WTH? Terminal Services is started but won't allow RDP access, can I fix that without rebooting the server again? Yes ...

Prerequisites:
You will need to have console or iLO/DRAC access to the server with the stalled terminal services instance.

This can be accomplished by either having physical access to the server console(KVM), by using a Lights-Out remote access card to remotely access the physical console or by using a non-TS based remote console access service such as LogMeIn, VNC, etc.

Microsoft (damn you, Ballmer!) decided to disable the ability to restart terminal services by default in Windows Server. Because, you know, ... the service never fails ... LAME!

Lucky you, you are about to find out a way around that little bit of design madness.

Abrakadabra! and poof ... SysInternals - Process Explorer.

** FYI - On Windows Server 2008 you will need to start procexp.exe with Administrator rights in order to kill processes**

• Access the server console via one of the means mentioned above under pre-reqs
• Open IE and go to http://live.sysinternals.com (allows you to run sysinternals apps from the net!)
• Locate the link to procexp.exe click it and open (not save) it.
• Once Process Explorer has launched, click View in the command bar and from it's drop down menu, click on Select Columns and check Command Line, click OK.
• Next sort by Process so that you get an alphabetical listing by process name and look for: svchost.exe.
• Now expand the Command Line column, look for a svchost line that looks something like this: C:\WINDOWS\SYSTEM32\svchost.exe -k termsvcs
• Stop that svchost.exe process by right clicking it and clicking Kill Process.
• Press Windows Key+R to launch the run command, type services.msc in the Run field and press Enter
• Once the Services management console launches, locate Terminal Services and right click it, then choose Start.

Yay! Terminal Services is working now.

Huzzah! And there was much rejoicing amongst all the remote workers and administrators and no local user's open files were harmed in the process by a nasty server reboot.

Who's their Daddy? Why, you are, of course. ;-)

Sometimes the fastest way to access a program on your Windows system is via the command line.

I have to admit to being a little command line biased. I spent most of my early IT career managing Novell Netware environments and an assortment of FreeBSD and Linux systems from the command line, in addition to the ubiquitous Windows menagerie . Sometimes it is just quicker to click a quick key stroke (Windows Key+R), bring up Run and type the command for the application you want and bang it's open.

In this post I am going to focus on launching those Control Panel applets we all use but don't like having to click through all the menus to find or having to add shortcuts to our desktops for.

The majority of Control Panel applets are files with a .CPL file extension which are located in the %SYSTEMROOT%\SYSTEM32 folder (i.e.: C:\WINDOWS\SYSTEM32 for most people).

To open the "Network Connections" applet, just hold down the Windows Key while also pressing the R key. This launches the "Run" commmand, now type "control ncpa.cpl" in the Open field and press Enter

Viola! Application launched.

Here is a list of the Control Panel applets which you can use in the same way as my example above:

Accessibility Options - access.cpl

Add/Remove Programs - appwiz.cpl

Add Hardware Wizard - hdwwiz.cpl

Administrative Tools - admintools

Automatic Updates - wuaucpl.cpl

Bluetooth Properties - bthprops.cpl

Display Properties - desk.cpl

Fastfind Properties - findfast.cpl

Firewall Properties - firewall.cpl

Game Controllers - joy.cpl

Internet Options - inetcpl.cpl

iSCSI Initiator - iscsicpl.cpl

Java Control Panel - jpicpl32.cpl

Keyboard Properties - main.cpl keyboard

Licensing Model - iccpa.cpl

Mouse Properties - main.cpl

Network Connections - ncpa.cpl

Network Setup Wizard - netsetup.cpl

ODBC Properties - odbccp32.cpl

Power Options - powercfg.cpl

Regional and Language Options - intl.cpl

Scanners and Camera Properties - sticpl.cpl

Sound and Audio Devices - mmsys.cpl

Stored Passwords - keymgr.cpl

System Properties - sysdm.cpl

Telephone and Modem Properties - telephon.cpl

Time and Date Settings - timedate.cpl

User Accounts - nusrmgr.cpl

Windows Security Center - wscui.cpl

Wireless Link - irprops.cpl

** NOTE: If you don't have a wireless card for instance, the Wireless Link - irprops.cpl applet will not work for you, this holds true for any applet for which you don't have the necessary equipment etc.

Here is also a list of other commands for opening the Control Panel folders/applets without the .CPL extension as well:

Control Panel - panel

Desktop Properties - desktop

Desktop Appearances Properties - color

Fonts Folder - fonts

Infrared Properties - infrared

Printers Folder - printers

Schedule Tasks - schedtasks

User Accounts Advances - userpasswords2

User Passwords - userpasswords

Check out these links for some further command line fun:

http://commandwindows.com/runline.htm
http://blogs.techrepublic.com.com/itdojo/?p=947

Changing the Product Key in Windows XP

You may run into a situation where you need to replace or fix the product key for a copy of Microsoft's Windows XP. There are a couple of ways to do this (http://support.microsoft.com/kb/328874) but the simplest and most fool-proof one for single instances is the following registry edit and windows re-activation process outlined below:

Editing the registry

Begin by opening the Registry Editor and navigating to

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\Current Version\WPAEvents

In the right pane, right-click the ODBETimer binary value and select Modify.

Change at least one character of this value to either a number from 0 to 9 or to a letter from A to F, then click OK and close the Registry Editor.

This renders the current product key invalid and deactivates Windows.

Now, it’s time to reactivate Windows using your new product key.

Click Start > Run and enter the command:

%systemroot%\system32\oobe\msoobe /a

where %systemroot% is your Windows directory.

In many cases, this command will look like:

C:\windows\system32\oobe\msoobe.exe /a

At this point, Windows will launch the Product Activation Wizard.

Figure 1

Select the option to telephone a Microsoft customer service representative to activate Windows, as shown in Figure 1, and click Next.

Now, select the Change Product Key option and enter your new product key as shown in Figure 2.

Finally, click Update and close the window. If Windows returns you to the previous screen, just select the Remind Me Later option. When the wizard is finished, reboot the system.

Figure 2

When Windows reboots, your next step will depend on which Windows XP version you are using.

If you have XP Home or Professional, you’ll be prompted to reactivate your copy of Windows through the normal activation process.


If you have XP Corporate, no activation is required and your machine should have a valid product ID. You can verify this by running the %systemroot%\system32\oobe\msoobe.exe /a command again.


When the wizard loads this time, you should see a message indicating that your copy of Windows has already been activated.

Changes to remote administration in Windows Server 2008

Recently I ran into an issue were I was using RDP (Remote Desktop) to remotely administer a Windows 2008 SBS server trying to use the /console switch to get connected to an admin user session that had already been started from the local KVM (Keyboard-Video-Mouse) of the server (also referred to as session 0) before I had left to come home.

I received the following error message "An unknown parameter was specified in computer name field" after a little research I found that Microsoft had changed RDP on Windows 2008 and deprecated the /console switch.

For detailed info on this please review http://support.microsoft.com/kb/947723

The synopsis is you can use the /admin switch to do something similar but that according to Microsoft it has improved application compatibility enough so that legacy apps that used to need to run as console no longer need to. I'm not totally convinced but time will tell.

Here are some additional links for further reading:

http://blogs.techrepublic.com.com/datacenter/?p=434

http://blogs.technet.com/askperf/archive/2008/01/04/mstsc-exe-no-more-console-switch-in-rdc-6-1.aspx

http://blogs.msdn.com/nickmac/archive/2007/11/28/mstsc-console-switch-in-windows-server-2008-and-windows-vista-sp1.aspx

http://blogs.technet.com/askperf/archive/2007/04/27/application-compatibility-session-0-isolation.aspx

Network Connectivity Troubleshooting Article Links

TCP/IP Troubleshooting: A Structured Approach - Part 1: An Introduction

TCP/IP Troubleshooting: A Structured Approach - Part 2: Troubleshooting Routing Tables

TCP/IP Troubleshooting: A Structured Approach - Part 3: Repairing Network Connections

TCP/IP Troubleshooting: A Structured Approach - Part 4: Using Netdiag.exe

Windows Group Policy Article Links

Useful articles for designing GPOs and dealing with common GPO issues:

Best Practices for Designing Group Policy

Optimizing Group Policy Performance

Using Logon Scripts in Pure and Mixed Active Directory Environments

How to Implement Group Policy Security Filtering

Troubleshooting Group Policy Processing

Terminal Services Group Policy

MSI Packaging Tools

Managing Printers Using Group Policy (Part 1)

Managing Printers Using Group Policy (Part 2)

Deploying Printers With Group Policy in Windows Server 2003 R2

ISP - MX Record Cutover links

Useful links for when you need to perform an ISP cutover from an old provider to a new one for a business client:

ISP Cutover Does MX record need to be changed?

Network Issue - new ISP cutover - internet traffic is flowing but not mail or web that is port-redirected to server

Tech Tip: Seamlessly transition your server's IP address

DNS And Name Server Cutover

Dell Server Support - Commonly Used Tools

When troubleshooting Dell Servers, the following links to utilities and drivers can be very useful:

The Dell™ Server Updates Utility

DVD - Stay on top of updates here

Gather system logs using DSET

Monitor your server with Server Administrator , or use bootable utilities in OMSA Live 5.5

Diagnose the issue with PowerEdge Diagnostics or 32 bit Diagnostics

Good Luck!

What the *&^@! happened to IE7's “Open these tabs the next time I use Internet Explorer” in IE8?!?!

or "How to Restore and Reopen Last Browsing Session Opened Tabs in IE8?"

Unlike Internet Explorer 7 which allows you to select option to re-open and restore opened tabs the next time you use Internet Explorer upon exiting IE with multiple tabs detected, Internet Explorer 8 has removed this ability. What the hell? Seriously, if you are gonna copy Firefox, at least do it right and keep it that way.

They have exchanged the useful feature from IE7 for the "Reopen Last Browsing Session" in the final version of IE8. Reopen Last Browsing Session works in a similar fashion with Show my windows and tabs from last time startup option of Firefox, except that there is no option to automatically reopen last browsing session upon start up or launch of IE8 browser. Lame.

In order to restore the last browsing session and re-open all last opened tabs in IE8, user have to run Internet Explorer first, and then use one of the following methods to open the last browsing session in IE 8 in Windows 7, Vista, XP, Server 2003, Server 2008 and Server 2008 R2.

How to Reopen Last Browsing Session in Internet Explorer 8

Method 1: In the Internet Explorer window, click on the Tools pull down menu (either from Command Bar or Menu Bar, which can also be activated via Alt+T keyboard shortcut), and select Reopen Last Browsing Session.

Method 2: Open a new tab, and then click on Reopen Last Browsing Session link. If you can’t see it, expand Reopen close tabs section.

Tip: FYI, If you set IE’s home page to about:Tabs, then it’s possible to access Reopen Last Browsing Session instantly on running IE browser.

For user who don’t use the feature, it’s possible to disable and turn off Reopen Last Browsing Session feature. If you want to reopen closed tabs, IE8 supports it too.

Configuring mailbox storage quota in Exchange 2007

From the Exchange Management Console

To set the default for the mailbox database for the company:

Server Configuraton > Mailbox > Storage Group > Mailbox Database > Right-click choose Properties > Limits Tab

To set it up for each individual mailbox (this overides the default for the mailbox database):
Recipient Configuration > Mailbox > Right-click on an individuals mailbox > Properties > Mailbox Settings Tab > Double-click Storage Quotas

Outlook 2003 - Add another person's mailbox to your account

Useful exerpt from Microsoft on adding another person's mailbox to your Outlook 2003

"If you are a delegate and routinely respond to e-mail for someone else, you may want to add their mailbox to your account for quick access. You must have been granted at least reviewer permission to open their mailbox and see it in your Folder List.

1. On the Tools menu, click E-Mail Accounts.
   
2. Click View or change existing e-mail accounts, and then click Next.
   
3. In the list, click the Exchange account type, and then click Change.
   
4. Click More Settings, and then click the Advanced tab.
   
5. Click Add, and then type the mailbox name of the person whose mailbox you want to add to your user profile. If you do not know the mailbox name of the person, contact your administrator."

Enjoy!

Set new windows in IE7 to open in Tabs

Before internet explorer 7 came out, I used to use a product called "Collector" by Hiroshi Takahashi that came bundled with TeraTerm Professional Enhanced version http://ttssh2.sourceforge.jp/

It was meant to capture VT console windows into a single tabbed interface to make tracking them easier when remotely administering servers via telnet and ssh. I also used it to collect IE6 windows into a single tabbed interface.

Thanksfully, I no longer need to kludge together my own IE-based tabbed browser.

By default in IE7 tabs are enabled but pop-up links or requests for new browser sessions (ctrl-click) open a new window not a tab in the current active IE window.

To have new windows and pop-ups open new tabs by default:

1. Open IE7
2. Click Tools
3. Click Internet Options
4. Click Settings
5. Check the "Always open pop-ups in new tab" box
6. Click OK until you are back in your browser

You should now be able to click on links to pop-up windows or CTRL-click on a link and they will all open in tabs by default.

Enjoy!

RDP Admin fun with your Hackintosh

I do IT consulting for a living now-a-days and I use a MacBook Pro laptop as my weapon of choice for my mobile computing platform for a few reasons.

1. I have all the major Operating System flavors legally on one machine and at my finger tips, ie: Windows (in Bootcamp or VM Fusion), Mac and Unix (FreeBSD/Darwin), which is great when you're a road warrior.
2. It's the only version of Unix-like OSes that has Micro$oft Office coded for it natively, can you say "PowerPoint" boys and girls?
3. Let's be honest, they look damn cool and the Aqua GUI trumps windows, yes, even Vista, for sleekness and functionality.
4. Plus the chicks dig it ... lol

That being said there are a few little snurks that disturb the otherwise stillness of the pond of my Mac meditation. Two of those are the lack of a few keyboard keys and a right-click touchpad button that I use frequently while connected via RDP to a remote Windows server.

If you have ever used Remote Desktop (RDP) to connect to a Windows server from your house in your undies, when you get a call at 2:00 AM from a frantic client about a critical service being down instead of having to hop into your clothes and drive 30 miles to their office, you'll understand it's incalculable value to you. I use it almost hourly, every day. (Man, I need to get a life.)

If you happen to want to lock the screen on that Windows server without having to log off or disconnect from the RDP session, then you are out of luck on a Mac laptop because you have no END key to perform the RDP version (CTRL+ALT+END) of the 3 finger salute (CTRL+ALT+DEL) to access the Windows Security dialog box so that you can lock the screen.

There is a way around this by creating a shortcut on the desktop of the Windows server you remotely connect to:

• Right click on any empty spot on the remote machine's desktop. Click on New and then Shortcut.
• In the dialog box that appears, type:

rundll32 user32.dll,LockWorkStation

• Click Next to continue.
• Enter a name for the new shortcut, i.e. "RDP Screenlock" or whatever makes sense to you.
• Click Finish to complete the task.
• If you are feeling particularly Mac-ish you can go to properties and assign a pretty icon with a key or lock or something. ;)

The lack of a right-click touchpad button can be resolved by either CTRL+CLICK-ing whatever you want to right-click on or by purchasing a Mac-compatible 2-button USB mouse (I prefer the wireless ones, myself.)

NOTE: The best Remote Desktops Manager software for Mac is a program called CoRD. I highly recommend it for creating your quick-list of RDP connection links and storing the credentials for each connection. Awesome app.

Enjoy!

Rounding up the usual suspects - Network Troubleshooting Part 1

When you are troubleshooting a network issue, it can be a little overwhelming if you don't begin the process by narrowing the cause of the problem. You do this by "rounding up the usual suspects", the common causes of network issues.

The Usual Suspects

Taking a queue from the Scientific Method and Occam's Razor , apply the following rule of thumb when localizing and narrowing down the problem: "All things being equal, the simplest explanation is probably the correct one."

Here are a few of the usual suspects:

• Logon Credentials
• The Obvious
• User error (aka PEBKAC)

Logon Credentials

Access to the network depends on a user providing correct logon credentials, normally a username and it's associated password/passtoken. These 2 items must match exactly to what is "on file" with the server that controls network-access, especially passwords, which are case-sensitive. Now technically this usual suspect actually fits into the User error category but user's mistype their passwords so often it is it's own category.

Typical causes of this error are :

1. CAPS Lock is On.
2. User simply mis-typed 1 or both items.
3. User forgot the correct password after having to recently change it due to company password policy enforcement.

The Obvious

Don't neglect the obvious stuff of OSI layer 1 (physical environment) Loose or damaged cables are common causes of physical layer networking issues. Check:

1. Network cables
2. Connectors (cable-end terminators, retaining clips break off of these constantly)
3. Switches installed by users in their workspaces with/without approval
4. Wall jacks (Ethernet)
5. Power plugs

User Error

Among IT professionals you'll hear terms like PEBKAC, ID Ten T , and Layer 8 when describing this usual suspect. One of my favorites is EEOC "Equipment Exceeds Operator Capability" ;)

Simply put, human error accounts for most problems, networking ones included. This issue is partly a problem of user education, as a networking professional it's part of your job to properly educate your end-users on the proper use and expectations of your network. So maybe a better acronym would be PEBAAU "Problem Exists Between Admin And Users" ;)

When you suspect that user error is the cause of a reported network issue, have the user reproduce the issue while you observe him/her. If it turns out to be that the user is following an incorrect procedure or other type of user error, the solution will be fairly obvious. If not, back to the drawing-board.

Good Luck in your networking adventures!

*** is not a valid Windows network message number.

It is always fun in Windows-land. Fun, fun, fun. [thinkingofmyhappyplace] ;)

I have a really good buddy who works at Micro$oft and being a good guy he passed along a tip about the Microsoft Exchange Server Error Code Look-up tool.

Turns out it "determines error values from decimal and hexadecimal error codes in (all) Microsoft Windows® operating systems." not just for Exchange.

Now that would have been a useful thing for Micro$oft to hype a little more than leading us to believe that this little tool was just for Exchange... [sigh] don't get me started... one day I'll regale you on multi-terabyte enterprise DFSr implementations held up by Micro$oft "unpublished" KBs.

The Error Code Lookup tool can look up one or more values at a time. If available, informational data associated with the value(s) will also be shown (see below).

Cmd line output from err /?

Table ? could not be found.

USAGE: err {value} [value] [value] ...
where must be of one of the following forms:
1. decorated hex (0x54f)
2. implicit hex (54f)
3. ambiguous (1359)
4. exact string (=ERROR_INTERNAL_ERROR)
5. substring (:INTERNAL_ERROR)

All values on the command line will be looked up in our internal tables and presented to you. If available, informational data associated with the value(s) will also be shown (see below). All tables are searched by default, but you can restrict the output to those tables you deem appropriate by adding "/" to the beginning of the cmd-line.

Example:

> err /winerror.h /ntstatus.h 0
# winerror.h selected.
# ntstatus.h selected.
# for hex 0x0 / decimal 0 :
STATUS_WAIT_0 ntstatus
ERROR_SUCCESS winerror
# The operation completed successfully.
NO_ERROR winerror
SEC_E_OK winerror
S_OK winerror
# 5 matches found for "0"

Last compiled on Mar 31 2003 14:39:19.
This app has support derived from the following headers and privates
...
There are currently 19871 return codes registered from 172 sources.

Cmd line output from err 5000

# for decimal 5000 / hex 0x1388 :
SPMEVENT_PACKAGE_FAULT lsapmsgs.mc
# The supplemental credentials for security package %1 for
# user %2%3 could not
# updated. The return code is the data.
# for hex 0x5000 / decimal 20480 :
CCERR_CHOOSECOLORCODES cderr.h
# 2 matches found for "5000"

After learning about this tool and playing with it, I did some more googling and found some additional information on the subject.

Check out To err is Admin and Information about the err.exe tool I use to look up error codes when debugging setup issues for more information.

Disk is Full. Clear up some space on your disk... WTH!?!

If you have been in IT long enough you will likely have run into something along these lines on a user data volume or (more annoyingly) a server OS partition. And you have come out of the server room IT guns blazing, shouting "Who done burned up all the storage on the server?!! DIE!!!" ;)

Well I have an app that I like to use in these instances to help me identify the who/what/where/how much of these storage issues. Best of all it's free, and you know I love me some free software that actually kicks butt and gets the job done. Makes my day.

For your directory scanning pleasure, I present:

JDiskReport a cross platform java-based tool, authored by Karsten Lentzsch of JGoodies, that focuses on understanding how much space the files and directories consume on your disk drives, and it helps you find obsolete files and folders.

The tool analyses your disk drives and collects several statistics which you can view as overview charts and details tables:

There are free binaries for Win32, OS X, Web Start and Java available.

Check it out, you won't be sorry.

Samba-da... Getting down and dirty with FreeBSD and Samba

Recently we had an Iomega NAS server melt down and leave a smoking hole in our data recovery. You ever just have one of those days? ;)

Our recommendation now, stay away from Iomega and Snap brand NAS devices, they are highly susceptible to overheating. You've been warned.

Besides for about half the price you can throw one together for yourself with greater capacity, good reliability and better RAID speed.

You can get a free NAS solution up and running without all the normal open source headaches by hopping over to http://www.freenas.org , downloading the ISO and following the instructions and you will have a FreeBSD-based NAS up in about an hour.

Shibby!

FreeNAS is a free NAS (Network-Attached Storage) server, supporting: CIFS (samba), FTP, NFS, AFP, RSYNC, iSCSI protocols, S.M.A.R.T., local user authentication, Software RAID (0,1,5) with a Full WEB configuration interface. FreeNAS takes less than 32MB once installed on Compact Flash, hard drive or USB key.

The minimal FreeBSD distribution, Web interface, PHP scripts and documentation are based on M0n0wall.

More fun with PEBuilder

Many thanks go out to Deral Heiland and crew for coming up with this little hack:

At the last Defcon(13), Deral did a session on the Insecure Windows Workstation, and along with some interesting privilege escalation using the system-level help API, he also explained how to use bart's PE to write a trojaned accessibility app to a NTFS root partition and then use WIN+U before logging in to access a system-level priviledged desktop.

Inaugural Post

{quoted from bart's pebuilder site}

"What is BartPE and PE Builder?

Bart's PE Builder helps you build a "BartPE" (Bart Preinstalled Environment) bootable Windows CD-Rom or DVD from the original Windows XP or Windows Server 2003 installation/setup CD, very suitable for PC maintenance tasks.

It will give you a complete Win32 environment with network support, a graphical user interface (800x600) and FAT/NTFS/CDFS filesystem support. Very handy for burn-in testing systems with no OS, rescuing files to a network share, virus scan and so on. This will replace any Dos bootdisk in no time!"

Quite simply, Bart's Preinstalled Environment is the freaking bomb for us tweak-heads who are consistently either fixing [l]user problems or futzing with our systems enough to make them melt down. It's at times like this that you need: a Preinstalled Environment. Now Micro$oft won't make their PE utility available to you unless you are an "active Micro$oft Software Assurance Member." (...Queue the final jeopardy music...)

"Hey wait, I'm not an active Microsoft Software Assurance Member. I'm screwed again! Damn you Bill Gates, damn you straight to hell!!" you say?

Don't feel bad, neither are we, and that is where Bart Lagerweij comes in. This kind and altruistic fellow coded up a solution to help you use those spare windows XP licenses you have laying around, (cough cough, wink wink, nudge nudge). And he did it for free.

Shibby!