the back room tech

Finding Windows user accounts with non-expiring passwords

Julie — Wed, 10 Feb 2010 13:55:39 +0000

I was performing a security audit on a Windows 2003 member server that had many local user accounts. One of my tasks was to identify which accounts had passwords that never expire.

I decided to use WMIC to enumerate the user accounts. The command I executed was:

wmic path Win32_UserAccount where PasswordExpires=”false”

Many accounts were identified, so I decided to save the output to the noexpire.cvs file:

wmic /output:noexpire.csv path Win32_UserAccount where PasswordExpires=”false”

WMIC is included in Windows XP, Windows 2003 and newer operating systems. You can use these platforms to remotely query a Windows 2000 system as well.

I could have scanned the server with MBSA to find the non-expiring passwords, but the scan would have been extremely evident in the server’s log files.

Direct patch download links for MS10-002 KB978207

Julie — Thu, 21 Jan 2010 20:56:44 +0000

Microsoft had released the out of band patch to resolve Internet Explorer vulnerabilities, see KB978207 and MS10-002 for additional details.

The patches for IE6, IE7, and IE8 are available on Windows Update and Microsoft Update. Unfortunately for me, our business proxy blocks access to these sites. We also have to go through a corporate vulnerability rating process, and if the vulnerability rates severe enough, a deployment plan will be developed, and tested, and scheduled…. long story short, without intervention on my part, it will be a long time until my machine sees any critical updates.

The ISC has rated this vulnerability at it’s highest risk level, PATCH NOW!

I manually downloaded the patch from the Microsoft download site. You can find the patch for all OSs and versions of IE here.

SQL query to find BES UserID

Julie — Fri, 15 Jan 2010 21:50:15 +0000

Had a support call today about a user not receiving email on his Blackberry device. After a phone call to Research in Motion, we determined the user was out of the coverage area. Very frustrating. All the information was in the Blackberry Enterprise Server’s MAGT log, I just didn’t know how to find it. Here’s how I figured it out.

Previously I had posted the following SQL query that determines a user’s name based upon the BES ID number.

SELECT     Id, DisplayName, UserName
FROM         UserConfig
WHERE     (Id = ‘73′)

I changed the query around to find the BES UserID based upon the UserName:

SELECT     Id, DisplayName, UserName
FROM         UserConfig
WHERE     (UserName = ‘jsmith’)

This query gave me the BES UserID, which was 779 in my case.

I then opened up the BES MAGT log, and searched for the following string:

UserId: 779 is out of coverage

I found it repeatedly. My user was out of coverage all day, which is why no mail was received on his Blackberry.

Script to remotely list Windows local administrator group membership

Julie — Mon, 07 Dec 2009 21:31:58 +0000

The following script can be run against remote Windows machines, and will enumerate the contents of the remote server’s local administrators group.

It requires Sysinternals PSExec utility, and must be run with administrative credentials. Set the four paths to the correct locations for your workstation.

REM set path to PSexec on machine the script is being run from
Set PSExecDir=c:\pstools

REM Set file that contains the list of all your remote machines
Set InputFile=C:\servers.txt

REM Set path to file where administrator group membership is logged
Set OutputFile=C:\localadmins.txt

REM set path to error log file
Set ErrorFile=C:\errors.txt

for /f %%a in (%InputFile%) do (

echo *** Checking Server %%a *** >> %OutputFile%

%PSExecDir%\psexec \\%%a net localgroup administrators >> %OutputFile%

IF ERRORLEVEL 1 (echo Problem with obtaining local administrators on %%a >> %ErrorFile%)
)

Fix: SQL Configuration Manager Connection to target machine could not be made in a timely fashion

Julie — Wed, 02 Dec 2009 13:29:33 +0000

Things didn’t go too smoothly yesterday when I was trying to reconfigure our SQL 2005 cluster and it’s database locations. At one point I couldn’t even get SQL Configuration Manager to start up. At various times I received both of the following errors.

The request failed or the service did not respond in a timely fashion. Consult the event log or other applicable error logs for details.

Connection to target machine could not be made in a timely fasion.

Luckily, the fix was pretty easy. Just launch services.msc and restart the Windows Management Instrumentation (WMI) service, SQL Configuration Manager should start up for you.

How to remotely wipe a media card in a BlackBerry smartphone

Julie — Thu, 19 Nov 2009 18:19:12 +0000

I was very excited to see the KB17776 article released by Research In Motion today entitled How to remotely wipe an installed microSD media card in a BlackBerry smartphone. Just yesterday we had a Storm stolen, and I was wondering how to wipe the media card.

Unfortunately, this has to be the most useless KB article ever. I would assume any document with the words “How To” in the title would actually detail how to do something… Here’s the remainder of the document in it’s entirety:

An installed microSD media card cannot be wiped remotely.

This is a previously reported issue that has been escalated internally to our development team. No resolution time frame is currently available.

Script to find and email files in a directory

Julie — Mon, 16 Nov 2009 18:49:29 +0000

I needed to write a batch file that would email some files, and could be run as a scheduled task. I chose to use Blat as my email program, you can download it for free from SourceForge.

The batch file requirements were:

1. Had to email all the .xls files in one directory from the current date. Luckily for me the date was in the file name, so I just had to find all files in the format *MMDDYY*.xls

2. The emails had to be sent “To” some users, then “CC”d to others

3. I could only use free software (no shareware) but could use our internal smtp replay server to send the mail through.

4. The Scheduled task that executes the script must run on a Windows 2003 server.

The following script is what I came up with. I’ll go through it line by line, then post the entire thing at the end.

****************************************************

Here I’m getting the current date in the month month day day year year format, and saving it to a variable named search. This can obviously be changed to meet your particular need

REM set search date variable in MMDDYY format for file search

REM set search to month-date-year for date formatting

for /f “Tokens=1-4 Delims=/ ” %%i in (‘date /t’) do set search=%%j%%k%%l

Adding a blank line to the log file ReportLog.txt since I like my logs nice and neat. Makes them easy to read.

echo. >> ReportLog.txt

Writing the date and time the script starts to the log file ReportLog.txt

echo %date% %time% Starting script >> ReportLog.txt

Using the variable search, which contains the current date, I’m getting a list of all .xls files from today and saving it in FileNames.txt

dir /b “\\server\share\%search%*.xls” > FileNames.txt

If there’s a problem retrieving the names of the files, write a message to the log file

IF ERRORLEVEL 1 (echo %date% %time% problem with retrieving file names >> ReportLog.txt)

Using find /c to count how many files are in filenames.txt, and saving that number in the variable NUMFILES

for /f “tokens=3″ %%i in (‘find /v /c “SomeStringNotToBeFound” filenames.txt’) do set NUMFILES=%%i

If the variable NumFiles equals zero, there were no files found for today. Skip to ZEROFILES to send an email alert

If %NUMFILES% EQU 0 GOTO ZEROFILES

If NUMFILES isn’t zero, then files exist that need to be emailed. There may be more than one file, so we’re going to use a loop to process all the files listed in FileNames.txt

For /F “tokens=1-2* delims=” %%B IN (FileNames.txt) DO (

write the name of the file to the log file

echo file to email is %%B >> ReportLog.txt

Use blat.exe to send the email to addresses specified in tolist.txt

Use blat.exe to send emails as CC to addresses specified in cclist.txt

Attached file is listed at the end of the command

This command is all one line, it may wrap on the page

blat.exe -tf tolist.txt -cf cclist.txt -subject “Report %%B” -body “Here is the current report.” -server smtp.yourdomain.com -f sender@yourdomain.com -attach “\\server\share\%%B”

)

We’re done emailing the files, so skip over to WRITELOG

goto WRITELOG

Zero files were found, so we need to send an email alert

:ZEROFILES

write the name of the file to the log file, along with the date and time

echo %date% %time% problem with retrieving number of current files >> ReportLog.txt

Use blat.exe to send an email alert to addresses specified in problist.txt

This command is all one line, it may wrap on the page

blat.exe -tf problist.txt -subject “Problem with Report” -body “Problem sending the current report.” -server smtp.yourdomain.com -f sender@yourdomain.com

Writing the date and time the script starts to the log file ReportLog.txt

:WRITELOG

echo %date% %time% Ending Script >> ReportLog.txt

****************************************************

The script in it’s entirely:

REM set search date variable in MMDDYY format for file search

REM set search to month-date-year for date formatting

for /f “Tokens=1-4 Delims=/ ” %%i in (‘date /t’) do set search=%%j%%k%%l

REM format ReportLog.txt

echo. >> ReportLog.txt

echo %date% %time% Starting script >> ReportLog.txt

REM Get the names of all log files for specified date, save to FileNames.txt

dir /b “\\server\share\%search%*.xls” > FileNames.txt

IF ERRORLEVEL 1 (echo %date% %time% problem with retrieving file names >> ReportLog.txt)

REM Count how many files are in filenames.txt, put into %NUMFILES%

for /f “tokens=3″ %%i in (‘find /v /c “SomeStringNotToBeFound” filenames.txt’) do set NUMFILES=%%i

If %NUMFILES% EQU 0 GOTO ZEROFILES

REM loop when more than one file to be emailed

For /F “tokens=1-2* delims=” %%B IN (FileNames.txt) DO (

echo file to email is %%B >> ReportLog.txt

blat.exe -tf tolist.txt -cf cclist.txt -subject “Report %%B” -body “Here is the current report.” -server smtp.yourdomain.com -f sender@yourdomain.com -attach “\\server\share\%%B”

)

goto WRITELOG

:ZEROFILES

echo %date% %time% problem with retrieving number of current files >> ReportLog.txt

blat.exe -tf problist.txt -subject “Problem with Hold Report” -body “Problem emailing the current hold report.” -server smtp.yourdomain.com -f sender@yourdomain.com

:WRITELOG

REM format ReportLog.txt

echo %date% %time% Ending Script >> ReportLog.txt

****************************************************

Howto: Disable a NIC when running Sysprep

Julie — Wed, 04 Nov 2009 15:25:07 +0000

Disabling a network card when running sysprepping a Windows machine is easy. Two things need to happen:

1. Add the following command to the [GuiRunOnce] section of your sysprep.inf file

Command0=”C:\temp\disablenic.cmd”

2. On the machine you are sysprepping, create a C:\temp\disablenic.cmd file that contains the following:

netsh interface set interface “Local Area Connection 2″ DISABLED

Change the name of the interface you want disabled as needed. To determine the names of all network interfaces on a system, run the following command:

netsh interface show interface

Proceed with syspreping as normal. When the machine boots up, the specified network interface(s) will be disabled.

Fix: Blackberry Media Manager exits with R6025 pure virtual function call error

Julie — Mon, 26 Oct 2009 16:38:04 +0000

My Blackberry Media Manager kept exiting on me when trying to access the Media stored on my Blackberry Storm. The specific error was:

Microsoft Visual C++ Runtime Library X Runtime Error!

Program: C:\program Files\Roxio\Media Manager 9\Mediamanager9.exe

R6025 – pure virtual function call

The problem ended up being that the RoxMediaDB9 service was disabled.

I changed the service from disabled to manual (could have been set to automatic if I wanted it to start following each reboot), started the RoxMediaDB9 service, which allowed Media Manager to start without issue.

Fix: SQL agent wont start on Windows 2003 Cluster, Event 53

Julie — Tue, 20 Oct 2009 19:31:59 +0000

The Problem

SQL Agent won’t start on a Windows cluster for a particular instance

The Symptoms

Seen in Windows Application log

Event: 53 Source: SQLAgent$CF3Common Category: Failover

[sqagtres] OnlineThread: Error 6 bringing resource online.

[sqagtres] OnlineThread: ResUtilSetResourceServiceEnvironment failed (status 6)

The Cause

In Cluster Administrator, the SQL Server Agent had lost its dependency upon the SQL server resource for the affected instance.

The Solution

Add the SQL Server dependency, bring SQL Server Agent online in Cluster Administrator