The Bit Bucket

General rants about live mostly centered on the IT Industry.

This post originally appeared on an external website

My first blog posting................

Guess the best way to do this is to start by introducing myself.
I work in IT and Im a geek. Pure and simple!!!!

The 'plan' (or maybe that's better put as the loose set of ideas) for this blog is to pass on hints tips, tricks and comments on the IT industry, Along the way I have no doubt I'll post some useful stuff as well as some real crap and from time to time I'll go off on a tangent............

Enjoy the ride!

This post originally appeared on an external website

Ok, It's happended once again. A virus has been unleased that exploits a windows security hole.

I suspect a lot of people will think this is normal for windows and you'd be right, just a few years back we had SQL slammer, my doom and the 'love bug'.
So, if it's so normal for windows and everyone expects it why has it been allowed to happen again?

You'd think corporations and internet-savvy home users will be battening down the hatches, being ultra cautious of opening attachments, making sure AV definitions are up to date. Nope they are not.

Why not?

Because it's too much hard work. Stupid isn't it?

Corporations spend millions on servers, projects and basic security yet each time a hole is exploited they are not ready.

Why not? Well, a lot of it is because the staff are actually not that interested in making security a priorty. Think about this - Anytime you make something more secure you also make it a pain in the arse to administer because of that security.
Security is a balance between usability and protection yet it is something that will also cause the most number of arguments of anything.

Over the next few blogs I'm going to go into the world of computer security and show how a patch works, how to take it apart, test it as well as (hopefully) show a few things that just may make life a bit easier.

Keep reading :-)

This post originally appeared on an external website

Computer security is not about eliminating risk. It's about managing it.

To elimate risk you'd need to swich off your PC, unplug the network cable and lock it in a safe and then hope that no one steals the safe.

Whatever happens there is always an element of risk when you have a computer connected to the internet.

Once you accept that risk the next step is to get to know the enemy and that enemy is quite simply everyone around you.
I'm sure you have received an email from someone that you know with an interesting subject line and then opened the attachment. You know you shouldn't, you know it's probably not going to be any good but yet you HAVE to see what the email contains.
Bang, you have a virus and may not even know it.

This sort of thing can be stopped but it means doing the one thing a lot of people loath. upsetting the users.

Firstly, there is no reason for ANY user aside from delegated accounts to have any sort of elevated admin access. You want to do something on the network? Go logon with the relevant account. Your own account should not have any special permissions.

I've seen many sites where the IT team are all domain admins and go around merrily logging on and forgetting to log off again afterwards.

Secondly, Remove administrator rights from the users. This WILL piss them off. Tough.
This second step ties nicely in with a sound policy that MUST be followed.
Too often I have seen places that have good polices over software installation that are then ignored simply because the company concerned doesn't know just how dangerous unauthorised software can be.

Of course, the question then is:
How can I as a member of the IT dept make sure the management know that they are at risk?

Remind them each and everytime. Unfortunatley, Management aren't very good at heading warnings and it will take a couple of incidents before they might, just, MIGHT pay attention.

It's a long shot but all too often it's the only shot we have.

This post originally appeared on an external website

As mentioned previously, There is now a vulnerability out on the net that exploits the latest security hole in MS Windows.

Whilst Microsoft has released a patch (MS05-039) it will only work on Windows 2000 SP4 and above so if your like the majority and running SP3 it's time to get over it and upgrade to SP4 then deploy these patches.

Eeye have released a free network scanning tool that will show what machines are vulnerable to this security hole. Note: It doesn't work on NT4 so other methods will need to be used to be sure that NT4 domain controllers are safe. Note that at this time there is no way of knowing for certain if they have been affected, it may well be that the architecture of NT4 is such that this security hole cannot be exploited.

This post originally appeared on an external website

Raymond Chen has a pretty good blog called 'the old new thing', this blog is partly based on his style. One of his common issues he, as an ms developer comes across, is 'people who ask for security holes' and its worth reading to get an idea of how misguided some peoples idea of security is.

In a similar vien I had a conversation that went like this:
'User x has changed the local admin password and removed domain adminstrators from local admins, how can I get admin access to the machine?'

When I semi patiently explained that such an ability would be a security hole and thst, generally speaking, you don't allow end users to be so disruptive he exploded 'Well, I'll bet MS has such a tool somewhere'.

Yes, Of course they do and I'll bet its called hack-my-pc-v1.exe

This is, of course, the very same sort of person who complains loudly about security holes when MS release patches.

This post originally appeared on an external website

There are some things that get under my skin, Cyclists riding through a closed cycle lane for one but Bulldog is one of two companies that has managed to REALLY get under my skin....

Back in March, The company I worked for designed that all IS staff were to have home DSL solutions installed. At the end of March I had a BT Engineer visit and install a new phone line - This was hooked up to Easynet and everything worked perfectly for two months.

Then comes along Bulldog who WITHOUT ANY AUTHORITY pull my Easynet connection and hook it up to themselves.
It took me a week to track down where the connection had been moved to but eventually I got through to Bulldog's complaints who appeared to be quite helpful without actually lifting a finger to get anything done.

a month into the problem, still with no DSL access I FINALLY get hold the complaints dept who promptly close ranks with a 'nuffing to do wiv us guv' type of attitude. Several unreturned phone calls and ignored emails later I have no choice but to lodge a complaint with ofcom which was subsequently dealt with by the company I work for.

I have no idea what happened with the OfCom complaint as I've never been told which is a bit frustrating but the most annoying thing about this whole episode is the one simple fact that there is NO department at BT that you can speak to who will sort these issues out. The only thing you get told is 'Can't happen'. At one point I managed to get hold of the DSL line provisioning dept who were horrified that I, a mere customer had even spoken to them as they only deal with ISP's.

Anyway, Last weekend I was out shopping when a bulldog customer agent came up to me and asked me if I wanted a Bulldog connection - I politely refused yet he persisted. The look on his face, when I told him just how bad I thought Bulldog is was an absolute picture.

Bulldog persist in sending me sales rubbish so I persist in being as annoying as possible to them - the perfect combination!!

I'd be interested to hear if anyone else has suffered problems from Bulldog illegally seizing thier phone/DSL circuit.

This post originally appeared on an external website

Ok Kiddies, I promised you that I would show you the mysteries behind security patches and this entry is the first part of that.

First of all, it's import to note what a security patch actually is.
It is simply one or more files that have corrections to code in them that close up certain loop holes in code that allows an undesired event to occur.
This will make more sense later.

For various reasons, security patches will fail to deploy or may say they are needed when they are not. These articles will hopefully explain why these events occur and give you the knowledge to fix them.

For now, You really should have access to the following:
A Windows 2000 SP4 box with SP4 and NO patches (vmware is excellent)
A Windows XP SP2 box with NO patches (vmware is excellent)
A copy of the Microsoft baseline security analyser See this page

An MD5 tool (MD5SUM works particually and will be used in the examples)
The Pendmoves sysinterals tool.

A pen or pencil and some paper.

Let's take a Windows 2000 SP4 machine first.

Install the MBSA and perform a local scan looking for missing security patches first and you will find you can't because of an error message titled:

"the catalog file is damaged or an invalid catalog."

The fix for this problem is to apply the following security patch

It seems a little daft that a security tool actually can't work without a particular security patch being applied but there you go....

Once the patch is applied try running the scan again. You should see something similar to the screenshot here:

That's enough for now - We have got the MBSA up and running and have a list of patches.

Next time I will show you how to break a patch.

by ciebie95 Dec 23, 2005

"" "the catalog file is damaged or an invalid catalog."

The fix for this problem is to apply the following security patch ""

I had this problem for some time. None of the suggested solutions (from several internet forums) worked. Has nothing to do with downloading problems, firewals, etc. The security patch did not work, because I'm on XP/sp2. After several attempts, this worked for me:

- after downloading wsusscan.cab to (administrator) \......\cache (one of the solutions that did not work at first), I ran "C:\Program Files\Microsoft Baseline Security Analyzer 2\MBSACLI.exe" /nd and to my surprise a 1kb "wsusscan.cab.dat" file appeared in the cache directory next to the .cab file. After that I can run MBSA2, although the download problem still exists.

Hope this helps somebody.

Regards, Kees.

by garydw Jan 14, 2006

I've been on the NT Bugtraq mailing list for months and then one cold September night (it may not actually have BEEN cold but I digress...) the list seemed to disappear only to reappear months later with no posting, no announcement of security patches.

Its a shame because NTBUGTRAQ was one hell of a good site promoting the free flow of security information and teaching the uninitiated good security practises and now all that is left is a somewhat bleak site with no more postings.

I hope NTBUGTRAQ can be resurrected as without it the security arena is a more lonely and dangerous place.

This post originally appeared on an external website

by garydw Jan 15, 2006

One of the really nice features in Windows is the unattended build.
Rather than having to do an install and hit Next, Next, Next, Cancel (damn, wrong one!) you can pass the installation routine all of the settings it needs.

This is useful because you get reliable, consistent builds across hardware types. Sometimes you will need to add in the additional drivers needed but once thats done it's actually a really nice way of performing an install.

Another nice feature is the ability to slipstream service packs into the install media. This gives you the ability to deploy the software with the service pack pre-installed.
I always spin off a copy of the install when applying a service pack. This way I can roll back to a previous unattended installation if needed.

Recently, Micrsoft has addd the ability to /integrate patches into the install. In theory you can install a new machine fully patched before it even hits the network.

In Theory.

In Practice someone needs to test this at Microsoft.

Recently I tried this on Windows 2003. The service pack slipstreamed and installed with no problems.

Integrating the patches also generated no errors but when running the installation you'll get the following error:

This DLL is used by MS05-039

So, Now we have a problem. Do we ignore the file? Well, you can't do that because you will still be unpatched so all you can do is NOT integrate that patch into the unattended files and this means when the machine starts up it will be missing patches.

Annoying and unnecessary.

This post originally appeared on an external website

This post originally appeared on an external website

Interesting day today.

I came across the credit card machine that cannot accept any credit card with curved edges (Have you EVER seen a credit card with squard edges?)

The complaints line that cannot accept complaints - Wanadoos' customer complaints line are unable to help unless they can do something about the problem.

And

The helpdesk that gets scheduled downtime confused with a network outage. Neither of which was true. Today I had problems with my Wanadoo broadband so I phoned the tech support line to be told that there was a network wide site downtime scheduled outage. When pressed further he clammed up. A call back 20 minutes later actually showed no issue and the problem was fixed.

At least my internet connection is back again but this is the second time in a week its failed with inconsistent information from wanadoo.

This post originally appeared on an external website

When I first started blogging I had this grand plan to blog something ever few weeks and now I notice it's been three months since I blogged. Not good.

Hmmmm.

From now on I will be a good boy and blog more often!

This post originally appeared on an external website

Microsoft have really been busy over the past month. We have had BETA's for office 2007 which looks GORGEOUS and I fully admit to being addicted to OneNote.

Vista is now in CTP and anyone can download it. I'm finding the front end a bit clunky and I have yet to find out where to turn off all the nice processor hungry fade effects but overall its, errm, well it's an operating system. I'm not sure what exactly it brings to the table in terms of an O/S. I guess time will tell.

Interesting enough, Vista doesn't use the unattend.txt file anymore. This time it's all pure XML. At some point this week I will be putting together a test autobuild. Will be interesting to see how that all works.

This post originally appeared on an external website

One of the really nice things about CD's is that they can be made bootable. Doing this is a slightly fiddly operation but worth the time.
Most of the autobuilds I create are written to an ISO file (for use in VMWare) or burnt to CD (for use on physical hardware.

One problem I have tripped over several times is that selecting 'Bootable CD' from the Nero menu will not give you a bootable CD that works for a Microsoft autobuild. The default Nero settings will screw with the filenames and so break the installation.

The fix is quite simple, select the 'ISO' tab before you burn your bootable CD and make sure it's configured as follows:

Data Mode: Mode 1
File System: ISO9960 Only
File name length: Max of 11= 8 + 3 chars (Level 1)
Allow path depth of more than 8 directories - TICKED
Allow more than 255 characters in path - UNTICKED
Do not add the ';1' ISO file version extension - UNTICKED

This post originally appeared on an external website

Several times now I have used big (great than 128GB) IDE hard disks in Windows 2000 and found that Windows cannot address more than 128GB. This is down to a limitation of the service pack (you need to be on service pack) and the simple fact that there is a registry value called EnableBigLBA that needs to be activated.

The required registry key is listed on Microsoft's support site. Click on this link to see the article.

This really is one of those tweaks that's handly to have in an automatic build or in a ghost image.

by garydw Jun 15, 2006

Everyone now and then it's possible to come across a website that's pure nostalgic gold. TV Creams top 50 TV themes of all time is just one such site.
This site has things like an extended version of the Terrahawks theme on it. If you remember programmes such as Terrahawks, Tales of the Unexpected and Sapphire & Steel then you just might waste an evening at this site.

This post originally appeared on an external website

by garydw Jun 23, 2006

Over the past few weeks I have had the chance to play with Active Directory Restoration and various failure scenarios. During this I have come up with a set of tips that I thought it would be worth sharing. If you have any more then please add them into the comments.

1. You should always have a MINIMUM of two domain controllers doing replication between them and they should be at different sites.

2. Should you ever need to restore the system state you should only restore the system state to the machine it was backed up FROM. This is because the system state contains more than just active directory, it contains all the registry settings and more therefore restoring
system state to a different machine will overwrite the settings on that machine.

3. The only exception to rule 2 is when you restore system state to a DIFFERENT location in order to promote a domain controller from another domain controllers system state.

4. DCPROMO /ADV is the command that will allow you to point the DCPROMO process at a restored system state. This is called a non-authoritative restore.

5. An authoritative restore cheats. It just increments the USN (Unique Sequence Number) of all objects that you are restoring by a huge amount (20 to 100 thousand) .

6. The Active Directory Database is called NTDS.DIT

6. It's helpful to understand Active Directories replication model - A domain controller will look in it's NTDS.DIT database and THEN ask the server running the PDC Emulator if it has a recorded with a higher USN.

7. Dependant on how your replication environment is configured it MAY be possible to jump onto another DC and mark the object you want recovered authoritative. This way, when the replication occurs it will be ignored because the USN's have changed.

8. To recover Active Directory the server MUST be in Active Directory services Restore Mode. This mode is a variant on Safe Mode and means the Active Directory database is NOT loaded. You must login using a logon name of Administrator and the Active Directory services restore password you set during DCPROMO. This password is the ONLY password that is stored locally on the domain controller. It can be changed by following tip 16.

9. To recover the ENTIRE Active Directory database you type NTDSUTIL -> Authoritiative Restore -> Restore Database

10. To recover an OU you type NTDSUTIL -> Authoritative Restore > Restore Subtree "OU=X, OU=Y, DC=A, DC=B"

11. To recover a single object you type NTDSUTIL -> Authoritative Restore > Restore Object "OU=X, OU=Y, DC=A, DC=B"

12. When restoring objects you need to use the full Distinghused Name. The Distingusted Name is the CN=X, OU=Y, DC=Z as listed above.

13. Acronyms used in Distingused Names:
CN is Common Name
OU is Organizational Unit
DC is Domain Component

14. It's possible to perform an authoritative restore WITHOUT being in Active Directory Services Restore mode. To do so you need to set a flag with the following command:
SET SAFEBOOT_OPTION=DSREPAIR.
Attempting this type of restore is NOT recommended. It's much cleaner and safer to be in Active Directory services restore mode.

15. NTBACKUP has a bug. If your NTDS.DIT database is on any drive other than C: you must back up a file on the same drive NTDS.DIT lives on. For example, if NTDS.DIT lives on the G: drive then you must back up ONE OTHER file on G: otherwise it won't work.
The bug is documented here.

16. You can change the Active Directory Services Restore Mode password by using the following command:
NTDSUTIL -> SET DSRM PASSWORD -> RESET PASSWORD ON SERVER

you will then be prompted for a new Active Directory Services Restore Mode password.

This post originally appeared on an external website

by user94327 Jul 11, 2006

I tried step 16.
Entered: NTDSUTIL
Prompt: ntdsutil:
Entered: SET DSRM PASSWORD
Prompt: Reset DSRM Administrator Password:
Entered: RESET PASSWORD ON SERVER
Prompt: Error 80070057 parsing input - illegal syntax?

Did I do something wrong here? I am by no means an AD expert.

Thanks!

by sysadmin Jul 11, 2006

Rather than "RESET PASSWORD ON SERVER", you need to enter "RESET PASSWORD ON SERVER NULL". The "NULL" instructs the DSRM password to be reset on the local computer. You can also substitute "NULL" with another server name to reset the local password on that particular server.

by garydw Jul 11, 2006

Good catch on point 16. Yes it should be 'RESET PASSWORD ON SERVER <SERVERNAME>

by cgerada Aug 21, 2006

I have 2 DC's on my network
one of them lost its ntdis.dit databse and I need to recover the server.
and I have no back up of it,

I have transfered all the active directoy rolls to the second?operational? DC, and wish to recover the damaged one, by uninstalling and then re-installing AD usinig DCPROMo (i think this is my only oiption)
my problem is that I cannot?boot?the?machine?in?normal?mode,?as?the?ntdis.dit?database?is?
missing?so?it?forces?me?to?boot?into?directory?recovery?mode,?but?in?
directory?recovery?mode you?cannot?run?dCpromo.
?DCpromo?must?be?run?in?(normal?Mode)
any ideasm?on?how?i?can?reset?my?.di?databse?file?so?that?i?can?start?over
would be muchly appreciated
thanks

Clive

by garydw Aug 21, 2006

Clive, in your example the quickest fix is FORMAT C:

Wipe the server, re-install the O/S then run DCPROMO and make it a second DC again.

You will then need to run NTDSUTIL to do a METADATA clean up.

This post originally appeared on an external website

I often wonder just how many people who 'found' the net after Tim Berners-Lee brought us the web actually know about newsgroups?

Well, Newsgroups are still very much alive and well. There are several companies they have public news servers to allow folk to talk about specialist topics. I'm amazed just how many of these companies decide to host thier newsgroups on IIS.

Whilst IIS does the job it severly lacks functionality, has a VERY annoying bug and its clunky to migrate - even between the same version of IIS!!!

Hamster Classic is a free NNTP server for Windows that will sit quite nicely on your network and connect to multiple NNTP servers. It is very handy where you want to distribute a subset of external news groups (e.g. the public Microsoft ones) and host your own internal groups.

Hamster can do all this and more but it does have several down sides:

It doesn't install as a service.
It has no scheduling mechasim so you need an external application to 'force' it to collect data from news servers and purge old data.
Most configuration is via text files.

Deepsite these annoyances it's actually a very nice piece of software that once configured just sits there and works.

This post originally appeared on an external website

Many times now I have seen the same errornous answer to the question of "How can I give people in different OU's different password policies?"

You cannot.

Password policy is function of the DOMAIN policy and not an OU policy therefore you need to think carefully about your password policies because this will affect your Active Directory design considerations.

This post originally appeared on an external website

I suspect that like many of you VMware plays a big part in testing new apps/systems and other fun toys that are released on an almost daily basis.

For sometime now I've been using VMWare workstation. The ability of workstation to be able to create network teams and multiple snapshots can be quite invaluable. The only functioanlity missing is the ability to run workstation on a server and be able to connect to it via a console or web page.

GSX (now VMWare Server) has this functionality and is freely available. Taking the plunge I removed VMWare workstation and have started using the free VMWare server. For me, the ability to be able to connect to the server via a webpage and control my machines outweighs the very small disadvantages.

In fact, because of the way VMWare networking can be configured using custom adapters it's quite easy to create a VERY similar level of fucntionality in VMWare as already exists in VMWare workstation.

As I am building a full test network using nothing but a Windows 2000 server and a copy of VMWare Server I wil blog various tips and tricks that I find as I build the test network.