LazyJeff

Send event log entries as SNMP traps

noreply@blogger.com (Jeff Kyker) — Sat, 18 Feb 2012 08:22:02 PST

Issue: An event just showed up in my system, security or application event log that is important. How can I be notified quickly about it?

Solution: Enable SNMP Traps for that event.

Create the event (or find it in the logs) – so you have it as an example
Identify three variables

Event Log - System, Application or Security
Log Source - eg: TermService, NTBackup
Event ID - eg: 8018, 8019

Run evntwin.exe (from windows\system32)
Click Custom / Click Edit
In the bottom left browse the event log, event log source then find the event id
Just double-click the event ID & accept the defaults
Click ok & you’re done
Trigger the event again and it will trigger an SNMP Trap to your SNMP Server.

Note: This assumes you have a fully functioning SNMP Server to receive traps and send them as emails. We recommend Dell's IT Assistant, especially for Dell Servers.

Why is my laptop trying to request wpad.holidayinnexpress.guest

noreply@blogger.com (Jeff Kyker) — Mon, 06 Feb 2012 08:56:48 PST

q: A customer's laptop was making odd URL requests to the router that all ended in holidayinnexpress.guest. What is causing this.
a: Recently the customer stayed at a Holiday Inn Express and used their connections for internet. Holiday Inn added a DNS suffix entry in the advanced TCP/IP settings of the laptop. Simply remove this.

To resolve this (in Windows 7)

Right click the network icon (down by the clock)
Click "Open Network and Sharing Center"
Right click on your "Local Area Connection"
Click Properties
Select "Internet Protocol Version 4" and click Properties
At the bottom of the Internet Protocol Version 4 (TCP/IPv4) Properties window click Advanced
Click the DNS Tab at the top
Select holidayinnexpress.guest under "Append these DNS suffixes (in order):"
Click Remove.
Click OK, OK, OK

Installing Forefront TMG 2010 Service Packs

noreply@blogger.com (Jeff Kyker) — Tue, 31 Jan 2012 11:02:00 PST

q: I need to install Forefront Threat Management Gateway 2010 and get it to the most recent version 7.0.9193.500. What is the quickest path?
a: We've determined the minimal path to installing and updating to that version is:

Install the base TMG Product

Run the Prep Tool
Run the Installation Wizard
Ver: 7.0.7734.100
Don't run the Management Wizard when prompted

Install TMG 2010 Service Pack 1

TMG-KB981324-AMD64-ENU.msp
Ver: 7.0.8108.200

Install SoftwareUpdate Service Pack 1 Update 1

TMG-KB2288910-amd64-ENU.exe
Ver: 7.0.9027.400

Install TMG 2010 Service Pack 2

TMG-KB2555840-amd64-ENU.exe
Ver: 7.0.9193.500

Then run the Forefront TMG Management Interface to configure the product or attach it to an array.

TMG 2010 SP1 Setup cannot modify or create the registry entry

noreply@blogger.com (Jeff Kyker) — Mon, 30 Jan 2012 12:07:01 PST

q: While installing Forefront Threat Management Gateway TMG 2010 Service Pack 1 (SP1) TMG-KB981324-AMD64-ENU.msp we encountered this alert/error "Error: Setup cannot modify or create the registry entry System\CurrentControlSet\Service\Tcpip\Parameters" Then it threw the error "Setup was unable to configure TCP settings. As a result, Setup cannot continue."

a: Simple solution, MSP files don't have the context menu to Run as administrator like EXE files do. So we need to be elevated before we run the MSP.

Click Start - type CMD (but don't hit enter)
When cmd.exe shows up in the results list, right click on it
Click "Run as administrator" / Click Yes if prompted by User Account Control
From here navigate to the folder where your MSP file is stored, let's say D:\Download\TMG_2010_SP1
Execute the MSP file by simply hitting tab, until the name is displayed or typing the name into the prompt.
TMG-KB981324-AMD64-ENU.msp

SideBySide - Windows Live Toolbar

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:43:04 PST

Issues: EventID 59: Activation context generation failed for "c:\program files (x86)\microsoft\search enhancement pack\search helper\searchhelper.dll".Error in manifest or policy file "c:\program files (x86)\microsoft\search enhancement pack\search helper\searchhelper.dll" on line 2. Invalid Xml syntax.

EventID 35: Activation context generation failed for "c:\program files (x86)\windows live\photo gallery\MovieMaker.Exe".Error in manifest or policy file "c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" on line 8. Component identity found in manifest does not match the identity of the component requested. Reference is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use sxstrace.exe for detailed diagnosis.

Solution: While searching "Activation context generation failed for "c:\program files (x86)\microsoft\search enhancement pack\search helper\searchhelper.dll"" We're taken to a Microsoft page saying it was associated to the Windows Live toolbar and that "no action is needed". Well, we don't use that toolbar, so to remove it:

Go to add/remove programs (appwiz.cpl)
Select "Windows Live Essentials" / then "uninstall/change"
Select (X) Uninstall / Click Continue
Then check "Windows Live Toolbar " / Click Continue
This leaves the other great Windows Live Essentials application installed and simply removes the toolbar.

Hide the Google People Widget Sidebar

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:44:09 PST

q: How can you hide Google's People Widget and it's sidebar container?
a: Well this one is a two parter:
Part one - Disable People Widget:

Within Gmail go to settings
On the General Tab, scroll down to People Widget and set it to (X) Hide the people widget
However, you'll notice it's sidebar is still there.

Part two - Disable/Hide the sidebar (only works for Google Chrome)

Open Chrome, visit the extension site for Minimalist:
https://chrome.google.com/webstore/detail/bmihblnpomgpjkfddepdpdafhhepdbek/details
Click (+ Add to Chrome) / Click Install when prompted
Visit your google mail site
Click on the M icon in the toolbar in the upper right / Click Dashboard
Under Minimalist for Gmail / Click Enable / Then click Options
On the "Main" tab at the top, Check the box next to "Hide Sidebar"
Click Save Changes at the Top Right
Open an email now & notice all the screen real estate you have gained.

Shoretel Caller ID is Unknown for Mobile Cell Phones

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:44:22 PST

q: we have an issue where forwarded calls and outbound calls to mobile phones from our ShoreTel SG-220T1A phone switch showed up as 'UNKNOWN' and it didn't even list the phone number.
a: The company that installed the phone system along with AT&T just threw up their hands. We thought it was related to a Caller ID issue. However, a short google search found this Very Helpful post: http://www.shoretelforums.com/forums/administrators/1811-inbound-outbound-caller-id-2.html - They provide clear instructions where you insert a ;2E in the Custom Trunk Group Dialing Rules. A quick call to some cell phones proved this to work and has resolved that issue.

You will need to enter Support Mode in Director
To do this BEFORE YOU LOG INTO SHOREWARE DIRECTOR
Press and hold the CTRL and Shift Key / Click on the U in User Name of the Log in, in Director
You will see a Red Support Entry Mode appear under the User name and Password
Log in normally to Director
Click on Trunks on the left, then click on Trunk Groups
Click on the name of your Trunk Group
Then scroll all the way to the bottom of the page where you see the last button is "Trunk Group Dialing Rules: Custom" Click Edit
Type ;2E into this field, click save.
Perform a test call in amazement.

WMSVC Web Management Service on Server 2008

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:44:34 PST

q: During the continued configuration of Microsoft's ARR, we tried to start the WMSVC service and got this error: IISWMSVC_STARTUP_UNABLE_TO_READ_CERTIFICATE

Unable to read the certificate with thumbprint '********'. Please make sure the SSL certificate exists and that is correctly configured in the Management Service page.

Process:WMSvc
User=NT AUTHORITY\LOCAL SERVICE

a: This was an easy fix.

Open IIS (Internet Information Services Manager),
Click on the Server Name on the left
In the middle pane, scroll down to the bottom, double-click "Management Service"

Check the box to (X) Enable remote connections
On the SSL certificate field, simply use the dropdown to select the default certificate already on the system
In the right pane | click Apply
In the right pane | click Start

That fixes it

TCP Port 8172 on Server 2008

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:44:45 PST

q: While configuring ARR (Microsoft's Application Request Routing Service) the application requires connection to Server Farm members over tcp port 8172. Using the command "netstat -ano | find ":8172" we confirmed the server farm members were not already listening on port 8172.
a: We discovered port 8172 is associated with WMSVC the "Web Management Service".

iConcept Wireless Keyboard New Batteries

noreply@blogger.com (Jeff Kyker) — Wed, 18 Jan 2012 12:10:42 PST

Q: A customer called today with an iConcept Wireless keyboard. They had recently changed the batteries and could no longer connect to the computer.
A: It was as easy as unplugging the USB dongle and with the new batteries in the keyboard and the keyboard nearby, plug the USB dongle back in. After a few moments the keyboard started working again.
Ref: http://www.sakar.com/images/resources/download-manual/62150N.pdf

Recover an Accidentally Closed Tab in Chrome

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:44:57 PST

Q: I just closed a tab in Chrome and didn't want to, what do I do?
A: To quickly recover a recently closed tab in Chrome, simply hit "Ctrl+Shift+T"

Recover Deleted Public Folder from Exchange 2003

noreply@blogger.com (Jeff Kyker) — Fri, 13 Jan 2012 12:14:35 PST

Q: Customer contacted us to say that a public folder with over 1,000 items had vanished.
A: We were able to recover it as a deleted item using Outlook.

Open Outlook
Navigate to Public Folders
Click the parent folder deleted folder
Click Tools, "Recover Deleted Items"
It showed the folder that had been deleted.
Select the folder, click the second icon in the toolbar "Recover Selected Items"

We found this link on Google and it has a much more details explanation of Exchange settings etc.

Wordpress Updates fails on Server 2008 with IIS 7

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:55:09 PST

Issue: The customer reported issues applying an update to a Wordpress site hosted on Windows Server 2008 on IIS 7.

Solution: We noticed IUSR was the account attempting to access the website folder during the upgrade. We granted IUSR Read/Write/Modify permissions to that folder and the update completed.

ESET Remote Administrator Console - License Manger

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:55:37 PST

Q: ESET ESET Remote Administrator Console - License Manager is displaying the wrong company license.
A: Apparently, the license files are stored in a folder. We performed these steps to fix the situation.

Make sure you have the newest license file "nod32.lic" for NOD32 from ESET Support.
Stop the "ESET Remote Administrator Server" service.

net stop era_server

Browse to: C:\Documents and Settings\All Users\Application Data\ESET\ESET Remote Administrator\Server\license\

Move all files to another folder for archive/safety.

Start the "ESET Remote Administrator Server" service.

net start era_server

Open ESET Remote Administrator Console. You'll be presented with the warning below that you're "connected to a trial version of ESET Remote Administrator Server". Click OK
Warning Message:
Once you click OK, you'll be presented with the License Manager:
Simply click Browse select the file, click OK.
You'll be asked if you want to Upload to Server, click OK and you're done.

Point a SEP Client to a different Manager

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:55:24 PST

ISSUE: The customer has Symantec Endpoint Protection installed on a workstation. They have two separate Symantec Endpoint Protection Manager servers. How can we modify the workstation to start using the new SEP Manager for updates?
SOLUTION: The config file for a 64-bit workstation that determines which Manager is used is C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SyLink.xml. The easiest solution is to simply copy this file from one workstation (using the new server) to this workstation using the steps below:

On each system please:

Click Start - Type this command SMC -stop <hit enter> (To Stop SEP) (Enter password: symantec if prompted)
Browse to: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\
Rename current SyLink.xml (feel free to view this as it will reference the Update Manager)Copy the new SyLink.xml into this folder
Click Start - Type this command SMC -start <hit enter> (To Start SEP)

SQL Server 2008 R2 - Report Server Web Service is not configured

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:56:24 PST

ISSUE: Report Server Web Service is not configured. Default values have been provided to you. To accept these defaults simply press the Apply button, else change them and then press Apply.

But when you click Apply you get the response:
Reserving url http://+:80
The Url has already been reserved

RESOLUTION: Using the "netsh http show urlacl" command we see that /ReportServer and /Reports are already reserved.
You can also run "netsh http show urlacl | find "Report"" - to see just those two lines.
>netsh http show urlacl | find "Report"
Reserved URL : http://+:80/ReportServer/
Reserved URL : http://+:80/Reports/

To resolve - simply delete the reserved URLs and recreate them. I think we're to assume SRSS had been installed on this server once before but not properly uninstalled.

C:\Windows\system32>netsh http delete urlacl http://+:80/ReportServer/
URL reservation successfully deleted

C:\Windows\system32>netsh http delete urlacl http://+:80/Reports/
URL reservation successfully deleted

Then if you re-run >netsh http show urlacl | find "Report" - you'll see nothing.

Now to re-create the bindings:

Open "Reporting Services Configuration Manager" -Click Connect
Click "Web Service URL" - then click "Apply" at the bottom and it should succeed this time.
Click "Report Manager URL" - then click "Apply". If Apply is grayed out, simply rename Reports to Report, then back to Reports. Apply will become available and you can click it.
Then visit each URL to test.

How to tail a file in Windows using Notepad++

noreply@blogger.com (Jeff Kyker) — Tue, 15 Nov 2011 14:06:02 PST

Q: Notepad++ is great for viewing log files but the prompt that file has been updated gets old. How can we configure it to automatically reload when the log file has been updated?
A: Install the Document Monitor Plugin.

Open Notepad++ (Available here)
Click Plugins / Click Plugin Manager / Click Show Plugin Manager
Click the checkbox next to "Document Monitor" (Figure 1) then click Install (let it restart Notepad++ when prompted.
With Notepad++ open, open the log file to be monitored
Click Plugins, click Document Monitor, click "Start to Monitor"
The file will automatically be reloaded when it is updated.

Figure 1: Install Document Monitor plugin

Server 2008 Event Log Filter by XML for a Username

noreply@blogger.com (Jeff Kyker) — Mon, 20 Feb 2012 07:58:56 PST

Issue: Customer presented us with a Server running 2008 and wanted to filter the logs for events associated to a user. When you use the same method as Server 2003 you get no results.

Solution: We had to migrate to use the XML Filtering.

within the Security Event Log, click "Filter Current Log..." on the right
Click the XML tab at the top
Click (X) Edit query manually
Replace the select line: <Select Path="Security">*</Select>
With this line (where %username% is the account you want): <Select Path="Security">* [EventData[Data[@Name='TargetUserName']='%username%']]</Select>

Reduce Sharepoint Services 3.0 log.ldf files

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:59:57 PST

q: our SharePoint services 3.0 log.ldf file is enourmous
a: using a post we found from Luka Manojlovic - just follow their steps:

You can solve this problem by using “Shrink” command in the MS SQL Server Management Studio Express
First you need to connect to your Sharepoint 3.0 database called: \\.\pipe\mssql$microsoft##ssee\sql\query - just put this string in your “Server name” field:
\\.\pipe\mssql$microsoft##ssee\sql\query
Create full backup of all databases before continuing!
After that we should change restore mode from “Full” (this the parameter that allows .log.ldf to grow that large as transaction logs are not purged) to “Simple”:Expand Databases, right mouse click on Sharepoint_Config… Properties, Options, Recovery model: Simple and click OK
Shrink the database procedure: Expand Databases, right mouse click on Sharepoint_Config… Tasks, Shrink, Files in File type select Log and click OK

FreeBSD Password Protected Folder

noreply@blogger.com (Jeff Kyker) — Tue, 18 Oct 2011 17:52:44 PDT

Issue: We were presented with a site hosted on a FreeBSD server that had a password protected folder when viewed with a browser. The customer wanted to update the password. They used to use http://home.flash.net/cgi-bin/pw.pl but it has been retired.
Solution: We were able to track down the password file the folder was using. But we couldn't figure out how to encrypt a new password.
We discovered htpasswd on the FreeBSD Server. We putty'd into the box, then ran htpasswd four times using each encryption method below. Then copy/pasted that value into the password file next to the username until we could authenticate to the site. We tested with the follow switches.

-n = simply display the output (don't create a file)
-b = use the password from the command line

htpasswd -nb apacheuser topsecretpassword
htpasswd -nmb apacheuser topsecretpassword - "Force MD5 encryption"
htpasswd -nsb apacheuser topsecretpassword - "Force SHA encryption"
htpasswd -ndb apacheuser topsecretpassword- Uses Crypt

We discovered the site was using Crypt as we were able to authenticate.

Restore SQL Database After Broken Mirror

noreply@blogger.com (Jeff Kyker) — Thu, 11 Aug 2011 07:27:19 PDT

Q: During a recent event a Database Mirror was broken using steps previously discussed. Now we needed to re-establish the mirror.
A: The easiest way was to

Detach database on 2nd SQL Server
Archive mdf/ldf files
Obtain nightly BAK from 1st SQL Server
Obtain every hourly TRN from 1st SQL Server since BAK was generated
Transfer all files to 2nd SQL Server
Restore .bak to 2nd SQL Server - selecting the radio button "RESTORE WITH NORECOVERY"
Restore the .trn file(s) using this script: (updating DBNAME & DBPATH):
RESTORE LOG [DBNAME] FROM DISK =

N'D:\DBPATH\Backup_201108110600.trn'
WITH FILE = 1, NORECOVERY, NOUNLOAD, STATS = 10
GO
Connect to 1st SQL Server and establish the mirror as before.

Dell OpenManage IT Assistant - IT Assistant will not launch because a dependent component is not installed.

noreply@blogger.com (Jeff Kyker) — Mon, 08 Aug 2011 11:30:27 PDT

Q: Server recently received a number of updates and now IT Assistant will not load.

IT Assistant will not launch because a dependent component is not installed. This may happen if :

Automatic prompting for ActiveX controls setting is disabled.
- Enable Automatic prompting for ActiveX controls under ActiveX controls and plug-ins in the security zone that IT Assistant is classified in. Close the browser and launch IT Assistant in a new browser window. You can disable this setting after the component is installed.
  Note: If you install the component from the information bar (yellow bar at the top) of the browser, IT Assistant may still fail to launch on certain operating systems.
You have canceled the installation of the component.

A: If you follow the steps above and the site still won't load but it used to work - try JAVA! Someone installed the very latest "Java(TM) 6 Update 26" version of JAVA. Once Update 26 was uninstalled, leaving only "Java(TM) 6 Update 3" the version that is installed by IT Assistant the site loaded.

The remote service supports the use of weak SSL ciphers

noreply@blogger.com (Jeff Kyker) — Fri, 27 Jan 2012 17:59:43 PST

Q: Windows Server 2003 is still configured to use weak or medium strength SSL ciphers. This can show up as a vulnerability in some security scans like McAfee's Foundstone.
A: FOUNDEOOOOOO! Foundeo is the perfect solution to this problem. With the click of a button, you can disable all the weak ciphers on a server, reboot it and you're done. Image1 is what you see after starting the app on a base server. Image2 is what you see after you click Uncheck Weak Ciphers. Then click Apply & reboot.

Improve Wordpress Performance with wp-super-cache

noreply@blogger.com (Jeff Kyker) — Mon, 01 Aug 2011 19:01:18 PDT

Visit the wordpress admin part of the site (/wp-admin)
Click the Plugins on the left / Click "Add New" / Search "WP Super Cache"
Under "WP Super Cache" click "Install" / OK / Click "Activate Plugin"
Red Warning bar at the top, click "plugin admin page"
Click "Permalinks Options Page" (/wp-admin/options-permalink.php)
Select one of the Permalink options (eg: Day and Name) / Save Changes
Edit wp-config.php - add - define('WP_CACHE', true);
Click Settings / WP Super Cache -
Click the (X) Caching On - Radio button / Click Update Status
All done.

I Need Internet Explorer 7!

noreply@blogger.com (Jeff Kyker) — Wed, 27 Jul 2011 09:23:12 PDT

Q: A developer requested a workstation or server with Internet Explorer 7 (IE7) running and we couldn't find one, as everyone had been updated to IE8 or IE9.
A: We used IE-TAB.

Install Chrome
Install the Chrome IE-TAB plugin - http://www.chromeextensions.org/utilities/ie-tab/
Visit the site, then click the new "View in IE TAB" button on the top right
You can always hit the wrench to change which IE Standards to use, but it defaults to IE7.