enabled before the hierarchy is replicatedhttp://support.microsoft.com//kb/328870 Exchange analyzer tools and .NET FrameWork: I would suggest you to run Exchange Best Practices analyzer tool from time to time to diagnose issues arising with Exchange server. Description of the Microsoft Exchange Server Best Practices Analyzer Toolhttp://support.microsoft.com/kb/892213 Download link for Exchange Server Best Practices Analyzer Tool v2.7http://www.microsoft.com/downloads/details.aspx?familyid=dbab201f-4bee-4943-ac22-e2ddbd258df3&displaylang=en Microsoft Exchange Server Performance Troubleshooting Analyzer Tool v1.1http://www.microsoft.com/downloads/details.aspx?familyid=4BDC1D6B-DE34-4F1C-AEBA-FED1256CAF9A&displaylang=en Microsoft Exchange Server Disaster Recovery Analyzer Tool v1.1http://www.microsoft.com/downloads/details.aspx?familyid=C86FA454-416C-4751-BD0E-5D945B8C107B&displaylang=en Download link for .NET FrameWorkhttp://www.microsoft.com/downloads/details.aspx?FamilyID=262d25e3-f589-4842-8157-034d1e7cf3a3&DisplayLang=en Best Regards, Vrushal ShindeEnterprise Messaging Support Email: v-9vrush@mssupport.microsoft.comPhone: 1-425-635-2998 Extension:68735

Microsoft exchange support case

2009-04-07T22:43:00.000-04:00

It was my pleasure to work with you on your Exchange server issue. I hope that you were delighted with the service that was provided to you. I am providing you with a summary of the key points of the case for your records.Based on the state of the case it appears that this case is ready to be archived. If this is pre-mature or you are not very satisfied with all aspects of this case please let me know as soon as possible. Otherwise, I will archive this case at the end of today’s business day. Should this same issue reoccur, you can call us back and I will be glad to help you with this incident. If you have any additional feedback about the service that you received please contact my manager using the information below. Thank you for choosing Microsoft. If you have any follow up questions regarding this support incident, please feel free to contact me directly. For your records, here is a summary of this support incident: ISSUE=======Need assistance on access the mailbox of the users after enabling them. RESOLUTION============We removed the Exchange attributes of the users.Run the cleanup agent on the mailbox store.Then reconnect the mailbox with the user.Updated Rus.Send email to the user.Tried to open mailbox and able to open it. Some Exchange 2003 Articles=========================824126 How to Use Recovery Storage Groups in Exchange Server 2003http://support.microsoft.com/?id=824126 820852 Backup of the Exchange Server 2003 Information Store and the Windowshttp://support.microsoft.com/?id=820852 822945 How to Move Exchange 2003 to New Hardware and Keep the Same Server Namehttp://support.microsoft.com/?id=822945 823176 HOW TO: Recover or Restore a Single Mailbox in Exchange Server 2003http://support.microsoft.com/?id=823176 185078 XADM: Recommendations for Successful Disaster Recoveryhttp://support.microsoft.com/?id=185078 822942 Considerations When You Upgrade to Exchange Server 2003http://support.microsoft.com/?id=822942 812593 Exchange Server 2003 Deployment Tools Overviewhttp://support.microsoft.com/?id=812593 821896 How to Upgrade to Exchange Server 2003 by Using the Swing Upgrade Method http://support.microsoft.com/?id=821896 822179 Overview of Operating System and Active Directory Requirements forhttp://support.microsoft.com/?id=822179 If you need to speak to someone when I am not available, You may call 800-936-3100 (premier) or 800-936-4900 (professional) and provide our case number and request to speak to the next available Support Professional Thanks and Regards Neeraj Ubhan

Multiple user credential and Stored User Names and Passwords in XP

2009-04-07T15:58:00.000-04:00

See this one
http://support.microsoft.com/kb/306541/?FR=1

Tombstone, Deleting AD objects , Deleting DNS objects

2009-04-07T13:54:00.000-04:00

When an Active Directory object is deleted, a small portion of the object remains for a specified period of time so that other domain controllers that are replicating changes will become aware of the deletion. This period of time is referred to as the "tombstone lifetime" and is configurable.
http://support.microsoft.com/default.aspx?scid=KB;EN-US;258310
http://dnsfunda.blogspot.com/2006_10_01_archive.html

What to do if a DC server die and tombstone life (60 days) ? it is because you will start to get a lot of replication errors. See follow link.
http://www.servernewsgroups.net/group/microsoft.public.windows.server.active_directory/topic18887.aspx
The options are:
1. dcpromo /forceremoval
2. reset the secure channel on the servers
3. restore from the tape and demote the server

We still need WINS even we are in windows 2003 environmnet, see this
http://www.informit.com/articles/article.aspx?p=102617&seqNum=8

DNS detail under _msdcs

2009-04-07T13:26:00.000-04:00

dc service include _kerboros and _ldap; it is site specific
domains service include only _ldap; it is not site specific; each domain is identified with a GUID
gc service include _ldap at tcp port 3268; it is also site specific
pdc service only include _ldap at port 389; only one server ( the FSMO pdc-emmulator) provide this service.

use VMware workstation to clone your laptop

2009-04-05T23:54:00.000-04:00

My friend T.K has a great way to use Vmware converter. He convert his laptop at work to a VM file and he can run this virtual machine at his home PC. He consider it as a one time backup. However, I realize this is a great use. For the past one year and half , I have to bring my laptop from work everyday just in case someone from work might call me and I need computer to support the problem infrastructure. The laptop has VPN, eRoom agent and ticket system agent on it, so I have to use this laptop instead of my home PC. Many time, I left my laptop on my car, because I need this just in case. If I borrow Thomas 's idea, convert this laptop to a VM running on my home PC, and the life will be very easy by saving many time to carry laptop from and to work.

I did a P-to-V convert today, and it take me about 70 minute to complete 2 10G partition PC by using import wizard. It only create one .vmdk file although there are two partitions at the source.
I also need to disable " simple file share" to make converting work.

Delegate non-domain admin group to workstation

2009-04-05T23:08:00.000-04:00

My recent work allow me to watch how Helpdesk works on the workstation deployment. It is a large enviornment, so helpdesk group don't have domain admin right, but they still need full admin right to user workstations, so there is a need to add domain\helpdesk group into each workstation, not the servers.

Here is their ways because they use disk cloning to complete OS/APP installation.

1. join in the domine, and add domain \helpdesk group into this local admin group of this workstation
2. remove this workstation from the domain; a unknown user account will show in local admin group, do NOT delete this one
3. clone this workstation
4. join the new workstation into domain, and this unknown user account will become domain\helpdesk group.

I know I can use restricted group in group policy computer setting to delegate a non-domain admin group to workstations, but the process is tricky and easy to make very serious problem, such as removing domain admin group from each workstations.

The group name must be "Administrators" and the Memebers has to include

Administrator - the local administrator
- Domain Admins
- Remote Administrator

This GPO policy is all-to-all change, not a incremental change, so you have to include every member in the group.

Here is another tutorial on restricted group

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

my little ones picture in studio

2009-04-04T16:13:00.000-04:00

Writing good specifications

2009-04-02T13:23:00.001-04:00

I was tasked to help helpdesk on workstation deployment because current environment requrie a lot of dissimilar hardware model, and many applications sets for different group users. Currently, many people has been involved in creating disk cloning image for fast PC deployment and thus has create a mess of version and mess of non-working problem. I 've heard that this netbios service need to be disable and immediately the other person said it is required for SAMBA. I don't know why they are so keen on reduce the windows XP components and disable a service. However, the communication and cooridiation has failed apparently. Now that what is my role to play when come down to this mess and detail-oriented work?

I am thinking about two things and get them half-complete this morning.

First , a high level definition of this topic, which provide a full picture that I badly need
Second, Roles and Responsibility , which define the roles and res among help desk, system admin, IT manager, and security admin.

Now, I come aross this book " Art of project Management" which talk about good specification and the writer have obviously argue for it and deal with the disagreement. Here come the story......

I once had an argument with a programmer who believed that we didn't need to write specs. I walked into his office with this big template I'd been told to use by our boss, and he just laughed at it (and unfortunately, at me as well). His opinion was that if what I wanted to do was so complicated that I needed 50 pages to explain it to the programmers, it wasn't worth building anyway. He saw the need for all of this process and paperwork as a signal that communication and coordination on the team were failing, and that we weren't trusted to decide things for ourselves. We shouldn't need so much overhead and bureaucracy, he said, implying that elaborate planning was never necessary.
Having had this argument before, I smiled. I asked him if he'd make the same claim about the engineering plans for the hi-rise apartment building he lived in or the three-story highway overpass he drove on to get to work. But apparently he had heard this question before, and he smiled right back. He said that while he was glad those things were planned in great detail, he didn't think working with software was quite the same as working with the laws of physics and construction materials. We quickly agreed on two points. First, that compared to traditional engineering, software is more flexible, easier to change, and rarely has people's lives at stake. But, we acknowledged that because we faced complex engineering challenges, had a team of people depending on our decisions, and had budgets and deadlines to meet, we needed more than our memories of hallway conversations to make sure the right things happened.
We also agreed that what we needed for our project was something suited to the kind of work we were doing and the kind of people we were. Some sort of written documentation would be useful if it solved real problems for our team, accelerated the process of getting things done, and improved the probability of a quality outcome (and it needed to be updatable over time without upsetting anyone). If we could make something that achieved those things, he said he would gladly use it, regardless of what we called it or what form it came in. And with that, we revised the spec process down into something we agreed would work for our small team. I went back to my boss, rehashed our conversation, and worked out a compromise. The big, tax law-size spec template went away.
The key lesson from this story is that like anything else people make, there is no one right way to write specifications or to document work. Specifications, like most things teams are asked to do, should match the needs of the current project and the people who will have to create and read them. And in the same way that web sites or software products need to go through a design process to find the best approaches, specifications need some thought and iteration to be done correctly.
But many experienced people I know have fallen into the trap of believing there is only one way to do specifications (or whatever they call them), which tends to be whatever way they did it last time. Sometimes this chain of repetition goes all the way back to the first projects they worked on. They assume that because those projects weren't complete disasters, the way they wrote specs contributed positively toward that outcome: a claim that without any investigation may or may not be true (i.e., the project might have succeeded in spite of a dysfunctional spec process). Worse, if good questions about how and why specs are written have never been asked, no one on the team really understands how good or bad the spec writing process really is, or how much it does or does not contribute to the team's performance. (This is entirely similar to how the absence of good questions about writing quality code prevents the possibility of understanding how good or bad the code really is.)
My aim in this chapter is to explain the following set of ideas. First, that specifications should do three things for a project: ensure that the right thing gets built, provide a schedule milestone that concludes a planning phase of a project, and enable deep review and feedback from different individuals on the course the project will take. These three things are very important, and it's unlikely that a process other than written specifications provide them all at the same time. For that reason alone, I'm a fan of specs. Second, most of the complaints people have about specs are easily remedied, provided their authors understand the common pitfalls of spec writing and recognize the specific benefits specs should be used to provide.

nLite and windows deployment tools

2009-04-01T22:39:00.000-04:00

Each Windows OS comes with a deploy.cab, which contain a number of deployment tools and user manual, such as sysprep, setupmgr, etc. It give the direction to create an unattended install, in other words, slipstream a install source. The work can be a lot when I remember the time spent to pick and choose the windows component at winnt.sif file.

nLite is a wonderful tool to make such task simplier. Here is what wikipedia says about it.

http://en.wikipedia.org/wiki/NLite

Migrate windows 2000 domain to windows 2003 domain

2009-03-29T11:35:00.000-04:00

Here are some links about the windows 2003 domain/forest features and benefits.
http://www.petri.co.il/whats_new_in_windows_server_2003_active_directory.htm
http://www.petri.co.il/understanding_function_levels_in_windows_2003_ad.htm

I completed a migration ( not the in-place upgrade) last week smoothly, now let me review the steps I did, comparing with the steps that other people follows.

1. Background: Two server, Server1 is the windows 2000 domain controller, also the root domain of forest, and hold all FSMO role and GC role. AD integrated DNS is on server1 as well.
Server2 is a new Windows 2003 server, not join in the domain yet. DHCP is running on the local router, no DHCP /file server/WINS functioned and no need to migrate these features.
2. Since the forest is still windows 2000, I need to use ADprep tool to prepare the upgrade on Server1. Run ADprep /forestprep , and ADprep /domainprep on Server1, because it is the forest schema master and the infrastructure master of this domain. Run "dcdiag" to diagnostic the current AD environment including FRS and GPO replication
3. Run "dcpromo" on the server2. During the AD installation wizard, reconfigure the network DNS setting so that it will query Server1 DNS to locate biovail.local domain. Chose to install in a existing forest, and existing domain . The installation complete but DNS service is not install on this new server. This result confirms that "dcpromo" don't necessary install DNS on each new DC. It is because no every DC in a larger environment need to be a DNS server.
4. Since I will move every AD function off the server1 to server2. I need the DNS function on the new server. Install DNS on server2, using Add/Remove program.
5. Verify the DNS on the new server is working and change the preferred DNS on its network setting to 127.0.0.1, itself. Use SRV query to verify if the new server has registered the DC service.
6. reboot server2, and all the function missed become avaiable.
7. transfer all FSMO role, GC role to server2
8. run "dcpromo" on server1 to demote the AD on this windows2000, which will remove DNS service as well. Run a backup of system state first.
9. run SRV query again to verify the record has been unregistered.
10. Run a workstation to test if it start to logon to the new server instead of old DC. Use "set" command and look for "logon server " entry.

Review: no need to do DNS zone transfer; other steps put install DNS server first before promote the 2003 server, but my steps works fine. Note that DNS has many details , such as forwarder, event log detail, replication.

SRV DNS records

2009-03-28T23:32:00.000-04:00

SRV DNS record topics is overlooked by me utill recently. I find its value when I configure a Active Directory and establish the two way trust between two forest. Also I find it is the important step to verify a new AD is working and working as you expect. For example, I use nslookup from a workstation to verify if I can see the Active Directory and site domain controller service , such as LDAP, GC, Kerboros
step 1. NSLOOKUP
steop 2. set type=all or set type =SRV
step 3. _ldap._tcp. or _gc._tcp., or .. site...
the result from DNS server are important, because it provide the address resolution( location-aware) to workstation logon/user authentication (Keboros and LDAP) and directory search (GC). The testing I did before is either use ping to ping domain name to test resolution, or jump to logon process or higher layer appplication to troubleshoot. Now that I won't miss this important step any more. I will use this SRV lookup right after the pint test.

http://support.microsoft.com/kb/816587

http://technet.microsoft.com/en-us/library/cc772774.aspx How DNS works, a complete guide

A domain controller named Phoenix in the domain contoso.com has an IP address of 157.55.81.157. It registers the following A records and SRV records with DNS:

phoenix.contoso.com A 157.55.81.157_ldap._tcp.contoso.com SRV 0 0 389 phoenix.contoso.com_kerberos._tcp.contoso.com SRV 0 0 88 phoenix.contoso.com_ldap._tcp.dc._msdcs.contoso.com SRV 0 0 389 phoenix.contoso.com_kerberos._tcp.dc._msdcs.contoso.com SRV 0 0 88 phoenix.contoso.com.

DNS Support for Active Directory Processes and Interactions
When a Windows Server 2003 member server is promoted to an Active Directory domain controller by installing Active Directory, the Net Logon service registers the DNS resource records necessary for network hosts and services to be able to locate the domain controller on the network. When network hosts and services attempt to perform an operation (such as joining a domain, for example) that requires an Active Directory domain controller, the Locator mechanism is used to locate the domain controller through DNS. The following table describes the processes and interactions involved in the registration and location of domain controllers in DNS.
Active Directory and DNS Processes and Interactions

Process or Interaction
Description
Domain controller DNS name registration
The Net Logon service registers DNS resource records on behalf of the Active Directory domain controller in the DNS zone with the same name as the Active Directory domain hosted by the domain controller.
DNS delegation, forwarders
DNS delegation resource records are created in the zone that is a parent of the zone supporting the Active Directory domain. The delegation enables the DNS name of the domain controller to be resolved downward from the root of the DNS hierarchy.
DNS forwarders are another DNS feature that enable domain controller location, and are commonly used for an Active Directory client in one domain to locate a domain controller in another domain.
DNS domain controller location
Network hosts and services use the DNS Locator mechanism to locate domain controllers in the Active Directory forest.

Wikipedia have a complete topic on SRV, including VoIP service and Exchange 2007 use SRV to self provision client.
http://en.wikipedia.org/wiki/SRV_record
Another topic is SRV Records Registered by Net Logon
below is an example of file netlogon.dns at %systemroomt%\config
biovail.local. 600 IN A 192.168.1.31_ldap._tcp.biovail.local. 600 IN SRV 0 100 389 server.biovail.local._ldap._tcp.e46b4812-0cb0-4846-a4d8-7492847575b7.domains._msdcs.biovail.local. 600 IN SRV 0 100 389 server.biovail.local.11283ddd-c1d1-4b7e-b927-b6710b916654._msdcs.biovail.local. 600 IN CNAME server.biovail.local._kerberos._tcp.dc._msdcs.biovail.local. 600 IN SRV 0 100 88 server.biovail.local._ldap._tcp.dc._msdcs.biovail.local. 600 IN SRV 0 100 389 server.biovail.local._kerberos._tcp.biovail.local. 600 IN SRV 0 100 88 server.biovail.local._kerberos._udp.biovail.local. 600 IN SRV 0 100 88 server.biovail.local._kpasswd._tcp.biovail.local. 600 IN SRV 0 100 464 server.biovail.local._kpasswd._udp.biovail.local. 600 IN SRV 0 100 464 server.biovail.local._ldap._tcp.ca1._sites.biovail.local. 600 IN SRV 0 100 389 server.biovail.local._kerberos._tcp.ca1._sites.dc._msdcs.biovail.local. 600 IN SRV 0 100 88 server.biovail.local._ldap._tcp.ca1._sites.dc._msdcs.biovail.local. 600 IN SRV 0 100 389 server.biovail.local._kerberos._tcp.ca1._sites.biovail.local. 600 IN SRV 0 100 88 server.biovail.local._ldap._tcp.gc._msdcs.biovail.local. 600 IN SRV 0 100 3268 server.biovail.local._ldap._tcp.ca1._sites.gc._msdcs.biovail.local. 600 IN SRV 0 100 3268 server.biovail.local.gc._msdcs.biovail.local. 600 IN A 192.168.1.31_gc._tcp.biovail.local. 600 IN SRV 0 100 3268 server.biovail.local._gc._tcp.ca1._sites.biovail.local. 600 IN SRV 0 100 3268 server.biovail.local._ldap._tcp.pdc._msdcs.biovail.local. 600 IN SRV 0 100 389 server.biovail.local.DomainDnsZones.biovail.local. 600 IN A 192.168.1.31_ldap._tcp.DomainDnsZones.biovail.local. 600 IN SRV 0 100 389 server.biovail.local._ldap._tcp.ca1._sites.DomainDnsZones.biovail.local. 600 IN SRV 0 100 389 server.biovail.local.ForestDnsZones.biovail.local. 600 IN A 192.168.1.31_ldap._tcp.ForestDnsZones.biovail.local. 600 IN SRV 0 100 389 server.biovail.local._ldap._tcp.ca1._sites.ForestDnsZones.biovail.local. 600 IN SRV 0 100 389 server.biovail.local.

Linksys SPA1001 configuration reset to facture setting

2009-03-28T13:38:00.000-04:00

Pick up the phone attached to the Linksys.

Dial ****73738#

Press 1 to confirm

Hang up the phone

Step3. Obtain an IP address of the Linksys SPA1001

Enable DHCP to acquire an IP address automatically

Pick up the phone attached to the Linksys
Dial ****
Press 101# after you hear “Sipura configuration menu.”
Press 1# to enable DHCP
Hang up the phone and wait a while.

Obtain a valid IP address of the Linksys SPA1001.

Pick up the phone attached to the Linksys SPA1001

Dial ****

Press 110# after you hear “Sipura configuration menu”

The Linksys will read back an IP address of the Linksys. If this IP address is valid, you can immediately go to Step 4. Otherwise, you need to take the following Step C.

If the IP address of the Linksys SPA1001 is 0.0.0.0, please take the following actions.

Hang up the phone, unplug and replug the SPA1001 power cord to reboot.

Wait a few minutes, then check the IP address again by Step B

If the IP address is still invalid, please check the following aspects.

The DHCP server does not assign an IP address to the SPA1001. Please configure the DHCP server.

The network does not have a DHCP server. Please configure a static IP address manually by Step 4.

Step 4. Configure a static IP address manually

If the Linksys SPA1001 can not acquire a valid IP address automatically, it is necessary to configure a static IP address manually.

Obtain an IP address, a default gateway and a subnet mask from your ISP or your router

Pick up the phone connected to the Linksys.

Dial ****

Press 101# after you hear “Sipura configuration menu”

Press 0# to disable DHCP.

Press 1 to save the setting.

Press 111# to access the IP address Menu

Input the static IP address followed by # and use * to indicate a period (.). For example, the IP address is 192.168.1.135 would be 192*168*1*135#.

Press 1 to save the setting.

Press 131# to access the default gateway menu.

Enter the default gateway followed by # and use * to indicate a period (.).

Press 1 to save the setting.

Press 121# to access the subnet mask menu

Enter the subnet mask followed by # and use * to indicate a period (.).

Press 1 to save the setting.

Finally, please verify the IP address of Linksys is valid by Step 3.B.

Step 5. Set the configuration of the Linksys

----------------
Personal setting: I will turn off the VMWI and MWI so the new message light won't lit up

Trust me, it is boring

2009-03-23T23:50:00.000-04:00

Yes, reading other people's technology blog can be very bored. My blog is one of example because it start with the technology study notes and with so many abstract concept in a non-consumer type world. And right now it is very self-engaged and lack of interaction with event and people. However, I get excited today to write this blog because I find out a new arena that attract me and will keep me thinking. It is the model and modelling in the current IT infrastructure. When was last time you think about a model?

I was chanlleged a question today, what is the group policy inheritance model? I also chanllenged with some troubleshooting scenario with OSI 7 layer model, which is very famous and have a foundamental impact for beginner and advancer. I also came across a discussion on AD group security model and a strategy to apply the model effectively. So what? what happen? I plan to use this blog to " collect model", just like my real life habit - collecting map, georgraphic map, natural map, camping map, river system map, bird migration map, people migration map, etc.

I believe there are many models out there for me to collect, especially in IT infrastructure and IT Security area. I know it is not on my priority list, because I am not planning to be a technology architecture in next 5 years, however, it is on my wish list and I enjoy to stop and learn about them.

So what is your comments on model ? do you remember any model and modelling?

I start with a easy one from junior school class.

1
1 1
1 2 1
1 3 3 1
.....

conflict management

2009-03-22T23:32:00.001-04:00

http://positivesharing.com/2006/07/5-essential-steps-to-resolve-a-conflict-at-work/

2009-03-22T21:43:00.000-04:00

use group policy to assign a special group , such as helpdesk, to assume local-admin right for all workstation in a OU, whilke keep domain admins and original administrator in the same control level.

It need to create a GPO and apply to this OU. The modification of this GPO is to go to computer setting\windows setting\security setting\restricted group, and create an in group called "administrators" and include "administrator, < >\domain admins, < >\helpdesk " . The trick is to udderstand the name specified above is used like leg for leg, hand for hand. No more, no less. It carve out the exact setting. If you miss out the domain admins group, you won't find it later. I have a lesson for this when I work for Yak in 2006. This is very tricky, very easy to make mistake.

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

DNS configuration for AD domain and forest

2009-03-21T22:07:00.001-04:00

The configuration of DNS for AD include the following aspect
1. Where to store the DNS - AD integrated, load the DNS from AD database
2. Where to replicate the DNS Zone
3. How many and what zone are need for domain and forest
4. What resource records ? SVR , service location RR is critical configuration for the AD domain and forest function. Enable dynamic update will allow those SVR record load from netlogon.dns file automatically instead of using script or manually provide those SVR RR for each DNS
5. which partition in AD database? DNS is stored in the application partition and replication accordingly.
6. Configure secondary zone will not help on resolve authentication issue even the zone get transfered and get resovled and able to response a ping
7. Child domain controller don't need to has its DNS server
8. pay attention to _msdcs. zone

http://www.mcgeown.co.uk/BlogEngine/post/2008/04/08/Adding-a-Windows-2003-domain-controller-to-your-existing-Windows-2000-domain.aspx

Namespace

2009-03-20T14:21:00.000-04:00

Netbios use a flat address space, while IP protocol use a hierachy address space

DNS use a hierachy namespace, while WINS use a flat namespace

In Windows 2000/2003 Active Directory, domain tree use contiguous namespace. Non-contiguous namespace is used by other domain trees in the same forest or a different forest. Like tree has a root, the domain tree has a root domain, which is unique to the forest. Root domain is also call top level domain in forest. By default, the TLD/root domains in the same forest use two way transitive trust to allow pass-thru authentication throughout the forest.

Multi forest can be created. This allows you to control which tree( DOMAIN TREE)are connected and share the resources, and which trees are separated so that user can not search GC for other forest.

A site is a combination of subnet; subnet consist of computer using the same grouping of IP address

A DC is a server has a copy of directory service

VMware VI diagram on TCP/UDP Port

2009-03-19T23:50:00.000-04:00

Above is the first one from VM community; next one is also from user community.

NAT traversal and UPnP

2009-03-19T00:20:00.000-04:00

NAT traversal is not new to me, it is a must feature for many smart Router/NAT and gateway device, especially for use of voice/video and VPN. However, I have not fully understood the benefit and solution it bring to the ever-complex technology world. NAT traversal or NAT-T help peer-to-peer application to traverse a NAT gateway and thus it has been disable generally in enterprise world, while it is widely used by home route/NAT gateway.

I read an article today to learn more about UPnP, and I found that some of functions it provide overlap with NAT traversal. Take a look at this :

"NAT traversal allows network devices or peer-to-peer applications to traverse a NAT gateway by dynamically opening and closings ports for communication with outside services."

That is what UPnP is doing , you can find out this when you look up your home router's UPnP port forwarding list . I admit that I am confused by that, but I will later on to explore the topic of this with the example of following applications:
Windows XP remote assistant - will this feature really work when a private IP XP machine send out help request to remote friend
VoIP ATA - How VoIP ATA open the port 5060 to the outside world without a network admin configure in router? Can you get VoIP ATA or X-lite work in a enterprise firewall? If yes, what is necessary?
Now it is come to Skype - what is the screte of Skype because it works everywhere?
Enable and Disable SSDP service on XP and see what happening
MSN live message - what server port this application open on the NAT device?
Security discussion - When it open the port without your knowledge can be a good thing for the sake of convenience , but can become a vulunrability for hacker to exploit , any report incidents about this?

here is the link that I recommend:

http://www.microsoft.com/windowsxp/using/setup/expert/crawford_02july22.mspx